fix: stabilize unload flow and support new DriverLoader list format #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ main, master ] | |
| pull_request: | |
| branches: [ main, master ] | |
| release: | |
| types: [ created ] | |
| jobs: | |
| build: | |
| name: Build Backend + Bundle Frontend | |
| runs-on: windows-latest | |
| steps: | |
| - name: Checkout backend | |
| uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25.x' | |
| cache: true | |
| # ── 拉取前端最新成功构建的 artifact ────────────────────────── | |
| - name: Get latest frontend run ID | |
| id: frontend_run | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| $resp = gh api ` | |
| "repos/OpenSysKit/new-FrontEnd/actions/workflows/build.yml/runs?status=success&branch=main&event=push&per_page=1" ` | |
| --jq ".workflow_runs[0].id" | |
| echo "run_id=$resp" >> $env:GITHUB_OUTPUT | |
| echo "Frontend run ID: $resp" | |
| - name: Download frontend artifact | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| $runId = "${{ steps.frontend_run.outputs.run_id }}" | |
| if (-not $runId -or $runId -eq "null") { | |
| echo "未找到前端构建产物，跳过前端捆绑" | |
| exit 0 | |
| } | |
| New-Item -ItemType Directory -Force -Path dist\_frontend | Out-Null | |
| gh run download $runId ` | |
| --repo OpenSysKit/new-FrontEnd ` | |
| --name OpenSysKit-UI-win-x64 ` | |
| --dir dist\_frontend | |
| echo "前端 artifact 下载完成" | |
| - name: Expand frontend bundle into dist | |
| shell: pwsh | |
| run: | | |
| if (-not (Test-Path "dist\_frontend")) { | |
| echo "前端 artifact 未下载，跳过解包" | |
| exit 0 | |
| } | |
| $zip = Get-ChildItem dist\_frontend -Filter *.zip -File -Recurse | Select-Object -First 1 | |
| if (-not $zip) { | |
| echo "未找到前端 zip，保留仅后端产物" | |
| exit 0 | |
| } | |
| Expand-Archive -Path $zip.FullName -DestinationPath dist\ -Force | |
| Remove-Item $zip.FullName -Force | |
| if (Test-Path dist\_frontend) { | |
| Remove-Item dist\_frontend -Recurse -Force | |
| } | |
| echo "前端已解包到 dist 根目录" | |
| - name: Verify frontend signature | |
| shell: pwsh | |
| run: | | |
| if (-not (Test-Path "dist\OpenSysKit.UI.exe")) { | |
| throw "前端 EXE 不存在，无法校验签名" | |
| } | |
| $sig = Get-AuthenticodeSignature "dist\OpenSysKit.UI.exe" | |
| if (-not $sig.SignerCertificate) { | |
| throw "前端产物未签名，拒绝继续构建后端 bundle" | |
| } | |
| - name: Generate backend Windows resources | |
| shell: pwsh | |
| run: .\scripts\generate-winres.ps1 -RootPath $PWD | |
| # ── 计算前端 SHA256 ────────────────────────── | |
| - name: Compute frontend SHA256 | |
| id: frontend_hash | |
| shell: pwsh | |
| run: | | |
| if (-not (Test-Path "dist\OpenSysKit.UI.exe")) { | |
| echo "sha256=" >> $env:GITHUB_OUTPUT | |
| exit 0 | |
| } | |
| $hash = (Get-FileHash -Path "dist\OpenSysKit.UI.exe" -Algorithm SHA256).Hash.ToLower() | |
| echo "sha256=$hash" >> $env:GITHUB_OUTPUT | |
| Write-Host "Frontend SHA256: $hash" | |
| # ── 编译后端（注入前端 hash）────────────────────────── | |
| - name: Build backend exe | |
| shell: pwsh | |
| run: | | |
| $version = git describe --tags --always --dirty 2>$null | |
| if (-not $version) { $version = "dev" } | |
| $buildTime = (Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ") | |
| $feHash = "${{ steps.frontend_hash.outputs.sha256 }}" | |
| $ldflags = "-H=windowsgui -s -w -X main.version=$version -X main.buildTime=$buildTime" | |
| if ($feHash) { | |
| $ldflags += " -X main.frontendSHA256=$feHash" | |
| Write-Host "Injecting frontend SHA256: $feHash" | |
| } | |
| go build -ldflags "$ldflags" -o dist\OpenSysKit.exe .\cmd\server | |
| working-directory: ${{ github.workspace }} | |
| - name: Sign backend executable | |
| shell: pwsh | |
| env: | |
| CODESIGN_PFX: ${{ secrets.CODESIGN_PFX }} | |
| CODESIGN_PASSWORD: ${{ secrets.CODESIGN_PASSWORD }} | |
| run: | | |
| if (-not $env:CODESIGN_PFX) { throw "CODESIGN_PFX 未设置，拒绝生成未签名后端产物" } | |
| if (-not $env:CODESIGN_PASSWORD) { throw "CODESIGN_PASSWORD 未设置" } | |
| $certPath = Join-Path $env:RUNNER_TEMP "codesign.pfx" | |
| $b64 = $env:CODESIGN_PFX -replace '\s', '' | |
| [IO.File]::WriteAllBytes($certPath, [Convert]::FromBase64String($b64)) | |
| $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" ` | |
| -Recurse -Filter "signtool.exe" -ErrorAction SilentlyContinue | | |
| Where-Object { $_.FullName -match "x64" } | | |
| Sort-Object FullName -Descending | | |
| Select-Object -First 1 | |
| if (-not $signtool) { throw "signtool.exe not found" } | |
| & $signtool.FullName sign ` | |
| /fd SHA256 ` | |
| /f $certPath ` | |
| /p $env:CODESIGN_PASSWORD ` | |
| /tr http://timestamp.digicert.com ` | |
| /td SHA256 ` | |
| "dist\OpenSysKit.exe" | |
| if ($LASTEXITCODE -ne 0) { throw "后端签名失败" } | |
| $sig = Get-AuthenticodeSignature "dist\OpenSysKit.exe" | |
| if (-not $sig.SignerCertificate) { throw "后端签名校验失败" } | |
| Remove-Item $certPath -Force | |
| - name: Copy DriverLoader.sys to dist | |
| shell: pwsh | |
| run: Copy-Item assets\DriverLoader.sys dist\DriverLoader.sys | |
| - name: List dist contents | |
| shell: pwsh | |
| run: Get-ChildItem dist\ -Recurse | |
| - name: Upload bundle artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: OpenSysKit-bundle-win-x64 | |
| path: dist\ | |
| if-no-files-found: error | |
| release: | |
| name: Attach to Release | |
| needs: build | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'release' | |
| steps: | |
| - name: Download bundle | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: OpenSysKit-bundle-win-x64 | |
| path: dist/ | |
| - name: Zip bundle | |
| run: | | |
| cd dist | |
| zip -r ../OpenSysKit-win-x64.zip . | |
| - name: Upload release asset | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: OpenSysKit-win-x64.zip |