okooooooo/msime-windows
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,941 Commits 1 Branch 0 Tags
f87809cf596fdd46f8d90acfae94fe01f6bcbbcd
Commit Graph
101 Commits
Author SHA1 Message Date
fanlusky 9dfa69c7e5 build(installer): 打包神经整句模型并在发布流程中下载 
Prepare-PackageFiles 断言并拷贝两个模型与授权声明；release workflow 在收集产物前
运行 fetch-neural-model.ps1。
 2026-09-24 14:03:43 +08:00
Evan c8a71ef141 fix(release): notify MSIME-Web after every release, not just the repair path (#451) 
The step that dispatches to MSIME-Web was gated on `github.event_name == 'workflow_dispatch'`. This workflow's own header documents workflow_dispatch as the repair path and a push to main as the normal one, so the notification only fired on the branch that almost never runs. MSIME-Web has received zero repository_dispatch events; its most recent twenty sync runs are all `schedule`.

That left the site waiting on a cron GitHub delivers about seven times a day instead of the forty-eight the schedule asks for, with measured gaps of two to five hours. Windows 0.8.0 published on 2026-09-20 and msime.app still offered 0.7.1 a day later.

The enclosing job already runs only when a release is being published, so the step needs no event condition at all.
 2026-09-21 14:46:57 +09:00
fanlusky d30d2946e4 feat(installer): 打包时生成并安装词格语言模型 sc.lm 
sc.lm 此前只能手工投放，重装即失效，发布包里也没有它。这里把它变成一个被钉住、
可复现、自动参与打包的产品输入。

它不走词库那条路：词库 release 由本仓库之外的构建器产出，资产集合和摘要在产品锁
里逐一钉死，加一项要对方先发新版。改为独立钉住上游语料，与 libime 自己的做法一致。

- language-model/lock.json 钉住上游 URL、语料摘要、转换参数和产物摘要。转换是
  确定性的（已在 MSVC 14.44 与 14.50 两套工具链上验证产物摘要一致），所以产物
  摘要可以像下载摘要一样钉死。
- scripts/build-language-model.ps1 下载、校验、转换、再校验，写临时文件后改名，
  中途失败不会留下摘要对不上的 sc.lm。幂等，摘要对得上直接返回。
- 它只 configure engine/ngram 一个目录，不拉 vcpkg 和 SQLite：转换工具只依赖
  kenlm 自己，而打包机上未必装得起引擎的全部依赖。
- Invoke-LocalTest.ps1 打完整包前自动调用它，轻量包本就不带数据文件，不调。
- 打包脚本只断言文件存在，摘要由构建脚本负责，与词库交给 product_lock.py 校验
  的分工一致。缺模型让打包失败而不是跳过：引擎对缺模型是静默降级的，运行期不会
  暴露，打包是唯一拦得住的地方，package-files.ps1 为此加了反向用例。

模型是 LGPL-2.1-or-later 的第三方数据，声明随之安装为 libime-lm-NOTICE.md。
安装脚本无需改动，它已按通配收集资源目录。产物与语料不进仓库，只进锁与声明。
 2026-09-19 10:08:39 +08:00
fanlusky 9bc1c925b2 fix(installer): 正式签名覆盖包内全部 EXE/DLL 
此前只有 MetasequoiaImeServer.exe 拿到真实签名——它是唯一一个技术上必须签的，
uiAccess=true 没有可信 Authenticode 签名就会被 Windows 忽略。其余随包分发的
二进制全部未签名：设置页、表情面板、手写面板、键盘面板、看门狗、词库回放，
以及 libcurl/sqlite3/zlib/WebView2Loader 四个 DLL 和两个架构的 TSF DLL。

Microsoft Defender 会按信誉拦下这些未签名的可执行文件，用户看到的现象是输入法
装完了、某个面板却打不开。

package-simplysign.ps1 和 release workflow 现在都签 server_exe\ 与 tsf_dll\ 下的
全部 EXE/DLL，共 13 个文件，加上外层安装包。

所有文件在一次 signtool sign 调用里签完，而不是逐个调用：SimplySign 可能对每次
调用弹一次 PIN，逐个签会把本地打包变成十几次手机确认。签名配额按文件计，合并
调用不会多花配额；证书每月 3000 次，每次发布十几个仍然远在额度之内。
 2026-09-17 23:10:54 +08:00
fanlusky 3b6b65020d perf(installer): 本地打包默认不含 PDB，另开带符号入口 
本地跑 test-light.ps1 等很久，慢的大头不是编译而是 Inno Setup 在压 PDB：
包里 PDB 约 140 MB，而真正的 EXE/DLL 只有约 20 MB，msime_setup.iss 又是
Compression=lzma2 + SolidCompression=yes，整整一遍压下来轻量包要 58.7 秒。

Prepare-PackageFiles.ps1 新增 -IncludeSymbols，不带它就把 server_exe\ 和
tsf_dll\ 里的 PDB 全部剔除。校验逻辑没有放松：仍然要求 Release 构建产出同名
PDB，缺符号照样打包失败，只是「符号是否随包安装」变成了显式选择。
msime_setup.iss 的两条 *.pdb 加上 skipifsourcedoesntexist，同一份脚本在带
符号和不带符号两种暂存下都能编译。

正式发布行为不变：release.yml 的打包步骤显式传 -IncludeSymbols，发布的安装包
依旧携带与二进制匹配的符号。

test.ps1 和 test-light.ps1 原本是两份几乎逐行相同的拷贝，现在一起收进
Invoke-LocalTest.ps1，三个入口都是它的薄包装：

  test.ps1          含词库，不含 PDB
  test-light.ps1    不含词库，不含 PDB
  test-symbols.ps1  含 PDB，默认轻量，加 -Full 走完整包

轻量包 Inno Setup 耗时 58.7s -> 9.2s，安装包体积 33.4 MB -> 7.7 MB。
 2026-09-13 03:56:58 +08:00
dependabot[bot] fecad35baa chore(deps): bump the actions group with 3 updates 
Bumps the actions group with 3 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup), [actions/setup-go](https://github.com/actions/setup-go) and [actions/dependency-review-action](https://github.com/actions/dependency-review-action).


Updates `pnpm/action-setup` from 6.0.10 to 6.1.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/0977fd99725f1db4007ccb2928dbb4e90d06cc86...ea17c68df8912ef543352723c149a84f56e3d413)

Updates `actions/setup-go` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)

Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](https://github.com/actions/dependency-review-action/compare/2031cfc080254a8a887f58cffee85186f0e49e48...a1d282b36b6f3519aa1f3fc636f609c47dddb294)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/dependency-review-action
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-11 20:01:39 +00:00
fanlusky a7779d2b05 refactor(engine): 将 engine 从 submodule 内嵌为仓内一等组件 
`vendor/MetasequoiaImeEngine` submodule 改为 `engine/` 目录，导入的是
product-lock.json 原本钉住的提交 c810d201，逐文件核对过 blob，因此这是一次
搬迁而不是引擎升级。引擎自己的嵌套 submodule（googlepinyinime-rev、utfcpp、
miniaudio）按各自 gitlink 一并展开，来源与提交见 engine/UPSTREAM.md。

Windows 专门化裁掉了不属于本产品的部分：whisper.cpp 与本地推理 provider、
macOS 示例宿主、整个 dictionary/ 建库流水线、上游 CI 与 release-please 配置。
词库仍按 product-lock.json 在构建时取发布产物。

引擎不再进 product-lock.json：没有 gitlink 就没有可比对的东西，锁里写一个上游
commit 等于宣称这棵树仍等于上游，而第一个 Windows 专门化改动落地时这句话就假了。
verify-contracts / verify-checkout 随之移除，verify-published 保留。

CI 与工具链：引擎源码并入根 scripts/format.sh（删掉引擎自己的那份，避免两套排除
列表分叉）；引擎 voice.yml 里的 silero_vad.onnx 摘要校验移到本仓 lock job；
engine-bump-triage 工作流与其测试删除；gitsubmodule 的 dependabot 频率由 daily
改为 monthly。

README、README.en、AGENTS.md、CONTRIBUTING、docs/product-release.md 及各子目录
文档同步说明新的位置与边界。
 2026-09-12 03:40:48 +08:00
fanlusky 73ec6fe9c9 perf(ci): cache the Server MSVC build with sccache 
The Server job's Build step dominates the pipeline (~6m37s of a ~9.5m job;
the dictionary/integration test is only ~43s). sccache caches individual
MSVC compiles across runs so an incremental change rebuilds only what it
touched instead of the whole server + engine tree.

sccache only caches an MSVC compile whose debug info is embedded in the
object, so switch the Server build's Release debug info from /Zi to /Z7.
The linker's /DEBUG still emits the beside-the-executable PDB the release
job validates, so the symbol layout is unchanged.

Its compiler-launcher hook is honoured only by the Ninja and Makefile
generators, so configure the Server build with Ninja Multi-Config (keeping
the --config Release / bin/Release layout the later steps depend on) and
add an MSVC-environment step, since Ninja does not locate cl.exe on its own.
 2026-09-11 03:46:30 +08:00
Neptrue_Lin 2d304168b5 Revise feature request template 
Updated feature request template for clarity.
 2026-09-09 14:53:19 +08:00
Neptrue_Lin 11c6b88e51 Revise bug report template 
Updated the bug report template for clarity.
 2026-09-09 14:50:23 +08:00
fanlusky d7e7b3f0d9 fix(ci): stop the self-hosted jobs racing on the global git config 
The three self-hosted release jobs are separate runner instances on one
machine, so they share C:\Users\runner\.gitconfig and all reach "Trust the
runner workspace" in the same second. Two win the config lock and the third
dies with "could not lock config file ...: File exists", taking Build TSF x64
down before it compiles anything and skipping the installer job.

Retry the write, and re-read safe.directory before each attempt so a peer
instance having already trusted this path counts as success.
 2026-09-09 03:00:23 +08:00
fanlusky 28689361ad fix(ci): unblock packaging on the self-hosted runners 
Two independent failures kept the v0.6.5 installer from being built after
the pipe probe was fixed.

The package job died in "Verify the release commit is on main" with git
exiting 128 on dubious ownership: runner instance 2 leaves _work owned by
SYSTEM while the job runs as `runner`. actions/checkout is unaffected, so
the first plain git call is what fails, and only jobs scheduled onto that
instance see it. Mark the workspace as safe in the three self-hosted jobs.

Neither vcpkg manifest carried a builtin-baseline, so vcpkg resolved ports
against the registry at HEAD and every build depended on a live fetch of
microsoft/vcpkg. When that fetch degraded, the ports simply vanished:

    Fetching registry information from https://github.com/microsoft/vcpkg (HEAD)...
    fmt does not exist
    utfcpp does not exist

Build TSF x64 failed this way twice and passed twice on the same runner,
which is what an unpinned registry looks like. Pin both manifests to
04a9d8e5, the commit vcpkg-lock.json already records as resolved.
 2026-09-09 02:18:57 +08:00
Evan 99ab7804ef docs(.github): 为新用户补充反馈模板示例与填写提示 (#263) 2026-09-08 07:42:07 +00:00
Evan 2fb4560d99 fix(release): use beta tags for automatic builds (#252) 
* fix(release): separate ci snapshots from stable tags

* fix(release): use beta tags for automatic builds
 2026-09-07 17:56:34 +09:00
Evan 0025e79b45 chore(ci): run CodeQL only on nightly schedule 
Run CodeQL daily at 00:00 Asia/Tokyo and remove all other workflow triggers.
 2026-09-07 17:55:09 +09:00
Evanandgithub-actions[bot] d1ac5273e4 fix(ci): guard the release vcpkg selection (#247) 
* chore(main): release 0.6.1

* release (#245)

* fix(installer): test server before embedding uiAccess manifest (#243)

* fix(ci): align release matrix with selected vcpkg (#244)

* fix(ci): guard the release vcpkg selection

* fix(ci): report the release runner in vcpkg errors

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-09-07 16:38:19 +09:00
Evan fbd6b390f1 fix(ci): align release matrix with selected vcpkg (#244) 2026-09-07 16:03:23 +09:00
Evan f62e8e5fc8 fix(installer): test server before embedding uiAccess manifest (#243) 2026-09-07 15:37:08 +09:00
Evan Hu 818069f9c3 fix(server): make release probes non-interactive 2026-09-07 13:28:25 +09:00
Neptrue_Lin 4b95c90fde Merge pull request #228 from AaGMix/feat/installer-pdb 
feat(installer): include release PDB symbols
 2026-09-07 09:46:06 +08:00
Evan ad48153c8e Merge pull request #230 from metasequoiaime/fix/release-vcpkg-lock 
fix(server): embed uiAccess manifest before signing
 2026-09-07 07:53:08 +09:00
Evan Hu 84de68fd1b fix(server): embed uiAccess manifest before signing 2026-09-07 07:42:14 +09:00
AaGMix e9a2c91214 feat(installer): include release PDB symbols 2026-09-07 02:10:38 +08:00
Evan Hu 2ff0509e67 feat(contracts): verify shared product lock primitives 2026-09-07 02:53:50 +09:00
Evan Hu 5b50503252 fix(ci): avoid duplicate CodeQL scans on pushes 2026-09-07 00:59:42 +09:00
Evan Hu 0973d3d4ef fix(ci): defer next release PR after publish 2026-09-07 00:52:01 +09:00
Evan Hu 7dc68ff498 fix(installer): sign releases from runner certificate store 2026-09-07 00:32:22 +09:00
Evan Hu 5b5960e5a0 fix(ci): correct isolated vcpkg command syntax 2026-09-07 00:05:17 +09:00
Evan Hu 5c85d297cd fix(ci): isolate release vcpkg installations 2026-09-07 00:03:40 +09:00
Evan Hu b827bbee3c fix(ci): serialize release builds sharing vcpkg 2026-09-07 00:02:19 +09:00
Evan Hu 8fa00f5576 chore(ci): 把工作流同步到 main 
release.yml 是从 main 运行的，branch-guard 也按 PR 的 base 分支加载工作流定义。两者只合进 develop 时都不生效：main 上的 release-please 仍会把版本 PR 开到默认分支 develop，而提到 main 的 PR 根本不会触发拦截。
 2026-09-06 22:51:28 +09:00
Evan 39c94b092d Merge pull request #196 from metasequoiaime/fix/ci-sanitizer-format 
fix(ci): separate automatic and manual release locks
 2026-09-06 18:39:52 +09:00
Evan Hu 276625fe31 fix(ci): separate automatic and manual release locks 2026-09-06 18:30:33 +09:00
Evan Hu 88720a80df fix(ci): 修复引擎 bump 自动合并的守卫，并补回 Issue 模板的脱敏警告 
engine-bump-triage.yml 里 `&& steps.lock.outputs.locked == 'yes'` 被写进了 HEAD 这个环境变量的值，而不是步骤的 if:。它在那个位置根本不是条件：不论契约锁校验通过与否，自动合并都会执行；步骤随后发出的评论还会把 commit 后面跟上字面量 `&& steps.lock.outputs.locked == 'yes'` 一起打印出来。因为没有任何东西失败，这个问题没有暴露过。

（实际风险有限：Product inputs 是必需检查，未审的 bump 不会真的被放行。但这条守卫本身写了等于没写。）

补 tests/test_engine_bump_triage.py 三个断言：自动合并的条件必须同时包含判定和锁；任何步骤的 env 值里都不许再出现条件片段；评论用的 BASE/HEAD 必须只是 range 输出本身。第二条是通用的，同类错误以后写在别的步骤上也会被抓到。

同时补回本仓 bug_report.yml 相对组织模板丢掉的两项：日志字段的「不要粘贴真实输入内容、用户词库、API Key 或任何凭据」加粗警告，以及「这不是安全漏洞」的必选确认项。全组织的 Issue 流量几乎都在这个仓库，恰恰是最需要这两条的地方——输入法的日志天然贴近用户真实输入。
 2026-09-06 18:15:51 +09:00
Evan Hu 1c25466511 test(ci): 给解析不可信输入的宿主无关代码加 ASan / UBSan 
MSIME-Linux 的 ci.yml 注释里已经写下了这个结论：「前端层才是解析不可信输入的那层……Windows 前端上次审计修的就是一批 race 和空指针，现有的 Debug 构建一个都抓不到。」Linux 仓照这个结论补了 sanitizer job，Windows 仓一条都没有。

给整个 Server 上 sanitizer 意味着要在 Windows runner 上做一份带 sanitizer 的 Boost、curl、sqlite 和 WebView2，代价很高。这里换一个能立刻落地的做法：把宿主无关的解析与策略代码单独建成一个不依赖任何包管理器的小目标，在 Linux runner 上用 ASan + UBSan 跑，几秒钟完成，每个 PR 都跑。

覆盖面确实小于全量 sanitize 构建，但它是真的在跑。目标从皮肤 CSS 策略起步，后续凡是能与 Windows 头文件解耦的、读取用户没写过的数据的逻辑（词库文件、IPC 负载、配置解析）都可以加进这个列表。

该目标同时以 -Wall -Wextra -Wpedantic -Werror 编译，与 Linux、Apple 两仓的标准一致。本机已用 ASan+UBSan 构建并运行通过。
 2026-09-06 18:11:37 +09:00
Evan Hu 71e560295e chore(governance): 给发布关键路径加 CODEOWNERS 
合并到 main 就等于发版：release-please 把每一次 fix:/feat: 合并变成已构建、已发布的安装包，中间没有任何人工节点。所以决定「发出去的是什么」的那些路径需要第二双眼睛，即使日常代码改动不需要。

覆盖四类：发布流水线本身与 CI 信任的一切（.github/、scripts/）；落到用户磁盘上的东西（installer/）；决定发出去的是哪个引擎、哪份词库、哪个版本（product-lock.json、version.txt、.gitmodules、vendor/）；以及用户据以判断是否信任这个软件的声明（PRIVACY.md、SECURITY.md、LICENSE、THIRD_PARTY_NOTICES.txt）。

这个文件只有在分支 ruleset 打开 require_code_owner_review 之后才会真正生效，那一半在仓库外。放在这里的是仓库内的一半。
 2026-09-06 18:11:37 +09:00
Evan Hu 1ec7bdd690 fix(settings): 检查更新时消费 update.json 的校验值与签名状态 
update.json 一直发布四个关于安装包的字段（installerName / installerUrl / installerSha256 / signed），而设置页的 UpdateManifest 类型只声明了 version 和 releaseUrl，另外两个字段发布出来却没有任何人消费。结果是：在安装包未签名的当下，SHA256 是用户唯一的完整性防线，服务端早已算好，却要用户自己去官网翻。

现在发现新版本的对话框会显示：signed 为 false 时给出明确警告（SmartScreen 会拦截、uiAccess 失效导致候选窗无法浮在提权程序之上），以及 Get-FileHash 命令和应得到的摘要，可选中复制。

「不做后台自动检查」是 PRIVACY.md 明示的隐私设计，没有改动——改的只是用户按下检查更新之后看到什么。

校验与展示逻辑抽到 update-manifest.ts：validateManifest 收紧了 releaseUrl 的判断（此前 startsWith 前缀匹配会放过 …/releases.attacker.example 这类同前缀域名），并对三个可选字段做格式校验——安装包名会进入一段让用户粘贴的命令，限制成发布流水线实际产出的形状；格式不对的可选字段按缺失处理，不让整次更新检查失败，老版本 manifest 仍然可用。

接入 vitest，11 个用例覆盖版本解析与排序（0.10.0 > 0.9.0、0.3 == 0.3.0）、manifest 校验的拒绝路径、以及签名/未签名/未声明三种状态下的展示。CI 在 build 之前加一步 pnpm test。
 2026-09-06 18:08:34 +09:00
Evan Hu a4d583bf2d ci: sign uiAccess server and installer 2026-09-06 17:04:08 +09:00
Evan Hu ef62de3f7e ci: sign only the release installer 2026-09-06 17:01:04 +09:00
Evan ef55ff67bb Merge branch 'main' into ci/self-hosted-runner-signing 2026-09-06 16:55:18 +09:00
Evan Hu e574a2381e ci: use self-hosted Windows signing runner 2026-09-06 16:54:49 +09:00
Evan b65063a155 Merge pull request #183 from metasequoiaime/chore/oss-hardening 
chore: harden the repository against mainstream OSS standards
 2026-09-06 15:21:25 +09:00
Neptrue_Lin 3a1a56633c Revise feature request template 
Updated options for feature request template to improve clarity.
 2026-09-06 12:32:14 +08:00
Evan 598b641dd1 docs: 校正签名配额的前提，README 加 badge 与 star 趋势 
四处文档把「签名证书次数有限」当作设计理由，其中 docs/product-release.md 据此建议把若干修复攒成
一个版本以省额度。证书实际允许每月 3000 次签名，这个项目的发布频率远低于该量级，前提不成立。
改为如实说明，并把攒版本的真实理由（发布节奏与 release notes 的碎片化）写清楚——那个考量仍然
成立，只是和配额无关。
 2026-09-06 12:43:16 +09:00
Evan 5bd82e9c5f ci(windows): 在 CI 里执行 clang-format 
移植 MSIME-Linux 的 scripts/format.sh，接进已经是 required 的 Workflow validation 作业。
四个组件各自的 .clang-format 一直在仓库里，但此前没有任何一处强制执行。

.git-blame-ignore-revs 指向上一个重排提交，git blame 会跳过它。
 2026-09-06 12:17:29 +09:00
Evan 24adac667a chore(windows): 截图自托管，issue chooser 补安全上报入口 
8 张 README 截图从 i.imgur.com 迁到 docs/images/：大陆网络直连不了 imgur，等于对最核心的受众
隐藏了产品截图，同时把门面绑在随时可能失效的第三方图床上。

issue chooser 此前三条 contact link 没有安全条目，而 blank issue 是关掉的——发现漏洞的人看到的
唯一路径就是提公开 bug，恰好是 SECURITY.md 明令禁止的。本仓 private vulnerability reporting 已启用，
直接指向 advisory 表单。文档链接改指 msime.app/docs。
 2026-09-06 12:11:35 +09:00
Evan f70f64acaa fix(ci,ui): 修掉 6 条 CodeQL high 告警，补上发布目标的祖先校验 
- validate-draft-release.sh 增加「target_sha 必须在 main 历史上」的校验。此前有 write 权限的人可以
  建一个指向任意 commit 的 draft release 再 dispatch，那份代码就会被编译并签进正式安装包；唯一的
  祖先检查跑在 checkout 之后的不可信工作树里，而负责编译的 TSF job 根本没有这道检查。校验放在
  prepare（默认分支上下文）里，所有构建 job 都 needs 它。
- 字体名引用只转义了 `"` 没转义反斜线，以 `\` 结尾的字体名能吃掉闭合引号让后续内容按 CSS 解析。
  两处（appearance.ts、shared.ts）都改为先转义转义符。
- voice_input_service.cpp: float 平方先提升到 double
- engine-bump-triage.yml 顶层权限从 write 收到 read，写权限下放到 job；runner 与同仓其他 workflow
  统一为 ubuntu-24.04

新增 CONTRIBUTING.md，把散在各 AGENTS.md / 组件 README 里的环境要求、构建顺序、打包步骤和提交前
检查串成外部贡献者能照着走完的一条路径，并从 README 首屏链出。
 2026-09-06 12:09:50 +09:00
Evan 4fc16952b3 wip(windows): 补齐隐私与许可交付，修好外部人的构建入口 
- 新增 PRIVACY.md：逐项写明每个联网端点、发送内容、默认开关与关闭方式，明确云候选默认开启、
  token 在 config.toml 明文存储、无任何遥测
- 设置页「用户协议」「隐私政策」两个无 handler 的死按钮接上；前者改名为「开源许可协议」指向
  LICENSE，开源产品的用户条款就是许可证本身，不再承诺一份不存在的 EULA
- 安装包随包装入 GPL 正文并在安装向导显示（GPLv3 §4/§6），补上打包测试断言
- release.yml 增加 build provenance attestation，并在发布后向 MSIME-Web 发 repository_dispatch，
  让 msime.app/update.json 不再等两小时一次的 cron
- 所有 CMakePresets 的 vcpkg 路径改用 $env{VCPKG_ROOT}，server 的 Boost 回退不再指向个人目录
- ui/README.md 指向本机绝对路径的 markdown 死链改成相对链接
- 新增 check-developer-paths.sh 并接入 required 的 quality 检查，防止路径回潮
- docs/installation.md 不再写死版本号
 2026-09-06 12:05:06 +09:00
Neptrue_Lin 78dee8cec0 Merge branch 'main' into docs/template-refinement 2026-09-06 10:14:51 +08:00
Evan 5a4484feea fix(ci): stop the engine bump triage from executing engine file names (#174) 
The Hold-for-review step built its comment with printf and spliced ${{ steps.classify.outputs.reason }} into the command text inside single quotes. That value is the list of file names the engine changed. GitHub substitutes ${{ }} textually before bash parses the line, so a path containing a single quote closes the quoting and the rest runs as a command — on a runner holding a contents:write and pull-requests:write token for this repository. Merge rights in MSIME-Engine became command execution here. Non-adversarially the same splice makes the step die under set -euo pipefail on any engine path containing an apostrophe, so a routine bump gets a red triage job and no review comment.

Every value now reaches the shell through env: and the comment body goes through --body-file. The $GITHUB_OUTPUT heredoc that carries those same file names gets a random delimiter, since a path equal to the literal EOF would otherwise close the block early.

Separately, the classifier could auto-merge a range it had not inspected. With an empty file list, echo emits one blank line, grep -v prints it, and command substitution strips it, so the emptiness test read "nothing suspicious changed" and enabled auto-merge. The compare API returns an empty file list whenever head is already an ancestor of base — an engine force-push, or the pin sitting ahead — which is exactly the case where a bump silently reverts engine source this frontend depends on. It now fails closed on any compare status other than a plain fast-forward, and on an empty file list.

Found while auditing MSIME-Apple, which carried a byte-identical copy of this workflow. Fixed there in metasequoiaime/MSIME-Apple#269.
 2026-09-06 11:14:01 +09:00