ci(release): 正式发版后在流水线内自动更新 Homebrew cask

原 update-cask.yml 监听 release: published，但 Release 由 release-tauri.yml 用默认 GITHUB_TOKEN 创建，不会触发该事件（GitHub 防递归）——所以 cask 从不自动更新，需手动；且其条件 endsWith('-tauri') 连 beta 也匹配。改为在 release-tauri.yml 内新增 needs:build 的 update-homebrew-cask job：仅正式版 tag（v*-tauri 且非 -beta-tauri），构建+建 Release 后下载 DMG 算 sha256、sed 更新 Casks/openless.rb、提交回默认分支（[skip ci]）。删除失效且会错配 beta 的 update-cask.yml。
2026-06-04 11:50:32 +08:00
1 parent 08ad6b7979
commit 0d35c811fe
@@ -637,3 +637,84 @@ jobs:
            openless-all/app/src-tauri/target/release/bundle/appimage/*.AppImage
            openless-all/app/src-tauri/target/release/bundle/appimage/*.AppImage.sig
            openless-all/app/src-tauri/target/release/bundle/latest-*.json
+
+  # ── 正式版发布后，自动更新 Homebrew cask ──
+  # 为什么放进这条流水线，而不是单独的 `release: published` 工作流：softprops 用默认
+  # GITHUB_TOKEN 创建的 Release 不会触发 `release` 事件的其它工作流（GitHub 防递归），
+  # 所以独立的 update-cask 工作流永远不会被自动触发（历史上只在一次手动场景跑过且失败）。
+  # 用 needs: build 串在构建之后、同一条流水线里，才能保证每次正式发版都自动更新 cask。
+  #
+  # 仅正式版：v*-tauri 且非 -beta-tauri。beta 不碰 Homebrew，避免把预发布版推给
+  # `brew install --cask openless` 的用户。cask 文件在默认分支（beta）上，提交回该分支。
+  update-homebrew-cask:
+    name: Update Homebrew cask (stable only)
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    if: >-
+      startsWith(github.ref, 'refs/tags/v')
+      && endsWith(github.ref, '-tauri')
+      && !endsWith(github.ref, '-beta-tauri')
+    steps:
+      - name: Checkout default branch (cask 住在这里)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve version + DMG sha256 from the release
+        id: meta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${TAG#v}"
+          version="${version%-tauri}"
+
+          # 直接下载 DMG 自己算 sha256，不依赖 GitHub 资产 digest 字段的时序/可用性。
+          mkdir -p "$RUNNER_TEMP/dmg"
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
+            --dir "$RUNNER_TEMP/dmg" \
+            --pattern '*aarch64.dmg' --pattern '*_x64.dmg'
+
+          arm_sha="$(sha256sum "$RUNNER_TEMP"/dmg/*aarch64.dmg | cut -d' ' -f1)"
+          intel_sha="$(sha256sum "$RUNNER_TEMP"/dmg/*_x64.dmg | cut -d' ' -f1)"
+
+          {
+            echo "version=$version"
+            echo "arm_sha=$arm_sha"
+            echo "intel_sha=$intel_sha"
+          } >> "$GITHUB_OUTPUT"
+          echo "cask → version=$version arm=$arm_sha intel=$intel_sha"
+
+      - name: Update Casks/openless.rb
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+          ARM_SHA: ${{ steps.meta.outputs.arm_sha }}
+          INTEL_SHA: ${{ steps.meta.outputs.intel_sha }}
+        run: |
+          set -euo pipefail
+          cask="Casks/openless.rb"
+          sed -i "s/version \"[^\"]*\"/version \"$VERSION\"/" "$cask"
+          sed -i "s/sha256 arm:   \"[^\"]*\"/sha256 arm:   \"$ARM_SHA\"/" "$cask"
+          sed -i "s/intel: \"[^\"]*\"/intel: \"$INTEL_SHA\"/" "$cask"
+          echo "----- updated $cask -----"
+          cat "$cask"
+
+      - name: Commit & push cask bump
+        env:
+          VERSION: ${{ steps.meta.outputs.version }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Casks/openless.rb
+          if git diff --cached --quiet; then
+            echo "cask 已是 $VERSION，无需提交"
+            exit 0
+          fi
+          # [skip ci]：cask 文本改动不需要再跑一遍跨平台 ci.yml。
+          git commit -m "[cask] openless $VERSION (auto from release) [skip ci]"
+          git push
@@ -1,83 +0,0 @@
-name: Update Cask on Release
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  update-cask:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    if: startsWith(github.event.release.tag_name, 'v') && endsWith(github.event.release.tag_name, '-tauri')
-    steps:
-      - name: Checkout tap repository
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract version from tag
-        id: version
-        run: |
-          TAG="${{ github.event.release.tag_name }}"
-          VERSION="${TAG#v}"
-          VERSION="${VERSION%-tauri}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Detected version: $VERSION"
-
-      - name: Fetch release assets SHA256
-        id: sha256
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          REPO="${{ github.repository }}"
-          
-          # Fetch release assets info
-          RESPONSE=$(gh api "repos/$REPO/releases/tags/v${VERSION}-tauri")
-          
-          # Extract SHA256 for aarch64 DMG
-          ARM64_SHA=$(echo "$RESPONSE" | jq -r '.assets[] | select(.name | contains("aarch64.dmg")) | .digest' | sed 's/sha256://')
-          
-          # Extract SHA256 for x64 DMG
-          X64_SHA=$(echo "$RESPONSE" | jq -r '.assets[] | select(.name | contains("_x64.dmg")) | .digest' | sed 's/sha256://')
-          
-          echo "arm64_sha=$ARM64_SHA" >> "$GITHUB_OUTPUT"
-          echo "x64_sha=$X64_SHA" >> "$GITHUB_OUTPUT"
-          
-          echo "aarch64 DMG SHA256: $ARM64_SHA"
-          echo "x64 DMG SHA256: $X64_SHA"
-
-      - name: Update Cask file
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          ARM64_SHA="${{ steps.sha256.outputs.arm64_sha }}"
-          X64_SHA="${{ steps.sha256.outputs.x64_sha }}"
-          CASK_FILE="Casks/openless.rb"
-          
-          # Update version
-          sed -i "s/version \"[^\"]*\"/version \"$VERSION\"/" "$CASK_FILE"
-          
-          # Update SHA256 values
-          sed -i "s/sha256 arm:   \"[^\"]*\"/sha256 arm:   \"$ARM64_SHA\"/" "$CASK_FILE"
-          sed -i "s/intel: \"[^\"]*\"/intel: \"$X64_SHA\"/" "$CASK_FILE"
-          
-          echo "Updated $CASK_FILE:"
-          cat "$CASK_FILE"
-
-      - name: Commit and push changes
-        run: |
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-          
-          VERSION="${{ steps.version.outputs.version }}"
-          
-          git add Casks/openless.rb
-          
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-            exit 0
-          fi
-          
-          git commit -m "[cask] Update openless to $VERSION"
-          git push