chore(repo): 完善仓库维护与自动化 (#108)

统一 Node.js 24 LTS、CI、文档和发布工作流配置。

完善仓库维护规范、Dependabot 与贡献文档，清理生成产物并统一既有 Go 代码格式。

.github/workflows/ci.yml

@@ -2,18 +2,24 @@ name: CI
 
 on:
   push:
-    branches: [main, master]
+    branches: [main]
   pull_request:
-    branches: [main, master]
+    branches: [main]
+  workflow_dispatch:
 
 # 最小权限：构建/测试仅需读取仓库内容，显式声明以收敛默认的可写令牌。
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   backend:
     name: Go Build & Test
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
@@ -23,6 +29,23 @@ jobs:
           go-version: '1.25'
           cache-dependency-path: server/go.sum
 
+      - name: Verify modules
+        working-directory: server
+        run: go mod verify
+
+      - name: Check formatting
+        working-directory: server
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            printf '%s\n' "$unformatted"
+            exit 1
+          fi
+
+      - name: Vet
+        working-directory: server
+        run: go vet ./...
+
       - name: Build
         working-directory: server
         run: go build ./...
@@ -34,13 +57,14 @@ jobs:
   frontend:
     name: React Build & Test
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
 
@@ -48,14 +72,10 @@ jobs:
         working-directory: web
         run: npm ci
 
-      - name: Type Check
-        working-directory: web
-        run: npx tsc --noEmit -p tsconfig.json
-
       - name: Test
         working-directory: web
         run: npm run test
 
-      - name: Build
+      - name: Type Check & Build
         working-directory: web
         run: npm run build

.github/workflows/docs.yml

@@ -1,9 +1,16 @@
 name: Deploy Docs
 
 # 触发条件：
-#   - 推送 main 时，如果 docs-site/ 或站点相关 README 有变化
+#   - PR 修改 docs-site/ 时执行类型检查和构建
+#   - 推送 main 时构建并部署 GitHub Pages
 #   - 手动触发（在 Actions 页面）
 on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'docs-site/**'
+      - '.github/workflows/docs.yml'
   push:
     branches:
       - main
@@ -12,20 +19,20 @@ on:
       - '.github/workflows/docs.yml'
   workflow_dispatch:
 
-# 允许写入 Pages，用于发布到 github.com/Awuqing/BackupX 的 Pages 站点
+# 默认只读；Pages 写权限仅授予部署任务。
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
-# 同时只保留一个部署任务
+# 同一分支只保留最新一次构建，避免旧提交覆盖新结果。
 concurrency:
-  group: pages-${{ github.ref }}
+  group: docs-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   build:
+    name: Build Docs
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     defaults:
       run:
         working-directory: docs-site
@@ -36,24 +43,34 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'npm'
           cache-dependency-path: docs-site/package-lock.json
 
       - name: Install dependencies
         run: npm ci
 
+      - name: Type check
+        run: npm run typecheck
+
       - name: Build site
         run: npm run build
 
       - name: Upload artifact
+        if: github.event_name != 'pull_request'
         uses: actions/upload-pages-artifact@v3
         with:
           path: docs-site/build
 
   deploy:
+    name: Deploy Docs
+    if: github.event_name != 'pull_request'
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/release.yml

@@ -27,25 +27,85 @@ on:
         type: string
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 # 统一版本号：tag 推送取 ref_name，手动触发取 inputs.version
 env:
   VERSION: ${{ github.event.inputs.version || github.ref_name }}
 
+concurrency:
+  group: release-${{ github.ref }}-${{ github.event.inputs.version || 'tag' }}
+  cancel-in-progress: false
+
 jobs:
+  # ─── Job 0: 校验版本与测试 ───
+  verify:
+    name: Validate Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate release input
+        shell: bash
+        env:
+          RELEASE_VERSION: ${{ env.VERSION }}
+          RELEASE_EVENT: ${{ github.event_name }}
+          RELEASE_REF: ${{ github.ref }}
+        run: |
+          if [[ ! "$RELEASE_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$ ]]; then
+            echo "Version must be a SemVer tag such as v1.2.3 or v1.2.3-rc.1"
+            exit 1
+          fi
+          if [[ "$RELEASE_EVENT" == "workflow_dispatch" && "$RELEASE_REF" != "refs/heads/main" ]]; then
+            echo "Manual releases must run from the main branch"
+            exit 1
+          fi
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache-dependency-path: server/go.sum
+
+      - name: Verify backend
+        working-directory: server
+        run: |
+          go mod verify
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            printf '%s\n' "$unformatted"
+            exit 1
+          fi
+          go vet ./...
+          go test ./...
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+
+      - name: Verify frontend
+        working-directory: web
+        run: |
+          npm ci
+          npm run test
+
   # ─── Job 1: 构建前端 ───
   build-web:
     name: Build Frontend
+    needs: verify
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
 
@@ -67,6 +127,9 @@ jobs:
     name: Build ${{ matrix.goarch }}
     needs: build-web
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
     strategy:
       matrix:
         include:
@@ -98,13 +161,13 @@ jobs:
         run: |
           go build \
             -trimpath \
-            -ldflags "-s -w -X main.version=${{ env.VERSION }}" \
+            -ldflags "-s -w -X main.version=${VERSION}" \
             -o ../backupx \
             ./cmd/backupx
 
       - name: Package release
         run: |
-          ARCHIVE_NAME="backupx-${{ env.VERSION }}-${{ matrix.goos }}-${{ matrix.goarch }}"
+          ARCHIVE_NAME="backupx-${VERSION}-${{ matrix.goos }}-${{ matrix.goarch }}"
           mkdir -p "${ARCHIVE_NAME}"
           cp backupx "${ARCHIVE_NAME}/"
           cp -r web/dist "${ARCHIVE_NAME}/web"
@@ -130,6 +193,7 @@ jobs:
             backupx-${{ env.VERSION }}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz.sha256
             backupx-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
             backupx-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz.sha256
+          fail_on_unmatched_files: true
           generate_release_notes: true
 
   # ─── Job 3: Docker 多架构 → Docker Hub ───
@@ -137,6 +201,7 @@ jobs:
     name: Build & Push Docker
     needs: build-web
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4