ci/release: 收敛检查、并行发行并迁入签名汇总与 OSS 双源更新

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+# Repository-specific runner label used by the iOS checks.
+self-hosted-runner:
+  labels:
+    - xcode-27

.github/workflows/android-apk.yml

@@ -1,7 +1,7 @@
 name: Android APK (debug)
 
 # Triggers:
-#   - push v*-tauri tag → signed release APK + minisign + updater manifest → GitHub Release
+#   - workflow_call from release-tauri.yml on v*-tauri tags → signed APKs + signatures → shared Release
 #   - workflow_dispatch → signed release APK when ANDROID_KEYSTORE_* secrets exist
 #     (overlay install + user data preserved); otherwise unsigned debug APK (annotated, non-blocking)
 #   - workflow_dispatch + signed_debug=true — debug APK signed with the release
@@ -15,12 +15,19 @@ name: Android APK (debug)
 #   - Tauri still runs plugin-init cargo + android-studio-script per ABI (first ABI twice).
 
 on:
-  push:
-    # Same reasoning as release-tauri: an APK per branch push cost 13-18 minutes
-    # and duplicated the Gradle + Rust trees that `android-check` already keeps
-    # warm. Tags, a weekly smoke build and explicit dispatch cover it.
-    tags:
-      - 'v*-tauri'
+  # Tag releases have exactly one entry point: release-tauri.yml. Keeping a
+  # second tag trigger here would compile/sign all four ABIs twice.
+  workflow_call:
+    inputs:
+      abis:
+        type: string
+        default: aarch64
+      fast_profile:
+        type: boolean
+        default: false
+      signed_debug:
+        type: boolean
+        default: false
   schedule:
     # Monday 05:23 UTC: weekly APK smoke build (debug-grade, not published).
     - cron: '23 5 * * 1'
@@ -76,7 +83,7 @@ jobs:
           ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
           ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
           ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
-          INPUT_SIGNED_DEBUG: ${{ github.event.inputs.signed_debug }}
+          INPUT_SIGNED_DEBUG: ${{ inputs.signed_debug }}
         run: |
           set -euo pipefail
           is_tag=false
@@ -129,8 +136,8 @@ jobs:
         id: abis
         shell: bash
         env:
-          INPUT_ABIS: ${{ github.event.inputs.abis }}
-          INPUT_FAST_PROFILE: ${{ github.event.inputs.fast_profile }}
+          INPUT_ABIS: ${{ inputs.abis }}
+          INPUT_FAST_PROFILE: ${{ inputs.fast_profile }}
         run: |
           set -euo pipefail
           if [ "${{ steps.mode.outputs.is_tag_release }}" = "true" ]; then
@@ -425,6 +432,9 @@ jobs:
   publish-android-release:
     timeout-minutes: 30
     name: Publish Android release assets
+    concurrency:
+      group: openless-release-assets-${{ github.ref_name }}
+      cancel-in-progress: false
     if: needs.plan.outputs.is_tag_release == 'true'
     needs: [plan, build-android-apk]
     permissions:
@@ -512,19 +522,6 @@ jobs:
             "$out_dir/OpenLess_${version}_x86.apk" \
             "$out_dir/OpenLess_${version}_x86_64.apk"
 
-      - name: Stage direct download aliases
-        if: needs.plan.outputs.is_tag_release == 'true'
-        working-directory: openless-all/app
-        env:
-          OPENLESS_DOWNLOAD_SOURCE_DIR: ${{ steps.stage.outputs.out_dir }}
-          OPENLESS_DOWNLOAD_OUTPUT_DIR: ${{ steps.stage.outputs.out_dir }}
-        run: |
-          set -euo pipefail
-          for arch in aarch64 armv7 i686 x86_64; do
-            OPENLESS_DOWNLOAD_TARGET=android OPENLESS_DOWNLOAD_ARCH="$arch" \
-              node scripts/stage-release-download-aliases.mjs
-          done
-
       - name: Write Android updater manifests
         working-directory: openless-all/app
         env:
@@ -550,17 +547,29 @@ jobs:
           path: |
             ${{ steps.stage.outputs.out_dir }}/latest-android-*.json
 
-      - name: Append release files (signatures + aliases)
+      - name: Consolidate release signatures
+        timeout-minutes: 5
+        working-directory: openless-all/app
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node scripts/merge-release-signatures.mjs "${{ steps.stage.outputs.out_dir }}" "$GITHUB_REF_NAME" "$GITHUB_REPOSITORY"
+
+      - name: Append release files (originals + signature index)
         id: release_assets
         shell: bash
         run: |
           set -euo pipefail
-          out_dir="${{ steps.stage.outputs.out_dir }}"
           {
             echo "${{ steps.stage.outputs.release_files }}"
-            for f in "$out_dir"/*.apk.sig "$out_dir"/OpenLess_android_*.apk; do
-              [ -e "$f" ] && echo "$f"
-            done
+            index="${{ steps.stage.outputs.out_dir }}/updater-signatures.json"
+            if [ -f "$index" ]; then
+              echo "$index"
+            else
+              # Targeted repairs of historical drafts keep their original format.
+              while IFS= read -r f; do
+                if [ -n "$f" ] && [ -f "$f.sig" ]; then echo "$f.sig"; fi
+              done <<< "${{ steps.stage.outputs.release_files }}"
+            fi
           } > "$RUNNER_TEMP/android-release-files.txt"
           echo "files<<EOF" >> "$GITHUB_OUTPUT"
           cat "$RUNNER_TEMP/android-release-files.txt" >> "$GITHUB_OUTPUT"

.github/workflows/cache-maintenance.yml

@@ -7,7 +7,8 @@ name: Cache maintenance
 # never be restored again: pull requests that are already closed or merged.
 #
 # It runs daily, when a pull request closes, and on demand. It retains the
-# newest branch generations and never prunes tag scopes.
+# newest branch generations first, then evicts least-recently-used branch caches
+# if the baseline alone exceeds budget. Tag and open PR scopes stay protected.
 on:
   schedule:
     # Daily cleanup prevents superseded build generations evicting baseline caches.
@@ -20,6 +21,7 @@ on:
 permissions:
   actions: write # required to delete caches
   contents: read
+  pull-requests: read # distinguish closed PR scopes from open/unreadable ones
 
 concurrency:
   group: cache-maintenance
@@ -34,8 +36,11 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: false
+          # A closed PR must not supply scripts executed with actions: write.
+          ref: ${{ github.event_name == 'pull_request' && github.event.repository.default_branch || github.sha }}
+          persist-credentials: false
 
-      - name: Report cache usage and prune dead pull request scopes
+      - name: Report cache usage and enforce the cache budget
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
@@ -46,4 +51,4 @@ jobs:
         # because `restore-keys` never needs more than the previous generation.
         run: >-
           bash scripts/ci-cache-usage.sh
-          --prune --keep-family 2 --repo "$REPO" --limit-gb "$LIMIT_GB"
+          --prune --keep-family 2 --prune-budget --repo "$REPO" --limit-gb "$LIMIT_GB"