feat(ota): 新增 OTA-only 热更通道; 修底部导航椭圆 FAB/点击高亮, 顶部内缩减半

2026-09-16 11:17:21 +08:00
parent bb1c2718df
commit 9a02886553
4 changed files with 204 additions and 6 deletions
@@ -0,0 +1,102 @@
+name: OTA Package Only
+
+# 手动触发: 前端已改但不想等全量 Android 构建 / 不想整镜像重部署时,
+# 只重建 dist + minisign 签名, 通过服务端 admin 接口直推运行中的容器
+# (容器挂载卷 wardrobe-ota:/app/ota-package, 设备下次轮询立即热更新, 后端/APK 均不动)
+#
+# 前置 (一次性, 配置中心 service-wardrobe/ota):
+#   - MINISIGN_PRIVATE_KEY : 私钥 (整段 .key 内容, 多行)
+#   - OTA_ADMIN_TOKEN      : 上传鉴权 token (单行, 与容器环境变量一致)
+on:
+  workflow_dispatch:
+
+jobs:
+  build-ota-only:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      CONFIG_CENTER_URL: '${{ secrets.CONFIG_CENTER_URL }}'
+      CONFIG_CENTER_TOKEN: '${{ secrets.CONFIG_CENTER_TOKEN }}'
+      REGISTRY_URL_FALLBACK: 'http://bh.vps.honor3.com:8008'
+      CFG_PROJECT_SIGNING: 'proj-mtwjnvir-k52zvp'
+      OTA_BASE: 'http://bh.vps.honor3.com:3002'
+
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install deps
+        run: npm ci --no-audit --no-fund
+
+      - name: Build frontend
+        run: npm run build
+
+      - name: Install minisign
+        run: sudo apt-get update && sudo apt-get install -y minisign
+
+      - name: Fetch config center (minisign key + ota admin token)
+        run: |
+          set -euo pipefail
+          export CONFIG_CENTER_URL="${CONFIG_CENTER_URL:-$REGISTRY_URL_FALLBACK}"
+          python3 - <<'PYEOF'
+          import json, os, urllib.request
+          url = os.environ["CONFIG_CENTER_URL"]
+          token = os.environ.get("CONFIG_CENTER_TOKEN", "") or ""
+          req = urllib.request.Request(f"{url}/api/projects/{os.environ['CFG_PROJECT_SIGNING']}/configs")
+          if token:
+              req.add_header("Authorization", "Bearer " + token)
+          with urllib.request.urlopen(req, timeout=20) as r:
+              data = json.load(r).get("data", [])
+          key_val = next((c.get("value", "") for c in data if c.get("key") == "MINISIGN_PRIVATE_KEY"), None)
+          ota_admin = next((c.get("value", "") for c in data if c.get("key") == "OTA_ADMIN_TOKEN"), None)
+          if not key_val:
+              raise SystemExit("配置中心缺少 MINISIGN_PRIVATE_KEY (service-wardrobe/ota)")
+          if not ota_admin:
+              raise SystemExit("配置中心缺少 OTA_ADMIN_TOKEN (service-wardrobe/ota, 单行)")
+          os.makedirs("ota-package", exist_ok=True)
+          with open("ota-package/hotswap.key", "w", encoding="utf-8") as f:
+              f.write(key_val if key_val.endswith("\n") else key_val + "\n")
+          os.chmod("ota-package/hotswap.key", 0o600)
+          with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as f:
+              f.write(f"OTA_ADMIN_TOKEN={ota_admin}\n")
+          PYEOF
+          echo "hotswap.key lines=$(wc -l < ota-package/hotswap.key)"
+          echo "OTA_ADMIN_TOKEN set: $([ -n "${OTA_ADMIN_TOKEN}" ] && echo yes || echo no)"
+
+      - name: Build & sign OTA package
+        env:
+          OTA_NOTES: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          node scripts/build-ota.mjs --out ota-package --key ota-package/hotswap.key --notes ${OTA_NOTES}
+          echo "===== latest.json ====="
+          cat ota-package/latest.json
+
+      - name: Publish to running server (OTA-only upload)
+        # 服务端 POST /api/ota/admin/bundle 覆盖卷内最新包, 不重建镜像/重启进程
+        env:
+          OTA_NOTES: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          cd ota-package
+          SEQ=$(python3 -c "import json;print(json.load(open('latest.json'))['sequence'])")
+          SHA=$(python3 -c "import json;print(json.load(open('latest.json'))['bundle_sha256'])")
+          SIG=$(python3 -c "import json;print(json.load(open('latest.json'))['signature'])")
+          VER=$(python3 -c "import json;print(json.load(open('latest.json'))['version'])")
+          MIN=$(python3 -c "import json;print(json.load(open('latest.json'))['min_binary_version'])")
+          echo "seq=${SEQ} sha=${SHA} version=${VER} min_binary=${MIN}"
+          curl -fsS -X POST "${OTA_BASE}/api/ota/admin/bundle" \
+            -H "Content-Type: application/gzip" \
+            -H "x-ota-token: ${OTA_ADMIN_TOKEN}" \
+            -H "x-ota-seq: ${SEQ}" \
+            -H "x-ota-sha256: ${SHA}" \
+            -H "x-ota-signature: ${SIG}" \
+            -H "x-ota-version: ${VER}" \
+            -H "x-ota-min-bin: ${MIN}" \
+            -H "x-ota-notes: ${OTA_NOTES}" \
+            --data-binary @wardrobe-ota.tar.gz