Recover release workflow (#14)

Author: AnlangA

.github/workflows/release.yml

@@ -88,10 +88,13 @@ jobs:
           retention-days: 7
 
   build:
-    name: Build signed ${{ matrix.name }} installer
+    name: Build ${{ matrix.name }} installer
     needs: validate
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
+    env:
+      WINDOWS_SIGNING_AVAILABLE: ${{ secrets.WINDOWS_CERTIFICATE != '' && secrets.WINDOWS_CERTIFICATE_PASSWORD != '' }}
+      APPLE_SIGNING_AVAILABLE: ${{ secrets.APPLE_CERTIFICATE != '' && secrets.APPLE_CERTIFICATE_PASSWORD != '' && secrets.APPLE_SIGNING_IDENTITY != '' && secrets.APPLE_ID != '' && secrets.APPLE_PASSWORD != '' && secrets.APPLE_TEAM_ID != '' }}
     strategy:
       fail-fast: false
       matrix:
@@ -126,7 +129,8 @@ jobs:
             patchelf \
             libudev-dev \
             dbus-x11 \
-            xvfb
+            xvfb \
+            webkit2gtk-driver
 
       - name: Setup pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
@@ -147,7 +151,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Import Windows signing certificate
-        if: runner.os == 'Windows'
+        if: runner.os == 'Windows' && env.WINDOWS_SIGNING_AVAILABLE == 'true'
         shell: pwsh
         env:
           WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
@@ -165,7 +169,7 @@ jobs:
           "WINDOWS_CERTIFICATE_THUMBPRINT=$($cert.Thumbprint)" >> $env:GITHUB_ENV
 
       - name: Verify Apple signing and notarization secrets
-        if: runner.os == 'macOS'
+        if: runner.os == 'macOS' && env.APPLE_SIGNING_AVAILABLE == 'true'
         shell: bash
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -180,23 +184,34 @@ jobs:
             test -n "${!name}" || { echo "$name is required" >&2; exit 1; }
           done
 
-      - name: Build signed Windows NSIS installer
+      - name: Report unsigned platform fallback
+        if: >-
+          (runner.os == 'Windows' && env.WINDOWS_SIGNING_AVAILABLE != 'true') ||
+          (runner.os == 'macOS' && env.APPLE_SIGNING_AVAILABLE != 'true')
+        shell: bash
+        run: echo "::warning::Platform signing secrets are not configured; this installer will be explicitly marked unsigned."
+
+      - name: Build Windows NSIS installer
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
-          $config = @{
-            bundle = @{
-              windows = @{
-                certificateThumbprint = $env:WINDOWS_CERTIFICATE_THUMBPRINT
-                digestAlgorithm = 'sha256'
-                timestampUrl = 'http://timestamp.digicert.com'
+          if ($env:WINDOWS_SIGNING_AVAILABLE -eq 'true') {
+            $config = @{
+              bundle = @{
+                windows = @{
+                  certificateThumbprint = $env:WINDOWS_CERTIFICATE_THUMBPRINT
+                  digestAlgorithm = 'sha256'
+                  timestampUrl = 'http://timestamp.digicert.com'
+                }
               }
-            }
-          } | ConvertTo-Json -Compress -Depth 5
-          pnpm tauri:build --target ${{ matrix.target }} --bundles nsis --config $config
+            } | ConvertTo-Json -Compress -Depth 5
+            pnpm tauri:build --target ${{ matrix.target }} --bundles nsis --config $config
+          } else {
+            pnpm tauri:build --target ${{ matrix.target }} --bundles nsis
+          }
 
       - name: Build signed and notarized macOS DMG
-        if: runner.os == 'macOS'
+        if: runner.os == 'macOS' && env.APPLE_SIGNING_AVAILABLE == 'true'
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -206,6 +221,10 @@ jobs:
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: pnpm tauri:build --target ${{ matrix.target }} --bundles dmg
 
+      - name: Build unsigned macOS DMG
+        if: runner.os == 'macOS' && env.APPLE_SIGNING_AVAILABLE != 'true'
+        run: pnpm tauri:build --target ${{ matrix.target }} --bundles dmg
+
       - name: Build Linux AppImage and deb installers
         if: runner.os == 'Linux'
         run: pnpm tauri:build --target ${{ matrix.target }} --bundles appimage,deb
@@ -229,8 +248,15 @@ jobs:
           New-Item -ItemType Directory -Force release-assets | Out-Null
           $installers = Get-ChildItem 'target/${{ matrix.target }}/release/bundle/nsis/*.exe'
           if ($installers.Count -ne 1) { throw "expected one NSIS installer, found $($installers.Count)" }
-          $signature = Get-AuthenticodeSignature $installers[0].FullName
-          if ($signature.Status -ne 'Valid') { throw "invalid Authenticode signature: $($signature.Status)" }
+          if ($env:WINDOWS_SIGNING_AVAILABLE -eq 'true') {
+            $signature = Get-AuthenticodeSignature $installers[0].FullName
+            if ($signature.Status -ne 'Valid') { throw "invalid Authenticode signature: $($signature.Status)" }
+            '- Windows NSIS: Authenticode signed and verified.' |
+              Set-Content release-assets/windows-signing-status.txt
+          } else {
+            '- Windows NSIS: unsigned (signing secrets were not configured).' |
+              Set-Content release-assets/windows-signing-status.txt
+          }
 
           $installRoot = Join-Path $env:RUNNER_TEMP 'bbcom-smoke'
           Start-Process -FilePath $installers[0].FullName -ArgumentList '/S', "/D=$installRoot" -Wait
@@ -261,8 +287,16 @@ jobs:
           dmg=(target/${{ matrix.target }}/release/bundle/dmg/*.dmg)
           test "${#app[@]}" -eq 1
           test "${#dmg[@]}" -eq 1
-          codesign --verify --deep --strict --verbose=2 "${app[0]}"
-          xcrun stapler validate "${dmg[0]}"
+          mkdir -p release-assets
+          if [[ "$APPLE_SIGNING_AVAILABLE" == 'true' ]]; then
+            codesign --verify --deep --strict --verbose=2 "${app[0]}"
+            xcrun stapler validate "${dmg[0]}"
+            echo '- macOS DMG: Developer ID signed and notarized.' \
+              > release-assets/macos-signing-status.txt
+          else
+            echo '- macOS DMG: unsigned and not notarized (signing secrets were not configured).' \
+              > release-assets/macos-signing-status.txt
+          fi
 
           mount_dir="$RUNNER_TEMP/bbcom-dmg"
           install_dir="$RUNNER_TEMP/bbcom-smoke-applications"
@@ -309,7 +343,6 @@ jobs:
           test ! -e "$installed_app"
           hdiutil detach "$mount_dir"
           rm -rf "$mount_dir"
-          mkdir -p release-assets
           cp "${dmg[0]}" release-assets/
 
       - name: Verify, launch, and uninstall Linux installers
@@ -350,6 +383,8 @@ jobs:
           test "$(dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null || true)" != installed
           mkdir -p release-assets
           cp "${appimage[0]}" "${deb[0]}" release-assets/
+          echo '- Linux AppImage/deb: Sigstore keyless bundles are attached by the release job.' \
+            > release-assets/linux-signing-status.txt
 
       - name: Upload installer
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
@@ -387,11 +422,13 @@ jobs:
           appimage=(release/*.AppImage)
           deb=(release/*.deb)
           sbom=(release/*.cdx.json)
+          signing_status=(release/*-signing-status.txt)
           test "${#nsis[@]}" -eq 1
           test "${#dmg[@]}" -eq 1
           test "${#appimage[@]}" -eq 1
           test "${#deb[@]}" -eq 1
           test "${#sbom[@]}" -eq 1
+          test "${#signing_status[@]}" -eq 3
           test -f release/frontend-licenses.json
           test -f release/rust-licenses.json
 
@@ -410,17 +447,24 @@ jobs:
         run: |
           (
             cd release
+            checksum_tmp="../SHA256SUMS.tmp"
             find . -maxdepth 1 -type f ! -name SHA256SUMS -print0 \
               | sort -z \
               | xargs -0 sha256sum \
-              | sed 's#  \./#  #' > SHA256SUMS
+              | sed 's#  \./#  #' > "$checksum_tmp"
+            mv "$checksum_tmp" SHA256SUMS
           )
           version="${GITHUB_REF_NAME#v}"
           awk -v heading="## [$version]" '
             index($0, heading) == 1 { found=1; next }
             found && /^## \[/ { exit }
             found { print }
           ' CHANGELOG.md > release-notes.md
+          {
+            echo
+            echo '## Artifact signing status'
+            cat release/*-signing-status.txt
+          } >> release-notes.md
           test -s release-notes.md
 
       - name: Attest release artifacts

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to bbcom are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-07-11
+
+### Release workflow recovery
+
+- Installed the WebKit WebDriver required by Tauri's native Linux smoke test.
+- Made Windows Authenticode and Apple signing/notarization conditional on the
+  complete platform secret set, while retaining unsigned installer builds when
+  those credentials are unavailable.
+- Added per-platform signing-status manifests to release assets and draft notes
+  so unsigned fallbacks are explicit and auditable. Linux installers continue
+  to receive Sigstore keyless bundles and GitHub provenance attestations.
+
 ## [0.7.0] - 2026-07-11
 
 ### Z.ai client API migration

Cargo.lock

@@ -53,7 +53,8 @@ sessions, checksums, OS credential storage, and bounded AI client calls.
   with model validation, request limits/cancellation, role-separated prompts,
   and risk classification.
 - **Desktop polish** with dark/light themes, English/Chinese UI catalogs,
-  persisted settings, keyboard shortcuts, and signed installer releases.
+  persisted settings, keyboard shortcuts, and installer releases with explicit
+  per-platform signing status.
 
 ## Screenshots
 
@@ -249,11 +250,12 @@ commit, it rejects unstaged or non-ignored untracked files. Do not use
 `--no-verify` to bypass it.
 
 GitHub Actions is intentionally release-only: it runs after an exact
-`vX.Y.Z` tag and performs signed, three-platform release assembly and smoke
-verification rather than repeating local PR checks.
+`vX.Y.Z` tag and performs three-platform release assembly and smoke verification
+rather than repeating local PR checks. Windows and macOS platform signing is
+enabled when the corresponding complete secret set is configured.
 
-Tags matching `vX.Y.Z` produce a draft release containing signed Windows NSIS
-and notarized macOS arm64 DMG installers, Linux AppImage/deb packages,
+Tags matching `vX.Y.Z` produce a draft release containing Windows NSIS, macOS
+arm64 DMG, Linux AppImage/deb packages, explicit signing-status manifests,
 SHA-256 checksums, a CycloneDX SBOM, license inventories, Sigstore bundles, and
 GitHub build provenance. No automatic updater is shipped in v0.5.0.
 

README.md

@@ -47,7 +47,7 @@
 - **AI 助手**：Linux/BusyBox 命令生成与串口日志分析，包含模型校验、
   请求限制/取消、角色隔离提示词和风险分级。
 - **桌面体验**：深色/浅色主题、中英文界面、本地设置持久化、快捷键
-  和签名安装包发布。
+  和带明确平台签名状态的安装包发布。
 
 ## 截图
 
@@ -236,12 +236,13 @@ P0 覆盖率、browser mock E2E、架构检查、审计、Rust fmt/Clippy/test/l
 `cargo-llvm-cov` 与 `cargo-audit` 版本。为确保校验对象正是将要提交的 index，
 hook 会拒绝未暂存或非忽略的未跟踪文件；请勿使用 `--no-verify` 绕过它。
 
-GitHub Actions 仅承担 release：精确 `vX.Y.Z` 标签触发后执行三平台签名打包与
-smoke 验证，不再重复运行本地 PR 检查。
+GitHub Actions 仅承担 release：精确 `vX.Y.Z` 标签触发后执行三平台打包与
+smoke 验证，不再重复运行本地 PR 检查。Windows 与 macOS 在完整签名 Secret
+已经配置时启用平台签名。
 
-`vX.Y.Z` 标签会生成草稿 release，其中包含已签名 Windows NSIS、已签名并
-公证的 macOS arm64 DMG、Linux AppImage/deb、SHA-256、CycloneDX SBOM、
-许可证清单、Sigstore bundle 和 GitHub 构建来源证明。v0.5.0 不提供自动更新器。
+`vX.Y.Z` 标签会生成草稿 release，其中包含 Windows NSIS、macOS arm64 DMG、
+Linux AppImage/deb、明确的签名状态清单、SHA-256、CycloneDX SBOM、许可证
+清单、Sigstore bundle 和 GitHub 构建来源证明。v0.5.0 不提供自动更新器。
 
 `pnpm install` 会自动安装 hook。提交 PR 前，如本次提交尚未运行门禁，请手动
 执行同一命令：

README.zh-CN.md

@@ -5,9 +5,12 @@
 configuration must match it and the local quality gate must pass before tagging.
 
 Only an exact `vX.Y.Z` tag whose commit is on protected `master` can start the
-release workflow. It creates a draft release after all three signed installer
-builds, checksums, SBOM, license inventories, Sigstore bundles, and provenance
-attestations are present. Publish the draft only after the platform smoke tests
-have been reviewed.
+release workflow. It creates a draft release after all three installer builds,
+checksums, SBOM, license inventories, Sigstore bundles, and provenance
+attestations are present. Windows Authenticode signing and Apple Developer ID
+signing/notarization are applied when their complete secret sets are configured;
+otherwise the draft and attached status manifests explicitly mark those
+installers unsigned. Publish the draft only after the platform smoke tests and
+signing-status manifests have been reviewed.
 
 No updater metadata is produced or published.

RELEASING.md

@@ -1,7 +1,7 @@
 {
   "name": "bbcom",
   "private": true,
-  "version": "0.7.0",
+  "version": "0.7.1",
   "type": "module",
   "packageManager": "pnpm@11.11.0",
   "engines": {

package.json

@@ -1,6 +1,6 @@
 [package]
 name = "bbcom"
-version = "0.7.0"
+version = "0.7.1"
 description = "Serial Port Assistant"
 edition = "2024"
 rust-version = "1.97"

src-tauri/Cargo.toml

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2.0.0",
   "productName": "bbcom",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "identifier": "com.bbcom.app",
   "build": {
     "beforeDevCommand": "pnpm dev",