93 lines
3.6 KiB
YAML
93 lines
3.6 KiB
YAML
name: OTA Frontend Build & Sign
|
|
|
|
# 前端 OTA 升级包构建 + 签名 + 上传 artifact
|
|
# 触发: 仅手动 (workflow_dispatch), 发版前用
|
|
# - 主分支 push 的自动 OTA 生成已并入 docker-build.yml (随镜像发布), 本 workflow 不再监听 push 避免重复构建
|
|
# 输入: sequence / notes / min_binary (可覆盖默认)
|
|
# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
|
|
# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
|
|
# 换密钥请手动改 conf 并 commit.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
sequence:
|
|
description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
|
|
required: false
|
|
type: string
|
|
notes:
|
|
description: '发布说明 (写入 latest.json.notes)'
|
|
required: false
|
|
type: string
|
|
default: ''
|
|
min_binary:
|
|
description: '最低 binary 版本 (默认 0.1.0 = 现有 APK 的原生版本, 与前端应用版本无关)'
|
|
required: false
|
|
type: string
|
|
default: '0.1.0'
|
|
|
|
jobs:
|
|
build-ota:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: https://gitea.com/actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Install deps
|
|
run: npm ci --no-audit --no-fund
|
|
|
|
- name: Build frontend
|
|
# 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
|
|
run: npm run build
|
|
|
|
- name: Install minisign
|
|
# 静态二进制直接下载, 免去每次 apt-get update + install
|
|
# 注意: release tarball 是 macOS 上打包的, 混有多个平台的 minisign 二进制,
|
|
# 逐个试运行挑出本机可执行的, 都不行再回退 apt
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /tmp/ms
|
|
curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
|
|
BIN=""
|
|
for c in $(find /tmp/ms -type f -name minisign); do
|
|
if "$c" -v >/dev/null 2>&1; then BIN="$c"; break; fi
|
|
done
|
|
if [ -n "$BIN" ]; then
|
|
sudo install -m755 "$BIN" /usr/local/bin/minisign
|
|
else
|
|
echo "未找到可执行的静态二进制, 回退 apt 安装"
|
|
sudo apt-get update && sudo apt-get install -y minisign
|
|
fi
|
|
minisign -v
|
|
|
|
- name: Build & sign OTA package
|
|
env:
|
|
MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
|
|
OTA_NOTES: ${{ inputs.notes }}
|
|
run: |
|
|
set -euo pipefail
|
|
OUT="ota-package"
|
|
ARGS="--out ${OUT}"
|
|
# sequence 留空 → 脚本默认用时间戳; min_binary 默认 0.1.0 (与前端版本解耦)
|
|
if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
|
|
if [ -n "${OTA_NOTES}" ]; then ARGS="${ARGS} --notes ${OTA_NOTES}"; fi
|
|
if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
|
|
node scripts/build-ota.mjs ${ARGS}
|
|
echo "===== latest.json ====="
|
|
cat ${OUT}/latest.json
|
|
echo "===== bundle sha256 ====="
|
|
sha256sum ${OUT}/iboard-ota.tar.gz
|
|
|
|
- name: Upload OTA package as artifact
|
|
uses: https://gitea.com/actions/upload-artifact@v4
|
|
with:
|
|
name: iboard-ota-${{ inputs.sequence || github.run_number }}
|
|
path: ota-package/
|
|
retention-days: 30
|
|
if-no-files-found: error
|