From b59553d00a40fed7e0cfa4238e2010bc987dc747 Mon Sep 17 00:00:00 2001 From: argszero Date: Thu, 6 Aug 2026 10:30:48 +0800 Subject: [PATCH] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20build-release=20wo?= =?UTF-8?q?rkflow=20=E8=A7=A3=E6=9E=90=E5=A4=B1=E8=B4=A5=20=E2=80=94=20if:?= =?UTF-8?q?=20=E4=B8=AD=E7=A6=81=E6=AD=A2=20secrets=20=E4=B8=8A=E4=B8=8B?= =?UTF-8?q?=E6=96=87=EF=BC=8C=E6=94=B9=E7=BB=8F=20job=20=E7=BA=A7=20env=20?= =?UTF-8?q?=E4=BC=A0=E9=80=92=EF=BC=88#441=20=E5=BC=95=E5=85=A5=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #441 在 if: 条件中直接引用 secrets.X != ''（第 54、122 行）， GitHub Actions 的 if: 上下文不支持 secrets（可用: env/github/inputs/ job/matrix/needs/runner/steps/strategy/vars），导致 workflow 解析失败， push 后 run 创建即失败、零 job（f26bf27 与 93e24d7 均复现，报 "This run likely failed because of a workflow file issue"）。 修复：将 secrets 提升为 job 级 env（job env 允许 secrets context， 未配置时求值为空字符串），if: 改用 env.MACOS_SIGNING_* != '' 判断； CSC_LINK/CSC_KEY_PASSWORD 同步改引用 env 变量。签名降级逻辑不变 （Secret 未配 → 跳过签名步骤、CSC_LINK 为空）。 验证：actionlint v1.7.12 校验 build-release.yml + test.yml 全绿（修复前 2 处 expression 报错）；pytest 473 passed；import check + emrg --help OK。 --- .github/workflows/build-release.yml | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 76969ff5..afa52c5d 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -36,6 +36,12 @@ jobs: arch: x64 artifact: EMRG-*-windows-x64.exe runs-on: ${{ matrix.os }} + env: + # secrets 不能在 if: 中直接引用（GitHub Actions 硬限制，否则 workflow 解析失败）。 + # 先提升为 job 级 env（允许 secrets context）；未配置时求值为空字符串 → 跳过降级。 + MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }} + MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }} + MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }} steps: - uses: actions/checkout@v5 @@ -51,11 +57,8 @@ jobs: # ── macOS 代码签名（rant 2026-08-06T10:06:55 P1/P2；Secret 未配则跳过降级）── - name: Import signing certificate (macOS only) - if: runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != '' + if: runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != '' shell: bash - env: - MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }} - MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }} run: | echo "$MACOS_SIGNING_P12_BASE64" | base64 --decode > /tmp/signing.p12 security create-keychain -p 'ci-temp' /tmp/ci.keychain @@ -101,8 +104,8 @@ jobs: env: # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign # （含 hardened runtime；Secret 未配时为空 → 不签名，保持现状降级） - CSC_LINK: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }} - CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_PASSWORD || '' }} + CSC_LINK: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }} + CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_PASSWORD || '' }} run: | npm ci npm run dist @@ -119,10 +122,8 @@ jobs: # ── pkg 签名（macOS only，P2；Secret 未配则跳过降级）── - name: Sign pkg (macOS only) - if: runner.os == 'macOS' && secrets.MACOS_SIGNING_IDENTITY != '' + if: runner.os == 'macOS' && env.MACOS_SIGNING_IDENTITY != '' shell: bash - env: - MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }} run: | PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)" if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi