🐛 fix(ci/driver): 修复驱动发布错配与 dev 驱动下载命中旧资产

- 发布链路新增 driver release 资产自检，校验已发布二进制与 manifest revision/sha256 一致
- dev-build 与 release 工作流在复用已发布驱动前先校验实际资产，发现旧二进制混入时强制全量重建
- driver manifest 新增 sha256 字段，避免仅凭 source commit 与 manifest 一致就误判发布有效
- 驱动变更检测与全量重建判定纳入 release asset 校验脚本变更，确保链路修复提交会触发自愈重建
- 驱动下载优先使用 GitHub release asset API 地址，并对资产接口按 octet-stream 下载，降低 dev-latest 同名资产命中旧缓存的风险
- 保持 DuckDB 无主键编辑修复不回退，并通过 internal/db 与前端相关回归测试

internal/app/methods_driver.go

@@ -3573,8 +3573,14 @@ func isOptionalDriverDownloadZipURL(urlText string) bool {
 	if trimmedURL == "" {
 		return false
 	}
-	if parsed, err := url.Parse(trimmedURL); err == nil && strings.TrimSpace(parsed.Path) != "" {
-		return strings.EqualFold(path.Ext(parsed.Path), ".zip")
+	if parsed, err := url.Parse(trimmedURL); err == nil {
+		if strings.TrimSpace(parsed.Path) != "" && strings.EqualFold(path.Ext(parsed.Path), ".zip") {
+			return true
+		}
+		if strings.TrimSpace(parsed.Fragment) != "" && strings.EqualFold(path.Ext(parsed.Fragment), ".zip") {
+			return true
+		}
+		return false
 	}
 	return strings.EqualFold(filepath.Ext(trimmedURL), ".zip")
 }
@@ -4492,6 +4498,45 @@ func driverReleaseLatestDownloadURL(assetName string) string {
 	return fmt.Sprintf("https://github.com/%s/releases/latest/download/%s", driverReleaseRepo, url.PathEscape(asset))
 }
 
+func findReleaseAssetByName(release *githubRelease, assetNames []string) (githubAsset, bool) {
+	if release == nil || len(release.Assets) == 0 || len(assetNames) == 0 {
+		return githubAsset{}, false
+	}
+	for _, expected := range assetNames {
+		trimmed := strings.TrimSpace(expected)
+		if trimmed == "" {
+			continue
+		}
+		for _, asset := range release.Assets {
+			if strings.EqualFold(strings.TrimSpace(asset.Name), trimmed) {
+				return asset, true
+			}
+		}
+	}
+	return githubAsset{}, false
+}
+
+func driverReleaseAssetAPIURL(asset githubAsset) string {
+	urlText := strings.TrimSpace(asset.URL)
+	if urlText != "" {
+		name := strings.TrimSpace(asset.Name)
+		if name == "" {
+			return urlText
+		}
+		parsed, err := url.Parse(urlText)
+		if err != nil {
+			return urlText
+		}
+		parsed.Fragment = name
+		return parsed.String()
+	}
+	urlText = strings.TrimSpace(asset.BrowserDownloadURL)
+	if urlText == "" {
+		return ""
+	}
+	return urlText
+}
+
 func optionalDriverBundlePlatformDir(goos string) string {
 	switch strings.ToLower(strings.TrimSpace(goos)) {
 	case "windows":
@@ -4579,8 +4624,18 @@ func resolveOptionalDriverBundleDownloadURLs() []string {
 	}
 
 	if tag := currentDriverReleaseTag(); tag != "" {
+		if release, err := fetchReleaseByTag(tag); err == nil {
+			if asset, ok := findReleaseAssetByName(release, []string{optionalDriverBundleAssetName}); ok {
+				appendURL(driverReleaseAssetAPIURL(asset))
+			}
+		}
 		appendURL(driverReleaseDownloadURL(tag, optionalDriverBundleAssetName))
 	}
+	if release, err := fetchLatestReleaseForDriverAssets(); err == nil {
+		if asset, ok := findReleaseAssetByName(release, []string{optionalDriverBundleAssetName}); ok {
+			appendURL(driverReleaseAssetAPIURL(asset))
+		}
+	}
 	appendURL(driverReleaseLatestDownloadURL(optionalDriverBundleAssetName))
 	return candidates
 }
@@ -5428,6 +5483,11 @@ func resolveLatestPublishedDriverDownloadURL(definition driverDefinition) (strin
 	if shouldUseDuckDBWindowsDynamicLibrary(driverType) {
 		if sizeByAsset, publishedAssets, ok := readReleaseAssetSizesFromCache("latest"); ok {
 			if publishedAssets[duckDBWindowsDriverZipAssetName] && sizeByAsset[duckDBWindowsDriverZipAssetName] > 0 {
+				if release, err := fetchLatestReleaseForDriverAssets(); err == nil {
+					if asset, found := findReleaseAssetByName(release, []string{duckDBWindowsDriverZipAssetName}); found {
+						return driverReleaseAssetAPIURL(asset), true
+					}
+				}
 				return driverReleaseLatestDownloadURL(duckDBWindowsDriverZipAssetName), true
 			}
 			return "", false
@@ -5438,6 +5498,11 @@ func resolveLatestPublishedDriverDownloadURL(definition driverDefinition) (strin
 			return "", false
 		}
 		if publishedAssets[duckDBWindowsDriverZipAssetName] && sizeByAsset[duckDBWindowsDriverZipAssetName] > 0 {
+			if release, relErr := fetchLatestReleaseForDriverAssets(); relErr == nil {
+				if asset, found := findReleaseAssetByName(release, []string{duckDBWindowsDriverZipAssetName}); found {
+					return driverReleaseAssetAPIURL(asset), true
+				}
+			}
 			return driverReleaseLatestDownloadURL(duckDBWindowsDriverZipAssetName), true
 		}
 		return "", false
@@ -5451,6 +5516,11 @@ func resolveLatestPublishedDriverDownloadURL(definition driverDefinition) (strin
 	if sizeByAsset, publishedAssets, ok := readReleaseAssetSizesFromCache("latest"); ok {
 		for _, assetName := range assetNames {
 			if publishedAssets[assetName] && sizeByAsset[assetName] > 0 {
+				if release, err := fetchLatestReleaseForDriverAssets(); err == nil {
+					if asset, found := findReleaseAssetByName(release, []string{assetName}); found {
+						return driverReleaseAssetAPIURL(asset), true
+					}
+				}
 				return driverReleaseLatestDownloadURL(assetName), true
 			}
 		}
@@ -5463,6 +5533,11 @@ func resolveLatestPublishedDriverDownloadURL(definition driverDefinition) (strin
 	}
 	for _, assetName := range assetNames {
 		if publishedAssets[assetName] && sizeByAsset[assetName] > 0 {
+			if release, relErr := fetchLatestReleaseForDriverAssets(); relErr == nil {
+				if asset, found := findReleaseAssetByName(release, []string{assetName}); found {
+					return driverReleaseAssetAPIURL(asset), true
+				}
+			}
 			return driverReleaseLatestDownloadURL(assetName), true
 		}
 	}

internal/app/methods_driver_version_test.go

@@ -92,11 +92,40 @@ func TestResolveOptionalDriverBundleDownloadURLsUsesDriverReleaseRepo(t *testing
 	urls := resolveOptionalDriverBundleDownloadURLs()
 	wantTagged := driverReleaseDownloadURL("v0.7.4", optionalDriverBundleAssetName)
 	wantLatest := driverReleaseLatestDownloadURL(optionalDriverBundleAssetName)
-	if len(urls) != 2 {
-		t.Fatalf("expected tagged and latest bundle URLs, got %v", urls)
+	if len(urls) < 2 {
+		t.Fatalf("expected at least tagged and latest bundle URLs, got %v", urls)
 	}
-	if urls[0] != wantTagged || urls[1] != wantLatest {
-		t.Fatalf("unexpected driver bundle URLs: got %v want [%q %q]", urls, wantTagged, wantLatest)
+	foundTagged := false
+	foundLatest := false
+	for _, candidate := range urls {
+		if candidate == wantTagged {
+			foundTagged = true
+		}
+		if candidate == wantLatest {
+			foundLatest = true
+		}
+	}
+	if !foundTagged || !foundLatest {
+		t.Fatalf("expected bundle URLs to include tagged=%q and latest=%q, got %v", wantTagged, wantLatest, urls)
+	}
+}
+
+func TestDriverReleaseAssetAPIURLUsesReleaseAssetEndpoint(t *testing.T) {
+	asset := githubAsset{
+		Name:               "kingbase-driver-agent-darwin-arm64",
+		BrowserDownloadURL: "https://github.com/Syngnat/GoNavi-DriverAgents/releases/download/dev-latest/kingbase-driver-agent-darwin-arm64",
+		URL:                "https://api.github.com/repos/Syngnat/GoNavi-DriverAgents/releases/assets/123456",
+		Size:               18 << 20,
+	}
+	if got := driverReleaseAssetAPIURL(asset); got != "https://api.github.com/repos/Syngnat/GoNavi-DriverAgents/releases/assets/123456#kingbase-driver-agent-darwin-arm64" {
+		t.Fatalf("expected release asset API URL, got %q", got)
+	}
+}
+
+func TestOptionalDriverDownloadZipURLAcceptsAssetAPIFragment(t *testing.T) {
+	urlText := "https://api.github.com/repos/Syngnat/GoNavi-DriverAgents/releases/assets/123456#duckdb-driver.zip"
+	if !isOptionalDriverDownloadZipURL(urlText) {
+		t.Fatalf("expected asset API URL with zip fragment to be treated as zip download: %q", urlText)
 	}
 }
 

internal/app/methods_update.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"math"
 	"net/http"
+	urlpkg "net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -102,6 +103,8 @@ type githubRelease struct {
 type githubAsset struct {
 	Name               string `json:"name"`
 	BrowserDownloadURL string `json:"browser_download_url"`
+	URL                string `json:"url"`
+	Digest             string `json:"digest"`
 	Size               int64  `json:"size"`
 }
 
@@ -655,6 +658,9 @@ func downloadFileWithHashWithTimeout(url, filePath string, onProgress func(downl
 		return "", err
 	}
 	req.Header.Set("User-Agent", "GoNavi-Updater")
+	if isGitHubReleaseAssetAPIURL(url) {
+		req.Header.Set("Accept", "application/octet-stream")
+	}
 
 	resp, err := client.Do(req)
 	if err != nil {
@@ -713,6 +719,17 @@ func downloadFileWithHashWithTimeout(url, filePath string, onProgress func(downl
 	return hex.EncodeToString(hasher.Sum(nil)), nil
 }
 
+func isGitHubReleaseAssetAPIURL(urlText string) bool {
+	parsed, err := urlpkg.Parse(strings.TrimSpace(urlText))
+	if err != nil {
+		return false
+	}
+	if !strings.EqualFold(parsed.Host, "api.github.com") {
+		return false
+	}
+	return strings.Contains(strings.ToLower(strings.TrimSpace(parsed.Path)), "/releases/assets/")
+}
+
 func buildUpdateDownloadResult(info UpdateInfo, staged *stagedUpdate) updateDownloadResult {
 	result := updateDownloadResult{
 		Info:          info,