发布 0.1.0:通知渠道、告警规则、令牌版本与安全加固

.gitea/workflows/release.yml

@@ -23,14 +23,15 @@ jobs:
           echo "IMAGE=${REGISTRY}/${{ gitea.repository }}" >> "$GITHUB_ENV"
           echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
 
-      - name: 下载前端最新 dist.zip 解压进嵌入目录
+      - name: 下载 DASH_VERSION 固定版本的前端 dist.zip,校验后解压进嵌入目录
         env:
           TOKEN: ${{ secrets.BUILD_TOKEN }}
         run: |
-          DASH_TAG=$(curl -fsSL -H "Authorization: token ${TOKEN}" \
-            "${{ gitea.server_url }}/api/v1/repos/${DASH_REPO}/releases/latest" | jq -r '.tag_name')
-          curl -fsSL -H "Authorization: token ${TOKEN}" \
-            -o dist.zip "${{ gitea.server_url }}/${DASH_REPO}/releases/download/${DASH_TAG}/dist.zip"
+          DASH_TAG=$(head -1 DASH_VERSION)
+          BASE="${{ gitea.server_url }}/${DASH_REPO}/releases/download/${DASH_TAG}"
+          curl -fsSL -H "Authorization: token ${TOKEN}" -o dist.zip "${BASE}/dist.zip"
+          curl -fsSL -H "Authorization: token ${TOKEN}" -o dist.zip.sha256 "${BASE}/dist.zip.sha256"
+          sha256sum -c dist.zip.sha256
           rm -rf internal/webui/dist && mkdir -p internal/webui/dist
           unzip -q dist.zip -d internal/webui/dist
           test -f internal/webui/dist/index.html
@@ -46,8 +47,9 @@ jobs:
           mkdir -p assets
           mv output/linux_amd64/oci-portal-server assets/oci-portal-server-linux-amd64
           mv output/linux_arm64/oci-portal-server assets/oci-portal-server-linux-arm64
+          (cd assets && sha256sum * > SHA256SUMS)
 
-      - name: 构建并推送多平台镜像(与上一步共享构建缓存)
+      - name: 构建并推送多平台镜像
         env:
           TOKEN: ${{ secrets.BUILD_TOKEN }}
         run: |
@@ -65,7 +67,7 @@ jobs:
           awk -v ver="${TAG#v}" '$0 ~ "^## \\[" ver "\\]" {flag=1; next} /^## \[/ && flag {exit} flag {print}' CHANGELOG.md > release-notes.md
           [ -s release-notes.md ] || echo "Release ${TAG}" > release-notes.md
 
-      - name: 创建 Release 并上传二进制附件(重跑幂等,同名附件自动替换)
+      - name: 创建 Release 并上传二进制附件
         uses: https://gitea.com/actions/gitea-release-action@v1
         with:
           token: ${{ secrets.BUILD_TOKEN }}