edgeever · default

Entrypoint: .wrangler/edgeever-worker/index.js

Build: bun scripts/build-cloudflare-worker.mjs

Static assets: apps/web/dist · single-page-application · Worker first: ["/api/*","/mcp","/__scheduled"]

• DB → D1
• RESOURCES → R2
• ASSETS → Static assets

Require Play-signed Draft APK · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Validate matching Draft Releaserelease="$(gh release view "$RELEASE_TAG" \ --repo "$GITHUB_REPOSITORY" \ --json isDraft,isPrerelease,tagName,targetCommitish)" test "$(jq -r '.isDraft' <<<"$release")" = "true" test "$(jq -r '.isPrerelease' <<<"$release")" = "false" test "$(jq -r '.tagName' <<<"$release")" = "$RELEASE_TAG" release_target="$(jq -r '.targetCommitish' <<<"$release")" test -n "$release_target" echo "target_commitish=$release_target" >> "$GITHUB_OUTPUT"
2. Check out the immutable Draft targetactions/checkout@v5
3. Verify the checked-out Draft targettest "$(git rev-parse HEAD)" = "$(git rev-parse "${RELEASE_TARGET}^{commit}")"
4. Download the Draft Android APKmkdir -p "$RUNNER_TEMP/android-release" gh release download "$RELEASE_TAG" \ --repo "$GITHUB_REPOSITORY" \ --pattern 'edgeever-android-v*-arm64-v8a.apk' \ --dir "$RUNNER_TEMP/android-release" test "$(find "$RUNNER_TEMP/android-release" -type f -name 'edgeever-android-v*-arm64-v8a.apk' | wc -l | tr -d ' ')" = "1" apk_path="$(find "$RUNNER_TEMP/android-release" -type f -name 'edgeever-android-v*-arm64-v8a.apk' -print -quit)" echo "apk_path=$apk_path" >> "$GITHUB_ENV"
5. Require the Play app-signing certificatetest -n "$ANDROID_PLAY_APP_SIGNER_SHA256" node scripts/verify-android-apk-signature.mjs "$apk_path"

Build and deploy Demo Worker · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Checkout Demo sourceactions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Install dependenciesbun install --frozen-lockfile
4. Resolve Release metadataif [ -z "${RELEASE_PUBLISHED_AT}" ]; then RELEASE_PUBLISHED_AT="$(gh api repos/tianma-if/edgeever/releases/latest --jq '.published_at')" fi echo "EDGE_EVER_RELEASED_AT=${RELEASE_PUBLISHED_AT}" >> "${GITHUB_ENV}"
5. Deploy Demo Workerbun run deploy
6. Verify Demo URLcurl --fail --silent --show-error --location --max-time 20 "https://${DEMO_DEPLOY_DOMAIN}/"Condition: env.DEMO_DEPLOY_DOMAIN != ''

Build and deploy personal Worker · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Resolve formal Releaseset -euo pipefail release_tag="${EVENT_RELEASE_TAG}" release_published_at="${EVENT_RELEASE_PUBLISHED_AT}" if [[ -z "${release_tag}" ]]; then release_tag="$(gh api repos/tianma-if/edgeever/releases/latest --jq '.tag_name')" release_published_at="$(gh api repos/tianma-if/edgeever/releases/latest --jq '.published_at')" fi if [[ ! "${release_tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "Expected a formal vX.Y.Z Release, got ${release_tag}" >&2 exit 1 fi { echo "tag=${release_tag}" echo "version…
2. Checkout personal instance sourceactions/checkout@v5
3. Set up Bunoven-sh/setup-bun@v2
4. Install dependenciesbun install --frozen-lockfile
5. Deploy personal Workerbun run deploy
6. Verify deployed Release versionnode --input-type=module <<'NODE' const rawBaseUrl = process.env.EDGE_EVER_DEPLOYMENT_URL?.trim() ?? ""; const expectedVersion = process.env.EXPECTED_RELEASE_VERSION?.trim() ?? ""; if (!rawBaseUrl || !expectedVersion) { throw new Error("Deployment URL and expected Release version are required."); } const baseUrl = /^[a-z][a-z0-9+.-]*:\/\//i.test(rawBaseUrl) ? rawBaseUrl : `https://${rawBaseUrl}`; const releaseUrl = new URL("/api/release", `${baseUrl.replace(/\/$/, "")}/`); let actualVersion = "…

Deploy Cloudflare Pages · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Checkoutactions/checkout@v5
2. Setup Bunoven-sh/setup-bun@v2
3. Install dependenciesbun install --frozen-lockfile
4. Build sitebun run build:site
5. Deploy sitecloudflare/wrangler-action@v3Wrangler command: pages deploy apps/site/dist --project-name=edgeever-official

Wrangler runner (${{ matrix.os }}) · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Checkoutactions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Install dependenciesbun install --frozen-lockfile
4. Launch project-local Wranglerbun scripts/run-wrangler.mjs --version
5. Test deployment toolingbun test tests/wrangler-runner.test.ts tests/deployment-verify.test.ts tests/deployment-entrypoints.test.ts

Plan desktop release asset · no job dependencies declared

Condition: ${{ github.repository == 'tianma-if/edgeever' && ( github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ) }}

1. Check out sourceactions/checkout@v5
2. Validate Draft Release targetexpected_version="$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")" test "$RELEASE_TAG" = "v${expected_version}" test "$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json isDraft --jq '.isDraft')" = "true" target_commitish="$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json targetCommitish --jq '.targetCommitish')" test "$(git rev-parse "${target_commitish}^{commit}")" = "$(git rev-parse "${GITHUB_SHA}^{commit}")"Condition: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
3. Compare with previous formal releasemapfile -t release_tags < <( gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \ --jq '.[] | select(.draft == false and .prerelease == false) | .tag_name' ) previous_tag="" for release_tag in "${release_tags[@]}"; do if [[ "$release_tag" != "$CURRENT_TAG" ]]; then previous_tag="$release_tag" break fi done test -n "$previous_tag" git fetch origin "refs/tags/${previous_tag}:refs/tags/${previous_tag}" echo "previous_tag=$previous_tag" >> "$GITHUB_OUTPUT" plan_output="$(node scripts/plan-na…

Reuse desktop release assets · after release-plan

Condition: ${{ github.repository == 'tianma-if/edgeever' && github.event_name == 'workflow_dispatch' && inputs.release_tag != '' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'false' && needs.release-plan.outputs.rebuild == 'false' }}

1. Copy latest compatible desktop assets without renamingmkdir -p "$RUNNER_TEMP/native-assets" gh release download "$PREVIOUS_TAG" \ --repo "$GITHUB_REPOSITORY" \ --pattern 'EdgeEver-*-mac-arm64.dmg' \ --pattern 'EdgeEver-*-mac-arm64.dmg.blockmap' \ --pattern 'EdgeEver-*-mac-arm64.zip' \ --pattern 'EdgeEver-*-mac-arm64.zip.blockmap' \ --pattern 'EdgeEver-*-mac-x64.dmg' \ --pattern 'EdgeEver-*-mac-x64.dmg.blockmap' \ --pattern 'EdgeEver-*-mac-x64.zip' \ --pattern 'EdgeEver-*-mac-x64.zip.blockmap' \ --pattern 'latest-mac.yml' \ --pattern 'EdgeEver-*-wi…

macOS ${{ matrix.arch }} · after release-plan

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && ( (github.event_name == 'workflow_dispatch' && inputs.release_tag == '') || ( github.event_name == 'workflow_dispatch' && inputs.release_tag != '' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'false' && needs.release-plan.outputs.rebuild == 'true' ) ) }}

1. Check out sourceactions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Set up Rustdtolnay/rust-toolchain@stable
4. Cache Bun dependencies for shared validationactions/cache@v5Condition: matrix.shared_validation
5. Cache Rust dependencies and sidecar buildsactions/cache@v5
6. Cache Electron downloadsactions/cache@v5
7. Import macOS signing identityif [[ -z "$MAC_CERTIFICATE_DER_BASE64" || -z "$MAC_PRIVATE_KEY_BASE64" ]]; then echo "::error::EDGEEVER_MAC_CERTIFICATE_DER_BASE64 and EDGEEVER_MAC_PRIVATE_KEY_BASE64 are required" exit 1 fi keychain_path="$RUNNER_TEMP/edgeever-build.keychain-db" keychain_password="$(openssl rand -hex 32)" certificate_path="$RUNNER_TEMP/edgeever-mac-signing.cer" private_key_path="$RUNNER_TEMP/edgeever-mac-signing.pem" traditional_key_path="$RUNNER_TEMP/edgeever-mac-signing-rsa.pem" printf '%s' "$MAC_CERTIFICATE…
8. Install dependenciesbun install --frozen-lockfile
9. Build Web rendererbun run build:web
10. Verify Web performance budgetbun run verify:web-performanceCondition: matrix.shared_validation
11. Run project type checksbun run typecheck bun run typecheck:mobileCondition: matrix.shared_validation
12. Build debug sidecar for integration testscargo build --manifest-path crates/desktop-sidecar/Cargo.tomlCondition: matrix.shared_validation
13. Run desktop regression testsbun run test:desktopCondition: matrix.shared_validation
14. Verify renderer origin storage migrationbun run verify:renderer-origin-migrationCondition: matrix.shared_validation
15. Verify packaged renderer startupbun run verify:desktop-rendererCondition: matrix.shared_validation
16. Validate Rust sidecarcargo fmt --manifest-path crates/desktop-sidecar/Cargo.toml -- --check cargo clippy --manifest-path crates/desktop-sidecar/Cargo.toml --all-targets -- -D warnings cargo test --manifest-path crates/desktop-sidecar/Cargo.tomlCondition: matrix.shared_validation
17. Build architecture-specific Rust sidecarcargo build --manifest-path crates/desktop-sidecar/Cargo.toml --release
18. Prepare Apple notarization API keyif [[ -z "$APPLE_API_KEY_BASE64" || -z "$APPLE_API_KEY_ID" || -z "$APPLE_API_ISSUER" ]]; then echo "::error::Apple notarization API key secrets are required" exit 1 fi apple_api_key_path="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8" printf '%s' "$APPLE_API_KEY_BASE64" | base64 -D > "$apple_api_key_path" chmod 600 "$apple_api_key_path" echo "APPLE_API_KEY=$apple_api_key_path" >> "$GITHUB_ENV" echo "APPLE_API_KEY_ID=$APPLE_API_KEY_ID" >> "$GITHUB_ENV" echo "APPLE_API_ISSUER=$APPLE_API_ISSUER" >> …
19. Package desktop installerbun scripts/run-desktop-builder.mjs --publish never
20. Verify packaged macOS cross-version startupprevious_directory="$RUNNER_TEMP/edgeever-previous-${{ matrix.arch }}" mkdir -p "$previous_directory/archive" "$previous_directory/app" gh release download "$PREVIOUS_TAG" \ --repo "$GITHUB_REPOSITORY" \ --pattern 'EdgeEver-*-mac-${{ matrix.arch }}.zip' \ --dir "$previous_directory/archive" previous_archive="$(find "$previous_directory/archive" -maxdepth 1 -type f -name '*.zip' -print -quit)" test -n "$previous_archive" ditto -x -k "$previous_archive" "$previous_directory/app" previous_executab…Condition: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
21. Verify packaged macOS first launchunpacked_directory="mac-${{ matrix.arch }}" if [[ "${{ matrix.arch }}" == "x64" ]]; then unpacked_directory="mac" fi bun run verify:packaged-desktop-startup -- "release/desktop/$unpacked_directory/EdgeEver.app/Contents/MacOS/EdgeEver"
22. Verify packaged macOS private protocol file flowsunpacked_directory="mac-${{ matrix.arch }}" if [[ "${{ matrix.arch }}" == "x64" ]]; then unpacked_directory="mac" fi bun run verify:desktop-protocol-e2e -- "release/desktop/$unpacked_directory/EdgeEver.app/Contents/MacOS/EdgeEver"
23. Verify desktop installerbun scripts/verify-desktop-package.mjs
24. Stage architecture-specific desktop assetsactions/upload-artifact@v6

Windows x64 unsigned Preview · after release-plan

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && ( (github.event_name == 'workflow_dispatch' && inputs.release_tag == '') || ( github.event_name == 'workflow_dispatch' && inputs.release_tag != '' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'false' && needs.release-plan.outputs.rebuild == 'true' ) ) }}

1. Check out sourceactions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Set up Rustdtolnay/rust-toolchain@stable
4. Cache Bun dependenciesactions/cache@v5
5. Cache Rust dependencies and sidecar buildsactions/cache@v5
6. Cache Electron downloadsactions/cache@v5
7. Install dependenciesfor ($attempt = 1; $attempt -le 3; $attempt++) { bun install --frozen-lockfile $installExitCode = $LASTEXITCODE if ($installExitCode -eq 0) { exit 0 } if ($attempt -eq 3) { exit $installExitCode } Write-Warning "Dependency installation failed on attempt $attempt; retrying." Start-Sleep -Seconds (15 * $attempt) }
8. Build Web rendererbun run build:web
9. Build x64 Rust sidecarcargo build --manifest-path crates/desktop-sidecar/Cargo.toml --release
10. Package unsigned Windows installerbun scripts/run-desktop-builder.mjs --publish never
11. Verify packaged Windows cross-version startup$previousDirectory = Join-Path $env:RUNNER_TEMP "edgeever-previous-windows-x64" New-Item -ItemType Directory -Force -Path $previousDirectory | Out-Null gh release download $env:PREVIOUS_TAG ` --repo $env:GITHUB_REPOSITORY ` --pattern 'EdgeEver-*-windows-x64.exe' ` --dir $previousDirectory if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } $previousInstaller = Get-ChildItem -LiteralPath $previousDirectory -Filter '*.exe' | Select-Object -First 1 if (-not $previousInstaller) { throw "Previous Window…Condition: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
12. Verify Windows package contents and architecturebun scripts/verify-desktop-package.mjs
13. Run packaged Windows sidecar integration tests$env:EDGE_EVER_SIDECAR_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/sidecar/edgeever-sidecar.exe").Path $env:EDGE_EVER_MIGRATIONS_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/migrations").Path bun scripts/test-desktop-sidecar.mjs
14. Verify packaged Windows first launchbun run verify:packaged-desktop-startup -- release/desktop/win-unpacked/EdgeEver.exe
15. Verify packaged Windows private protocol file flowsbun run verify:desktop-protocol-e2e -- release/desktop/win-unpacked/EdgeEver.exe
16. Verify that Preview executables are unsigned$version = (Get-Content apps/desktop/package.json | ConvertFrom-Json).version $paths = @( "release/desktop/EdgeEver-$version-windows-x64.exe", "release/desktop/win-unpacked/EdgeEver.exe", "release/desktop/win-unpacked/resources/sidecar/edgeever-sidecar.exe" ) foreach ($path in $paths) { $signature = Get-AuthenticodeSignature -LiteralPath $path if ($signature.Status -ne "NotSigned") { throw "Unsigned Preview asset unexpectedly has an Authenticode signature: $path ($($signature.Status))" } }
17. Create Windows update metadata$version = (Get-Content apps/desktop/package.json | ConvertFrom-Json).version node scripts/create-windows-update-metadata.mjs release/desktop $version
18. Stage Windows Preview assetsactions/upload-artifact@v6

Linux x64 AppImage Preview · after release-plan

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && ( (github.event_name == 'workflow_dispatch' && inputs.release_tag == '') || ( github.event_name == 'workflow_dispatch' && inputs.release_tag != '' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'false' && needs.release-plan.outputs.rebuild == 'true' ) ) }}

1. Check out sourceactions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Set up Rustdtolnay/rust-toolchain@stable
4. Install AppImage runtime dependenciessudo apt-get update sudo apt-get install --yes libfuse2
5. Cache Bun dependenciesactions/cache@v5
6. Cache Rust dependencies and sidecar buildsactions/cache@v5
7. Cache Electron downloadsactions/cache@v5
8. Install dependenciesfor attempt in 1 2 3; do if bun install --frozen-lockfile; then exit 0 fi if [[ "$attempt" = "3" ]]; then exit 1 fi sleep "$((15 * attempt))" done
9. Build Web rendererbun run build:web
10. Build x64 Rust sidecarcargo build --manifest-path crates/desktop-sidecar/Cargo.toml --release
11. Build Linux automatic update predecessorif [[ -n "$PREVIOUS_TAG" ]]; then git fetch --depth=1 origin "refs/tags/${PREVIOUS_TAG}:refs/tags/${PREVIOUS_TAG}" if git show "${PREVIOUS_TAG}:apps/desktop/src/main/index.mjs" | grep -q 'linuxUpdateTestMode'; then previous_directory="$RUNNER_TEMP/edgeever-previous-linux-x64" mkdir -p "$previous_directory" gh release download "$PREVIOUS_TAG" \ --repo "$GITHUB_REPOSITORY" \ --pattern 'EdgeEver-*-linux-x64.AppImage' \ --dir "$previous_directory" previous_app_image="$(find "$previous_directory" -m…
12. Package Linux AppImagebun scripts/run-desktop-builder.mjs --publish never
13. Verify Linux package contents, architecture, and glibc baselinebun scripts/verify-desktop-package.mjs
14. Run packaged Linux sidecar integration testsbun scripts/test-desktop-sidecar.mjs
15. Verify packaged Linux first launchexecutable="" for candidate in release/desktop/linux-unpacked/EdgeEver release/desktop/linux-unpacked/edgeever; do if [[ -x "$candidate" ]]; then executable="$candidate" break fi done test -n "$executable" xvfb-run -a bun run verify:packaged-desktop-startup -- "$executable"
16. Verify packaged Linux private protocol file flowsexecutable="" for candidate in release/desktop/linux-unpacked/EdgeEver release/desktop/linux-unpacked/edgeever; do if [[ -x "$candidate" ]]; then executable="$candidate" break fi done test -n "$executable" xvfb-run -a bun run verify:desktop-protocol-e2e -- "$executable"
17. Create Linux checksumversion="$(node -p "JSON.parse(require('fs').readFileSync('apps/desktop/package.json', 'utf8')).version")" cd release/desktop sha256sum "EdgeEver-${version}-linux-x64.AppImage" > SHA256SUMS-linux.txt sha256sum --check SHA256SUMS-linux.txt
18. Verify Linux automatic update metadataversion="$(node -p "JSON.parse(require('fs').readFileSync('apps/desktop/package.json', 'utf8')).version")" node scripts/verify-linux-update-release.mjs release/desktop "$version"
19. Verify real Linux AppImage automatic updateversion="$(node -p "JSON.parse(require('fs').readFileSync('apps/desktop/package.json', 'utf8')).version")" xvfb-run -a bun scripts/verify-linux-appimage-update.mjs \ "$RUNNER_TEMP/EdgeEver-linux-update-source.AppImage" \ "release/desktop/EdgeEver-${version}-linux-x64.AppImage" \ "$version"
20. Stage Linux Preview assetsactions/upload-artifact@v6

Report desktop build timings · after desktop, windows, linux

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && (needs.desktop.result != 'skipped' || needs.windows.result != 'skipped' || needs.linux.result != 'skipped') }}

1. Check out timing reporteractions/checkout@v5
2. Collect native build timingsgh api \ "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/jobs?filter=latest&per_page=100" \ > "$RUNNER_TEMP/actions-jobs.json" node scripts/report-native-build-timings.mjs \ --input "$RUNNER_TEMP/actions-jobs.json" \ --platform desktop \ --json "$RUNNER_TEMP/native-build-timings.json" \ --markdown "$RUNNER_TEMP/native-build-timings.md" cat "$RUNNER_TEMP/native-build-timings.md" >> "$GITHUB_STEP_SUMMARY"
3. Upload machine-readable timing reportactions/upload-artifact@v6

Finalize desktop release assets · after release-plan, desktop, windows, linux

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && needs.desktop.result == 'success' && needs.windows.result == 'success' && needs.linux.result == 'success' && ( (github.event_name == 'workflow_dispatch' && inputs.release_tag == '') || ( github.event_name == 'workflow_dispatch' && inputs.release_tag != '' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'false' && needs.release-plan.outputs.rebuild == 'true' ) ) }}

1. Check out sourceactions/checkout@v5
2. Download platform-specific assetsactions/download-artifact@v7
3. Create and audit combined update metadataversion="$(node -p "JSON.parse(require('fs').readFileSync('apps/desktop/package.json', 'utf8')).version")" node scripts/create-mac-update-metadata.mjs release/desktop "$version" node scripts/verify-linux-update-release.mjs release/desktop "$version" asset_ready="$( find release/desktop -maxdepth 1 -type f -exec basename {} \; | node scripts/check-native-release-assets.mjs desktop true "v${version}" "$version" allow-missing-windows-signature )" test "$asset_ready" = "true"
4. Upload verified desktop assets to Releasegh release upload "$RELEASE_TAG" release/desktop/* \ --repo "$GITHUB_REPOSITORY" \ --clobberCondition: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
5. Upload combined desktop installers and metadataactions/upload-artifact@v6

Audit signed Windows update · after release-plan

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'true' && ( github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ) }}

1. Check out sourceactions/checkout@v5
2. Download Windows release assetsmkdir -p release/desktop node scripts/download-release-assets.mjs \ --repo "$GITHUB_REPOSITORY" \ --tag "$RELEASE_TAG" \ --dir release/desktop \ --pattern 'EdgeEver-*-windows-x64.exe' \ --pattern 'latest.yml' \ --pattern 'latest-windows.json' \ --pattern 'latest-windows.json.sig' \ --pattern 'SHA256SUMS-windows.txt'
3. Verify signature and installer digestsnode scripts/verify-windows-update-release.mjs release/desktop

Audit Linux Preview asset · after release-plan

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'true' && ( github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ) }}

1. Check out sourceactions/checkout@v5
2. Download Linux release assetsmkdir -p release/desktop node scripts/download-release-assets.mjs \ --repo "$GITHUB_REPOSITORY" \ --tag "$RELEASE_TAG" \ --dir release/desktop \ --pattern 'EdgeEver-*-linux-x64.AppImage' \ --pattern 'latest-linux.yml' \ --pattern 'SHA256SUMS-linux.txt'
3. Verify Linux automatic update releasenode scripts/verify-linux-update-release.mjs release/desktop

Build and verify container · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever' && github.event_name != 'release'

1. Checkoutactions/checkout@v5
2. Build local imagedocker build --build-arg EDGE_EVER_BUILD_ID="${GITHUB_SHA}" --tag edgeever:ci .
3. Start containerdocker run --detach --name edgeever-ci \ --env EDGE_EVER_AUTH_PASSWORD=container-ci-password \ --publish 127.0.0.1:8787:8787 \ edgeever:ci
4. Verify shared API and persistent storagefor attempt in $(seq 1 60); do if health="$(curl --fail --silent --show-error http://127.0.0.1:8787/api/health)"; then break fi sleep 1 done echo "${health}" | jq -e '.ok == true and .runtime == "self-hosted-bun" and .authMode == "required"' curl --fail --silent --show-error http://127.0.0.1:8787/ | grep -F '<!doctype html>' docker exec edgeever-ci test -f /data/edgeever.sqlite docker exec edgeever-ci test -d /data/resources docker exec edgeever-ci test -s /app/scripts/self-hosted-server.js doc…
5. Stop container gracefullydocker stop --timeout 30 edgeever-ci docker logs edgeever-ci | grep -F '[self-hosted] shutdown complete'
6. Show container logs on failuredocker logs edgeever-ci || trueCondition: failure()

Publish official multi-platform image · after container-test

Condition: github.repository == 'tianma-if/edgeever' && github.event_name != 'pull_request' && github.event_name != 'release'

1. Checkoutactions/checkout@v5
2. Resolve image tagsif [[ -n "${RELEASE_TAG}" ]]; then if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "release_tag must match vX.Y.Z" >&2 exit 1 fi release_json="$(gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" --json isDraft,isPrerelease,targetCommitish)" if [[ "$(jq -r '.isDraft' <<<"${release_json}")" != "true" ]] || [[ "$(jq -r '.isPrerelease' <<<"${release_json}")" != "false" ]]; then echo "${RELEASE_TAG} must identify a non-prerelease Draft release" >&2 exit 1 fi version=…
3. Set up QEMUdocker/setup-qemu-action@v3
4. Set up Docker Buildxdocker/setup-buildx-action@v3
5. Sign in to GitHub Container Registrydocker/login-action@v3
6. Build and publish imagedocker/build-push-action@v6
7. Verify anonymous GHCR image accessdocker logout ghcr.io docker buildx imagetools inspect "${GHCR_IMAGE_NAME}:${{ steps.image.outputs.audit_tag }}" docker buildx imagetools inspect --raw "${GHCR_IMAGE_NAME}:${{ steps.image.outputs.audit_tag }}" | jq -e '([.manifests[].platform.architecture] | index("amd64") != null) and ([.manifests[].platform.architecture] | index("arm64") != null)' docker pull "${GHCR_IMAGE_NAME}:${{ steps.image.outputs.audit_tag }}" container_name=edgeever-published-audit trap 'docker rm --force "${container_…

Audit published Docker image · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever' && github.event_name == 'release'

1. Verify prepared public image tagsrelease_inspect="$(docker buildx imagetools inspect "${GHCR_IMAGE_NAME}:${RELEASE_TAG}")" latest_inspect="$(docker buildx imagetools inspect "${GHCR_IMAGE_NAME}:latest")" release_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${release_inspect}" | head -n 1)" latest_digest="$(sed -n 's/^Digest:[[:space:]]*//p' <<<"${latest_inspect}" | head -n 1)" test -n "${release_digest}" test "${release_digest}" = "${latest_digest}" docker buildx imagetools inspect --raw "${GHCR_IMAGE_NAME}:${RELEASE_TAG}"…

Trigger asynchronous Tencent-side image build · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Resolve verified source and CNB destinationif [[ "${EVENT_NAME}" == "release" ]]; then source_ref="${RELEASE_TAG}" destination_ref="${RELEASE_TAG}" else source_ref="${INPUT_SOURCE_REF}" destination_ref="${INPUT_DESTINATION_REF}" fi if [[ "${destination_ref}" != "main" ]] && [[ ! "${destination_ref}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "destination_ref must be main or vX.Y.Z" >&2 exit 1 fi { echo "source_ref=${source_ref}" echo "destination_ref=${destination_ref}" } >> "${GITHUB_OUTPUT}"
2. Check out the GHCR-verified sourceactions/checkout@v5
3. Verify formal source metadatatest "$(jq -r '.version' package.json)" = "${RELEASE_TAG#v}" test "$(git rev-parse HEAD)" = "$(git rev-list -n 1 "${RELEASE_TAG}")"Condition: steps.source.outputs.destination_ref != 'main'
4. Push the same Git commit to CNBtest -n "${CNB_PUSH_TOKEN}" auth="$(printf 'cnb:%s' "${CNB_PUSH_TOKEN}" | base64 -w 0)" if [[ "${DESTINATION_REF}" == "main" ]]; then destination="refs/heads/main" else destination="refs/tags/${DESTINATION_REF}" fi git -c http.extraHeader="Authorization: Basic ${auth}" push \ https://cnb.cool/tianma-if/edgeever \ "HEAD:${destination}"

Build Chromium and Firefox · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Checkoutactions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Install dependenciesbun install --frozen-lockfile
4. Test extension manifestsbun run test:extension
5. Build Chromium extensionbun run build:extension
6. Build Firefox extensionbun run build:extension:firefox
7. Lint Firefox extensionbun run lint:extension:firefox

Xcode build + unit tests · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Checkoutactions/checkout@v5
2. Select Xcodesudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer || \ sudo xcode-select -s /Applications/Xcode.app/Contents/Developer xcodebuild -version
3. Install XcodeGenbrew install xcodegen
4. Generate projectxcodegen generate
5. Resolve packagesxcodebuild -project EdgeEver.xcodeproj -scheme EdgeEver \ -resolvePackageDependencies \ -destination 'generic/platform=iOS Simulator'
6. Buildset -o pipefail xcodebuild build \ -project EdgeEver.xcodeproj \ -scheme EdgeEver \ -destination 'generic/platform=iOS Simulator' \ CODE_SIGNING_ALLOWED=NO \ | xcpretty || true xcodebuild build \ -project EdgeEver.xcodeproj \ -scheme EdgeEver \ -destination 'generic/platform=iOS Simulator' \ CODE_SIGNING_ALLOWED=NO
7. TestDEST="$( xcodebuild -project EdgeEver.xcodeproj -scheme EdgeEver -showdestinations 2>/dev/null \ | sed -n 's/.*name:\(iPhone[^,}]*\).*/\1/p' \ | head -1 )" if [[ -z "$DEST" ]]; then DEST="iPhone 16" fi echo "Using simulator: $DEST" xcodebuild test \ -project EdgeEver.xcodeproj \ -scheme EdgeEver \ -destination "platform=iOS Simulator,name=$DEST" \ CODE_SIGNING_ALLOWED=NO \ -only-testing:EdgeEverTests

xcode-cloud · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Check out Xcode Cloud toolingactions/checkout@v5
2. Install App Store Connect client dependenciespython3 -m pip install --quiet PyJWT cryptography
3. Inspect, start, or monitor Xcode Cloudcase "$XCODE_CLOUD_MODE" in inspect) python3 scripts/xcode-cloud-control.py inspect ;; start) args=(start --wait) if [[ -n "$XCODE_CLOUD_WORKFLOW_ID" ]]; then args+=(--workflow-id "$XCODE_CLOUD_WORKFLOW_ID") fi python3 scripts/xcode-cloud-control.py "${args[@]}" ;; describe) if [[ -z "$XCODE_CLOUD_BUILD_RUN_ID" ]]; then echo "::error::build_run_id is required in describe mode" exit 1 fi python3 scripts/xcode-cloud-control.py describe \ --build-run-id "$XCODE_CLOUD_BUILD_RUN_ID" ;; monitor) if […

Plan Android release asset · no job dependencies declared

Condition: ${{ github.repository == 'tianma-if/edgeever' && ( github.event_name == 'release' || github.event_name == 'workflow_dispatch' ) }}

1. Checkoutactions/checkout@v5
2. Validate Draft Release targetexpected_version="$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")" test "$RELEASE_TAG" = "v${expected_version}" test "$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json isDraft --jq '.isDraft')" = "true" target_commitish="$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json targetCommitish --jq '.targetCommitish')" test "$(git rev-parse "${target_commitish}^{commit}")" = "$(git rev-parse "${GITHUB_SHA}^{commit}")"Condition: github.event_name == 'workflow_dispatch'
3. Set up Bun for release validationoven-sh/setup-bun@v2
4. Install release validation dependenciesbun install --frozen-lockfile
5. Run full project regression testsbun run test
6. Compare with previous formal releasemapfile -t release_tags < <( gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \ --jq '.[] | select(.draft == false and .prerelease == false) | .tag_name' ) previous_tag="" for release_tag in "${release_tags[@]}"; do if [[ "$release_tag" != "$CURRENT_TAG" ]]; then previous_tag="$release_tag" break fi done test -n "$previous_tag" git fetch origin "refs/tags/${previous_tag}:refs/tags/${previous_tag}" echo "previous_tag=$previous_tag" >> "$GITHUB_OUTPUT" plan_output="$(node scripts/plan-na…
7. Verify existing APK uses the pinned signermkdir -p "$RUNNER_TEMP/native-assets" node scripts/download-release-assets.mjs \ --repo "$GITHUB_REPOSITORY" \ --tag "$CURRENT_TAG" \ --dir "$RUNNER_TEMP/native-assets" \ --pattern 'edgeever-android-v*-arm64-v8a.apk' apk_path="$(find "$RUNNER_TEMP/native-assets" -type f -name 'edgeever-android-v*-arm64-v8a.apk' -print -quit)" test -n "$apk_path" test -n "$ANDROID_PLAY_APP_SIGNER_SHA256" node scripts/verify-android-apk-signature.mjs "$apk_path"Condition: steps.plan.outputs.asset_ready == 'true'

Restore invalid Android Release to Draft · after release-plan

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && github.event_name == 'release' && needs.release-plan.result == 'failure' }}

1. Restore Draft stategh release edit "$CURRENT_TAG" --repo "$GITHUB_REPOSITORY" --draft=true

Reuse Android release APK · after release-plan

Condition: ${{ github.repository == 'tianma-if/edgeever' && github.event_name == 'workflow_dispatch' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'false' && needs.release-plan.outputs.rebuild == 'false' }}

1. Checkoutactions/checkout@v5
2. Copy latest compatible APK without renamingmkdir -p "$RUNNER_TEMP/native-assets" gh release download "$PREVIOUS_TAG" \ --repo "$GITHUB_REPOSITORY" \ --pattern 'edgeever-android-v*-arm64-v8a.apk' \ --dir "$RUNNER_TEMP/native-assets" test "$(find "$RUNNER_TEMP/native-assets" -type f -name 'edgeever-android-v*-arm64-v8a.apk' | wc -l | tr -d ' ')" = "1" apk_path="$(find "$RUNNER_TEMP/native-assets" -type f -name 'edgeever-android-v*-arm64-v8a.apk' -print -quit)" test -n "$ANDROID_PLAY_APP_SIGNER_SHA256" node scripts/verify-android-apk-signa…

Build Android packages · after release-plan

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && ( (github.event_name == 'push' && github.ref == 'refs/heads/main') || ( github.event_name == 'workflow_dispatch' && needs.release-plan.result == 'success' && needs.release-plan.outputs.asset_ready == 'false' && needs.release-plan.outputs.rebuild == 'true' ) ) }}

1. Checkoutactions/checkout@v5
2. Install dependenciesbun install --frozen-lockfile
3. Check Expo dependenciesif ! bun --cwd apps/mobile expo install --check; then echo "::warning::Expo reported compatible patch-version updates; continuing with the frozen lockfile for this build." fi
4. Typecheckbun run typecheck:mobile
5. Reset Metro cache for this checkoutbun --cwd apps/mobile expo export --platform android --clear --max-workers 1 --output-dir "$RUNNER_TEMP/edgeever-metro-warmup"
6. Restore Android signing keystoretest -n "$ANDROID_KEYSTORE_BASE64" printf '%s' "$ANDROID_KEYSTORE_BASE64" | openssl base64 -d -A > "$RUNNER_TEMP/edgeever-upload.p12" chmod 600 "$RUNNER_TEMP/edgeever-upload.p12"
7. Build fast main-branch APKbun run build:android:fastCondition: github.event_name == 'push'
8. Build signed release APK for GitHub Releasebun run build:android:apkCondition: github.event_name == 'workflow_dispatch'
9. Verify release APK signaturenode scripts/verify-android-apk-signature.mjs apps/mobile/android/app/build/outputs/apk/release/app-release.apkCondition: github.event_name == 'workflow_dispatch'
10. Upload APKactions/upload-artifact@v7Condition: github.event_name == 'push'
11. Upload release APK to GitHub Releaserelease_asset="$RUNNER_TEMP/edgeever-android-${RELEASE_TAG}-arm64-v8a.apk" cp apps/mobile/android/app/build/outputs/apk/release/app-release.apk "$release_asset" gh release upload "$RELEASE_TAG" "$release_asset" --repo "$GITHUB_REPOSITORY" --clobberCondition: github.event_name == 'workflow_dispatch'
12. Remove temporary upload keystorerm -f "$RUNNER_TEMP/edgeever-upload.p12"Condition: always()

Report Android build timings · after android

Condition: ${{ always() && github.repository == 'tianma-if/edgeever' && needs.android.result != 'skipped' }}

1. Checkout timing reporteractions/checkout@v5
2. Collect native build timingsgh api \ "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/jobs?filter=latest&per_page=100" \ > "$RUNNER_TEMP/actions-jobs.json" node scripts/report-native-build-timings.mjs \ --input "$RUNNER_TEMP/actions-jobs.json" \ --platform android \ --json "$RUNNER_TEMP/native-build-timings.json" \ --markdown "$RUNNER_TEMP/native-build-timings.md" cat "$RUNNER_TEMP/native-build-timings.md" >> "$GITHUB_STEP_SUMMARY"
3. Upload machine-readable timing reportactions/upload-artifact@v7

audit · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. actions/checkout@v5actions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Install dependenciesbun install --frozen-lockfile
4. Inspect generated APK typesnode scripts/download-play-universal-apk.mjs "${{ inputs.version_code }}" --inspect

Collect all Release endpoint timings · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Check out timing reporteractions/checkout@v5
2. Resolve Release and post-publication workflow runsrelease_json="$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json isDraft,isPrerelease,publishedAt,targetCommitish,url)" test "$(jq -r '.isDraft' <<<"$release_json")" = "false" test "$(jq -r '.isPrerelease' <<<"$release_json")" = "false" test "$(jq -r '.targetCommitish' <<<"$release_json")" = "$RELEASE_SHA" find_release_run() { local workflow="$1" local deadline=$((SECONDS + 120)) while ((SECONDS < deadline)); do run_id="$( gh run list \ --repo "$GITHUB_REPOSITORY" \ --workflow …
3. Wait for Cloudflare deployment and TCR source syncwait_for_run() { local run_id="$1" while true; do run_json="$(gh run view "$run_id" --repo "$GITHUB_REPOSITORY" --json status,conclusion,url)" status="$(jq -r '.status' <<<"$run_json")" if [[ "$status" = "completed" ]]; then jq -r '.conclusion' <<<"$run_json" return 0 fi sleep 10 done } echo "demo_conclusion=$(wait_for_run "$DEMO_RUN_ID")" >> "$GITHUB_OUTPUT" echo "tcr_source_conclusion=$(wait_for_run "$TCR_RUN_ID")" >> "$GITHUB_OUTPUT"
4. Observe public TCR Release readinessstatus="failure" ready_at="" if [[ "$SOURCE_CONCLUSION" = "success" ]]; then for attempt in $(seq 1 180); do if raw_manifest="$(docker buildx imagetools inspect --raw "${TCR_IMAGE}:${RELEASE_TAG}" 2>/dev/null)" && jq -e '([.manifests[].platform.architecture] | index("amd64") != null) and ([.manifests[].platform.architecture] | index("arm64") != null)' <<<"$raw_manifest" >/dev/null; then metadata="$(docker buildx imagetools inspect "${TCR_IMAGE}:${RELEASE_TAG}" --format '{{json .Image}}' 2>/dev/…
5. Download exact Actions timing datacollect_run() { local name="$1" local run_id="$2" gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${run_id}" > "$RUNNER_TEMP/${name}-run.json" gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${run_id}/jobs?filter=latest&per_page=100" > "$RUNNER_TEMP/${name}-jobs.json" jq -s '{run: .[0], jobs: .[1].jobs}' \ "$RUNNER_TEMP/${name}-run.json" \ "$RUNNER_TEMP/${name}-jobs.json" \ > "$RUNNER_TEMP/${name}.json" } collect_run desktop "$DESKTOP_RUN_ID" collect_run mobile "$MOBILE_RUN_ID" collect_run dock…
6. Generate unified Release timing reportstore_args=() if [[ -f "$RUNNER_TEMP/store.json" ]]; then store_args=(--store "$RUNNER_TEMP/store.json") fi node scripts/report-release-timings.mjs \ --tag "${{ inputs.release_tag }}" \ --sha "${{ inputs.release_sha }}" \ --published-at "${{ steps.release.outputs.published_at }}" \ --release-url "$RELEASE_URL" \ --desktop "$RUNNER_TEMP/desktop.json" \ --desktop-mode "${{ inputs.desktop_mode }}" \ --mobile "$RUNNER_TEMP/mobile.json" \ --mobile-mode "${{ inputs.mobile_mode }}" \ --docker "$RUNNER…
7. Return timing report to the related Issuemarker="<!-- edgeever-release-build-timings:${RELEASE_TAG} -->" comment_file="$RUNNER_TEMP/release-build-timings-comment.md" printf '%s\n\n' "$marker" > "$comment_file" cat "$RUNNER_TEMP/release-build-timings.md" >> "$comment_file" comment_id="$( gh api "repos/${GITHUB_REPOSITORY}/issues/${ISSUE_NUMBER}/comments?per_page=100" \ --paginate \ --jq ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n 1 )" if [[ -n "$comment_id" ]]; then jq -n --rawfile body "$comment_file" '{body: $body…
8. Upload machine-readable Release timing reportactions/upload-artifact@v7

Validate store delivery source · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Validate Release and resolve its formal predecessorrelease="$( gh release view "$RELEASE_TAG" \ --repo "$GITHUB_REPOSITORY" \ --json isDraft,isPrerelease,tagName,targetCommitish )" release_is_draft="$(jq -r '.isDraft' <<<"$release")" test "$release_is_draft" = "true" -o "$release_is_draft" = "false" test "$(jq -r '.isPrerelease' <<<"$release")" = "false" test "$(jq -r '.tagName' <<<"$release")" = "$RELEASE_TAG" release_target="$(jq -r '.targetCommitish' <<<"$release")" test -n "$release_target" test "$release_target" != "null" echo "release_tar…
2. Check out the immutable Release targetactions/checkout@v5
3. Validate the checked-out Release targettest "$(git rev-parse HEAD)" = "$(git rev-parse "${RELEASE_TARGET}^{commit}")" git fetch origin "refs/tags/${PREVIOUS_TAG}:refs/tags/${PREVIOUS_TAG}" if git rev-parse --verify --quiet "refs/tags/${RELEASE_TAG}" >/dev/null; then test "$(git rev-parse "${RELEASE_TAG}^{commit}")" = "$(git rev-parse "${RELEASE_TARGET}^{commit}")" else git tag "$RELEASE_TAG" "$RELEASE_TARGET" fi
4. Validate mobile version and audited change rangeset -o pipefail node scripts/validate-store-delivery.mjs \ "$RELEASE_TAG" \ "$PREVIOUS_TAG" \ "$PLATFORM" \ "$ANDROID_TRACK" | tee -a "$GITHUB_OUTPUT"

Deliver Google Play · after plan

Condition: ${{ github.repository == 'tianma-if/edgeever' && (inputs.platform == 'android' || inputs.platform == 'both') }}

1. Check out the immutable Release targetactions/checkout@v5
2. Set up Bunoven-sh/setup-bun@v2
3. Set up EAS CLIexpo/expo-github-action@v8Condition: ${{ !inputs.recover_play_apk }}
4. Install dependenciesfor attempt in 1 2 3; do if bun install --frozen-lockfile \ --cache-dir "$RUNNER_TEMP/edgeever-bun-cache-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${attempt}"; then exit 0 fi echo "Dependency install failed on attempt ${attempt}/3" >&2 done exit 1Condition: ${{ !inputs.recover_play_apk }}
5. Install Play APK recovery dependencyif ! bun install --frozen-lockfile \ --cache-dir "$RUNNER_TEMP/edgeever-bun-cache-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"; then node --input-type=module -e "await import('google-auth-library')" fiCondition: ${{ inputs.recover_play_apk }}
6. Restore Android upload keystoretest -n "$ANDROID_KEYSTORE_BASE64" printf '%s' "$ANDROID_KEYSTORE_BASE64" | openssl base64 -d -A > "$RUNNER_TEMP/edgeever-upload.p12" chmod 600 "$RUNNER_TEMP/edgeever-upload.p12"Condition: ${{ !inputs.recover_play_apk }}
7. Build and verify signed Play bundlebun run build:android:playCondition: ${{ !inputs.recover_play_apk }}
8. Preserve Play bundle and deobfuscation mappingactions/upload-artifact@v7Condition: ${{ !inputs.recover_play_apk }}
9. Upload bundle to Google Playtest -n "$EXPO_TOKEN" eas submit \ --platform android \ --profile "store-${ANDROID_TRACK}" \ --path android/app/build/outputs/bundle/release/app-release.aab \ --non-interactive \ --waitCondition: ${{ !inputs.recover_play_apk }}
10. Download Play-signed universal APKapk_path="$RUNNER_TEMP/edgeever-android-${RELEASE_TAG}-arm64-v8a.apk" node scripts/download-play-universal-apk.mjs "$VERSION_CODE" "$apk_path" echo "apk_path=$apk_path" >> "$GITHUB_ENV"
11. Verify Play app signaturenode scripts/verify-android-apk-signature.mjs "$apk_path"
12. Verify Play APK architectureactual_archs="$(unzip -Z1 "$apk_path" | sed -n 's#^lib/\([^/]*\)/.*#\1#p' | sort -u | paste -sd, -)" if [[ "$actual_archs" != "arm64-v8a" ]]; then echo "::error::Expected an arm64-v8a Play APK, received: ${actual_archs:-no native libraries}." exit 1 fi
13. Replace GitHub Release APK with the Play-signed buildgh release upload "$RELEASE_TAG" "$apk_path" --repo "$GITHUB_REPOSITORY" --clobber
14. Remove temporary upload keystorerm -f "$RUNNER_TEMP/edgeever-upload.p12"Condition: always()

Deliver App Store Connect · after plan

Condition: ${{ github.repository == 'tianma-if/edgeever' && (inputs.platform == 'ios' || inputs.platform == 'both') }}

1. Check out the immutable Release targetactions/checkout@v5
2. Check out current store-delivery toolingactions/checkout@v5
3. Resolve the App Store buildif [[ -n "$REQUESTED_BUILD_NUMBER" ]]; then echo "build_number=$REQUESTED_BUILD_NUMBER" >> "$GITHUB_OUTPUT" echo "Using existing App Store Connect build $REQUESTED_BUILD_NUMBER" exit 0 fi test -n "$ASC_API_ISSUER" test -n "$ASC_API_KEY_ID" test -n "$ASC_API_KEY_BASE64" python3 -m pip install --quiet PyJWT cryptography log_file="$RUNNER_TEMP/xcode-cloud-control.log" # Manual Xcode Cloud workflows reject tags that are not in the start # condition. Start the Archive workflow on its configured defa…
4. Load App Store release notesnode --input-type=module <<'NODE' import { appendFileSync, readFileSync } from "node:fs"; const summary = JSON.parse(readFileSync("release-summary.json", "utf8")); const join = (items) => (Array.isArray(items) ? items : []) .map((item) => String(item).trim()) .filter(Boolean) .join("\n"); const write = (key, value) => { appendFileSync(process.env.GITHUB_OUTPUT, `${key}<<EOF\n${value}\nEOF\n`); }; write("notes_en", join(summary.changes?.["en-US"])); write("notes_zh", join(summary.changes?.["zh-C…
5. Set up Ruby and fastlaneruby/setup-ruby@v1
6. Submit the uploaded build to App Reviewtest -n "$APP_STORE_CONNECT_API_ISSUER_ID" test -n "$APP_STORE_CONNECT_API_KEY_ID" test -n "$APP_STORE_CONNECT_API_KEY_P8_BASE64" test -n "$APP_STORE_BUILD_NUMBER" log_file="$RUNNER_TEMP/edgeever-app-store-review.log" for attempt in {1..20}; do set +e bundle exec fastlane ios submit_review 2>&1 | tee "$log_file" status="${PIPESTATUS[0]}" set -e if [[ "$status" -eq 0 ]]; then exit 0 fi if ! grep -Fq "Build number: ${APP_STORE_BUILD_NUMBER} does not exist" "$log_file" || [[ "$attempt" -eq 20 ]]; …

Publish Tencent COS mirror · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Checkoutactions/checkout@v5
2. Install Tencent COSCMDpython3 -m venv "${RUNNER_TEMP}/coscmd" "${RUNNER_TEMP}/coscmd/bin/pip" install --disable-pip-version-check 'coscmd==1.9.0.6' echo "${RUNNER_TEMP}/coscmd/bin" >> "${GITHUB_PATH}"
3. Configure COSCMDtest -n "${COS_BUCKET}" test -n "${COS_REGION}" test -n "${COS_SECRET_ID}" test -n "${COS_SECRET_KEY}" coscmd config \ -a "${COS_SECRET_ID}" \ -s "${COS_SECRET_KEY}" \ -b "${COS_BUCKET}" \ -r "${COS_REGION}"
4. Upload installer filescoscmd upload -f apps/site/public/install.sh install.sh coscmd upload -f apps/site/public/compose.yaml compose.yaml
5. Verify public mirrorbase_url="https://${COS_BUCKET}.cos.${COS_REGION}.myqcloud.com" curl --fail --silent --show-error "${base_url}/install.sh" | cmp apps/site/public/install.sh - curl --fail --silent --show-error "${base_url}/compose.yaml" | cmp apps/site/public/compose.yaml -

Sync Fork and trigger deployment · no job dependencies declared

Condition: github.repository != 'tianma-if/edgeever'

1. Checkout deployed repositoryactions/checkout@v5
2. Require a GitHub Forkset -euo pipefail is_fork="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.fork')" if [ "${is_fork}" != "true" ]; then echo "This deployment repository must be a GitHub Fork of ${UPSTREAM_REPOSITORY}." >&2 echo "Create the repository with the EdgeEver Fork flow before enabling upstream updates." >&2 exit 1 fi
3. Resolve upstream versionset -euo pipefail git remote add upstream "https://github.com/${UPSTREAM_REPOSITORY}.git" git fetch upstream main --tags case "${UPDATE_CHANNEL}" in stable) target_ref="$(gh api "repos/${UPSTREAM_REPOSITORY}/releases/latest" --jq '.tag_name')" ;; edge) target_ref="upstream/main" ;; *) echo "Unsupported update channel: ${UPDATE_CHANNEL}" >&2 exit 1 ;; esac target_commit="$(git rev-parse "${target_ref}^{commit}")" head_commit="$(git rev-parse HEAD)" target_version="$(git show "${target_commit}:pa…
4. Align to upstreamset -euo pipefail git config user.name "edgeever-updater[bot]" git config user.email "edgeever-updater[bot]@users.noreply.github.com" helper_path="${RUNNER_TEMP}/prepare-upstream-sync.mjs" if git cat-file -e "${TARGET_COMMIT}:scripts/prepare-upstream-sync.mjs" 2>/dev/null; then git show "${TARGET_COMMIT}:scripts/prepare-upstream-sync.mjs" > "${helper_path}" else cp scripts/prepare-upstream-sync.mjs "${helper_path}" fi EDGE_SYNC_ALIGN_MODE="${ALIGN_MODE}" \ EDGE_SYNC_BASE_COMMIT="HEAD" \ EDGE_SY…Condition: steps.upstream.outputs.update_required == 'true'
5. Set up Bunoven-sh/setup-bun@v2Condition: steps.upstream.outputs.align_mode == 'merge'
6. Verify customized mergeset -euo pipefail bun install --frozen-lockfile bun run db:migrate:local bun run test bun run typecheck bun run buildCondition: steps.upstream.outputs.align_mode == 'merge'
7. Publish updateset -euo pipefail git config user.name "edgeever-updater[bot]" git config user.email "edgeever-updater[bot]@users.noreply.github.com" if [ "${REPUBLISH_ONLY}" = "true" ] && [ "${UPDATE_REQUIRED}" != "true" ]; then git commit --allow-empty -m "chore: retrigger EdgeEver deployment for ${TARGET_REF}" git push origin HEAD:main echo "mode=empty_commit" >> "${GITHUB_OUTPUT}" echo "Pushed empty commit to retrigger Cloudflare Workers Builds." exit 0 fi git commit \ -m "chore: update EdgeEver from ${TAR…Condition: steps.upstream.outputs.update_required == 'true' || steps.upstream.outputs.republish_only == 'true'
8. Request Cloudflare deploymentset -euo pipefail if [ -z "${DEPLOY_HOOK_URL:-}" ]; then echo "No EDGE_EVER_CLOUDFLARE_DEPLOY_HOOK_URL secret — relying on Cloudflare Git integration for main pushes." echo "Optional: add a Workers/Pages Deploy Hook secret if pushes do not start builds." >> "${GITHUB_STEP_SUMMARY}" echo "method=git_push" >> "${GITHUB_OUTPUT}" exit 0 fi curl -fsS -X POST "${DEPLOY_HOOK_URL}" >/dev/null echo "Triggered Cloudflare Deploy Hook." echo "method=git_push_and_deploy_hook" >> "${GITHUB_OUTPUT}" echo "" >…Condition: steps.publish.outcome == 'success'
9. Report result / 输出结果set -euo pipefail final_commit="$(git rev-parse HEAD)" git_result="Not requested / 未请求" deploy_result="Not requested / 未请求" live_result="Not changed by this run / 本次运行未改变线上部署" live_status="unchanged" notice_level="notice" notice_title="Scheduled check / 定时检查" notice_body="Fork code is already v${TARGET_VERSION}. No Git push or Cloudflare deployment was requested." if [ "${UPDATE_REQUIRED}" = "true" ] || [ "${REPUBLISH_ONLY}" = "true" ]; then live_result="Not verified by this workflow / 本工作流未验证"…Condition: always() && steps.upstream.outcome == 'success'
10. Report an update failureset -euo pipefail title="EdgeEver automatic update requires attention" existing="$(gh issue list --state open --search "${title} in:title" --json number --jq '.[0].number // empty')" if [ -z "${existing}" ]; then gh issue create \ --title "${title}" \ --body "The daily update from \`${UPSTREAM_REPOSITORY}\` (${TARGET_REF}) could not be aligned or verified. The current production deployment was left unchanged. Open the failed **Update deployed EdgeEver** workflow run for details (see the job sum…Condition: failure()

Build and test-sign Windows x64 installer · no job dependencies declared

Condition: github.repository == 'tianma-if/edgeever'

1. Check out sourceactions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
2. Set up Bunoven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
3. Set up Rustdtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c
4. Install dependenciesfor ($attempt = 1; $attempt -le 3; $attempt++) { bun install --frozen-lockfile $installExitCode = $LASTEXITCODE if ($installExitCode -eq 0) { exit 0 } if ($attempt -eq 3) { exit $installExitCode } Write-Warning "Dependency installation failed on attempt $attempt; retrying." Start-Sleep -Seconds (15 * $attempt) }
5. Run project type checksbun run typecheck bun run typecheck:mobile
6. Build Web rendererbun run build:web
7. Build Rust sidecarcargo build --manifest-path crates/desktop-sidecar/Cargo.toml --release
8. Package unsigned Windows installerbun scripts/run-desktop-builder.mjs --publish never
9. Verify Windows package contents and architecturebun scripts/verify-desktop-package.mjs
10. Run packaged Windows sidecar integration tests$env:EDGE_EVER_SIDECAR_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/sidecar/edgeever-sidecar.exe").Path $env:EDGE_EVER_MIGRATIONS_PATH = (Resolve-Path "release/desktop/win-unpacked/resources/migrations").Path bun scripts/test-desktop-sidecar.mjs
11. Verify packaged Windows first launchbun run verify:packaged-desktop-startup -- release/desktop/win-unpacked/EdgeEver.exe
12. Verify unsigned Windows installer$version = (Get-Content apps/desktop/package.json | ConvertFrom-Json).version $installer = "release/desktop/EdgeEver-$version-windows-x64.exe" if (-not (Test-Path -LiteralPath $installer)) { throw "Expected Windows installer was not created: $installer" } $signature = Get-AuthenticodeSignature -LiteralPath $installer if ($signature.Status -ne "NotSigned") { throw "Installer must be unsigned before SignPath submission; status: $($signature.Status)" } "path=$installer" >> $env:GITHUB_OUTPUT
13. Upload unsigned installer for SignPathactions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
14. Submit SignPath test-signing requestSignPath/github-action-submit-signing-request@b9d91eadd323de506c0c81cf0c7fe7438f3360fd
15. Verify SignPath test signature$signedInstallers = @( Get-ChildItem -LiteralPath "${{ runner.temp }}\edgeever-signpath-signed" -Filter *.exe -File -Recurse ) if ($signedInstallers.Count -ne 1) { throw "Expected exactly one signed installer, found $($signedInstallers.Count)" } $signedInstaller = $signedInstallers[0] $signature = Get-AuthenticodeSignature -LiteralPath $signedInstaller.FullName if ($null -eq $signature.SignerCertificate -or $signature.Status -eq "NotSigned") { throw "SignPath did not return an Authenticode-sign…
16. Upload test-signed installeractions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a