From 090435403c3a2b1e6a4f7cad8d4a27c99133ec52 Mon Sep 17 00:00:00 2001 From: x x Date: Mon, 14 Sep 2026 20:27:51 +0800 Subject: [PATCH] =?UTF-8?q?ci:=20=E9=99=8D=E4=BD=8E=E5=B8=B8=E8=A7=84?= =?UTF-8?q?=E9=97=A8=E7=A6=81=E5=A4=96=E9=83=A8=E4=BE=9D=E8=B5=96=E5=81=B6?= =?UTF-8?q?=E5=8F=91=E5=A4=B1=E8=B4=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 8 +++-- .github/workflows/windows-installer.yml | 41 ++++++++++++------------- scripts/test/ci_workflow_test.go | 7 +++++ 3 files changed, 33 insertions(+), 23 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e14736cc..cf034ac5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -126,9 +126,13 @@ jobs: cache: true - name: Install Xvfb + shell: bash run: | - sudo apt-get update - sudo apt-get install -y xvfb xauth + if command -v xvfb-run >/dev/null 2>&1 && command -v xauth >/dev/null 2>&1; then + exit 0 + fi + sudo apt-get -o Acquire::Retries=3 update + sudo apt-get -o Acquire::Retries=3 install -y --no-install-recommends xvfb xauth - name: Browser integration race shell: bash diff --git a/.github/workflows/windows-installer.yml b/.github/workflows/windows-installer.yml index 58206ee8..2c57cbb7 100644 --- a/.github/workflows/windows-installer.yml +++ b/.github/workflows/windows-installer.yml @@ -115,18 +115,6 @@ jobs: $ErrorActionPreference = 'Stop' go test ./internal/desktopruntime -run TestSelectInteractiveTaskSessionID -count=1 - - name: Download and validate exact installer bytes - shell: powershell - run: | - $ErrorActionPreference = 'Stop' - $downloadedInstaller = Join-Path $env:RUNNER_TEMP 'install-downloaded.ps1' - $installerUrl = 'https://raw.githubusercontent.com/${{ github.repository }}/${{ github.sha }}/scripts/install/install.ps1' - & .\scripts\test\test-install-windows-download.ps1 ` - -Url $installerUrl ` - -ExpectedInstallerPath .\scripts\install\install.ps1 ` - -OutputPath $downloadedInstaller - "DOWNLOADED_INSTALLER=$downloadedInstaller" | Out-File -FilePath $env:GITHUB_ENV -Encoding ascii -Append - - name: Run full install and in-place upgrade as standard user shell: powershell run: | @@ -190,7 +178,7 @@ jobs: } while ($true) & .\scripts\test\run-windows-installer-e2e-as-standard-user.ps1 ` - -InstallerPath $env:DOWNLOADED_INSTALLER ` + -InstallerPath .\scripts\install\install.ps1 ` -Version latest ` -ReleaseBaseUrl $releaseBaseUrl } finally { @@ -262,18 +250,29 @@ jobs: $checksumPath = "$archivePath.sha256" [IO.File]::WriteAllText($checksumPath, "$hash agentdock_windows_amd64.zip`n", [Text.UTF8Encoding]::new($false)) - $cloudflaredPath = Join-Path $payloadRoot 'cloudflared-windows-amd64.exe' - Invoke-WebRequest ` - -UseBasicParsing ` - -Uri 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe' ` - -OutFile $cloudflaredPath + "AMD64_ARCHIVE=$archivePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding ascii -Append + "AMD64_CHECKSUM=$checksumPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding ascii -Append + + - name: Download and verify cloudflared compatibility payload + shell: pwsh + run: | + $ErrorActionPreference = 'Stop' + $ProgressPreference = 'SilentlyContinue' + $cloudflaredPath = Join-Path $env:RUNNER_TEMP 'cloudflared-windows-amd64.exe' + $cloudflaredUrl = 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe' + for ($attempt = 1; $attempt -le 5; $attempt++) { + try { + Invoke-WebRequest -UseBasicParsing -Uri $cloudflaredUrl -OutFile $cloudflaredPath + break + } catch { + if ($attempt -eq 5) { throw } + Start-Sleep -Seconds 2 + } + } $cloudflaredSignature = Get-AuthenticodeSignature -LiteralPath $cloudflaredPath if ($cloudflaredSignature.Status -ne [Management.Automation.SignatureStatus]::Valid) { throw "cloudflared Authenticode signature is invalid: $($cloudflaredSignature.StatusMessage)" } - - "AMD64_ARCHIVE=$archivePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding ascii -Append - "AMD64_CHECKSUM=$checksumPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding ascii -Append "AMD64_CLOUDFLARED=$cloudflaredPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding ascii -Append - name: Test Quick Tunnel restart lifecycle diff --git a/scripts/test/ci_workflow_test.go b/scripts/test/ci_workflow_test.go index e2cdc4c3..a7838e7e 100644 --- a/scripts/test/ci_workflow_test.go +++ b/scripts/test/ci_workflow_test.go @@ -81,9 +81,16 @@ func TestWindowsInstallerWorkflowHasAlwaysPresentPullRequestGate(t *testing.T) { "CHANGES_RESULT: ${{ needs.changes.result }}", "VALIDATE_RESULT: ${{ needs.validate.result }}", "github.event_name == 'workflow_dispatch' && inputs.test_tag != ''", + "-InstallerPath .\\scripts\\install\\install.ps1", + "name: Download and verify cloudflared compatibility payload", + "for ($attempt = 1; $attempt -le 5; $attempt++)", + "Get-AuthenticodeSignature -LiteralPath $cloudflaredPath", } { if !strings.Contains(workflow, want) { t.Fatalf("Windows Installer workflow must keep a safe pull-request gate; missing %q", want) } } + if strings.Contains(workflow, "raw.githubusercontent.com/${{ github.repository }}/${{ github.sha }}/scripts/install/install.ps1") { + t.Fatal("routine Windows installer validation must use the checked-out installer instead of refetching it over the network") + } }