jif2.zhang
8203a7f893
Docker Build and Push / build-image (push) Successful in 1m1s
- ota-build.yml: notes 默认取检出 commit 的 message, --commit 写入 manifest (与 docker-build 一致); 参数加引号防空格断裂 - docker-build.yml: 去掉 head -c 400 字节截断 (会把多字节汉字切成 非法 UTF-8 导致 latest.json 解析失败), 截断统一由打包脚本按字符处理 - build-ota.mjs: CI 日志输出 build_id 与 commit
98 lines
3.8 KiB
YAML
98 lines
3.8 KiB
YAML
name: OTA Frontend Build & Sign
|
|
|
|
# 前端 OTA 升级包构建 + 签名 + 上传 artifact
|
|
# 触发: 仅手动 (workflow_dispatch), 发版前用
|
|
# - 主分支 push 的自动 OTA 生成已并入 docker-build.yml (随镜像发布), 本 workflow 不再监听 push 避免重复构建
|
|
# 输入: sequence / notes / min_binary (可覆盖默认)
|
|
# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
|
|
# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
|
|
# 换密钥请手动改 conf 并 commit.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
sequence:
|
|
description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
|
|
required: false
|
|
type: string
|
|
notes:
|
|
description: '发布说明 (写入 latest.json.notes)'
|
|
required: false
|
|
type: string
|
|
default: ''
|
|
min_binary:
|
|
description: '最低 binary 版本 (默认 0.1.0 = 现有 APK 的原生版本, 与前端应用版本无关)'
|
|
required: false
|
|
type: string
|
|
default: '0.1.0'
|
|
|
|
jobs:
|
|
build-ota:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: https://gitea.com/actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Install deps
|
|
run: npm ci --no-audit --no-fund
|
|
|
|
- name: Build frontend
|
|
# 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
|
|
run: npm run build
|
|
|
|
- name: Install minisign
|
|
# 静态二进制直接下载, 免去每次 apt-get update + install
|
|
# 注意: release tarball 是 macOS 上打包的, 混有多个平台的 minisign 二进制,
|
|
# 逐个试运行挑出本机可执行的, 都不行再回退 apt
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /tmp/ms
|
|
curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
|
|
BIN=""
|
|
for c in $(find /tmp/ms -type f -name minisign); do
|
|
if "$c" -v >/dev/null 2>&1; then BIN="$c"; break; fi
|
|
done
|
|
if [ -n "$BIN" ]; then
|
|
sudo install -m755 "$BIN" /usr/local/bin/minisign
|
|
else
|
|
echo "未找到可执行的静态二进制, 回退 apt 安装"
|
|
sudo apt-get update && sudo apt-get install -y minisign
|
|
fi
|
|
minisign -v
|
|
|
|
- name: Build & sign OTA package
|
|
# 发布说明默认 = 检出 commit 的 message (标题+正文), commit sha 单独写入;
|
|
# 手动填写的 notes 优先
|
|
env:
|
|
MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
OUT="ota-package"
|
|
ARGS="--out ${OUT} --commit ${GITHUB_SHA}"
|
|
if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
|
|
if [ -n "${{ inputs.notes }}" ]; then
|
|
ARGS="${ARGS} --notes \"${{ inputs.notes }}\""
|
|
else
|
|
MSG="$(git log -1 --pretty=format:%B | sed -e '/^[[:space:]]*$/d')"
|
|
ARGS="${ARGS} --notes \"${MSG}\""
|
|
fi
|
|
if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
|
|
eval "node scripts/build-ota.mjs ${ARGS}"
|
|
echo "===== latest.json ====="
|
|
cat ${OUT}/latest.json
|
|
echo "===== bundle sha256 ====="
|
|
sha256sum ${OUT}/iboard-ota.tar.gz
|
|
|
|
- name: Upload OTA package as artifact
|
|
uses: https://gitea.com/actions/upload-artifact@v4
|
|
with:
|
|
name: iboard-ota-${{ inputs.sequence || github.run_number }}
|
|
path: ota-package/
|
|
retention-days: 30
|
|
if-no-files-found: error
|