ci: 梳理 Actions —— 修复矩阵遗漏、统一版本与命名

.github/workflows/auto-deploy.yml

@@ -1,8 +1,8 @@
-name: 02 Auto deploy clitools (Release)
+name: Release · 02 Deploy Clitools
 
 on:
   workflow_run:
-    workflows: ["01 Auto publish packages (Release)"]
+    workflows: ["Release · 01 Publish Packages"]
     types:
       - completed
     branches:
@@ -11,6 +11,11 @@ on:
 permissions:
   contents: read
 
+# 同一 release 分支的部署串行执行；01 重跑完成后 02 自然跟上
+concurrency:
+  group: release-deploy-${{ github.event.workflow_run.head_branch || github.ref }}
+  cancel-in-progress: false
+
 jobs:
   setup_environment:
     if: ${{ github.event.workflow_run.conclusion == 'success'}}
@@ -240,7 +245,7 @@ jobs:
 
     steps:
       - name: Download Windows artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: windows-artifacts
           path: ./artifacts/windows

.github/workflows/auto-publish.yml

@@ -1,4 +1,4 @@
-name: 01 Auto publish packages (Release)
+name: Release · 01 Publish Packages
 
 on:
   push:
@@ -8,6 +8,11 @@ on:
 permissions:
   contents: read
 
+# 同一 release 分支重复 push 不并行发布；旧的发布跑完为止
+concurrency:
+  group: release-publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   create_release:
     runs-on: ubuntu-latest
@@ -257,7 +262,7 @@ jobs:
           echo "$sum  $name" | tee "checksums/${{ matrix.platform }}-${{ matrix.arch }}.txt"
 
       - name: Upload checksum fragment
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: checksums-${{ matrix.platform }}-${{ matrix.arch }}
           path: checksums/
@@ -320,7 +325,7 @@ jobs:
           echo "VERSION=$VERSION" >> "$GITHUB_ENV"
 
       - name: Download checksum fragments
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: checksums-*
           path: checksums
@@ -333,7 +338,7 @@ jobs:
           cat SHA256SUMS.txt
 
       - name: Upload SHA256SUMS.txt to release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-name: "CodeQL Advanced"
+name: "Security · CodeQL"
 
 # Replaces GitHub's default CodeQL setup: its C/C++ autobuild tries a full
 # cmake build of this project (downloads ONNXRuntime, platform toolchains…)

.github/workflows/dependabot-automerge.yml

@@ -1,4 +1,4 @@
-name: Dependabot auto-merge
+name: Deps · Dependabot Auto-merge
 
 # Enables auto-merge (squash) on Dependabot PRs for non-major updates.
 # Major bumps still require human review & manual merge.

.github/workflows/issue-classifier.yml

@@ -1,4 +1,4 @@
-name: Issue 分类器
+name: Community · Issue Classifier
 on:
   issues:
     types: [opened, reopened]

.github/workflows/smoke.yml

@@ -1,4 +1,4 @@
-name: <Test> Inference Smoke
+name: CI · Inference Smoke
 
 # Manual / on-demand inference smoke gate. Downloads the sd-turbo ONNX set
 # from HF (~4.8GB, fast on runners) and runs the turbo slice of the smoke

.github/workflows/test-cross.yml

@@ -1,4 +1,4 @@
-name: <Test> Cross Compiling
+name: CI · Cross Build
 
 on:
   push:
@@ -20,6 +20,7 @@ on:
       - '.gitignore'
       - '.editorconfig'
       - '.clang-format'
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -92,6 +93,11 @@ jobs:
             platform: linux
           - os: windows-latest
             platform: macos
+          # Android builds only run on the ubuntu leg (aligned with auto-publish.yml)
+          - os: windows-latest
+            platform: android
+          - os: macos-latest
+            platform: android
           - os: ubuntu-latest
             platform: windows
           - os: ubuntu-latest

.github/workflows/test-native.yml

@@ -1,4 +1,4 @@
-name: <Test> Native Compiling
+name: CI · Native Build
 
 permissions:
   contents: read
@@ -98,6 +98,11 @@ jobs:
             platform: linux
           - os: windows-latest
             platform: macos
+          # Android builds only run on the ubuntu leg (aligned with auto-publish.yml)
+          - os: windows-latest
+            platform: android
+          - os: macos-latest
+            platform: android
           - os: ubuntu-latest
             platform: windows
           - os: ubuntu-latest

.github/workflows/weekly-report.yml

@@ -1,12 +1,12 @@
-name: 周报生成
+name: Community · Weekly Report
 
 on:
   schedule:
     - cron: '0 1 * * 6'  # 每周六 UTC 1:00 = 北京时间 9:00
   workflow_dispatch:     # 支持手动触发
 
 permissions:
-  discussions: write
+  discussions: read
   issues: read
   pull-requests: read
 
@@ -216,6 +216,8 @@ jobs:
     needs: collect
     runs-on: ubuntu-latest
     if: needs.collect.outputs.hasContent == 'true'
+    permissions:
+      discussions: write   # 仅发布 job 需要写权限
     steps:
       - name: 创建或追加周报 Discussion
         uses: actions/github-script@v7

docs/assistant-tooling.md

@@ -97,7 +97,7 @@ bash scripts/import-labels.sh
 ### 触发方式
 
 - **定时**: 每周六 UTC 1:00（北京时间 9:00）
-- **手动**: GitHub Actions 页面 → Run workflow
+- **手动**: GitHub Actions 页面 → 「Community · Weekly Report」→ Run workflow
 
 ### 逻辑