From 8f0e0b3f9aedf86b5790682a6a929a4eda6d9d71 Mon Sep 17 00:00:00 2001
From: argszero <argszero@gmail.com>
Date: Thu, 6 Aug 2026 11:14:41 +0800
Subject: [PATCH] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20windows=20?=
 =?UTF-8?q?=E6=9E=84=E5=BB=BA=E5=A4=B1=E8=B4=A5=20=E2=80=94=20CSC=5FLINK?=
 =?UTF-8?q?=20=E7=A9=BA=E5=AD=97=E7=AC=A6=E4=B8=B2=20env=20=E8=A7=A6?=
 =?UTF-8?q?=E5=8F=91=20electron-builder=20=E8=B7=AF=E5=BE=84=E8=A7=A3?=
 =?UTF-8?q?=E6=9E=90=20bug=EF=BC=88#441=20=E5=9B=9E=E5=BD=92=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

v0.2.7 build-release（run 31067519195）windows-x64 job 失败：
  ⨯ Env WIN_CSC_LINK is not correct, cannot resolve: D:\a\emrg\emrg\emrg\gui not a file

根因：#441 给 Build GUI 步骤加 CSC_LINK/CSC_KEY_PASSWORD env，非 macOS
上表达式求值为空字符串。electron-builder 将空字符串 CSC_LINK 视为
已设置并解析为相对路径（working-directory）→ 失败。

修复：移除 step env，改为 run 脚本内条件 export（仅 macOS + Secret
存在时设置）。Windows/Linux 完全不设置 → electron-builder 走不签名
分支（保持 #441 之前行为）。macOS 签名降级逻辑不变。

验证：actionlint 全绿（exit 0）；pytest 473 passed；import + --help OK。
---
 .github/workflows/build-release.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index ba38843e..0530d177 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -107,12 +107,16 @@ jobs:
       - name: Build GUI (electron-builder)
         working-directory: emrg/gui
         shell: bash
-        env:
-          # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign
-          # （含 hardened runtime；Secret 未配时为空 → 不签名，保持现状降级）
-          CSC_LINK: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
-          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_PASSWORD || '' }}
         run: |
+          # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign
+          # （含 hardened runtime；Secret 未配时不设置 → 不签名，保持现状降级）
+          # ⚠️ 不能设为空字符串 env：electron-builder 会把空 CSC_LINK 当"已设置"并
+          #    解析为相对路径 → 失败（v0.2.7 windows 构建 "WIN_CSC_LINK is not
+          #    correct, cannot resolve: ... not a file" 根因）。仅在 macOS 条件 export。
+          if [ "$RUNNER_OS" = "macOS" ] && [ -n "$MACOS_SIGNING_P12_BASE64" ]; then
+            export CSC_LINK="file:///tmp/signing.p12"
+            export CSC_KEY_PASSWORD="$MACOS_SIGNING_P12_PASSWORD"
+          fi
           npm ci
           npm run dist