跟新 CICD，每次制作 ota 升级包

2026-08-07 10:04:57 +08:00
parent 4f5cdb4325
commit 8999b29646
3 changed files with 123 additions and 33 deletions
@@ -0,0 +1,72 @@
+name: OTA Frontend Build & Sign
+
+# 前端 OTA 升级包构建 + 签名 + 上传 artifact
+# 触发: 手动 (workflow_dispatch), 由"我"页/发版前点一下
+# 输入: sequence / notes (可覆盖默认)
+# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
+# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
+#       换密钥请手动改 conf 并 commit.
+
+on:
+  workflow_dispatch:
+    inputs:
+      sequence:
+        description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
+        required: false
+        type: string
+      notes:
+        description: '发布说明 (写入 latest.json.notes)'
+        required: false
+        type: string
+        default: ''
+      min_binary:
+        description: '最低 binary 版本 (留空用 src-tauri/tauri.conf.json 的 version)'
+        required: false
+        type: string
+        default: ''
+
+jobs:
+  build-ota:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install deps
+        run: npm ci --no-audit --no-fund
+
+      - name: Build frontend
+        # 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
+        run: npm run build
+
+      - name: Install minisign
+        run: sudo apt-get update && sudo apt-get install -y minisign
+
+      - name: Build & sign OTA package
+        env:
+          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          OUT="ota-package"
+          ARGS="--out ${OUT}"
+          if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
+          if [ -n "${{ inputs.notes }}" ]; then ARGS="${ARGS} --notes ${{ inputs.notes }}"; fi
+          if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
+          node scripts/build-ota.mjs ${ARGS}
+          echo "===== latest.json ====="
+          cat ${OUT}/latest.json
+          echo "===== bundle sha256 ====="
+          sha256sum ${OUT}/iboard-ota.tar.gz
+
+      - name: Upload OTA package as artifact
+        uses: https://gitea.com/actions/upload-artifact@v4
+        with:
+          name: iboard-ota-${{ inputs.sequence || github.run_number }}
+          path: ota-package/
+          retention-days: 30
+          if-no-files-found: error