Repository navigation
CI 和发版核对，准备 v1.0.0 - #2
Merged
Merged
Conversation
- python -I 下当前目录和脚本目录都不进 sys.path，`-m unittest scripts.test_repo_checks` 导入失败，authors job 每次都会挂。改成直接运行测试文件，测试自己把脚本目录加进 sys.path。 - ubuntu 上的 job 改用 python3，和 ModAVD 主仓库一致。 - README：安装规则只留一份，放回「随 ModAVD 分发」；发版和核对单独成节；v1.0.0 的命令补上 -BuildTools（没设 ANDROID_HOME 时必须给）；写明以后版本的 SHA256SUMS 只作 Release 附件、 不补进仓库；目录表加上 scripts/ 和 release/。
- test_verify_release_apk 和作者检查自测一样改成直接运行文件、自己把脚本目录加进 sys.path（python -I 下 `from scripts import` 导入失败），scripts/__init__.py 不再需要。 - 自测造的样本 manifest 不是二进制 XML，apksigner 读不出 minSdkVersion 就拒绝签名， setUpClass 必定失败；签名时加 --min-sdk-version 30。 - 自测补上签名块首尾长度字段被改、classes.dex 内容被改一个字节、中央目录被改的样本。 - verify job 是 pwsh，GitHub 只看最后一条命令的退出码：自测失败后照样往下跑， job 仍然是绿的。keytool、apksigner、自测和核对脚本之后都检查 $LASTEXITCODE。 - download-artifact 钉的 d3f86a1 实际是 v4.3.0，注释却写 v5.0.0；它和 upload-artifact v4.6.2 都还是 node20。换成 upload-artifact v7.0.2、download-artifact v8.0.2（node24）。 - release-local.ps1 编译时同样设 TZ=CET-1，和 verify-release 的构建条件一致。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
搭 CI 和发版核对，准备第一个独立版本 v1.0.0。这个 PR 包含
ci/checks分支的全部提交，ime/、testapp/、build.ps1一个字节都没改。CI（
ci.yml，替换test.yml）contents: read，checkout 不留凭据。java -version。自测加-Xlint:all -Werror。android.jar（platforms;android-36 r2）的 SHA-256，编译时设TZ=CET-1。scripts/privacy.py和 ModAVD 主仓库的同一份，扫全部跟踪文件。scripts/repo_checks.py（带单元测试），提交作者和Co-authored-by只接受维护者身份和 GitHub noreply 地址。发版核对
verify-release.yml：手动触发，输入 tag。fetch-releasejob 只有它有contents: write（取草稿 Release 要用），不 checkout、不跑仓库代码，只下载附件；verifyjob 只读，checkout tag、编 APK、用一次性 RSA-4096 密钥签名，再用scripts/verify_release_apk.py比对签名块以外的字节和中央目录，并核对发布 APK 的证书。发布后会自动再跑一遍复核。scripts/release-local.ps1：维护者本机建草稿。只用正式密钥签输入法这一个 APK，密钥库不存在就报错；-UseExistingApk给 v1.0.0 用，-DryRun只打印 gh 命令。release/1.0.0.md、release/1.0.0.SHA256SUMS.txt：v1.0.0 和 ModAVD 0.36.0 包里的components\modavd-ime.apk逐字节相同（SHA-256912c9c97…38e0e2，证书d18cca3c…e823，versionName1.0）。本地验证
fork 上的 workflow 不会跑，下面这些在本机做过，签名一律用临时密钥：
aligned.apk是217a37dd…dc26，和 0.36.0 发版时的中间产物相同。verify_release_apk.py对 0.36.0 的发布 APK 比对通过，证书d18cca3c…；证书不对、条目改一个字节都会失败。verify-release.yml的 pwsh 步骤原样取出、按 Actions 的包装方式跑：正常样本通过；自测或核对失败时步骤以非零退出。python -I直接运行测试文件）：3 项、5 项全过。作者检查、隐私扫描 0 失败。release-local.ps1：-UseExistingApk -DryRun写出正确的 SHA256SUMS、只打印 gh 命令；输入 APK 哈希不对、密钥不存在都报错退出；用临时密钥走完整构建签名，结果和单独签的一致。合并以后
v1.0.0；release-local.ps1 -Tag v1.0.0 -UseExistingApk <0.36.0 包里的 modavd-ime.apk> -BuildTools <SDK 根>\build-tools\36.1.0建草稿；verify-release，输入v1.0.0；