ci: remove main repository workflows; CI belongs to Desktop

.github/workflows/desktop-ci.yml

@@ -1,49 +0,0 @@
-name: GA backend contracts
-
-"on":
-  push:
-    branches: [main]
-    paths: ["agentmain.py", "llmcore.py", "llmcore/**", "frontends/**", ".github/workflows/**"]
-  pull_request:
-    branches: [main]
-    paths: ["agentmain.py", "llmcore.py", "llmcore/**", "frontends/**", ".github/workflows/**"]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ga-backend-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  python-contracts:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
-        with:
-          persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: pip
-          cache-dependency-path: frontends/tests/requirements.txt
-      - run: python -m pip install -r frontends/tests/requirements.txt
-      - name: Run bridge, conductor, cost and backup contracts
-        # These two legacy suites describe the removed bundled Desktop shell,
-        # not the GA backend. Do not fetch private Desktop source to run them.
-        run: >-
-          python -m pytest frontends/tests -q
-          --ignore=frontends/tests/test_release_qualification.py
-          --ignore=frontends/tests/test_tauri_security_contract.py
-      - name: Verify Desktop remains an unlinked placeholder
-        shell: bash
-        run: |
-          set -euo pipefail
-          expected=$(printf '%s\n' frontends/desktop/.gitignore frontends/desktop/README.md)
-          test "$(git ls-files frontends/desktop)" = "$expected"

.github/workflows/desktop-release-package.yml

@@ -1,117 +0,0 @@
-name: Assemble GA source deployment
-
-# Windows publication still follows the existing release SOP.
-# This workflow assembles source + a prebuilt component, never private source.
-"on":
-  workflow_dispatch:
-    inputs:
-      platform:
-        description: Desktop component platform
-        required: true
-        type: choice
-        options: [windows, macos, linux]
-      component_url:
-        description: Public HTTPS URL of the exe, signed app ZIP, or AppImage
-        required: true
-        type: string
-      component_sha256:
-        description: Expected SHA256 from the Desktop component build
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  assemble:
-    runs-on: ${{ inputs.platform == 'macos' && 'macos-14' || 'ubuntu-24.04' }}
-    timeout-minutes: 20
-    env:
-      PLATFORM: ${{ inputs.platform }}
-      COMPONENT_URL: ${{ inputs.component_url }}
-      COMPONENT_SHA256: ${{ inputs.component_sha256 }}
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
-        with:
-          persist-credentials: false
-      - name: Fetch fixed component and export GA source
-        shell: bash
-        run: |
-          set -euo pipefail
-          [[ "$COMPONENT_URL" == https://* ]]
-          [[ "$COMPONENT_SHA256" =~ ^[0-9a-fA-F]{64}$ ]]
-          mkdir -p staging/GenericAgent out
-          curl --fail --location --retry 3 --proto '=https' --proto-redir '=https' \
-            --output component.bin "$COMPONENT_URL"
-          python3 - <<'PY'
-          import hashlib, os
-          from pathlib import Path
-          actual = hashlib.sha256(Path('component.bin').read_bytes()).hexdigest()
-          assert actual == os.environ['COMPONENT_SHA256'].lower(), 'Component SHA256 mismatch'
-          PY
-          git archive HEAD | tar -x -C staging/GenericAgent
-          mkdir -p staging/GenericAgent/frontends
-      - name: Install component into source tree
-        shell: bash
-        run: |
-          set -euo pipefail
-          FRONTENDS=staging/GenericAgent/frontends
-          case "$PLATFORM" in
-            windows)
-              cp component.bin "$FRONTENDS/GenericAgent.exe"
-              ;;
-            macos)
-              # Reject archive traversal; ditto preserves app modes, links and signature.
-              python3 - <<'PY'
-          import zipfile
-          from pathlib import PurePosixPath
-          with zipfile.ZipFile('component.bin') as archive:
-              for name in archive.namelist():
-                  path = PurePosixPath(name)
-                  assert not path.is_absolute() and '..' not in path.parts and '\\' not in name, name
-                  assert path.parts and path.parts[0] in ('GenericAgent.app', '__MACOSX'), name
-          PY
-              ditto -x -k component.bin "$FRONTENDS"
-              test -d "$FRONTENDS/GenericAgent.app"
-              rm -rf "$FRONTENDS/__MACOSX"
-              codesign --verify --deep --strict "$FRONTENDS/GenericAgent.app"
-              ;;
-            linux)
-              cp component.bin "$FRONTENDS/GenericAgent.AppImage"
-              chmod +x "$FRONTENDS/GenericAgent.AppImage"
-              ;;
-          esac
-          python3 - <<'PY'
-          import json, os
-          from pathlib import Path
-          record = {'ga_commit': os.environ['GITHUB_SHA'], 'platform': os.environ['PLATFORM'],
-                    'component_url': os.environ['COMPONENT_URL'], 'component_sha256': os.environ['COMPONENT_SHA256'].lower()}
-          Path('staging/GenericAgent/DESKTOP_COMPONENT.json').write_text(json.dumps(record, indent=2) + '\n')
-          PY
-      - name: Archive and verify deployment
-        shell: bash
-        run: |
-          set -euo pipefail
-          NAME="GenericAgent-Source-$PLATFORM"
-          if [[ "$PLATFORM" == macos ]]; then
-            ditto -c -k --sequesterRsrc --keepParent staging/GenericAgent "out/$NAME.zip"
-            ditto -x -k "out/$NAME.zip" "$RUNNER_TEMP/deployment-verify"
-            codesign --verify --deep --strict "$RUNNER_TEMP/deployment-verify/GenericAgent/frontends/GenericAgent.app"
-          elif [[ "$PLATFORM" == windows ]]; then
-            (cd staging && zip -qr "../out/$NAME.zip" GenericAgent)
-          else
-            tar -czf "out/$NAME.tar.gz" -C staging GenericAgent
-          fi
-          python3 - <<'PY'
-          import hashlib
-          from pathlib import Path
-          for path in list(Path('out').iterdir()):
-              digest = hashlib.sha256(path.read_bytes()).hexdigest()
-              path.with_name(path.name + '.sha256').write_text(digest + '  ' + path.name + '\n')
-          PY
-      - uses: actions/upload-artifact@v4
-        with:
-          name: ga-source-${{ inputs.platform }}
-          path: out/*
-          if-no-files-found: error
-          retention-days: 30

docs/desktop_components.md

@@ -16,18 +16,15 @@ UI由Tauri内嵌，不依赖 `frontends/desktop/static/`。组件不包含GA、P
 
 mac组件沿用ad-hoc签名，签名校验失败会中止构建；压缩解压后再次验签。它不是Developer ID签名或Apple公证，首次启动可能需要系统设置中手动允许。当前只构建Apple Silicon，不是Intel或Universal版。保持 `.app` 完整，不修改内部文件。
 
-## GA源码包组装
+## 部署与发布
 
-Windows现有手工/VPS发布流程不变。以下是可选的CI组装入口，不会自动发布或覆盖现有Release：
+**主仓不配置CI；CI仅在Desktop仓构建桌面组件。**
 
-1. 下载Desktop Actions产物，核对其中记录的Desktop commit、目标平台及SHA256。
+1. 从Desktop Actions下载对应平台产物，核对SHA256和Desktop commit。
-2. 将**内层组件文件**与校验和放到现有公开二进制分发渠道。私有仓Actions下载需要认证，且产物只保留30天；不能把Actions外层ZIP或私有下载页当作公开组件地址。
+2. 将组件放到上表所列的源码部署路径。mac需完整解压 `.app`，不要修改内部文件。
-3. 在GA仓选择需要分发的源码版本，手动运行 **Assemble GA source deployment**，填写平台、固定HTTPS组件URL、预期SHA256。
+3. 使用已有GA源码、Python环境与依赖启动桌面。
-4. 工作流验证哈希，以 `git archive HEAD` 导出当前提交，注入对应 `frontends/` 路径，生成 `GenericAgent-Source-<platform>.zip`（Linux为 `.tar.gz`）。mac最终源码ZIP解压后再次验签。
+4. Windows发布沿用现有手工/VPS发布SOP；需要分发mac组件时，使用Desktop CI输出的已签名ZIP。
-5. 下载 `ga-source-<platform>` Actions产物。包内 `DESKTOP_COMPONENT.json` 记录GA commit、组件URL与哈希。按原发布流程分发。
 
-这些是源码部署包，不是离线portable运行时或DMG安装器。不会自动下载Python，也不会自动更新用户环境；旧portable标签不再触发本工作流。
+私有仓Actions下载需要认证，产物保留30天。长期分发使用现有二进制发布渠道，不把私有Actions下载页作为公开下载地址。
 
-## 后端CI
+Desktop CI不打包GA或Python；主仓不承担自动组装、测试或发布任务。
-
-主仓 **GA backend contracts** 测试Python 3.10–3.13，不安装Node/Rust，也不访问Desktop私有仓。两套依赖已移除桌面源码的旧壳/打包契约不再由主仓执行。Desktop仓独立运行前端测试、类型检查、构建及产物检查。