ci: publish native tagged release assets

Author: Saitamasans

.github/workflows/release.yml

@@ -1,49 +1,93 @@
 name: Release
+
 on:
   workflow_dispatch:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
-  bundle:
+  source-assets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: "3.11", cache: pip}
+      - run: python -m pip install -e ".[dev]" build
+      - run: ruff format --check .
+      - run: ruff check .
+      - run: python -m pytest tests/unit -q
+      - run: python scripts/validate_schemas.py
+      - run: python scripts/validate_skill.py .
+      - run: python scripts/security_scan.py .
+      - run: python -m build
+      - run: python scripts/generate_supply_chain_docs.py
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-source-assets
+          path: |
+            dist/multi_api_test_executor-*.whl
+            dist/multi_api_test_executor-*.tar.gz
+            build/release/sbom.cdx.json
+            build/release/THIRD_PARTY_LICENSES.txt
+
+  native-bundles:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - {os: windows-latest, artifact: windows-x64}
-          - {os: ubuntu-latest, artifact: linux-x64}
-          - {os: macos-15-intel, artifact: macos-x64}
-          - {os: macos-14, artifact: macos-arm64}
+          - {os: windows-latest, platform: windows-x64}
+          - {os: ubuntu-latest, platform: linux-x64}
+          - {os: macos-15-intel, platform: macos-x64}
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: {python-version: "3.11", cache: pip}
       - run: python -m pip install -e ".[dev]" build pyinstaller
-      - run: ruff check .
-      - run: python -m pytest --cov --cov-branch -q
-      - run: python scripts/validate_schemas.py
-      - run: python scripts/validate_skill.py .
       - run: python -m build
-      - run: python -m pip download --dest wheelhouse dist/*.whl
+      - run: python -m pip download --dest wheelhouse .
       - run: python scripts/build_binary.py
       - run: python scripts/generate_supply_chain_docs.py
-      - run: python scripts/build_skill_bundle.py --platform ${{ matrix.artifact }}
+      - run: python scripts/build_skill_bundle.py --platform ${{ matrix.platform }}
+      - run: python scripts/verify_checksums.py build/release/SHA256SUMS.txt build/release
+      - if: runner.os == 'Windows'
+        run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/ci_bundle_smoke.ps1 -BundleZip build/release/multi-api-test-executor-0.1.0-${{ matrix.platform }}.zip
+      - if: runner.os != 'Windows'
+        run: sh scripts/ci_bundle_smoke.sh build/release/multi-api-test-executor-0.1.0-${{ matrix.platform }}.zip
+      - run: python scripts/package_release_asset.py --bundle build/release/multi-api-test-executor-0.1.0-${{ matrix.platform }}.zip --platform ${{ matrix.platform }} --tag ${{ github.ref_name }}
       - uses: actions/upload-artifact@v4
         with:
-          name: multi-api-test-executor-${{ matrix.artifact }}
-          path: build/release/*
+          name: release-${{ matrix.platform }}
+          path: build/release-assets/*
 
   publish:
     if: startsWith(github.ref, 'refs/tags/')
-    needs: bundle
+    needs: [source-assets, native-bundles]
     runs-on: ubuntu-latest
-    permissions: {contents: write}
+    permissions:
+      contents: write
     steps:
+      - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
         with: {path: artifacts, merge-multiple: true}
-      - run: sha256sum artifacts/* > artifacts/SHA256SUMS.txt
+      - name: Write aggregate checksums
+        run: |
+          python - <<'PY'
+          from hashlib import sha256
+          from pathlib import Path
+          root = Path("artifacts")
+          files = sorted(path for path in root.iterdir() if path.is_file())
+          (root / "SHA256SUMS.txt").write_text(
+              "\n".join(f"{sha256(path.read_bytes()).hexdigest()}  {path.name}" for path in files) + "\n",
+              encoding="utf-8",
+          )
+          PY
       - uses: softprops/action-gh-release@v2
         with:
           files: artifacts/*
-          generate_release_notes: true
+          body_path: docs/release-notes-v0.1.0.md
+          prerelease: ${{ contains(github.ref_name, '-') }}
+          fail_on_unmatched_files: true

CHANGELOG.md

@@ -1,10 +1,12 @@
 # Changelog
 
-## 0.1.0 RC (unreleased)
+## 0.1.0 RC - 2026-07-21
 
 - Added real read-only SQLite checks with PostgreSQL/MySQL adapters, limits, assertions, and redacted evidence.
 - Added graceful cancellation, deterministic statuses, audited cleanup, allowlisted plugins, and `summary_for_ai.json`.
 - Hardened local OpenAPI refs, Postman scripts, SSRF, response limits, HTML/Excel output, and installer checksums.
+- Verified Windows x64, Linux x64, and macOS x64 bundles plus Python 3.11–3.13 on all three operating systems in GitHub Actions.
+- Verified PostgreSQL 17 and MySQL 8.4 service integration, Unix SIGINT evidence, offline installation, checksum, SBOM, licenses, and repeated Mock E2E.
 
 ## 0.1.0 - 2026-07-21
 

README.md

@@ -1,5 +1,7 @@
 # multi-api-test-executor
 
+[![CI](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml/badge.svg)](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml)
+
 > 第十个 Skill｜多接口自动化执行与证据回填
 
 从接口文档出发，自动生成并真实执行多接口业务链路，完成动态参数传递、确定性断言、证据保存和结果回填。
@@ -17,6 +19,20 @@ HTTP 200 只证明传输层满足预期，不等于业务成功。业务结论
 
 LLM 可以分析非结构化资料并提出候选规则；它不发送请求、不决定最终 passed/failed、不模拟证据。
 
+## 真实支持矩阵
+
+以下状态来自 GitHub Actions 原生 Runner 与真实数据库 service，不是仅解析 workflow 配置：
+
+| 平台或依赖 | 状态 | 验证范围 |
+|---|---|---|
+| Windows x64 | 已真实验证 | Python 3.11–3.13、离线 Bundle、doctor、本地 Mock E2E |
+| Linux x64 | 已真实验证 | Python 3.11–3.13、SIGINT、离线 Bundle、doctor、本地 Mock E2E |
+| macOS x64 | 已真实验证 | Intel 原生 Runner、Python 3.11–3.13、SIGINT、离线 Bundle、doctor、本地 Mock E2E |
+| macOS arm64 | 未验证 | v0.1.0 不发布 arm64 产物 |
+| SQLite | 已真实验证 | 只读 post-check 与完整 E2E |
+| PostgreSQL 17 | 已真实验证 | GitHub service、参数绑定、只读事务与 SQL 门禁 |
+| MySQL 8.4 | 已真实验证 | GitHub service、参数绑定、只读事务与 SQL 门禁 |
+
 ## 支持资料与 L1-L4
 
 | 等级 | 资料 | 可信能力 |
@@ -133,13 +149,15 @@ evidence/RUN_ID/
 
 Runner 定位优先级：`MULTI_API_RUNNER_PATH`、PATH、Windows `%LOCALAPPDATA%\multi-api-test-executor\multi-api.cmd`、macOS/Linux `${XDG_DATA_HOME:-$HOME/.local/share}/multi-api-test-executor/multi-api`。Skill 0.1.x 兼容 Runner `>=0.1.0,<0.2.0`，不会自动升级或在 run 阶段安装。
 
-当前机器为 Windows/Python 3.14：SQLite 和 Windows Runner 可本机验证；PostgreSQL/MySQL 与 Python 3.11–3.13 由 CI 定义覆盖；macOS/Linux 当前未做本机原生验证。
+GitHub Actions 已在 Windows、Linux、macOS 的 Python 3.11–3.13 上真实运行；PostgreSQL 17、MySQL 8.4、Linux/macOS SIGINT 以及三个已发布平台的离线安装和 Mock E2E 均通过。
 
-- v0.1 聚焦 REST；可插拔加密、真实数据库驱动执行和 Ctrl+C 跨平台信号测试仍需增强。
+- v0.1 聚焦 REST，不支持 UI、gRPC 或 WebSocket 执行。
+- Windows 合作式取消已覆盖；GitHub Windows Runner 无法可靠完成原生双 Ctrl+C E2E，因此该项仍为已知限制。
+- Postman JavaScript 不执行；远程 OpenAPI `$ref` 默认关闭；插件未经 allowlist 配置不执行。
 - Markdown 是保守的 Method/Path 提取，不理解任意自然语言表格。
 - Excel 仅支持基础列映射和结果副本回填。
 - Apifox 仅确定性支持其 OpenAPI 导出格式。
-- macOS x64/arm64 发行依赖 GitHub 对应原生 Runner；工作流不会把未构建架构标成成功。
+- macOS v0.1.0 仅发布已在 Intel 原生 Runner 验证的 x64 产物，不宣称 arm64 支持。
 
 ## 性能基准
 

README_EN.md

@@ -1,12 +1,14 @@
 # Multi-API Test Executor
 
+[![CI](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml/badge.svg)](https://github.com/Saitamasans/skill-multi-api-test-executor/actions/workflows/ci.yml)
+
 ## V0.1 release-candidate capabilities
 
 The runner supports real read-only SQLite post-checks, PostgreSQL/MySQL adapters, graceful cancellation with partial evidence, audited cleanup, an allowlisted plugin SDK, escaped RC HTML reports, and compact `summary_for_ai.json` output. Security controls include local-only OpenAPI refs, Postman script non-execution, SSRF policies, bounded evidence, Excel formula neutralization, and installer SHA-256 checks.
 
 Exit codes are 0 passed, 1 test/assertion/cleanup failure, 2 input or preflight error, 3 infrastructure error, 4 cancellation, 5 partial/time-budget completion, and 6 internal error. Skill 0.1.x requires Runner `>=0.1.0,<0.2.0` and never installs at run time.
 
-Native verification here is Windows/Python 3.14. SQLite is local; PostgreSQL/MySQL and Python 3.11–3.13 are configured in CI. macOS/Linux were not run natively on this machine.
+GitHub Actions has natively verified Windows x64, Linux x64, and macOS x64 across Python 3.11–3.13. SQLite, PostgreSQL 17, MySQL 8.4, Unix SIGINT, offline installation, doctor, and the local Mock E2E all pass. macOS arm64 is unverified and is not published for v0.1.0; native Windows double Ctrl+C remains a known limitation.
 
 An execution Skill that compiles API material into ATIR, sends real REST requests through a deterministic Runner, passes dynamic values across steps, evaluates sourced assertions, and writes redacted evidence plus JSON/HTML/JUnit reports.
 

docs/installation.md

@@ -19,3 +19,5 @@ Use the matching uninstall script. The scripts validate that default deletion st
 ## Build limitations
 
 Independent binaries use PyInstaller on native GitHub-hosted operating systems. macOS x64 and arm64 jobs are separate because cross-compiling those architectures is not treated as equivalent proof. If a native runner is unavailable, the corresponding job fails or remains absent; release notes must not claim that artifact.
+
+Version 0.1.0 publishes only the architectures verified by native CI: Windows x64, Linux x64, and macOS x64. macOS arm64 is not published for this version.

docs/release-notes-v0.1.0.md

@@ -0,0 +1,37 @@
+# Multi-API Test Executor v0.1.0
+
+Multi-API Test Executor is an execution-oriented Codex Skill plus deterministic Runner. It compiles API documents and requirements into auditable REST workflows with dynamic value propagation, sourced assertions, read-only database checks, cleanup, and redacted evidence.
+
+## Verified platforms
+
+- Windows x64, Linux x64, and macOS x64 native bundles.
+- Python 3.11, 3.12, and 3.13 on Windows, Linux, and macOS.
+- SQLite, PostgreSQL 17, and MySQL 8.4 read-only database checks.
+
+## Install once
+
+This release does not provide an automatic Skill installation hook. Download the archive for the platform, verify it against `SHA256SUMS.txt`, extract it, and run the installer once:
+
+- Windows: `powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\installers\install.ps1`
+- Linux/macOS: `sh installers/install.sh`
+
+The installed Runner is reused by later Skill runs. Normal execution never invokes pip or updates dependencies.
+
+## Trust and evidence
+
+HTTP 200 is transport evidence, not automatic business success. Business outcomes require independent, sourced assertions. The Runner writes JSON, HTML, JUnit, manifest, cleanup, database, and cancellation evidence while recursively redacting credentials and sensitive headers.
+
+Database post-checks permit only parameterized read-only queries. Production execution is blocked by default and high-risk operations require explicit approval.
+
+## Known limits
+
+- REST only; UI, gRPC, and WebSocket execution are not supported.
+- Postman JavaScript is not executed.
+- Remote OpenAPI `$ref` resolution is disabled by default.
+- Plugins require explicit allowlist configuration.
+- macOS arm64 is not included because v0.1.0 CI verified only the native x64 release runner.
+- Windows cooperative cancellation is covered; native double Ctrl+C remains a documented platform limitation.
+
+## Integrity and RC plan
+
+Verify every downloaded asset with `SHA256SUMS.txt`. The release also includes a CycloneDX SBOM and third-party license inventory. The RC is promoted to stable only after downloading the Windows asset from GitHub into a clean directory, verifying its checksum, installing offline, running doctor and the complete local Mock E2E twice, and confirming installation state remains unchanged.

scripts/package_release_asset.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import argparse
+import re
+import shutil
+import tarfile
+import tempfile
+import zipfile
+from pathlib import Path, PurePosixPath
+
+VERSION = re.compile(r"^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)$")
+
+
+def release_version(tag: str) -> str:
+    match = VERSION.fullmatch(tag)
+    if not match:
+        raise ValueError(f"unsupported release tag: {tag}")
+    return match.group(1)
+
+
+def _validate_zip_members(bundle: Path) -> None:
+    with zipfile.ZipFile(bundle) as archive:
+        for name in archive.namelist():
+            member = PurePosixPath(name)
+            if member.is_absolute() or ".." in member.parts:
+                raise ValueError(f"unsafe bundle member: {name}")
+
+
+def package_release_asset(bundle: Path, platform: str, tag: str, output: Path) -> Path:
+    bundle = bundle.resolve()
+    if not bundle.is_file():
+        raise FileNotFoundError(bundle)
+    _validate_zip_members(bundle)
+    version = release_version(tag)
+    output.mkdir(parents=True, exist_ok=True)
+    stem = f"multi-api-test-executor-{version}-{platform}"
+    if platform.startswith("windows"):
+        target = output / f"{stem}.zip"
+        shutil.copy2(bundle, target)
+        return target
+    target = output / f"{stem}.tar.gz"
+    with tempfile.TemporaryDirectory(prefix="multi-api-release-") as temporary:
+        extracted = Path(temporary)
+        with zipfile.ZipFile(bundle) as archive:
+            archive.extractall(extracted)
+        with tarfile.open(target, "w:gz") as archive:
+            for path in sorted(extracted.rglob("*")):
+                archive.add(path, arcname=path.relative_to(extracted).as_posix(), recursive=False)
+    return target
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--bundle", type=Path, required=True)
+    parser.add_argument("--platform", required=True)
+    parser.add_argument("--tag", required=True)
+    parser.add_argument("--output", type=Path, default=Path("build/release-assets"))
+    args = parser.parse_args()
+    print(package_release_asset(args.bundle, args.platform, args.tag, args.output))
+
+
+if __name__ == "__main__":
+    main()

tests/unit/test_release_packaging.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import tarfile
+import zipfile
+from pathlib import Path
+
+ROOT = Path(__file__).parents[2]
+
+
+def load_packager() -> dict[str, object]:
+    script = ROOT / "scripts/package_release_asset.py"
+    namespace: dict[str, object] = {"__name__": "release_packager_test", "__file__": str(script)}
+    exec(compile(script.read_text(encoding="utf-8"), str(script), "exec"), namespace)
+    return namespace
+
+
+def test_release_packager_uses_tagged_platform_names_and_expected_formats(tmp_path: Path) -> None:
+    namespace = load_packager()
+    bundle = tmp_path / "bundle.zip"
+    with zipfile.ZipFile(bundle, "w") as archive:
+        archive.writestr("SKILL.md", "release fixture")
+        archive.writestr("installers/install.sh", "#!/bin/sh\n")
+    output = tmp_path / "assets"
+
+    windows = namespace["package_release_asset"](bundle, "windows-x64", "v0.1.0-rc.1", output)
+    linux = namespace["package_release_asset"](bundle, "linux-x64", "v0.1.0-rc.1", output)
+
+    assert windows.name == "multi-api-test-executor-0.1.0-rc.1-windows-x64.zip"
+    assert linux.name == "multi-api-test-executor-0.1.0-rc.1-linux-x64.tar.gz"
+    with zipfile.ZipFile(windows) as archive:
+        assert "SKILL.md" in archive.namelist()
+    with tarfile.open(linux, "r:gz") as archive:
+        assert "SKILL.md" in archive.getnames()
+
+
+def test_release_workflow_publishes_native_assets_and_supply_chain_files() -> None:
+    workflow = (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8")
+    for phrase in [
+        "windows-x64",
+        "linux-x64",
+        "macos-x64",
+        "scripts/package_release_asset.py",
+        "multi_api_test_executor-*.whl",
+        "multi_api_test_executor-*.tar.gz",
+        "sbom.cdx.json",
+        "THIRD_PARTY_LICENSES.txt",
+        "SHA256SUMS.txt",
+        "docs/release-notes-v0.1.0.md",
+        "prerelease: ${{ contains(github.ref_name, '-') }}",
+    ]:
+        assert phrase in workflow