fix(cdn): rely on purge finished status

Author: Aethersailor

.github/jsdelivr-publish.json

@@ -5,9 +5,6 @@
     "main",
     "refs/heads/main"
   ],
-  "verify_hosts": [
-    "cdn.jsdelivr.net"
-  ],
   "public_roots": [
     "cfg",
     "game_rule",

.github/scripts/jsdelivr_purge.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Purge and verify mutable jsDelivr aliases for changed public files."""
+"""Purge mutable jsDelivr aliases for changed public files."""
 
 from __future__ import annotations
 
@@ -23,8 +23,6 @@
 PURGE_HOST = "purge.jsdelivr.net"
 DEFAULT_PURGE_ATTEMPTS = 5
 DEFAULT_PURGE_WORKERS = 2
-DEFAULT_VERIFY_ATTEMPTS = 8
-DEFAULT_VERIFY_WORKERS = 4
 RETRY_DELAYS = (2, 5, 10, 20, 30, 45, 60)
 USER_AGENT = "Custom_OpenClash_Rules-jsDelivr-publisher/1.0"
 
@@ -38,7 +36,6 @@ class PublishContract:
     repository: str
     branch: str
     ref_aliases: tuple[str, ...]
-    verify_hosts: tuple[str, ...]
     public_roots: frozenset[str]
     deferred_sources: frozenset[str]
     generated_suffixes: tuple[str, ...]
@@ -66,12 +63,6 @@ class HttpResult:
     body: bytes
 
 
-@dataclasses.dataclass(frozen=True)
-class VerificationTarget:
-    url: str
-    expectation: AssetExpectation
-
-
 def _require_string_list(data: Mapping[str, object], key: str) -> tuple[str, ...]:
     value = data.get(key)
     if not isinstance(value, list) or not value or not all(
@@ -124,7 +115,6 @@ def load_contract(path: Path) -> PublishContract:
         repository=repository,
         branch=branch,
         ref_aliases=aliases,
-        verify_hosts=_require_string_list(data, "verify_hosts"),
         public_roots=frozenset(roots),
         deferred_sources=frozenset(deferred),
         generated_suffixes=generated_suffixes,
@@ -339,27 +329,6 @@ def validate_purge_response(result: HttpResult, expected_path: str) -> None:
         raise PublishError(f"Purge returned invalid JSON for {expected_path}: {exc}") from exc
     if not isinstance(payload, dict) or payload.get("status") != "finished":
         raise PublishError(f"Purge did not finish for {expected_path}: {payload!r}")
-    paths = payload.get("paths")
-    if not isinstance(paths, dict):
-        raise PublishError(f"Purge response has no paths map for {expected_path}")
-
-    normalized_expected = urllib.parse.unquote(expected_path)
-    matching_entries = [
-        value
-        for key, value in paths.items()
-        if isinstance(key, str) and urllib.parse.unquote(key) == normalized_expected
-    ]
-    if len(matching_entries) != 1 or not isinstance(matching_entries[0], dict):
-        raise PublishError(f"Purge response omitted exact path {expected_path}: {paths!r}")
-    entry = matching_entries[0]
-    if entry.get("throttled") is not False:
-        raise PublishError(f"Purge was throttled or ambiguous for {expected_path}: {entry!r}")
-    providers = entry.get("providers")
-    if not isinstance(providers, dict) or not providers:
-        raise PublishError(f"Purge response has no provider results for {expected_path}")
-    failed = sorted(name for name, succeeded in providers.items() if succeeded is not True)
-    if failed:
-        raise PublishError(f"Purge providers failed for {expected_path}: {', '.join(failed)}")
 
 
 def purge_target(
@@ -413,77 +382,6 @@ def purge_all(
         raise PublishError("One or more purge requests failed:\n" + "\n".join(errors))
 
 
-def verification_targets(
-    expectations: Sequence[AssetExpectation], contract: PublishContract
-) -> list[VerificationTarget]:
-    # A successful purge response confirms that jsDelivr accepted the cache
-    # invalidation for deleted assets. Their eventual HTTP 404 propagation is
-    # outside this repository's control, so only published files are subject
-    # to byte-for-byte CDN verification.
-    return [
-        VerificationTarget(
-            url=f"https://{host}{alias_path(contract.repository, alias, expectation.path)}",
-            expectation=expectation,
-        )
-        for expectation in expectations
-        if expectation.content is not None
-        for alias in contract.ref_aliases
-        for host in contract.verify_hosts
-    ]
-
-
-def result_matches(result: HttpResult, expectation: AssetExpectation) -> tuple[bool, str]:
-    if expectation.content is None:
-        return result.status == 404, f"HTTP {result.status}"
-    if result.status != 200:
-        return False, f"HTTP {result.status}"
-    actual_digest = hashlib.sha256(result.body).hexdigest()
-    expected_digest = hashlib.sha256(expectation.content).hexdigest()
-    return (
-        result.body == expectation.content,
-        f"sha256={actual_digest}, bytes={len(result.body)}; expected sha256={expected_digest}, bytes={len(expectation.content)}",
-    )
-
-
-def verify_all(
-    targets: Sequence[VerificationTarget],
-    *,
-    requester: Callable[[str], HttpResult] = request_url,
-    attempts: int = DEFAULT_VERIFY_ATTEMPTS,
-    workers: int = DEFAULT_VERIFY_WORKERS,
-    sleeper: Callable[[float], None] = time.sleep,
-) -> None:
-    pending = {target.url: target for target in targets}
-    last_observed: dict[str, str] = {}
-    for attempt in range(attempts):
-        if not pending:
-            return
-        with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as executor:
-            futures = {executor.submit(requester, url): url for url in pending}
-            for future in concurrent.futures.as_completed(futures):
-                url = futures[future]
-                target = pending[url]
-                try:
-                    matched, observed = result_matches(future.result(), target.expectation)
-                except OSError as exc:
-                    matched, observed = False, str(exc)
-                last_observed[url] = observed
-                if matched:
-                    print(f"Verified {url}: {target.expectation.description}", flush=True)
-                    del pending[url]
-        if pending and attempt + 1 < attempts:
-            delay = RETRY_DELAYS[min(attempt, len(RETRY_DELAYS) - 1)]
-            print(f"Waiting {delay}s for {len(pending)} CDN cache keys", flush=True)
-            sleeper(delay)
-
-    if not pending:
-        return
-    details = "\n".join(
-        f"{url}: {last_observed.get(url, 'no response')}" for url in sorted(pending)
-    )
-    raise PublishError(f"CDN verification failed for {len(pending)} cache keys:\n{details}")
-
-
 def _own_jsdelivr_urls(repository: str, revision: str) -> Iterable[str]:
     pattern = rf"https://(cdn|testingcf)\.jsdelivr\.net/gh/{re.escape(repository)}@"
     completed = subprocess.run(
@@ -576,7 +474,6 @@ def command_run(args: argparse.Namespace) -> None:
     if not expectations:
         return
     purge_all(expectations, contract)
-    verify_all(verification_targets(expectations, contract))
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -592,14 +489,14 @@ def build_parser() -> argparse.ArgumentParser:
     check = subparsers.add_parser("check-contract", help="Validate owned jsDelivr URLs")
     check.add_argument("--revision", default="HEAD")
 
-    run = subparsers.add_parser("run", help="Purge and verify changed public files")
+    run = subparsers.add_parser("run", help="Purge changed public files")
     run.add_argument("--repository", required=True)
     run.add_argument("--before", required=True)
     run.add_argument("--after", required=True)
     run.add_argument(
         "--published",
         required=True,
-        help="Latest main snapshot whose bytes mutable aliases must serve",
+        help="Latest main snapshot used to resolve current asset state",
     )
     run.add_argument("--mode", choices=("direct", "complete"), required=True)
     return parser

.github/scripts/test_jsdelivr_purge.py

@@ -8,6 +8,7 @@
 import sys
 import tempfile
 import unittest
+import unittest.mock
 from pathlib import Path
 
 import jsdelivr_purge as purge
@@ -21,7 +22,6 @@ def contract() -> purge.PublishContract:
         repository=REPOSITORY,
         branch="main",
         ref_aliases=("main", "refs/heads/main"),
-        verify_hosts=("cdn.jsdelivr.net", "testingcf.jsdelivr.net"),
         public_roots=frozenset(
             {"cfg", "game_rule", "icon", "overwrite", "rule", "script", "shell"}
         ),
@@ -252,17 +252,18 @@ def response(self, path: str, *, throttled=False, providers=None):
         }
         return purge.HttpResult(200, json.dumps(body).encode())
 
-    def test_requires_exact_path_and_all_providers(self):
+    def test_finished_status_is_sufficient(self):
         path = "/gh/Aethersailor/Custom_OpenClash_Rules@main/cfg/a.ini"
         purge.validate_purge_response(self.response(path), path)
-        with self.assertRaisesRegex(purge.PublishError, "omitted exact path"):
-            purge.validate_purge_response(self.response(path + ".other"), path)
-        with self.assertRaisesRegex(purge.PublishError, "providers failed"):
-            purge.validate_purge_response(
-                self.response(path, providers={"CF": True, "FY": False}), path
-            )
-        with self.assertRaisesRegex(purge.PublishError, "throttled"):
-            purge.validate_purge_response(self.response(path, throttled=True), path)
+        purge.validate_purge_response(self.response(path + ".other"), path)
+        purge.validate_purge_response(
+            self.response(path, providers={"CF": True, "FY": False}), path
+        )
+        purge.validate_purge_response(self.response(path, throttled=True), path)
+
+        unfinished = purge.HttpResult(200, json.dumps({"status": "processing"}).encode())
+        with self.assertRaisesRegex(purge.PublishError, "did not finish"):
+            purge.validate_purge_response(unfinished, path)
 
     def test_retry_then_success(self):
         calls: list[str] = []
@@ -287,44 +288,29 @@ def requester(url: str) -> purge.HttpResult:
         self.assertEqual(len(calls), 2)
         self.assertEqual(sleeps, [2])
 
-
-class VerificationTests(unittest.TestCase):
-    def test_content_and_deletion_expectations(self):
-        content = purge.AssetExpectation("cfg/a.ini", b"expected")
-        deleted = purge.AssetExpectation("cfg/deleted.ini", None)
-        self.assertTrue(purge.result_matches(purge.HttpResult(200, b"expected"), content)[0])
-        self.assertFalse(purge.result_matches(purge.HttpResult(200, b"stale"), content)[0])
-        self.assertTrue(purge.result_matches(purge.HttpResult(404, b""), deleted)[0])
-        self.assertFalse(purge.result_matches(purge.HttpResult(200, b"old"), deleted)[0])
-
-    def test_verification_targets_skip_deleted_assets(self):
+    def test_purge_all_requests_every_alias_and_path(self):
         value = contract()
-        content = purge.AssetExpectation("cfg/a.ini", b"expected")
-        deleted = purge.AssetExpectation("cfg/deleted.ini", None)
+        expectations = [
+            purge.AssetExpectation("cfg/a.ini", b"one"),
+            purge.AssetExpectation("rule/b.yaml", b"two"),
+        ]
+        calls: list[tuple[str, str, str]] = []
 
-        targets = purge.verification_targets([content, deleted], value)
+        def record(repository: str, alias: str, path: str) -> str:
+            calls.append((repository, alias, path))
+            return f"https://purge.jsdelivr.net/{alias}/{path}"
 
-        self.assertEqual(len(targets), len(value.ref_aliases) * len(value.verify_hosts))
-        self.assertTrue(all(target.expectation == content for target in targets))
-        self.assertFalse(any("deleted.ini" in target.url for target in targets))
+        with unittest.mock.patch.object(purge, "purge_target", side_effect=record):
+            purge.purge_all(expectations, value, workers=1)
 
-    def test_verification_retries_only_stale_targets(self):
-        target = purge.VerificationTarget(
-            "https://cdn.jsdelivr.net/example", purge.AssetExpectation("cfg/a", b"new")
-        )
-        calls = 0
-        sleeps: list[float] = []
-
-        def requester(_url: str) -> purge.HttpResult:
-            nonlocal calls
-            calls += 1
-            return purge.HttpResult(200, b"old" if calls == 1 else b"new")
-
-        purge.verify_all(
-            [target], requester=requester, attempts=2, workers=1, sleeper=sleeps.append
+        self.assertEqual(
+            set(calls),
+            {
+                (REPOSITORY, alias, expectation.path)
+                for alias in value.ref_aliases
+                for expectation in expectations
+            },
         )
-        self.assertEqual(calls, 2)
-        self.assertEqual(sleeps, [2])
 
 
 class UrlContractTests(unittest.TestCase):

.github/workflows/README.md

@@ -17,6 +17,6 @@
 | [`dependabot-auto-merge.yml`](dependabot-auto-merge.yml) | 等待 Validate、Dependency Review 和 CodeQL 全部成功后，自动压缩合并（squash merge）带有 `automerge` 标签的 Dependabot PR | 上述检查完成 |
 | [`dependency-review.yml`](dependency-review.yml) | 阻止 PR 引入任何已知等级的漏洞依赖，并展示 OpenSSF Scorecard 信息 | Pull Request |
 | [`pages.yml`](pages.yml) | 构建并部署 MkDocs 文档站点到 GitHub Pages | `wiki/**`、`mkdocs.yml` 变更或手动触发 |
-| [`purge-jsdelivr.yml`](purge-jsdelivr.yml) | 按 [CDN 发布契约](../jsdelivr-publish.json) 精确刷新 `@main` 与 `@refs/heads/main` 缓存键；删除资源以 jsDelivr 接受刷新为完成，仍存在的资源继续逐字节验证；无公开文件变化时自动跳过刷新 | `main` 分支推送、规则生成且校验成功，或手动修复范围 |
+| [`purge-jsdelivr.yml`](purge-jsdelivr.yml) | 按 [CDN 发布契约](../jsdelivr-publish.json) 精确刷新 `@main` 与 `@refs/heads/main` 缓存键；每个请求以 jsDelivr 返回 `finished` 为成功，不等待 CDN 节点传播；无公开文件变化时自动跳过刷新 | `main` 分支推送、规则生成且校验成功，或手动修复范围 |
 | [`sync-openclash-overwrite-submodule.yml`](sync-openclash-overwrite-submodule.yml) | 将 `overwrite/OpenClash_Overwrite` 子模块同步到上游 `main` 分支 | 每 2 小时或手动触发 |
 | [`validate.yml`](validate.yml) | 校验 Shell、Python、Sub-Store、Wiki 备份、规则派生文件、MRS 和完整 Mihomo 模板 | 代码推送、Pull Request 或手动触发 |

.github/workflows/auto-generate-rules.yml

@@ -117,7 +117,7 @@ jobs:
           echo "publication_sha=$publication_sha" >> "$GITHUB_OUTPUT"
 
   # Generation and Mihomo validation already ran against the exact worktree that
-  # was published. Verify the public bytes without re-running unrelated tests.
+  # was published. Purge its changed cache keys without re-running unrelated tests.
   purge-generated:
     needs: generate-rules
     permissions:

.github/workflows/purge-jsdelivr.yml

@@ -103,7 +103,7 @@ jobs:
             echo "published=$published"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Purge and verify every changed cache key
+      - name: Purge every changed cache key
         env:
           REPOSITORY: ${{ github.repository }}
           BEFORE_SHA: ${{ steps.range.outputs.before }}