From b59553d00a40fed7e0cfa4238e2010bc987dc747 Mon Sep 17 00:00:00 2001
From: argszero <argszero@gmail.com>
Date: Thu, 6 Aug 2026 10:30:48 +0800
Subject: [PATCH 1/4] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20build-release?=
 =?UTF-8?q?=20workflow=20=E8=A7=A3=E6=9E=90=E5=A4=B1=E8=B4=A5=20=E2=80=94?=
 =?UTF-8?q?=20if:=20=E4=B8=AD=E7=A6=81=E6=AD=A2=20secrets=20=E4=B8=8A?=
 =?UTF-8?q?=E4=B8=8B=E6=96=87=EF=BC=8C=E6=94=B9=E7=BB=8F=20job=20=E7=BA=A7?=
 =?UTF-8?q?=20env=20=E4=BC=A0=E9=80=92=EF=BC=88#441=20=E5=BC=95=E5=85=A5?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#441 在 if: 条件中直接引用 secrets.X != ''（第 54、122 行），
GitHub Actions 的 if: 上下文不支持 secrets（可用: env/github/inputs/
job/matrix/needs/runner/steps/strategy/vars），导致 workflow 解析失败，
push 后 run 创建即失败、零 job（f26bf27 与 93e24d7 均复现，报
"This run likely failed because of a workflow file issue"）。

修复：将 secrets 提升为 job 级 env（job env 允许 secrets context，
未配置时求值为空字符串），if: 改用 env.MACOS_SIGNING_* != '' 判断；
CSC_LINK/CSC_KEY_PASSWORD 同步改引用 env 变量。签名降级逻辑不变
（Secret 未配 → 跳过签名步骤、CSC_LINK 为空）。

验证：actionlint v1.7.12 校验 build-release.yml + test.yml 全绿（修复前
2 处 expression 报错）；pytest 473 passed；import check + emrg --help OK。
---
 .github/workflows/build-release.yml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 76969ff5..afa52c5d 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -36,6 +36,12 @@ jobs:
             arch: x64
             artifact: EMRG-*-windows-x64.exe
     runs-on: ${{ matrix.os }}
+    env:
+      # secrets 不能在 if: 中直接引用（GitHub Actions 硬限制，否则 workflow 解析失败）。
+      # 先提升为 job 级 env（允许 secrets context）；未配置时求值为空字符串 → 跳过降级。
+      MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
+      MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
+      MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
     steps:
       - uses: actions/checkout@v5
 
@@ -51,11 +57,8 @@ jobs:
 
       # ── macOS 代码签名（rant 2026-08-06T10:06:55 P1/P2；Secret 未配则跳过降级）──
       - name: Import signing certificate (macOS only)
-        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != ''
+        if: runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != ''
         shell: bash
-        env:
-          MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
-          MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
         run: |
           echo "$MACOS_SIGNING_P12_BASE64" | base64 --decode > /tmp/signing.p12
           security create-keychain -p 'ci-temp' /tmp/ci.keychain
@@ -101,8 +104,8 @@ jobs:
         env:
           # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign
           # （含 hardened runtime；Secret 未配时为空 → 不签名，保持现状降级）
-          CSC_LINK: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
-          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_PASSWORD || '' }}
+          CSC_LINK: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
+          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && env.MACOS_SIGNING_P12_PASSWORD || '' }}
         run: |
           npm ci
           npm run dist
@@ -119,10 +122,8 @@ jobs:
 
       # ── pkg 签名（macOS only，P2；Secret 未配则跳过降级）──
       - name: Sign pkg (macOS only)
-        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_IDENTITY != ''
+        if: runner.os == 'macOS' && env.MACOS_SIGNING_IDENTITY != ''
         shell: bash
-        env:
-          MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
         run: |
           PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi

From e833bdc5e88dea229a0a737d429e390f86421ac9 Mon Sep 17 00:00:00 2001
From: argszero <argszero@gmail.com>
Date: Thu, 6 Aug 2026 10:35:26 +0800
Subject: [PATCH 2/4] =?UTF-8?q?emrg:=20CI=20=E5=A2=9E=E5=8A=A0=20actionlin?=
 =?UTF-8?q?t=20=E6=A0=A1=E9=AA=8C=20=E2=80=94=20workflow=20=E8=A7=A3?=
 =?UTF-8?q?=E6=9E=90=E9=94=99=E8=AF=AF=E7=AB=8B=E5=8D=B3=E5=A4=B1=E8=B4=A5?=
 =?UTF-8?q?=EF=BC=88#441=20=E6=95=99=E8=AE=AD=E5=9B=BA=E5=8C=96=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

#441 在 build-release.yml 的 if: 条件中直接引用 secrets 上下文（GitHub
Actions 硬限制），导致 workflow 解析失败、push 后 run 创建即失败零 job。
该错误人工审查无法发现（第 81 轮 review 未检出），直到 #443 用 actionlint
v1.7.12 才定位根因。

修复：test.yml 在 checkout 后增加 rhysd/actionlint@v1 步骤，全量校验
.github/workflows/*.yml——任何 workflow 语法/上下文错误在 PR CI 即失败，
不再等到 build-release 触发时暴露。

验证：actionlint 本地校验全部 workflow exit 0；pytest 473 passed；
import check + emrg --help OK。
---
 .github/workflows/test.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b282a2b5..f2e62279 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,6 +11,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
+      # #441 教训：workflow 文件的 if: secrets 等解析错误人工审查易漏
+      # （actionlint 可捕获），push 后才在 build-release 触发时暴露。
+      # → CI 全量校验所有 workflow，解析错误立即失败（R82 固化）。
+      - name: Actionlint (workflow lint)
+        uses: rhysd/actionlint@v1
       - uses: astral-sh/setup-uv@v5
         with:
           python-version: "3.13"

From 21f1f608de77019438c2c30c04bd4b741e76702f Mon Sep 17 00:00:00 2001
From: argszero <argszero@gmail.com>
Date: Thu, 6 Aug 2026 10:36:38 +0800
Subject: [PATCH 3/4] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20actionlint=20a?=
 =?UTF-8?q?ction=20=E7=89=88=E6=9C=AC=20=E2=80=94=20rhysd/actionlint=20?=
 =?UTF-8?q?=E6=97=A0=20v1=20rolling=20tag=EF=BC=8C=E6=94=B9=E7=94=A8=20v1.?=
 =?UTF-8?q?7.12=20=E5=9B=BA=E5=AE=9A=E7=89=88=E6=9C=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI run 31066063023 失败：Unable to resolve action rhysd/actionlint@v1,
unable to find version v1。该 repo 仅发布版本化 tag（v1.7.x），无 v1
rolling tag。改为固定 @v1.7.12（当前最新，CI 确定性更佳）。
---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f2e62279..3f4f499f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,7 +15,7 @@ jobs:
       # （actionlint 可捕获），push 后才在 build-release 触发时暴露。
       # → CI 全量校验所有 workflow，解析错误立即失败（R82 固化）。
       - name: Actionlint (workflow lint)
-        uses: rhysd/actionlint@v1
+        uses: rhysd/actionlint@v1.7.12
       - uses: astral-sh/setup-uv@v5
         with:
           python-version: "3.13"

From 80e8bace02afe9a249bbd9c1a8fbde0a853b93a1 Mon Sep 17 00:00:00 2001
From: argszero <argszero@gmail.com>
Date: Thu, 6 Aug 2026 10:39:53 +0800
Subject: [PATCH 4/4] =?UTF-8?q?emrg:=20=E4=BF=AE=E5=A4=8D=20build-release?=
 =?UTF-8?q?=20shellcheck=20=E8=AD=A6=E5=91=8A=20=E2=80=94=20SC2046=20?=
 =?UTF-8?q?=E6=98=BE=E5=BC=8F=E6=A0=87=E6=B3=A8=E6=9C=89=E6=84=8F=E8=AF=8D?=
 =?UTF-8?q?=E5=88=86=E5=89=B2=E3=80=81SC2012=20ls=20=E6=94=B9=20find?=
 =?UTF-8?q?=EF=BC=88actionlint=20=E9=97=A8=E7=A6=81=E8=90=BD=E5=9C=B0?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub Docker action 版 actionlint（@v1.7.12）内置 shellcheck 集成，
对 build-release.yml 报 2 处：
- SC2046（Import signing certificate）：security list-keychains -s 需
  每个 keychain 路径为独立参数，词分割是有意的 → 加 shellcheck disable
  注释显式声明
- SC2012（Sign pkg）：ls | head 取 pkg 文件 → 改 find -maxdepth 1
本地 macOS 版 actionlint 无 shellcheck 集成故未检出，CI Docker 版
自带 shellcheck 才暴露——门禁价值再次体现。
---
 .github/workflows/build-release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index afa52c5d..fbd36293 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -67,6 +67,8 @@ jobs:
           security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
             -T /usr/bin/codesign -T /usr/bin/productsign
           security set-key-partition-list -S apple-tool:,apple: -k 'ci-temp' /tmp/ci.keychain
+          # SC2046: -s 需要将每个 keychain 路径作为独立参数传递，词分割是有意的
+          # shellcheck disable=SC2046
           security list-keychains -d user -s /tmp/ci.keychain $(security list-keychains -d user | tr -d '"')
           security find-identity -v -p codesigning /tmp/ci.keychain
 
@@ -125,7 +127,7 @@ jobs:
         if: runner.os == 'macOS' && env.MACOS_SIGNING_IDENTITY != ''
         shell: bash
         run: |
-          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          PKG="$(find dist/artifacts -maxdepth 1 -name 'EMRG-*-macos-*.pkg' | head -1)"
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
           productsign --sign "$MACOS_SIGNING_IDENTITY" "$PKG" "${PKG}.signed"
           mv "${PKG}.signed" "$PKG"