发布 0.1.0:通知渠道、告警规则、令牌版本与安全加固

.github/workflows/release.yml

@@ -10,7 +10,7 @@ permissions:
 
 env:
   BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
-  DASH_DOWNLOAD: https://github.com/wangdefaa/oci-portal-dash/releases/latest/download/dist.zip
+  DASH_REPO: wangdefaa/oci-portal-dash
   IMAGE: ghcr.io/wangdefaa/oci-portal
 
 jobs:
@@ -21,14 +21,18 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
-      - name: 下载前端最新 dist.zip 解压进嵌入目录
+      - name: 下载前端 dist.zip
         run: |
-          curl -fsSL -o dist.zip "$DASH_DOWNLOAD"
+          DASH_TAG=$(head -1 DASH_VERSION)
+          BASE="https://github.com/${DASH_REPO}/releases/download/${DASH_TAG}"
+          curl -fsSL -o dist.zip "${BASE}/dist.zip"
+          curl -fsSL -o dist.zip.sha256 "${BASE}/dist.zip.sha256"
+          sha256sum -c dist.zip.sha256
           rm -rf internal/webui/dist && mkdir -p internal/webui/dist
           unzip -q dist.zip -d internal/webui/dist
           test -f internal/webui/dist/index.html
 
-      - name: 构建双架构二进制(artifact stage 导出)
+      - name: 构建双架构二进制
         run: |
           BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
           echo "BUILD_TIME=${BUILD_TIME}" >> "$GITHUB_ENV"
@@ -41,6 +45,7 @@ jobs:
           mkdir -p assets
           mv output/linux_amd64/oci-portal-server assets/oci-portal-server-linux-amd64
           mv output/linux_arm64/oci-portal-server assets/oci-portal-server-linux-arm64
+          (cd assets && sha256sum * > SHA256SUMS)
           ls -lh assets/
 
       - name: 提取 CHANGELOG 版本段作为 Release 描述