fix: validate embedded config encoding in CI builds

Author: lius-new

.github/workflows/tauri-build-win-official.yml

@@ -140,7 +140,9 @@ jobs:
           Set-ConfigValue '^(updater_temp_dir\s*=\s*)".*"$' "${{ env.APP_UPDATER_TEMP_DIR }}"
           Set-ConfigValue '^(downlaod_url\s*=\s*)".*"$' "${{ env.APP_WEBVIEW_DOWNLOAD_URL }}"
 
-          Set-Content -Path $configPath -Value $content -NoNewline
+          $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+          $resolvedConfigPath = (Resolve-Path $configPath).Path
+          [System.IO.File]::WriteAllText($resolvedConfigPath, $content, $utf8NoBom)
 
       # 在 CI 构建期间使用 fixed 版本的 Tauri 配置
       # 先将 src-tauri/tauri.conf.fixed.json 覆盖为 src-tauri/tauri.conf.json，

.github/workflows/tauri-release-win.yml

@@ -86,7 +86,9 @@ jobs:
           Set-ConfigValue '^(updater_temp_dir\s*=\s*)".*"$' "${{ env.APP_UPDATER_TEMP_DIR }}"
           Set-ConfigValue '^(downlaod_url\s*=\s*)".*"$' "${{ env.APP_WEBVIEW_DOWNLOAD_URL }}"
 
-          Set-Content -Path $configPath -Value $content -NoNewline
+          $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+          $resolvedConfigPath = (Resolve-Path $configPath).Path
+          [System.IO.File]::WriteAllText($resolvedConfigPath, $content, $utf8NoBom)
 
       - name: Use fixed Tauri config
         shell: powershell

src-tauri/build.rs

@@ -385,6 +385,15 @@ mod config_encrypt {
             );
         });
 
+        std::str::from_utf8(&config_bytes).unwrap_or_else(|e| {
+            panic!(
+                "[BUILD ERROR] Config file '{}' is not valid UTF-8: {}\n\
+                 Please ensure workflow/local scripts write this file with UTF-8 encoding.",
+                config_path.display(),
+                e
+            );
+        });
+
         let encrypted = crypto::encrypt(&config_bytes).expect("Failed to encrypt config");
 
         let out_path = Path::new(&out_dir).join("config_encrypted.bin");