Skip to content

每次应用发版自动重建 WCDB 并刷新 45 天有效期 #158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
2977094657 merged 2 commits into from
Sep 25, 2026
Merged

每次应用发版自动重建 WCDB 并刷新 45 天有效期 #158

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
57ba773
ci: rebuild WCDB for every application release
2977094657 Sep 25, 2026
79b2300
ci: wait for producer through the Actions API
2977094657 Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
184 changes: 24 additions & 160 deletions .github/workflows/macos-private-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,24 +37,10 @@ jobs:
env:
UV_MANAGED_PYTHON: "true"
WCE_MACOS_SIGNING_MODE: self-signed
# The artifact repository identifies the producer; the download repository
# identifies where the immutable asset is currently hosted.
WCE_MACOS_XKEY_ARTIFACT_REPOSITORY: ${{ vars.WCE_MACOS_XKEY_ARTIFACT_REPOSITORY }}
WCE_MACOS_XKEY_ARTIFACT_DOWNLOAD_REPOSITORY: ${{ vars.WCE_MACOS_XKEY_ARTIFACT_DOWNLOAD_REPOSITORY }}
WCE_MACOS_XKEY_ARTIFACT_SHA256: ${{ vars.WCE_MACOS_XKEY_ARTIFACT_SHA256 }}
WCE_MACOS_XKEY_ARTIFACT_RUN_ID: ${{ vars.WCE_MACOS_XKEY_ARTIFACT_RUN_ID }}
WCE_MACOS_XKEY_SOURCE_REVISION: ${{ vars.WCE_MACOS_XKEY_SOURCE_REVISION }}
WCE_MACOS_XKEY_BUILD_ID: ${{ vars.WCE_MACOS_XKEY_BUILD_ID }}
WCE_MACOS_KEY_HELPER_SIGNER_SHA256: ${{ vars.WCE_MACOS_KEY_HELPER_SIGNER_SHA256 }}
WCE_MACOS_WCDA_HOST_SIGNER_SHA256: ${{ vars.WCE_MACOS_WCDA_HOST_SIGNER_SHA256 }}
WCE_MACOS_WCDA_HOST_SIGNING_IDENTITY: ${{ vars.WCE_MACOS_WCDA_HOST_SIGNING_IDENTITY }}
WCE_MACOS_XKEY_ALLOW_DEVELOPMENT_ARTIFACTS: "0"
WCE_NATIVE_CORE_ARTIFACT_REPOSITORY: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_REPOSITORY }}
WCE_NATIVE_CORE_ARTIFACT_DOWNLOAD_REPOSITORY: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_DOWNLOAD_REPOSITORY }}
WCE_NATIVE_CORE_ARTIFACT_SHA256: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_SHA256 }}
WCE_NATIVE_CORE_ARTIFACT_RUN_ID: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_RUN_ID }}
WCE_NATIVE_CORE_SOURCE_REVISION: ${{ vars.WCE_NATIVE_CORE_SOURCE_REVISION }}
WCE_NATIVE_CORE_BUILD_ID: ${{ vars.WCE_NATIVE_CORE_BUILD_ID }}
WCE_NATIVE_CORE_CLIENT_SIGNER_SHA256: ${{ vars.WCE_NATIVE_CORE_CLIENT_SIGNER_SHA256 }}
WCE_NATIVE_CORE_BROKER_SIGNER_SHA256: ${{ vars.WCE_NATIVE_CORE_BROKER_SIGNER_SHA256 }}
WCE_NATIVE_CORE_HOST_SIGNER_SHA256: ${{ vars.WCE_NATIVE_CORE_HOST_SIGNER_SHA256 }}
Expand All @@ -64,13 +50,6 @@ jobs:
WCE_NATIVE_CORE_HOST_SIGNING_IDENTIFIER: ${{ vars.WCE_NATIVE_CORE_HOST_SIGNING_IDENTIFIER }}
WCE_NATIVE_CORE_REQUIRED: "1"
WCE_NATIVE_CORE_ALLOW_DEVELOPMENT_ARTIFACTS: "0"
WCE_INTEGRITY_ARTIFACT_REPOSITORY: ${{ vars.WCE_INTEGRITY_ARTIFACT_REPOSITORY }}
WCE_INTEGRITY_ARTIFACT_DOWNLOAD_REPOSITORY: ${{ vars.WCE_INTEGRITY_ARTIFACT_DOWNLOAD_REPOSITORY }}
WCE_INTEGRITY_ARTIFACT_RUN_ID: ${{ vars.WCE_INTEGRITY_ARTIFACT_RUN_ID }}
WCE_INTEGRITY_ARTIFACT_SHA256: ${{ vars.WCE_INTEGRITY_ARTIFACT_SHA256 }}
WCE_INTEGRITY_SOURCE_REVISION: ${{ vars.WCE_INTEGRITY_SOURCE_REVISION }}
WCE_INTEGRITY_BUILD_ID: ${{ vars.WCE_INTEGRITY_BUILD_ID }}
WCE_INTEGRITY_BINARY_SHA256: ${{ vars.WCE_INTEGRITY_BINARY_SHA256 }}
WCE_INTEGRITY_UI_SOURCE_REPOSITORY: ${{ github.repository }}
WCE_INTEGRITY_UI_SOURCE_REVISION: ${{ github.sha }}
WCE_INTEGRITY_REQUIRED: "1"
Expand All @@ -87,7 +66,12 @@ jobs:
fetch-depth: 0
persist-credentials: false

- name: Verify immutable source and protected pins
- name: Setup Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version-file: .python-version

- name: Verify immutable source and package version
shell: bash
env:
WORKFLOW_REF: ${{ github.ref }}
Expand Down Expand Up @@ -124,6 +108,24 @@ jobs:
[[ "$package_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9.-]+)?$ ]]
printf 'PACKAGE_VERSION=%s\n' "$package_version" >> "$GITHUB_ENV"

- name: Rebuild macOS native components for this release
shell: bash
env:
GH_TOKEN: ${{ secrets.WCE_NATIVE_CORE_PRODUCER_TOKEN }}
run: |
set -euo pipefail
python3 tools/rebuild_wcdb_release.py \
--component macos-native \
--component macos-xkey \
--component macos-integrity \
--output-root "$RUNNER_TEMP"

- name: Verify protected pins
shell: bash
env:
WORKFLOW_REVISION: ${{ github.sha }}
run: |
set -euo pipefail
[[ "$WCE_MACOS_XKEY_ARTIFACT_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
if [[ -n "${WCE_MACOS_XKEY_ARTIFACT_DOWNLOAD_REPOSITORY:-}" ]]; then
[[ "$WCE_MACOS_XKEY_ARTIFACT_DOWNLOAD_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
Expand Down Expand Up @@ -174,139 +176,6 @@ jobs:
test "$WCE_INTEGRITY_UI_SOURCE_REPOSITORY" = "$GITHUB_REPOSITORY"
test "$WCE_INTEGRITY_UI_SOURCE_REVISION" = "$WORKFLOW_REVISION"

- name: Download exact Producer helper artifact
timeout-minutes: 15
shell: bash
env:
GH_TOKEN: ${{ secrets.WCE_MACOS_PRODUCER_READ_TOKEN }}
run: |
set -euo pipefail
test -n "$GH_TOKEN"
artifact_dir="$RUNNER_TEMP/wda-xkey"
release_repository="${WCE_MACOS_XKEY_ARTIFACT_DOWNLOAD_REPOSITORY:-}"
release_tag="macos-xkey-$WCE_MACOS_XKEY_BUILD_ID"
release_asset="wda-xkey-macos-universal-production-$WCE_MACOS_XKEY_BUILD_ID.zip"
release_archive="$RUNNER_TEMP/$release_asset"
downloaded=0
for attempt in 1 2 3; do
rm -rf "$artifact_dir"
mkdir -p "$artifact_dir"
rm -f "$release_archive"
if [[ -n "$release_repository" ]] && \
gh release download "$release_tag" \
--repo "$release_repository" \
--pattern "$release_asset" \
--dir "$RUNNER_TEMP"
then
actual_sha256="$(shasum -a 256 "$release_archive" | awk '{print $1}')"
test "$actual_sha256" = "$WCE_MACOS_XKEY_ARTIFACT_SHA256"
/usr/bin/unzip -q "$release_archive" -d "$artifact_dir"
downloaded=1
break
elif gh run download "$WCE_MACOS_XKEY_ARTIFACT_RUN_ID" \
--repo "$WCE_MACOS_XKEY_ARTIFACT_REPOSITORY" \
--name wda-xkey-macos-universal-production \
--dir "$artifact_dir"
then
downloaded=1
break
fi
if [ "$attempt" -lt 3 ]; then
sleep "$((attempt * 15))"
fi
done
test "$downloaded" = 1
test -f "$artifact_dir/wda_xkey_helper"
echo "WCE_MACOS_XKEY_ARTIFACT_DIR=$artifact_dir" >> "$GITHUB_ENV"

- name: Download exact Producer native-core artifact
timeout-minutes: 15
shell: bash
env:
GH_TOKEN: ${{ secrets.WCE_MACOS_PRODUCER_READ_TOKEN }}
run: |
set -euo pipefail
test -n "$GH_TOKEN"
artifact_dir="$RUNNER_TEMP/wechatdb-native-macos-arm64-production"
release_repository="${WCE_NATIVE_CORE_ARTIFACT_DOWNLOAD_REPOSITORY:-}"
release_tag="macos-native-$WCE_NATIVE_CORE_BUILD_ID"
release_asset="wechatdb-native-macos-arm64-production-$WCE_NATIVE_CORE_BUILD_ID.zip"
release_archive="$RUNNER_TEMP/$release_asset"
downloaded=0
for attempt in 1 2 3; do
rm -rf "$artifact_dir"
mkdir -p "$artifact_dir"
rm -f "$release_archive"
if [[ -n "$release_repository" ]] && \
gh release download "$release_tag" \
--repo "$release_repository" \
--pattern "$release_asset" \
--dir "$RUNNER_TEMP"
then
actual_sha256="$(shasum -a 256 "$release_archive" | awk '{print $1}')"
test "$actual_sha256" = "$WCE_NATIVE_CORE_ARTIFACT_SHA256"
/usr/bin/unzip -q "$release_archive" -d "$artifact_dir"
downloaded=1
break
elif gh run download "$WCE_NATIVE_CORE_ARTIFACT_RUN_ID" \
--repo "$WCE_NATIVE_CORE_ARTIFACT_REPOSITORY" \
--name wechatdb-native-macos-arm64-production \
--dir "$artifact_dir"
then
downloaded=1
break
fi
if [ "$attempt" -lt 3 ]; then
sleep "$((attempt * 15))"
fi
done
test "$downloaded" = 1
test -f "$artifact_dir/libwechatdb_client.dylib"
test -f "$artifact_dir/wechatdb_broker"
test -f "$artifact_dir/wechatdb_native_build.json"
echo "WCE_NATIVE_CORE_ARTIFACT_DIR=$artifact_dir" >> "$GITHUB_ENV"

- name: Download exact private export-integrity artifact
timeout-minutes: 15
shell: bash
env:
GH_TOKEN: ${{ secrets.WCE_MACOS_PRODUCER_READ_TOKEN }}
run: |
set -euo pipefail
test -n "$GH_TOKEN"
release_tag="macos-integrity-$WCE_INTEGRITY_BUILD_ID"
asset_name="wce-integrity-macos-arm64-production-$WCE_INTEGRITY_BUILD_ID.zip"
download_repository="${WCE_INTEGRITY_ARTIFACT_DOWNLOAD_REPOSITORY:-$WCE_INTEGRITY_ARTIFACT_REPOSITORY}"
archive="$RUNNER_TEMP/$asset_name"
artifact_dir="$RUNNER_TEMP/wce-integrity-macos-arm64-production"
downloaded=0
test ! -e "$artifact_dir"
for attempt in 1 2 3; do
rm -f "$archive"
if gh release download "$release_tag" \
--repo "$download_repository" \
--pattern "$asset_name" \
--dir "$RUNNER_TEMP"
then
downloaded=1
break
fi
if [ "$attempt" -lt 3 ]; then
sleep "$((attempt * 15))"
fi
done
test "$downloaded" = 1
test -s "$archive"
actual_sha256="$(shasum -a 256 "$archive" | awk '{print $1}')"
test "$actual_sha256" = "$WCE_INTEGRITY_ARTIFACT_SHA256"
mkdir -p "$artifact_dir"
/usr/bin/unzip -q "$archive" -d "$artifact_dir"
test -f "$artifact_dir/libwce_integrity.dylib"
test -f "$artifact_dir/wce_integrity_build.json"
test -f "$artifact_dir/provenance.json"
test -f "$artifact_dir/SHA256SUMS.txt"
echo "WCE_INTEGRITY_ARTIFACT_DIR=$artifact_dir" >> "$GITHUB_ENV"

- name: Import persistent self-signed host identity
timeout-minutes: 5
shell: bash
Expand Down Expand Up @@ -412,11 +281,6 @@ jobs:
frontend/package-lock.json
desktop/package-lock.json

- name: Setup Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version-file: .python-version

- name: Install build dependencies
shell: bash
run: |
Expand Down
75 changes: 20 additions & 55 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,52 +52,58 @@ jobs:
"TAG_NAME=$tag" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
"VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

- name: Setup Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version-file: .python-version

- name: Rebuild Windows native core for this release
shell: pwsh
env:
GH_TOKEN: ${{ secrets.WCE_NATIVE_CORE_PRODUCER_TOKEN }}
run: |
python tools/rebuild_wcdb_release.py `
--component windows-native `
--output-root $env:RUNNER_TEMP

- name: Require pinned native artifact source
id: native-artifact-source
shell: pwsh
env:
# The artifact repository identifies the producer; the download
# repository identifies where the immutable asset is hosted.
NATIVE_ARTIFACT_REPOSITORY: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_REPOSITORY }}
NATIVE_ARTIFACT_DOWNLOAD_REPOSITORY: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_DOWNLOAD_REPOSITORY }}
NATIVE_ARTIFACT_RUN_ID: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_RUN_ID }}
NATIVE_ARTIFACT_SHA256: ${{ vars.WCE_NATIVE_CORE_ARTIFACT_SHA256 }}
NATIVE_SOURCE_REVISION: ${{ vars.WCE_NATIVE_CORE_SOURCE_REVISION }}
NATIVE_BUILD_ID: ${{ vars.WCE_NATIVE_CORE_BUILD_ID }}
NATIVE_CLIENT_SIGNER_SHA256: ${{ vars.WCE_NATIVE_CORE_CLIENT_SIGNER_SHA256 }}
NATIVE_BROKER_SIGNER_SHA256: ${{ vars.WCE_NATIVE_CORE_BROKER_SIGNER_SHA256 }}
PRIVATE_ROOT_SHA256: ${{ vars.WCE_WINDOWS_PRIVATE_ROOT_SHA256 }}
run: |
$repository = [string]$env:NATIVE_ARTIFACT_REPOSITORY
$repository = [string]$env:WCE_NATIVE_CORE_ARTIFACT_REPOSITORY
$repository = $repository.Trim()
if ($repository -notmatch '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$') {
throw "WCE_NATIVE_CORE_ARTIFACT_REPOSITORY must be an explicit owner/repository value."
}
$downloadRepository = [string]$env:NATIVE_ARTIFACT_DOWNLOAD_REPOSITORY
$downloadRepository = [string]$env:WCE_NATIVE_CORE_ARTIFACT_DOWNLOAD_REPOSITORY
$downloadRepository = $downloadRepository.Trim()
if ([string]::IsNullOrWhiteSpace($downloadRepository)) {
$downloadRepository = $repository
} elseif ($downloadRepository -notmatch '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$') {
throw "WCE_NATIVE_CORE_ARTIFACT_DOWNLOAD_REPOSITORY must be an explicit owner/repository value."
}

$rawRunId = ([string]$env:NATIVE_ARTIFACT_RUN_ID).Trim()
$rawRunId = ([string]$env:WCE_NATIVE_CORE_ARTIFACT_RUN_ID).Trim()
[long]$runId = 0
if (-not [long]::TryParse($rawRunId, [ref]$runId) -or $runId -le 0) {
throw "WCE_NATIVE_CORE_ARTIFACT_RUN_ID must be an explicit positive workflow run ID."
}

$artifactSha256 = ([string]$env:NATIVE_ARTIFACT_SHA256).Trim().ToLowerInvariant()
$artifactSha256 = ([string]$env:WCE_NATIVE_CORE_ARTIFACT_SHA256).Trim().ToLowerInvariant()
if ($artifactSha256 -cnotmatch '^[0-9a-f]{64}$' -or
$artifactSha256 -match '^0{64}$') {
throw "WCE_NATIVE_CORE_ARTIFACT_SHA256 must be a non-zero lowercase SHA-256 digest."
}

$sourceRevision = ([string]$env:NATIVE_SOURCE_REVISION).Trim()
$sourceRevision = ([string]$env:WCE_NATIVE_CORE_SOURCE_REVISION).Trim()
if ($sourceRevision -cnotmatch '^[0-9a-f]{40}$') {
throw "WCE_NATIVE_CORE_SOURCE_REVISION must be an exact lowercase 40-character Git revision."
}
$buildId = ([string]$env:NATIVE_BUILD_ID).Trim()
$buildId = ([string]$env:WCE_NATIVE_CORE_BUILD_ID).Trim()
if ($buildId -notmatch '^[A-Za-z0-9._-]{8,128}$' -or
$buildId -match '(^|[._-])(dev|debug|test|local|snapshot|staging)([._-]|$)') {
throw "WCE_NATIVE_CORE_BUILD_ID must be an immutable production build ID."
Expand Down Expand Up @@ -199,42 +205,6 @@ jobs:
frontend/package-lock.json
desktop/package-lock.json

- name: Download pinned native source-public release asset
shell: pwsh
env:
GH_TOKEN: ${{ secrets.WCE_NATIVE_CORE_ARTIFACT_READ_TOKEN }}
NATIVE_REPOSITORY: ${{ steps.native-artifact-source.outputs.download-repository }}
NATIVE_BUILD_ID: ${{ steps.native-artifact-source.outputs.build-id }}
NATIVE_ARTIFACT_SHA256: ${{ steps.native-artifact-source.outputs.artifact-sha256 }}
run: |
if ([string]::IsNullOrWhiteSpace($env:GH_TOKEN)) {
throw "WCE_NATIVE_CORE_ARTIFACT_READ_TOKEN is required to download the private native Release."
}
$releaseTag = "windows-native-$env:NATIVE_BUILD_ID"
$assetName = "wechatdb-native-windows-x64-source-public-$env:NATIVE_BUILD_ID.zip"
$archivePath = Join-Path $env:RUNNER_TEMP $assetName
$artifactPath = Join-Path $env:RUNNER_TEMP 'wechatdb-native-windows-x64-source-public'
if ((Test-Path -LiteralPath $archivePath) -or
(Test-Path -LiteralPath $artifactPath)) {
throw "Native Release destination already exists on the clean runner."
}

gh release download $releaseTag `
--repo $env:NATIVE_REPOSITORY `
--pattern $assetName `
--dir $env:RUNNER_TEMP
if ($LASTEXITCODE -ne 0 -or
-not (Test-Path -LiteralPath $archivePath -PathType Leaf)) {
throw "Failed to download the exact native source-public Release asset."
}

$actualSha256 = (Get-FileHash -LiteralPath $archivePath -Algorithm SHA256).Hash.ToLowerInvariant()
if ($actualSha256 -cne $env:NATIVE_ARTIFACT_SHA256) {
throw "Native source-public Release asset SHA-256 does not match the pinned digest."
}
New-Item -ItemType Directory -Path $artifactPath | Out-Null
Expand-Archive -LiteralPath $archivePath -DestinationPath $artifactPath

- name: Import protected cloud signing identity
id: cloud-signing
shell: powershell
Expand Down Expand Up @@ -418,11 +388,6 @@ jobs:
"WCE_NATIVE_CORE_SECURITY_CHECKPOINT_SET_SHA256=$($manifest.securityCheckpointSetSha256)" |
Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

- name: Setup Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version-file: .python-version

- name: Install uv
shell: pwsh
run: python -m pip install uv
Expand Down
Loading
Loading