From 7fb22a2f856b9f01c8d21858514eb62ba0ed4f84 Mon Sep 17 00:00:00 2001 From: Liang Jiaqing Date: Fri, 16 Oct 2026 19:07:41 +0800 Subject: [PATCH] ci: remove main repository workflows; CI belongs to Desktop --- .github/workflows/desktop-ci.yml | 49 -------- .github/workflows/desktop-release-package.yml | 117 ------------------ docs/desktop_components.md | 19 ++- 3 files changed, 8 insertions(+), 177 deletions(-) delete mode 100644 .github/workflows/desktop-ci.yml delete mode 100644 .github/workflows/desktop-release-package.yml diff --git a/.github/workflows/desktop-ci.yml b/.github/workflows/desktop-ci.yml deleted file mode 100644 index c6cc8cf1..00000000 --- a/.github/workflows/desktop-ci.yml +++ /dev/null @@ -1,49 +0,0 @@ -name: GA backend contracts - -"on": - push: - branches: [main] - paths: ["agentmain.py", "llmcore.py", "llmcore/**", "frontends/**", ".github/workflows/**"] - pull_request: - branches: [main] - paths: ["agentmain.py", "llmcore.py", "llmcore/**", "frontends/**", ".github/workflows/**"] - workflow_dispatch: - -permissions: - contents: read - -concurrency: - group: ga-backend-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -jobs: - python-contracts: - runs-on: ubuntu-24.04 - timeout-minutes: 15 - strategy: - fail-fast: false - matrix: - python-version: ["3.10", "3.11", "3.12", "3.13"] - steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - with: - persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 - with: - python-version: ${{ matrix.python-version }} - cache: pip - cache-dependency-path: frontends/tests/requirements.txt - - run: python -m pip install -r frontends/tests/requirements.txt - - name: Run bridge, conductor, cost and backup contracts - # These two legacy suites describe the removed bundled Desktop shell, - # not the GA backend. Do not fetch private Desktop source to run them. - run: >- - python -m pytest frontends/tests -q - --ignore=frontends/tests/test_release_qualification.py - --ignore=frontends/tests/test_tauri_security_contract.py - - name: Verify Desktop remains an unlinked placeholder - shell: bash - run: | - set -euo pipefail - expected=$(printf '%s\n' frontends/desktop/.gitignore frontends/desktop/README.md) - test "$(git ls-files frontends/desktop)" = "$expected" diff --git a/.github/workflows/desktop-release-package.yml b/.github/workflows/desktop-release-package.yml deleted file mode 100644 index bdbd8ac0..00000000 --- a/.github/workflows/desktop-release-package.yml +++ /dev/null @@ -1,117 +0,0 @@ -name: Assemble GA source deployment - -# Windows publication still follows the existing release SOP. -# This workflow assembles source + a prebuilt component, never private source. -"on": - workflow_dispatch: - inputs: - platform: - description: Desktop component platform - required: true - type: choice - options: [windows, macos, linux] - component_url: - description: Public HTTPS URL of the exe, signed app ZIP, or AppImage - required: true - type: string - component_sha256: - description: Expected SHA256 from the Desktop component build - required: true - type: string - -permissions: - contents: read - -jobs: - assemble: - runs-on: ${{ inputs.platform == 'macos' && 'macos-14' || 'ubuntu-24.04' }} - timeout-minutes: 20 - env: - PLATFORM: ${{ inputs.platform }} - COMPONENT_URL: ${{ inputs.component_url }} - COMPONENT_SHA256: ${{ inputs.component_sha256 }} - steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - with: - persist-credentials: false - - name: Fetch fixed component and export GA source - shell: bash - run: | - set -euo pipefail - [[ "$COMPONENT_URL" == https://* ]] - [[ "$COMPONENT_SHA256" =~ ^[0-9a-fA-F]{64}$ ]] - mkdir -p staging/GenericAgent out - curl --fail --location --retry 3 --proto '=https' --proto-redir '=https' \ - --output component.bin "$COMPONENT_URL" - python3 - <<'PY' - import hashlib, os - from pathlib import Path - actual = hashlib.sha256(Path('component.bin').read_bytes()).hexdigest() - assert actual == os.environ['COMPONENT_SHA256'].lower(), 'Component SHA256 mismatch' - PY - git archive HEAD | tar -x -C staging/GenericAgent - mkdir -p staging/GenericAgent/frontends - - name: Install component into source tree - shell: bash - run: | - set -euo pipefail - FRONTENDS=staging/GenericAgent/frontends - case "$PLATFORM" in - windows) - cp component.bin "$FRONTENDS/GenericAgent.exe" - ;; - macos) - # Reject archive traversal; ditto preserves app modes, links and signature. - python3 - <<'PY' - import zipfile - from pathlib import PurePosixPath - with zipfile.ZipFile('component.bin') as archive: - for name in archive.namelist(): - path = PurePosixPath(name) - assert not path.is_absolute() and '..' not in path.parts and '\\' not in name, name - assert path.parts and path.parts[0] in ('GenericAgent.app', '__MACOSX'), name - PY - ditto -x -k component.bin "$FRONTENDS" - test -d "$FRONTENDS/GenericAgent.app" - rm -rf "$FRONTENDS/__MACOSX" - codesign --verify --deep --strict "$FRONTENDS/GenericAgent.app" - ;; - linux) - cp component.bin "$FRONTENDS/GenericAgent.AppImage" - chmod +x "$FRONTENDS/GenericAgent.AppImage" - ;; - esac - python3 - <<'PY' - import json, os - from pathlib import Path - record = {'ga_commit': os.environ['GITHUB_SHA'], 'platform': os.environ['PLATFORM'], - 'component_url': os.environ['COMPONENT_URL'], 'component_sha256': os.environ['COMPONENT_SHA256'].lower()} - Path('staging/GenericAgent/DESKTOP_COMPONENT.json').write_text(json.dumps(record, indent=2) + '\n') - PY - - name: Archive and verify deployment - shell: bash - run: | - set -euo pipefail - NAME="GenericAgent-Source-$PLATFORM" - if [[ "$PLATFORM" == macos ]]; then - ditto -c -k --sequesterRsrc --keepParent staging/GenericAgent "out/$NAME.zip" - ditto -x -k "out/$NAME.zip" "$RUNNER_TEMP/deployment-verify" - codesign --verify --deep --strict "$RUNNER_TEMP/deployment-verify/GenericAgent/frontends/GenericAgent.app" - elif [[ "$PLATFORM" == windows ]]; then - (cd staging && zip -qr "../out/$NAME.zip" GenericAgent) - else - tar -czf "out/$NAME.tar.gz" -C staging GenericAgent - fi - python3 - <<'PY' - import hashlib - from pathlib import Path - for path in list(Path('out').iterdir()): - digest = hashlib.sha256(path.read_bytes()).hexdigest() - path.with_name(path.name + '.sha256').write_text(digest + ' ' + path.name + '\n') - PY - - uses: actions/upload-artifact@v4 - with: - name: ga-source-${{ inputs.platform }} - path: out/* - if-no-files-found: error - retention-days: 30 diff --git a/docs/desktop_components.md b/docs/desktop_components.md index a215c392..5a3b3ebb 100644 --- a/docs/desktop_components.md +++ b/docs/desktop_components.md @@ -16,18 +16,15 @@ UI由Tauri内嵌，不依赖 `frontends/desktop/static/`。组件不包含GA、P mac组件沿用ad-hoc签名，签名校验失败会中止构建；压缩解压后再次验签。它不是Developer ID签名或Apple公证，首次启动可能需要系统设置中手动允许。当前只构建Apple Silicon，不是Intel或Universal版。保持 `.app` 完整，不修改内部文件。 -## GA源码包组装 +## 部署与发布 -Windows现有手工/VPS发布流程不变。以下是可选的CI组装入口，不会自动发布或覆盖现有Release： +**主仓不配置CI；CI仅在Desktop仓构建桌面组件。** -1. 下载Desktop Actions产物，核对其中记录的Desktop commit、目标平台及SHA256。 -2. 将**内层组件文件**与校验和放到现有公开二进制分发渠道。私有仓Actions下载需要认证，且产物只保留30天；不能把Actions外层ZIP或私有下载页当作公开组件地址。 -3. 在GA仓选择需要分发的源码版本，手动运行 **Assemble GA source deployment**，填写平台、固定HTTPS组件URL、预期SHA256。 -4. 工作流验证哈希，以 `git archive HEAD` 导出当前提交，注入对应 `frontends/` 路径，生成 `GenericAgent-Source-.zip`（Linux为 `.tar.gz`）。mac最终源码ZIP解压后再次验签。 -5. 下载 `ga-source-` Actions产物。包内 `DESKTOP_COMPONENT.json` 记录GA commit、组件URL与哈希。按原发布流程分发。 +1. 从Desktop Actions下载对应平台产物，核对SHA256和Desktop commit。 +2. 将组件放到上表所列的源码部署路径。mac需完整解压 `.app`，不要修改内部文件。 +3. 使用已有GA源码、Python环境与依赖启动桌面。 +4. Windows发布沿用现有手工/VPS发布SOP；需要分发mac组件时，使用Desktop CI输出的已签名ZIP。 -这些是源码部署包，不是离线portable运行时或DMG安装器。不会自动下载Python，也不会自动更新用户环境；旧portable标签不再触发本工作流。 +私有仓Actions下载需要认证，产物保留30天。长期分发使用现有二进制发布渠道，不把私有Actions下载页作为公开下载地址。 -## 后端CI - -主仓 **GA backend contracts** 测试Python 3.10–3.13，不安装Node/Rust，也不访问Desktop私有仓。两套依赖已移除桌面源码的旧壳/打包契约不再由主仓执行。Desktop仓独立运行前端测试、类型检查、构建及产物检查。 +Desktop CI不打包GA或Python；主仓不承担自动组装、测试或发布任务。