From efe708635623b22e24620cf283c002f633dba47c Mon Sep 17 00:00:00 2001 From: neng Date: Tue, 18 Aug 2026 10:18:49 +0800 Subject: [PATCH 1/2] build: publish browser CLI for DSH platforms --- .github/workflows/ci.yml | 6 +- .github/workflows/release.yml | 61 ++++++++++++++++--- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 13 ++-- skills/lexmount-browser/scripts/bootstrap.ps1 | 2 +- skills/lexmount-browser/scripts/bootstrap.sh | 2 +- 7 files changed, 66 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5625850..d03d162 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,15 +18,15 @@ jobs: - run: cargo clippy --all-targets --locked -- -D warnings - name: Verify release target contract run: | - ! grep -q 'x86_64-unknown-linux' .github/workflows/release.yml - ! grep -q 'x86_64-apple-darwin' .github/workflows/release.yml + grep -q 'x86_64-unknown-linux-musl' .github/workflows/release.yml + grep -q 'x86_64-apple-darwin' .github/workflows/release.yml grep -q 'aarch64-apple-darwin' .github/workflows/release.yml grep -q 'x86_64-pc-windows-msvc' .github/workflows/release.yml grep -q 'environment: macos-release' .github/workflows/release.yml grep -q './scripts/sign_and_notarize_macos.sh' .github/workflows/release.yml grep -q 'environment: cos-release' .github/workflows/release.yml grep -q './scripts/upload-release-to-cos.sh cos-upload browser-cli' .github/workflows/release.yml - grep -q 'needs: \[build-macos, build-windows\]' .github/workflows/release.yml + grep -q 'needs: \[build-linux, build-macos, build-windows\]' .github/workflows/release.yml ! grep -q 'skills/lexmount-browser/bin/' .github/workflows/release.yml - run: bash -n scripts/sign_and_notarize_macos.sh scripts/upload-release-to-cos.sh - run: sh -n scripts/package-skill.sh skills/lexmount-browser/scripts/bootstrap.sh skills/lexmount-browser/scripts/doctor.sh diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e29a155..4565ece 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,15 +9,23 @@ permissions: jobs: build-macos: - runs-on: macos-14 + strategy: + fail-fast: false + matrix: + include: + - target: aarch64-apple-darwin + runner: macos-14 + - target: x86_64-apple-darwin + runner: macos-15-intel + runs-on: ${{ matrix.runner }} environment: macos-release steps: - uses: actions/checkout@v5 - uses: dtolnay/rust-toolchain@stable with: - targets: aarch64-apple-darwin + targets: ${{ matrix.target }} - run: cargo test --locked - - run: cargo build --release --locked --target aarch64-apple-darwin + - run: cargo build --release --locked --target '${{ matrix.target }}' - name: Sign and notarize env: MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_APPLICATION_P12_BASE64 }} @@ -25,17 +33,49 @@ jobs: APPLE_NOTARY_APPLE_ID: ${{ secrets.APPLE_NOTARY_APPLE_ID }} APPLE_NOTARY_TEAM_ID: ${{ secrets.APPLE_NOTARY_TEAM_ID }} APPLE_NOTARY_APP_PASSWORD: ${{ secrets.APPLE_NOTARY_APP_PASSWORD }} - run: ./scripts/sign_and_notarize_macos.sh target/aarch64-apple-darwin/release/browser-cli + run: ./scripts/sign_and_notarize_macos.sh 'target/${{ matrix.target }}/release/browser-cli' - name: Package run: | version="${GITHUB_REF_NAME#v}" - asset="browser-cli-v${version}-aarch64-apple-darwin" - cp target/aarch64-apple-darwin/release/browser-cli "$asset" + asset="browser-cli-v${version}-${{ matrix.target }}" + cp 'target/${{ matrix.target }}/release/browser-cli' "$asset" + "./$asset" version shasum -a 256 "$asset" > "$asset.sha256" - uses: actions/upload-artifact@v4 with: - name: release-aarch64-apple-darwin - path: browser-cli-v*-aarch64-apple-darwin* + name: release-${{ matrix.target }} + path: browser-cli-v*-${{ matrix.target }}* + + build-linux: + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@v5 + - uses: dtolnay/rust-toolchain@stable + with: + targets: x86_64-unknown-linux-musl + - run: sudo apt-get update && sudo apt-get install --yes musl-tools + - run: cargo test --locked + - name: Build static Linux binary + env: + CC_x86_64_unknown_linux_musl: musl-gcc + CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc + run: cargo build --release --locked --target x86_64-unknown-linux-musl + - name: Package + run: | + version="${GITHUB_REF_NAME#v}" + asset="browser-cli-v${version}-x86_64-unknown-linux-musl" + cp target/x86_64-unknown-linux-musl/release/browser-cli "$asset" + chmod 755 "$asset" + if readelf --program-headers --wide "$asset" | grep -F 'Requesting program interpreter'; then + echo 'Linux release binary is dynamically linked' >&2 + exit 1 + fi + "./$asset" version + sha256sum "$asset" > "$asset.sha256" + - uses: actions/upload-artifact@v4 + with: + name: release-x86_64-unknown-linux-musl + path: browser-cli-v*-x86_64-unknown-linux-musl* build-windows: runs-on: windows-latest @@ -52,6 +92,7 @@ jobs: version="${GITHUB_REF_NAME#v}" asset="browser-cli-v${version}-x86_64-pc-windows-msvc.exe" cp target/x86_64-pc-windows-msvc/release/browser-cli.exe "$asset" + "./$asset" version sha256sum "$asset" > "$asset.sha256" - uses: actions/upload-artifact@v4 with: @@ -59,7 +100,7 @@ jobs: path: browser-cli-v*-x86_64-pc-windows-msvc* publish: - needs: [build-macos, build-windows] + needs: [build-linux, build-macos, build-windows] runs-on: ubuntu-latest timeout-minutes: 30 environment: cos-release @@ -89,7 +130,9 @@ jobs: mkdir cos-upload cp \ "browser-cli-v${version}-aarch64-apple-darwin" \ + "browser-cli-v${version}-x86_64-apple-darwin" \ "browser-cli-v${version}-x86_64-pc-windows-msvc.exe" \ + "browser-cli-v${version}-x86_64-unknown-linux-musl" \ cos-upload/ (cd cos-upload && sha256sum browser-cli-v* | sort -k2 > SHA256SUMS) ./scripts/upload-release-to-cos.sh cos-upload browser-cli "${version}" diff --git a/Cargo.lock b/Cargo.lock index d3c24a3..d50a7c3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1208,7 +1208,7 @@ checksum = "db13adb97ab515a3691f56e4dbab09283d0b86cb45abd991d8634a9d6f501760" [[package]] name = "lexmount-browser" -version = "1.1.11" +version = "1.1.12" dependencies = [ "base64 0.22.1", "clap", diff --git a/Cargo.toml b/Cargo.toml index cc2542e..384923c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "lexmount-browser" -version = "1.1.11" +version = "1.1.12" edition = "2024" license = "MIT" description = "Native Rust SDK and CLI for Lexmount cloud browsers" diff --git a/README.md b/README.md index cb25f5a..deed7ce 100644 --- a/README.md +++ b/README.md @@ -35,11 +35,12 @@ release from Tencent Cloud COS and verifies its SHA-256 digest. Set `LEXMOUNT_BROWSER_CLI_VERSION` or `LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL` only when testing a different published release or mirror. -Published binaries are intentionally limited to two targets: macOS arm64 and -Windows x64. The macOS binary is signed with a Developer ID Application -certificate, hardened-runtime enabled, and accepted by Apple's notarization -service before it is published. Linux and macOS Intel remain unsupported -release platforms. +The native release publishes four targets: macOS arm64, macOS Intel, Windows +x64, and static Linux x64. Both macOS binaries are signed with a Developer ID +Application certificate, hardened-runtime enabled, and accepted by Apple's +notarization service before publication. The WorkBuddy Skill continues to +select only its existing macOS arm64 and Windows x64 targets; the additional +assets are consumed by integrations such as the DSH wrapper. The release workflow reads the signing certificate and notarization credentials from the `macos-release` GitHub environment. It requires @@ -47,7 +48,7 @@ from the `macos-release` GitHub environment. It requires `MACOS_DEVELOPER_ID_P12_PASSWORD`, `APPLE_NOTARY_APPLE_ID`, `APPLE_NOTARY_TEAM_ID`, and `APPLE_NOTARY_APP_PASSWORD`. -The publish job uploads both platform binaries and their checksum manifest to +The publish job uploads all four platform binaries and their checksum manifest to Tencent Cloud COS through the `cos-release` GitHub environment. It requires `TENCENT_CLOUD_SECRET_ID` and `TENCENT_CLOUD_SECRET_KEY` secrets plus `COS_BUCKET`, `COS_REGION`, `COS_PUBLIC_BASE_URL`, and `COS_OBJECT_PREFIX` diff --git a/skills/lexmount-browser/scripts/bootstrap.ps1 b/skills/lexmount-browser/scripts/bootstrap.ps1 index e7afd75..af04df2 100644 --- a/skills/lexmount-browser/scripts/bootstrap.ps1 +++ b/skills/lexmount-browser/scripts/bootstrap.ps1 @@ -12,7 +12,7 @@ function Invoke-Tls12Download { } } -$version = if ($env:LEXMOUNT_BROWSER_CLI_VERSION) { $env:LEXMOUNT_BROWSER_CLI_VERSION } else { "1.1.11" } +$version = if ($env:LEXMOUNT_BROWSER_CLI_VERSION) { $env:LEXMOUNT_BROWSER_CLI_VERSION } else { "1.1.12" } $downloadBaseUrl = if ($env:LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL) { $env:LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL.TrimEnd('/') } else { "https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli" } $architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE } if ($architecture -ne "AMD64") { throw "Only Windows x64 is supported" } diff --git a/skills/lexmount-browser/scripts/bootstrap.sh b/skills/lexmount-browser/scripts/bootstrap.sh index ee7427a..d316f9f 100755 --- a/skills/lexmount-browser/scripts/bootstrap.sh +++ b/skills/lexmount-browser/scripts/bootstrap.sh @@ -1,7 +1,7 @@ #!/bin/sh set -eu -version="${LEXMOUNT_BROWSER_CLI_VERSION:-1.1.11}" +version="${LEXMOUNT_BROWSER_CLI_VERSION:-1.1.12}" download_base_url="${LEXMOUNT_BROWSER_CLI_DOWNLOAD_BASE_URL:-https://cli-bin-1377899528.cos.ap-nanjing.myqcloud.com/releases/browser-cli}" repo="${download_base_url%/}/v${version}" case "$(uname -s)-$(uname -m)" in From 8a779d5155de1d5166d2e1f653b21b59fe3983da Mon Sep 17 00:00:00 2001 From: neng Date: Tue, 18 Aug 2026 10:42:39 +0800 Subject: [PATCH 2/2] ci: validate browser CLI release tags --- .github/workflows/ci.yml | 2 ++ .github/workflows/release.yml | 20 +++++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d03d162..d6a599e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,6 +27,8 @@ jobs: grep -q 'environment: cos-release' .github/workflows/release.yml grep -q './scripts/upload-release-to-cos.sh cos-upload browser-cli' .github/workflows/release.yml grep -q 'needs: \[build-linux, build-macos, build-windows\]' .github/workflows/release.yml + grep -q 'git merge-base --is-ancestor' .github/workflows/release.yml + grep -q 'test "${GITHUB_REF_NAME}" = "v${version}"' .github/workflows/release.yml ! grep -q 'skills/lexmount-browser/bin/' .github/workflows/release.yml - run: bash -n scripts/sign_and_notarize_macos.sh scripts/upload-release-to-cos.sh - run: sh -n scripts/package-skill.sh skills/lexmount-browser/scripts/bootstrap.sh skills/lexmount-browser/scripts/doctor.sh diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4565ece..db920bb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,10 +5,24 @@ on: tags: ["v*"] permissions: - contents: write + contents: read jobs: + validate-release: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + with: + fetch-depth: 0 + - name: Validate tag and source commit + run: | + version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n 1)" + test -n "${version}" + test "${GITHUB_REF_NAME}" = "v${version}" + git merge-base --is-ancestor "${GITHUB_SHA}" origin/main + build-macos: + needs: validate-release strategy: fail-fast: false matrix: @@ -47,6 +61,7 @@ jobs: path: browser-cli-v*-${{ matrix.target }}* build-linux: + needs: validate-release runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v5 @@ -78,6 +93,7 @@ jobs: path: browser-cli-v*-x86_64-unknown-linux-musl* build-windows: + needs: validate-release runs-on: windows-latest steps: - uses: actions/checkout@v5 @@ -104,6 +120,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 environment: cos-release + permissions: + contents: write steps: - uses: actions/checkout@v5 - uses: actions/download-artifact@v4