Merge remote-tracking branch 'upstream/main'

zouyonghe · zouyonghe · commit 98c570f7a912 · 2026-04-13T14:49:06.000+09:00
diff --git a/.github/workflows/build-desktop-tauri.yml b/.github/workflows/build-desktop-tauri.yml
@@ -266,6 +266,75 @@ jobs:
         with:
           astrbot_version: ${{ steps.desktop_version.outputs.normalized }}
 
+      - name: Import Apple Developer Certificate
+        id: import_apple_certificate
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+            echo "APPLE_CERTIFICATE is not configured; skipping certificate import."
+            printf 'signing_identity=\n' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          CERT_PATH="$RUNNER_TEMP/certificate.p12"
+          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain"
+
+          echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security default-keychain -s "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          rm -f "$CERT_PATH"
+
+          signing_identities=()
+          while IFS= read -r identity; do
+            signing_identities+=("$identity")
+          done < <(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | grep "Developer ID Application" || true)
+          if [ "${#signing_identities[@]}" -eq 0 ]; then
+            echo "::error::No Developer ID Application identity found in the imported keychain." >&2
+            security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true
+            exit 1
+          fi
+          if [ "${#signing_identities[@]}" -ne 1 ]; then
+            echo "::error::Expected exactly one Developer ID Application identity, found ${#signing_identities[@]}." >&2
+            printf '%s\n' "${signing_identities[@]}" >&2
+            exit 1
+          fi
+          CERT_ID=$(printf '%s\n' "${signing_identities[0]}" | awk -F'"' '{print $2}')
+          if [ -z "$CERT_ID" ]; then
+            echo "::error::Failed to parse the imported Developer ID Application identity." >&2
+            exit 1
+          fi
+          printf 'APPLE_SIGNING_IDENTITY=%s\n' "$CERT_ID" >> "$GITHUB_ENV"
+          printf 'signing_identity=%s\n' "$CERT_ID" >> "$GITHUB_OUTPUT"
+          echo "Imported signing identity: $CERT_ID"
+
+      - name: Pre-sign backend resources (macOS)
+        if: ${{ steps.import_apple_certificate.outputs.signing_identity != '' }}
+        env:
+          ASTRBOT_SOURCE_GIT_URL: ${{ needs.resolve_build_context.outputs.source_git_url }}
+          ASTRBOT_SOURCE_GIT_REF: ${{ needs.resolve_build_context.outputs.source_git_ref }}
+          ASTRBOT_DESKTOP_VERSION: ${{ steps.desktop_version.outputs.prefixed }}
+          ASTRBOT_DESKTOP_UPDATER_PUBLIC_KEY: ${{ env.ASTRBOT_DESKTOP_UPDATER_PUBLIC_KEY }}
+          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          pnpm run prepare:resources
+          if [ ! -d "resources/backend" ]; then
+            echo "::error::resources/backend not found after prepare:resources." >&2
+            exit 1
+          fi
+          echo "Pre-signing Mach-O binaries in resources/backend..."
+          bash scripts/ci/codesign-macos-nested.sh "resources/backend" "src-tauri/entitlements.plist"
+
       - name: Resolve macOS app bundle name
         id: resolve_macos_app_bundle
         env:
@@ -295,6 +364,11 @@ jobs:
           ASTRBOT_DESKTOP_CRYPTOGRAPHY_FALLBACK_VERSIONS: ${{ vars.ASTRBOT_DESKTOP_CRYPTOGRAPHY_FALLBACK_VERSIONS || '' }}
           ASTRBOT_MACOS_BUILD_MAX_ATTEMPTS: ${{ vars.ASTRBOT_MACOS_BUILD_MAX_ATTEMPTS || '3' }}
           ASTRBOT_MACOS_BUILD_RETRY_SLEEP_SECONDS: ${{ vars.ASTRBOT_MACOS_BUILD_RETRY_SLEEP_SECONDS || '8' }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           GITHUB_TOKEN: ${{ github.token }}
           GH_TOKEN: ${{ github.token }}
         shell: bash
@@ -306,6 +380,8 @@ jobs:
 
           max_attempts="${ASTRBOT_MACOS_BUILD_MAX_ATTEMPTS}"
           retry_sleep_seconds="${ASTRBOT_MACOS_BUILD_RETRY_SLEEP_SECONDS}"
+          # Resources are already prepared and pre-signed in the previous step.
+          tauri_config_override='{"build":{"beforeBuildCommand":""}}'
           # Retry only for known transient cargo/crates network failures.
           # Spurious retry hints emitted by cargo.
           transient_retry_spurious='spurious network error|network failure seems to have happened'
@@ -330,7 +406,7 @@ jobs:
 
           for attempt in $(seq 1 "${max_attempts}"); do
             build_log="$(mktemp -t tauri-macos-build.XXXXXX.log)"
-            if cargo tauri build --verbose --target ${{ matrix.target }} --bundles app 2>&1 | tee "${build_log}"; then
+            if cargo tauri build --verbose --target ${{ matrix.target }} --bundles app --config "${tauri_config_override}" 2>&1 | tee "${build_log}"; then
               rm -f "${build_log}" || true
               break
             fi
diff --git a/scripts/ci/codesign-macos-nested.sh b/scripts/ci/codesign-macos-nested.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -z "${APPLE_SIGNING_IDENTITY:-}" ]; then
+  echo "::warning::APPLE_SIGNING_IDENTITY is not set; skipping code signing."
+  exit 0
+fi
+
+TARGET="${1:?Usage: $0 <path-to-directory-or-app-bundle> [entitlements.plist]}"
+ENTITLEMENTS_PATH="${2:-}"
+ENTITLEMENTS_ARGS=()
+if [ -n "${ENTITLEMENTS_PATH}" ] && [ -f "${ENTITLEMENTS_PATH}" ]; then
+  ENTITLEMENTS_ARGS=(--entitlements "${ENTITLEMENTS_PATH}")
+fi
+
+SIGN_OPTS=(--force --options runtime --sign "${APPLE_SIGNING_IDENTITY}")
+
+if [ ! -d "${TARGET}" ]; then
+  echo "::error::Target not found: ${TARGET}" >&2
+  exit 1
+fi
+
+BINARY_FILE_DESCRIPTIONS=()
+NESTED_BINARIES=()
+while IFS= read -r -d '' file; do
+  file_description="$(file --brief "${file}")"
+  if [[ "${file_description}" == *"Mach-O"* ]]; then
+    NESTED_BINARIES+=("${file}")
+    BINARY_FILE_DESCRIPTIONS+=("${file_description}")
+  fi
+done < <(find "${TARGET}" -type f -print0 2>/dev/null)
+
+if [ "${#NESTED_BINARIES[@]}" -eq 0 ]; then
+  echo "No Mach-O binaries found in ${TARGET}; nothing to sign."
+  exit 0
+fi
+
+echo "Found ${#NESTED_BINARIES[@]} Mach-O binary(ies) to sign in ${TARGET}."
+
+for index in "${!NESTED_BINARIES[@]}"; do
+  binary="${NESTED_BINARIES[${index}]}"
+  file_description="${BINARY_FILE_DESCRIPTIONS[${index}]}"
+  echo "  Signing: ${binary}"
+  # Only apply entitlements to executables, not dylibs
+  CURRENT_ENTITLEMENTS=()
+  if [ ${#ENTITLEMENTS_ARGS[@]} -gt 0 ] && [[ "${file_description}" == *"executable"* ]]; then
+    CURRENT_ENTITLEMENTS=("${ENTITLEMENTS_ARGS[@]}")
+  fi
+  codesign "${SIGN_OPTS[@]}" \
+    ${CURRENT_ENTITLEMENTS[@]+"${CURRENT_ENTITLEMENTS[@]}"} \
+    "${binary}"
+done
+
+echo "Code signing completed successfully for ${#NESTED_BINARIES[@]} binary(ies)."
diff --git a/scripts/ci/lib/nightly_version.py b/scripts/ci/lib/nightly_version.py
@@ -6,7 +6,7 @@
 
 
 SPEC_PATH = Path(__file__).resolve().parents[3] / "src-tauri" / "nightly-version-format.json"
-BASE_VERSION_PATTERN = r"[0-9]+(?:\.[0-9]+){1,2}"
+BASE_VERSION_PATTERN = r"[0-9]+(?:\.[0-9]+){1,2}(?:-[a-zA-Z0-9.]+)?"
 
 _SPEC = json.loads(SPEC_PATH.read_text(encoding="utf-8"))
 NIGHTLY_CANONICAL_FORMAT = str(_SPEC["canonicalFormat"])
diff --git a/scripts/prepare-resources/desktop-bridge-checks.mjs b/scripts/prepare-resources/desktop-bridge-checks.mjs
@@ -60,6 +60,49 @@ export const patchMonacoCssNestingWarnings = async ({ dashboardDir, projectRoot
   }
 };
 
+export const patchDesktopReleaseUpdateIndicator = async ({ dashboardDir, projectRoot }) => {
+  const file = path.join(
+    dashboardDir,
+    'src',
+    'layouts',
+    'full',
+    'vertical-header',
+    'VerticalHeader.vue',
+  );
+  if (!existsSync(file)) {
+    return;
+  }
+
+  const source = await readFile(file, 'utf8');
+  if (source.includes('const backendHasNewVersion = !isDesktopReleaseMode.value && res.data.data.has_new_version;')) {
+    return;
+  }
+
+  const targetPattern =
+    /^(\s*)hasNewVersion\.value\s*=\s*res\.data\.data\.has_new_version;\s*\n\s*if\s*\(\s*res\.data\.data\.has_new_version\s*\)\s*\{/m;
+
+  if (!targetPattern.test(source)) {
+    console.warn(
+      `[prepare-resources] Could not patch desktop release update banner gating in ${path.relative(projectRoot, file)} because the expected update check pattern was not found.`,
+    );
+    return;
+  }
+
+  const patched = source.replace(
+    targetPattern,
+    (_, indent) =>
+      `${indent}const backendHasNewVersion = !isDesktopReleaseMode.value && res.data.data.has_new_version;\n` +
+      `${indent}hasNewVersion.value = backendHasNewVersion;\n\n` +
+      `${indent}if (backendHasNewVersion) {`,
+  );
+  if (patched !== source) {
+    await writeFile(file, patched, 'utf8');
+    console.log(
+      `[prepare-resources] Patched desktop release update banner gating in ${path.relative(projectRoot, file)}`,
+    );
+  }
+};
+
 export const verifyDesktopBridgeArtifacts = async ({
   dashboardDir,
   projectRoot,
diff --git a/scripts/prepare-resources/desktop-bridge-checks.test.mjs b/scripts/prepare-resources/desktop-bridge-checks.test.mjs
@@ -1,10 +1,14 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 
 import {
   getDesktopBridgeExpectations,
   shouldEnforceDesktopBridgeExpectation,
 } from './desktop-bridge-expectations.mjs';
+import { patchDesktopReleaseUpdateIndicator } from './desktop-bridge-checks.mjs';
 
 test('getDesktopBridgeExpectations returns stable expectation metadata', () => {
   const expectations = getDesktopBridgeExpectations();
@@ -60,3 +64,85 @@ test('shouldEnforceDesktopBridgeExpectation enforces required expectations on no
     true,
   );
 });
+
+test('patchDesktopReleaseUpdateIndicator tolerates minor formatting changes in the upstream source', async () => {
+  const dashboardDir = await mkdtemp(path.join(tmpdir(), 'astrbot-dashboard-'));
+  const headerFile = path.join(
+    dashboardDir,
+    'src',
+    'layouts',
+    'full',
+    'vertical-header',
+    'VerticalHeader.vue',
+  );
+  await mkdir(path.dirname(headerFile), { recursive: true });
+  await writeFile(
+    headerFile,
+    `function checkUpdate() {
+  axios.get('/api/update/check')
+    .then((res) => {
+        hasNewVersion.value   =   res.data.data.has_new_version;
+      if   ( res.data.data.has_new_version )   {
+        releaseMessage.value = res.data.message;
+        updateStatus.value = t('core.header.version.hasNewVersion');
+      } else {
+        updateStatus.value = res.data.message;
+      }
+      dashboardHasNewVersion.value = isDesktopReleaseMode.value
+        ? false
+        : res.data.data.dashboard_has_new_version;
+    })
+}
+`,
+    'utf8',
+  );
+
+  await patchDesktopReleaseUpdateIndicator({ dashboardDir, projectRoot: dashboardDir });
+
+  const patched = await readFile(headerFile, 'utf8');
+  assert.match(
+    patched,
+    /const backendHasNewVersion = !isDesktopReleaseMode\.value && res\.data\.data\.has_new_version;/,
+  );
+  assert.match(patched, /hasNewVersion\.value = backendHasNewVersion;/);
+  assert.match(patched, /if \(backendHasNewVersion\) \{/);
+  assert.doesNotMatch(patched, /hasNewVersion\.value = res\.data\.data\.has_new_version;/);
+});
+
+test('patchDesktopReleaseUpdateIndicator warns when the expected update pattern is missing', async () => {
+  const dashboardDir = await mkdtemp(path.join(tmpdir(), 'astrbot-dashboard-'));
+  const headerFile = path.join(
+    dashboardDir,
+    'src',
+    'layouts',
+    'full',
+    'vertical-header',
+    'VerticalHeader.vue',
+  );
+  await mkdir(path.dirname(headerFile), { recursive: true });
+  await writeFile(
+    headerFile,
+    `function checkUpdate() {
+  axios.get('/api/update/check')
+    .then((res) => {
+      updateStatus.value = res.data.message;
+    })
+}
+`,
+    'utf8',
+  );
+
+  const warnings = [];
+  const originalWarn = console.warn;
+  console.warn = (message) => warnings.push(String(message));
+
+  try {
+    await patchDesktopReleaseUpdateIndicator({ dashboardDir, projectRoot: dashboardDir });
+  } finally {
+    console.warn = originalWarn;
+  }
+
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /Could not patch desktop release update banner gating/);
+  assert.match(warnings[0], /VerticalHeader\.vue/);
+});
diff --git a/scripts/prepare-resources/mode-tasks.mjs b/scripts/prepare-resources/mode-tasks.mjs
@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import {
+  patchDesktopReleaseUpdateIndicator,
   patchMonacoCssNestingWarnings,
   verifyDesktopBridgeArtifacts,
 } from './desktop-bridge-checks.mjs';
@@ -66,6 +67,7 @@ export const prepareWebui = async ({
   const dashboardDir = path.join(sourceDir, 'dashboard');
   ensurePackageInstall(dashboardDir, 'AstrBot dashboard');
   await patchMonacoCssNestingWarnings({ dashboardDir, projectRoot });
+  await patchDesktopReleaseUpdateIndicator({ dashboardDir, projectRoot });
   await verifyDesktopBridgeArtifacts({
     dashboardDir,
     projectRoot,
diff --git a/src-tauri/entitlements.plist b/src-tauri/entitlements.plist
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
@@ -31,6 +31,9 @@
     "active": true,
     "createUpdaterArtifacts": true,
     "targets": "all",
+    "macOS": {
+      "entitlements": "entitlements.plist"
+    },
     "windows": {
       "webviewInstallMode": {
         "type": "downloadBootstrapper",
