From b400187197c57f46ead3d38d7bcf2f6e6787d42b Mon Sep 17 00:00:00 2001 From: coso Date: Fri, 17 Apr 2026 07:18:55 +0800 Subject: [PATCH] release: prepare v1.12.1 --- .github/workflows/release.yml | 77 ++++++++++++++++++++---------- RELEASE_NOTES.md | 40 +++++++--------- package-lock.json | 4 +- package.json | 2 +- packages/lime-cli-npm/README.md | 2 +- packages/lime-cli-npm/package.json | 2 +- src-tauri/Cargo.lock | 38 +++++++-------- src-tauri/Cargo.toml | 4 +- src-tauri/tauri.conf.headless.json | 2 +- src-tauri/tauri.conf.json | 2 +- 10 files changed, 96 insertions(+), 77 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 10493eb47..c1ad9268c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -371,6 +371,27 @@ jobs: security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH security list-keychain -d user -s $KEYCHAIN_PATH + - name: Validate macOS notarization prerequisites + if: startsWith(matrix.platform, 'macos') + shell: bash + env: + APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} + APPLE_ID: ${{ secrets.APPLE_ID }} + APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + run: | + set -euo pipefail + missing=() + [ -n "${APPLE_SIGNING_IDENTITY:-}" ] || missing+=("APPLE_SIGNING_IDENTITY") + [ -n "${APPLE_ID:-}" ] || missing+=("APPLE_ID") + [ -n "${APPLE_PASSWORD:-}" ] || missing+=("APPLE_PASSWORD") + [ -n "${APPLE_TEAM_ID:-}" ] || missing+=("APPLE_TEAM_ID") + + if [ "${#missing[@]}" -gt 0 ]; then + printf 'Missing macOS notarization secrets: %s\n' "${missing[*]}" >&2 + exit 1 + fi + - name: Build Tauri app (Windows offline, direct release upload) if: matrix.platform == 'windows-2022' && steps.updater_mode.outputs.enabled == 'true' uses: tauri-apps/tauri-action@v0 @@ -677,33 +698,17 @@ jobs: find "$bundle_dir" -maxdepth 4 -type f | sort done - - name: Build macOS app (fallback without notarization, verbose) - id: build_macos_fallback + - name: Fail when macOS notarized build is unavailable if: startsWith(matrix.platform, 'macos') && steps.build_macos_primary.outcome == 'failure' && steps.build_macos_retry.outcome == 'failure' shell: bash - env: - CARGO_PROFILE_RELEASE_LTO: "off" - CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 32 - CARGO_INCREMENTAL: 0 - CARGO_TARGET_DIR: src-tauri/target - SCCACHE_GHA_ENABLED: "true" - RUSTC_WRAPPER: sccache - APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} - APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }} run: | - set -euxo pipefail - echo "Fallback macOS target without notarization: ${{ matrix.target }}" - pnpm tauri build --target "${{ matrix.target }}" - - - name: Warn on macOS notarization fallback - if: startsWith(matrix.platform, 'macos') && steps.build_macos_primary.outcome == 'failure' && steps.build_macos_retry.outcome == 'failure' - run: | - echo "::warning::macOS notarization failed twice; fallback build skipped notarization and produced a signed-only artifact." + set -euo pipefail + echo "::error::macOS notarization failed twice. Blocking release instead of publishing a signed-only artifact." + exit 1 - name: Resolve macOS bundle dir id: resolve_macos_bundle_dir - if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success') + if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success') shell: bash run: | set -euo pipefail @@ -735,6 +740,28 @@ jobs: echo "Resolved macOS bundle dir: $bundle_dir" echo "bundle_dir=$bundle_dir" >> "$GITHUB_OUTPUT" + - name: Verify notarized macOS app bundle + if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success') + shell: bash + run: | + set -euo pipefail + BUNDLE_DIR="${{ steps.resolve_macos_bundle_dir.outputs.bundle_dir }}" + if [ -z "$BUNDLE_DIR" ] || [ ! -d "$BUNDLE_DIR" ]; then + echo "Expected bundle dir missing: $BUNDLE_DIR" >&2 + exit 1 + fi + + app_bundle="$(find "$BUNDLE_DIR" -type d -name "*.app" | sort | head -n 1)" + if [ -z "$app_bundle" ] || [ ! -d "$app_bundle" ]; then + echo "No .app bundle found under $BUNDLE_DIR" >&2 + find "$BUNDLE_DIR" -maxdepth 4 | sort || true + exit 1 + fi + + echo "Validating notarized app bundle: $app_bundle" + spctl -a -vv "$app_bundle" + xcrun stapler validate "$app_bundle" + - name: Inspect final macOS outputs if: startsWith(matrix.platform, 'macos') && always() shell: bash @@ -753,7 +780,7 @@ jobs: fi - name: Stage macOS release assets - if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success') + if: startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success') shell: bash run: | set -euo pipefail @@ -792,7 +819,7 @@ jobs: find "$STAGING_DIR" -maxdepth 1 -type f | sort - name: Build lime-cli release binary - if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success'))) + if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success'))) shell: bash env: CARGO_PROFILE_RELEASE_LTO: "off" @@ -807,7 +834,7 @@ jobs: - name: Package lime-cli release asset id: package_lime_cli - if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success'))) + if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success'))) shell: bash run: | set -euxo pipefail @@ -827,7 +854,7 @@ jobs: echo "asset_path=$asset_path" >> "$GITHUB_OUTPUT" - name: Stage lime-cli release asset - if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success' || steps.build_macos_fallback.outcome == 'success'))) + if: matrix.build_cli && (matrix.platform == 'windows-2022' || matrix.platform == 'ubuntu-22.04' || (startsWith(matrix.platform, 'macos') && (steps.build_macos_primary.outcome == 'success' || steps.build_macos_retry.outcome == 'success'))) shell: bash run: | set -euxo pipefail diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 2a56180c7..6e256c84c 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,38 +1,30 @@ -## Lime v1.12.0 +## Lime v1.12.1 -### ✨ 主要更新 +### 主要更新 -- 本次 `v1.12.0` 重点把 Harness Engine 的验证事实源进一步收口到同一条主链：`evidence / analysis / review / dashboard / cleanup` 现在共享同一套 verification facts 语义，前端 review 与 evidence 展示也开始复用统一的验证结果区块 -- Agent 工作台继续围绕 General Workbench、Harness 状态、Tool Search / Tool Call、Inline Process Step、Message List 与 Review Decision 做交互收敛，工作区输入发送与场景运行时同步补齐了一批回归测试 -- 资源工作台补上图片资源工作台与分类浏览能力，Provider Pool 同步把 Prompt Cache 认知前置到配置 UI，`anthropic-compatible` 渠道与官方兼容 Host 的展示口径进一步统一 -- 仓库治理继续做减法：独立 `terminal / tools / image-gen / video` 页面面已下线，只保留当前主路径需要的运行时与 API 能力，侧边栏与旧页面残留同步清退 -- `docs/roadmap/harness-engine/`、`docs/aiprompts/quality-workflow.md`、`docs/aiprompts/terminal.md`、`docs/aiprompts/providers.md` 等文档已按当前实现刷新，长期路线图与工程边界描述同步更新 +- 修复 macOS 发布工作流：notarization 所需 secrets 缺失时直接阻断发布，不再继续产出 signed-only 但未 notarize 的安装包 +- 调整 macOS 发布校验顺序：在上传产物前增加 `.app` 的 `spctl` 和 `xcrun stapler validate` 检查，确保发布资产符合签名与公证预期 +- 统一同步应用、Rust workspace、Tauri 配置和 CLI npm wrapper 版本到 `1.12.1` -### 🔗 版本与发布同步 +### 版本与发布同步 -- 应用、Rust workspace 与 CLI npm wrapper 版本已统一提升到 `1.12.0` - 应用版本入口已对齐到 `package.json`、`src-tauri/Cargo.toml`、`src-tauri/tauri.conf.json`、`src-tauri/tauri.conf.headless.json` -- `package-lock.json`、`src-tauri/Cargo.lock`、`packages/lime-cli-npm/package.json` 与 CLI README 示例已同步到当前版本 -- 本次发布目标 tag 为 `v1.12.0` +- CLI npm wrapper 版本与 README 发布示例已同步到 `1.12.1` +- 本次发布目标 tag 为 `v1.12.1` -### 🧪 已执行校验 +### 计划执行校验 - `npm run verify:app-version` -- `cargo test --manifest-path "src-tauri/Cargo.toml"`：通过，`913` 个单测通过；另有 `2` 个真实联网用例按默认配置保持 `ignored` -- `cargo clippy --manifest-path "src-tauri/Cargo.toml"`：通过，当前包含 `2` 条非阻塞告警，分别是 `src-tauri/crates/core/src/models/provider_pool_model.rs` 的 `clippy::if_same_then_else` 与 `src-tauri/src/commands/aster_agent_cmd/tool_runtime/workspace_tools.rs` 的 `dead_code` +- `cargo fmt --manifest-path "src-tauri/Cargo.toml" --all` +- `cargo test --manifest-path "src-tauri/Cargo.toml"` +- `cargo clippy --manifest-path "src-tauri/Cargo.toml"` - `npm run lint` -### ⏳ 待执行发布动作 +### 发布说明 -- `cargo fmt --manifest-path "src-tauri/Cargo.toml" --all` -- 创建并推送 `v1.12.0` tag -- 推送当前分支到 GitHub - -### 📝 发布说明 - -- 本次发布说明按当前工作区完整改动刷新，重点覆盖 Harness Engine 验证闭环、Agent Workspace 交互收口、资源工作台与 Provider 配置体验，以及旧页面面的治理减法 -- 由于 `cargo fmt --all` 和 `git tag / git push` 具有批量改写或发布风险，当前 release note 已明确把它们标记为待执行动作；完成后可直接作为 GitHub Release note 使用 +- 这是一次以发布链路修复为主的补丁版本，核心目标是避免类似 `v1.12.0` 那样在 macOS notarization 失败后仍继续对外发布问题包 +- 若 macOS notarization 再次失败，CI 现在会直接失败并阻止发布，需要先修复签名或公证环境后再重新发版 --- -**完整变更**: `v1.11.0` -> `v1.12.0` +**完整变更**: `v1.12.0` -> `v1.12.1` diff --git a/package-lock.json b/package-lock.json index e55be84c5..56c9dd823 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "lime", - "version": "1.12.0", + "version": "1.12.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "lime", - "version": "1.12.0", + "version": "1.12.1", "dependencies": { "@babel/standalone": "^7.29.0", "@fabianlars/tauri-plugin-oauth": "^2", diff --git a/package.json b/package.json index c69b96e82..99f01493d 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "lime", "private": true, - "version": "1.12.0", + "version": "1.12.1", "type": "module", "engines": { "node": ">=22.0.0" diff --git a/packages/lime-cli-npm/README.md b/packages/lime-cli-npm/README.md index a7a9af12e..905f01fb3 100644 --- a/packages/lime-cli-npm/README.md +++ b/packages/lime-cli-npm/README.md @@ -112,7 +112,7 @@ npm run build:release -- \ ```bash npm run build:release -- \ --target-triple "aarch64-apple-darwin" \ - --version "1.12.0" \ + --version "1.12.1" \ --out-dir "./dist" ``` diff --git a/packages/lime-cli-npm/package.json b/packages/lime-cli-npm/package.json index c87d4e159..92131afda 100644 --- a/packages/lime-cli-npm/package.json +++ b/packages/lime-cli-npm/package.json @@ -1,6 +1,6 @@ { "name": "@limecloud/lime-cli", - "version": "1.12.0", + "version": "1.12.1", "description": "Lime 官方任务 CLI", "bin": { "lime": "scripts/run.js" diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index d420d09f1..64908b61f 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -5101,7 +5101,7 @@ dependencies = [ [[package]] name = "lime" -version = "1.12.0" +version = "1.12.1" dependencies = [ "anyhow", "arboard", @@ -5206,7 +5206,7 @@ dependencies = [ [[package]] name = "lime-agent" -version = "1.12.0" +version = "1.12.1" dependencies = [ "anyhow", "aster-core", @@ -5235,7 +5235,7 @@ dependencies = [ [[package]] name = "lime-browser-runtime" -version = "1.12.0" +version = "1.12.1" dependencies = [ "chrono", "futures", @@ -5252,7 +5252,7 @@ dependencies = [ [[package]] name = "lime-cli" -version = "1.12.0" +version = "1.12.1" dependencies = [ "clap", "lime-core", @@ -5264,7 +5264,7 @@ dependencies = [ [[package]] name = "lime-config" -version = "1.12.0" +version = "1.12.1" dependencies = [ "async-trait", "lime-core", @@ -5280,7 +5280,7 @@ dependencies = [ [[package]] name = "lime-core" -version = "1.12.0" +version = "1.12.1" dependencies = [ "aster-models", "async-trait", @@ -5320,7 +5320,7 @@ dependencies = [ [[package]] name = "lime-credential" -version = "1.12.0" +version = "1.12.1" dependencies = [ "axum 0.7.9", "base64 0.22.1", @@ -5355,7 +5355,7 @@ dependencies = [ [[package]] name = "lime-gateway" -version = "1.12.0" +version = "1.12.1" dependencies = [ "aes", "axum 0.7.9", @@ -5385,7 +5385,7 @@ dependencies = [ [[package]] name = "lime-infra" -version = "1.12.0" +version = "1.12.1" dependencies = [ "chrono", "dashmap 5.5.3", @@ -5405,7 +5405,7 @@ dependencies = [ [[package]] name = "lime-mcp" -version = "1.12.0" +version = "1.12.1" dependencies = [ "async-trait", "dirs 5.0.1", @@ -5421,7 +5421,7 @@ dependencies = [ [[package]] name = "lime-media-runtime" -version = "1.12.0" +version = "1.12.1" dependencies = [ "axum 0.7.9", "chrono", @@ -5452,7 +5452,7 @@ dependencies = [ [[package]] name = "lime-processor" -version = "1.12.0" +version = "1.12.1" dependencies = [ "async-trait", "lime-core", @@ -5471,7 +5471,7 @@ dependencies = [ [[package]] name = "lime-providers" -version = "1.12.0" +version = "1.12.1" dependencies = [ "anyhow", "async-stream", @@ -5526,7 +5526,7 @@ dependencies = [ [[package]] name = "lime-server" -version = "1.12.0" +version = "1.12.1" dependencies = [ "aster-core", "async-stream", @@ -5571,7 +5571,7 @@ dependencies = [ [[package]] name = "lime-server-utils" -version = "1.12.0" +version = "1.12.1" dependencies = [ "axum 0.7.9", "futures", @@ -5586,7 +5586,7 @@ dependencies = [ [[package]] name = "lime-services" -version = "1.12.0" +version = "1.12.1" dependencies = [ "anyhow", "aster-core", @@ -5628,7 +5628,7 @@ dependencies = [ [[package]] name = "lime-skills" -version = "1.12.0" +version = "1.12.1" dependencies = [ "async-trait", "dirs 5.0.1", @@ -5646,7 +5646,7 @@ dependencies = [ [[package]] name = "lime-terminal" -version = "1.12.0" +version = "1.12.1" dependencies = [ "async-trait", "base64 0.22.1", @@ -5673,7 +5673,7 @@ dependencies = [ [[package]] name = "lime-websocket" -version = "1.12.0" +version = "1.12.1" dependencies = [ "axum 0.7.9", "chrono", diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 10eeef9da..9f25ac8ae 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -4,7 +4,7 @@ exclude = ["crates/aster", "crates/aster-models", "crates/aster-rust"] resolver = "2" [workspace.package] -version = "1.12.0" +version = "1.12.1" edition = "2021" authors = ["coso"] repository = "https://github.com/aiclientproxy/lime" @@ -189,7 +189,7 @@ version = "2.4" [package] name = "lime" -version = "1.12.0" +version = "1.12.1" description = "AI API Proxy Desktop App" authors = ["you"] edition = "2021" diff --git a/src-tauri/tauri.conf.headless.json b/src-tauri/tauri.conf.headless.json index cdd14533d..34bec4525 100644 --- a/src-tauri/tauri.conf.headless.json +++ b/src-tauri/tauri.conf.headless.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "Lime", - "version": "1.12.0", + "version": "1.12.1", "identifier": "com.lime.app", "build": { "beforeDevCommand": "npm run dev:web-bridge", diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json index 483acdc71..697dae586 100644 --- a/src-tauri/tauri.conf.json +++ b/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "Lime", - "version": "1.12.0", + "version": "1.12.1", "identifier": "com.lime.app", "build": { "beforeDevCommand": "npm run dev",