refactor: replace Authenticode verification with SHA256 hash check #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ main, master ] | |
| pull_request: | |
| branches: [ main, master ] | |
| release: | |
| types: [ created ] | |
| jobs: | |
| build: | |
| name: Build Backend + Bundle Frontend | |
| runs-on: windows-latest | |
| steps: | |
| - name: Checkout backend | |
| uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25.x' | |
| cache: true | |
| # ── 拉取前端最新成功构建的 artifact ────────────────────────── | |
| - name: Get latest frontend run ID | |
| id: frontend_run | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| $resp = gh api ` | |
| "repos/OpenSysKit/new-FrontEnd/actions/workflows/build.yml/runs?status=success&per_page=1" ` | |
| --jq ".workflow_runs[0].id" | |
| echo "run_id=$resp" >> $env:GITHUB_OUTPUT | |
| echo "Frontend run ID: $resp" | |
| - name: Download frontend artifact | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| $runId = "${{ steps.frontend_run.outputs.run_id }}" | |
| if (-not $runId -or $runId -eq "null") { | |
| echo "未找到前端构建产物，跳过前端捆绑" | |
| exit 0 | |
| } | |
| New-Item -ItemType Directory -Force -Path dist\_frontend | Out-Null | |
| gh run download $runId ` | |
| --repo OpenSysKit/new-FrontEnd ` | |
| --name OpenSysKit-UI-win-x64 ` | |
| --dir dist\_frontend | |
| echo "前端 artifact 下载完成" | |
| - name: Expand frontend bundle into dist | |
| shell: pwsh | |
| run: | | |
| $zip = Get-ChildItem dist\_frontend -Filter *.zip -File -Recurse | Select-Object -First 1 | |
| if (-not $zip) { | |
| echo "未找到前端 zip，保留仅后端产物" | |
| exit 0 | |
| } | |
| Expand-Archive -Path $zip.FullName -DestinationPath dist\ -Force | |
| Remove-Item $zip.FullName -Force | |
| if (Test-Path dist\_frontend) { | |
| Remove-Item dist\_frontend -Recurse -Force | |
| } | |
| echo "前端已解包到 dist 根目录" | |
| # ── 计算前端 SHA256 ────────────────────────── | |
| - name: Compute frontend SHA256 | |
| id: frontend_hash | |
| shell: pwsh | |
| run: | | |
| if (-not (Test-Path "dist\OpenSysKit.UI.exe")) { | |
| echo "sha256=" >> $env:GITHUB_OUTPUT | |
| exit 0 | |
| } | |
| $hash = (Get-FileHash -Path "dist\OpenSysKit.UI.exe" -Algorithm SHA256).Hash.ToLower() | |
| echo "sha256=$hash" >> $env:GITHUB_OUTPUT | |
| Write-Host "Frontend SHA256: $hash" | |
| # ── 编译后端（注入前端 hash）────────────────────────── | |
| - name: Build backend exe | |
| shell: pwsh | |
| run: | | |
| $version = git describe --tags --always --dirty 2>$null | |
| if (-not $version) { $version = "dev" } | |
| $buildTime = (Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ") | |
| $feHash = "${{ steps.frontend_hash.outputs.sha256 }}" | |
| $ldflags = "-s -w -X main.version=$version -X main.buildTime=$buildTime" | |
| if ($feHash) { | |
| $ldflags += " -X main.frontendSHA256=$feHash" | |
| Write-Host "Injecting frontend SHA256: $feHash" | |
| } | |
| go build -ldflags "$ldflags" -o dist\OpenSysKit.exe .\cmd\server | |
| working-directory: ${{ github.workspace }} | |
| - name: List dist contents | |
| shell: pwsh | |
| run: Get-ChildItem dist\ -Recurse | |
| - name: Upload bundle artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: OpenSysKit-bundle-win-x64 | |
| path: dist\ | |
| if-no-files-found: error | |
| release: | |
| name: Attach to Release | |
| needs: build | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'release' | |
| steps: | |
| - name: Download bundle | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: OpenSysKit-bundle-win-x64 | |
| path: dist/ | |
| - name: Zip bundle | |
| run: | | |
| cd dist | |
| zip -r ../OpenSysKit-win-x64.zip . | |
| - name: Upload release asset | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: OpenSysKit-win-x64.zip |