release

Author: linyuan.yang

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
           - platform: macos-latest
             args: '--target x86_64-apple-darwin'
             rust-target: x86_64-apple-darwin
-          - platform: ubuntu-22.04
+          - platform: ubuntu-24.04
             args: ''
             rust-target: ''
           - platform: windows-latest
@@ -61,7 +61,7 @@ jobs:
             ${{ matrix.platform }}-cargo-
 
       - name: Install Linux deps
-        if: matrix.platform == 'ubuntu-22.04'
+        if: startsWith(matrix.platform, 'ubuntu-')
         run: |
           sudo apt-get update
           sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libpipewire-0.3-dev patchelf
@@ -100,8 +100,7 @@ jobs:
           releaseBody: ${{ steps.notes.outputs.body }}
           releaseDraft: true
           prerelease: false
-          includeUpdaterJson: true
-          updaterJsonPreferNsis: true
+          includeUpdaterJson: false
           args: ${{ matrix.args }}
 
   publish-manifest:
@@ -148,9 +147,9 @@ jobs:
           # run already created the draft, its body is stuck on whatever was there. Force it.
           gh release edit "$TAG" -R "$REPO" --notes "$BODY"
 
-      # 给桌面产物文件名加系统标识（tauri-action 上传时不含）。
+      # 给桌面产物文件名加系统和架构标识（tauri-action 上传时不含）。
       # 此 job needs: release-desktop，所有桌面 matrix 已完成，不会再有旧名文件上传。
-      # sed 不加 $ 行尾锚，.sig 后缀会自动保留；latest.json 不匹配规则，留待后续删除。
+      # sed 不加 $ 行尾锚，.tar.gz / .zip / .sig 后缀会自动保留。
       - name: Rename desktop assets with OS tag
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -175,32 +174,112 @@ jobs:
             fi
           done
 
-      - name: Sync updater manifest to updater channel
+      - name: Generate updater manifest
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
           TAG: ${{ steps.release.outputs.tag }}
           ASSET_VERSION: ${{ steps.release.outputs.version }}
         run: |
-          if ! gh release download "$TAG" -R "$REPO" -p "latest.json" -O latest.json; then
-            echo "::error::latest.json not found on release $TAG — no platform produced an updater manifest"
-            exit 1
-          fi
-          # 上一步已重命名更新载荷文件，latest.json 里的 URL 需同步改写，否则更新器会 404。
-          # latest.json 只含 app.tar.gz / setup.exe / AppImage 三类载荷 URL；base64 签名字段不含这些模式，g 全局替换安全。
-          sed -i -E \
-            -e "s#sbox_aarch64\.app\.tar\.gz#sbox_${ASSET_VERSION}_macos_arm64.app.tar.gz#g" \
-            -e "s#sbox_x64\.app\.tar\.gz#sbox_${ASSET_VERSION}_macos_x64.app.tar.gz#g" \
-            -e "s#sbox_[0-9][0-9.]*_x64-setup\.exe#sbox_${ASSET_VERSION}_windows_x64.exe#g" \
-            -e "s#sbox_[0-9][0-9.]*_arm64-setup\.exe#sbox_${ASSET_VERSION}_windows_arm64.exe#g" \
-            -e "s#sbox_[0-9][0-9.]*_amd64\.AppImage#sbox_${ASSET_VERSION}_linux_x64.AppImage#g" \
-            -e "s#sbox_[0-9][0-9.]*_arm64\.AppImage#sbox_${ASSET_VERSION}_linux_arm64.AppImage#g" \
-            latest.json
+          set -euo pipefail
+          gh api "/repos/$REPO/releases/tags/$TAG" > release.json
+          rm -rf updater-signatures
+          mkdir -p updater-signatures
+          gh release download "$TAG" -R "$REPO" -p "*.sig" --dir updater-signatures --clobber
+          node <<'NODE'
+          const fs = require('node:fs');
+          const path = require('node:path');
+
+          const version = process.env.ASSET_VERSION;
+          const release = JSON.parse(fs.readFileSync('release.json', 'utf8'));
+          const assets = new Map(release.assets.map((asset) => [asset.name, asset]));
+          const platforms = {};
+          const missing = [];
+
+          function changelogNotes() {
+            const changelog = fs.readFileSync('CHANGELOG.md', 'utf8').split(/\r?\n/);
+            const lines = [];
+            let capture = false;
+            for (const line of changelog) {
+              const parts = line.trim().split(/\s+/);
+              if (parts[0] === '##' && parts[1] === version) {
+                capture = true;
+                continue;
+              }
+              if (capture && parts[0] === '##') break;
+              if (capture) lines.push(line);
+            }
+            const body = lines.join('\n').trim();
+            return body || `Release ${version}`;
+          }
+
+          function signatureFor(assetName) {
+            const sigName = `${assetName}.sig`;
+            if (!assets.has(sigName)) {
+              throw new Error(`missing signature asset: ${sigName}`);
+            }
+            const sigPath = path.join('updater-signatures', sigName);
+            if (!fs.existsSync(sigPath)) {
+              throw new Error(`signature asset was not downloaded: ${sigName}`);
+            }
+            return fs.readFileSync(sigPath, 'utf8');
+          }
+
+          function add(keys, candidates) {
+            const asset = candidates.map((name) => assets.get(name)).find(Boolean);
+            if (!asset) {
+              missing.push(candidates.join(' or '));
+              return;
+            }
+            const entry = {
+              signature: signatureFor(asset.name),
+              url: asset.browser_download_url,
+            };
+            for (const key of keys) {
+              platforms[key] = entry;
+            }
+          }
+
+          add(['darwin-x86_64', 'darwin-x86_64-app'], [
+            `sbox_${version}_macos_x64.app.tar.gz`,
+          ]);
+          add(['darwin-aarch64', 'darwin-aarch64-app'], [
+            `sbox_${version}_macos_arm64.app.tar.gz`,
+          ]);
+          add(['windows-x86_64', 'windows-x86_64-nsis'], [
+            `sbox_${version}_windows_x64.exe`,
+            `sbox_${version}_windows_x64.exe.zip`,
+            `sbox_${version}_windows_x64.nsis.zip`,
+          ]);
+          add(['windows-aarch64', 'windows-aarch64-nsis'], [
+            `sbox_${version}_windows_arm64.exe`,
+            `sbox_${version}_windows_arm64.exe.zip`,
+            `sbox_${version}_windows_arm64.nsis.zip`,
+          ]);
+          add(['linux-x86_64', 'linux-x86_64-appimage'], [
+            `sbox_${version}_linux_x64.AppImage.tar.gz`,
+            `sbox_${version}_linux_x64.AppImage`,
+          ]);
+
+          if (missing.length > 0) {
+            throw new Error(`missing updater payload asset(s): ${missing.join(', ')}`);
+          }
+
+          fs.writeFileSync(
+            'latest.json',
+            `${JSON.stringify({
+              version,
+              notes: changelogNotes(),
+              pub_date: new Date().toISOString(),
+              platforms,
+            }, null, 2)}\n`,
+          );
+          NODE
           gh release view updater -R "$REPO" >/dev/null 2>&1 || \
             gh release create updater -R "$REPO" \
               --title "Updater Manifests" \
               --notes "Auto-maintained by CI. Hosts the updater JSON for sbox." \
               --latest=false
           gh release upload updater latest.json -R "$REPO" --clobber
-          # latest.json 只是中间产物，自动更新读的是固定 updater release 那份，从版本 release 删掉。
-          gh release delete-asset "$TAG" latest.json -R "$REPO" --yes
+          # 自动更新读的是固定 updater release 那份；版本 release 若残留旧 latest.json，则删除。
+          gh release delete-asset "$TAG" latest.json -R "$REPO" --yes || true