Revert "feat: richer fingerprint surface — hardware (cores/RAM/touch)… #76
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # 所有 push / PR 只经过同一个验证关；验证通过的 main/master 才继续打包与滚动发布。 | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # 所有 ref 统一：新提交到达即取消同 ref 在跑的旧 run。 | |
| # main 的 publish 步骤有回滚 trap 兜底中断态，且发布头检查会拒绝过期 run。 | |
| concurrency: | |
| group: ${{ format('ci-{0}', github.ref) }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify: | |
| name: Verify | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npx biome ci . | |
| - run: npx tsc | |
| - run: node scripts/check-syntax.mjs | |
| - run: node scripts/validate-manifest.mjs | |
| - run: npm test | |
| - name: Verify purged CSS is in sync | |
| run: | | |
| node scripts/purge-css.mjs | |
| git diff --exit-code src/shared/vendor/bootstrap.purged.css | |
| package: | |
| name: Build extension zip | |
| needs: verify | |
| if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Build extension zip | |
| run: | | |
| set -euo pipefail | |
| VERSION=$(jq -r .version manifest.json) | |
| STAGE="MultiLangSwitcher-v${VERSION}" | |
| mkdir "$STAGE" | |
| cp manifest.json LICENSE "$STAGE/" | |
| cp -r src _locales assets "$STAGE/" | |
| find "$STAGE/src/shared/vendor" -name "*.map" -delete 2>/dev/null || true | |
| zip -r "${STAGE}.zip" "$STAGE" | |
| sha256sum "${STAGE}.zip" | awk '{print $1}' > digest.txt | |
| printf '%s\n' "$GITHUB_SHA" > source-sha.txt | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: extension-zip | |
| path: | | |
| MultiLangSwitcher-v*.zip | |
| digest.txt | |
| source-sha.txt | |
| if-no-files-found: error | |
| retention-days: 7 | |
| publish-latest: | |
| name: Publish rolling prerelease | |
| needs: package | |
| if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: extension-zip | |
| path: release | |
| - name: Verify artifact integrity and branch head | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| zip_file="$(ls release/MultiLangSwitcher-v*.zip)" | |
| test "$(cat release/digest.txt)" = "$(sha256sum "$zip_file" | awk '{print $1}')" | |
| test "$(cat release/source-sha.txt)" = "$GITHUB_SHA" | |
| # 过期 run（re-run 或并发）不接触线上 Release | |
| current="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/$GITHUB_REF_NAME" --jq '.object.sha')" | |
| test "$current" = "$GITHUB_SHA" || { echo "::error::$GITHUB_REF_NAME 已前进，拒绝用旧提交发布。"; exit 1; } | |
| cp "$zip_file" release/MultiLangSwitcher-latest.zip | |
| - name: Move latest tag to HEAD | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git tag -fa latest -m "Rolling latest build" | |
| git push -f origin latest | |
| - uses: softprops/action-gh-release@c12583777ecdfd3be55c69cf75464299dc01057e # v3 | |
| with: | |
| tag_name: latest | |
| name: Latest (continuous) | |
| body: | | |
| 自动构建的最新扩展包（滚动测试渠道，与正式版 Release 互不冲突）。 | |
| 提交：${{ github.sha }} | |
| prerelease: true | |
| files: release/MultiLangSwitcher-latest.zip | |
| release: | |
| name: Publish tagged release | |
| needs: package | |
| if: ${{ startsWith(github.ref, 'refs/tags/v') }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Guard tag/version match | |
| run: | | |
| set -euo pipefail | |
| TAG=${GITHUB_REF_NAME#v} | |
| VERSION=$(jq -r .version manifest.json) | |
| test "$TAG" = "$VERSION" || { echo "tag $TAG != manifest version $VERSION"; exit 1; } | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: extension-zip | |
| path: release | |
| - name: Verify digest before publishing | |
| run: | | |
| set -euo pipefail | |
| zip_file="$(ls release/MultiLangSwitcher-v*.zip)" | |
| test "$(sha256sum "$zip_file" | awk '{print $1}')" = "$(cat release/digest.txt)" | |
| test "$(cat release/source-sha.txt)" = "$GITHUB_SHA" | |
| - uses: softprops/action-gh-release@c12583777ecdfd3be55c69cf75464299dc01057e # v3 | |
| with: | |
| files: release/MultiLangSwitcher-v*.zip | |
| generate_release_notes: true |