⚡️ perf(driver/release): 优化驱动镜像下载与发布链路

- 将各平台驱动拆分为独立 ZIP，并为 DuckDB 同包携带运行库 - 仅生成 ZIP 下载候选，按 Gatewaysentry 与 GitHub 短测速结果调整优先级 - 扩展发布索引的归档摘要与条目元数据，强化跨平台资产校验 - 禁止裸驱动与 CI 总包进入 VPS 镜像，并校验载荷摘要和索引一致性 - 显式控制驱动镜像发布，自动清理失败暂存、过期目录和旧版本
2026-08-10 08:43:34 +08:00 · 2026-07-23 16:10:08 +08:00
parent dd9a56a70d
commit 84d6007be9
14 changed files with 2493 additions and 159 deletions
--- a/.github/actions/publish-vps-mirror/action.yml
+++ b/.github/actions/publish-vps-mirror/action.yml
@@ -14,6 +14,9 @@ inputs:
  app-manifest:
    description: Application latest manifest path
    required: true
+  driver-enabled:
+    description: Whether this deployment must publish driver assets
+    required: true
  driver-tag:
    description: Physical driver release directory name
    required: false
@@ -56,6 +59,7 @@ runs:
        MIRROR_APP_TAG: ${{ inputs.app-tag }}
        MIRROR_APP_DIR: ${{ inputs.app-dir }}
        MIRROR_APP_MANIFEST: ${{ inputs.app-manifest }}
+        MIRROR_DRIVER_ENABLED: ${{ inputs.driver-enabled }}
        MIRROR_DRIVER_TAG: ${{ inputs.driver-tag }}
        MIRROR_DRIVER_DIR: ${{ inputs.driver-dir }}
        MIRROR_DRIVER_VERSION_INDEX: ${{ inputs.driver-version-index }}
@@ -68,11 +72,36 @@ runs:
      run: |
        set -euo pipefail
        mirror_root="/srv/gonavi-downloads"
+        [[ "${MIRROR_CHANNEL}" == "stable" || "${MIRROR_CHANNEL}" == "dev" ]] || {
+          echo "Invalid mirror channel: ${MIRROR_CHANNEL}" >&2
+          exit 1
+        }
+        [[ "${GITHUB_RUN_ID:-}" =~ ^[0-9]+$ && "${GITHUB_RUN_ATTEMPT:-}" =~ ^[0-9]+$ ]] || {
+          echo "Invalid GitHub run identity" >&2
+          exit 1
+        }
        deployment_id="${MIRROR_CHANNEL}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
        stage_dir="${RUNNER_TEMP}/gonavi-vps-mirror-${deployment_id}"
        ssh_dir="${RUNNER_TEMP}/gonavi-vps-ssh-${deployment_id}"
        remote_stage="${mirror_root}/.incoming/${deployment_id}"
        effective_driver_tag=""
+        remote=""
+        remote_cleanup_enabled=false
+        ssh_options=()
+
+        cleanup() {
+          local exit_code=$?
+          local cleanup_remote_command=""
+          trap - EXIT
+          set +e
+          if [[ "${remote_cleanup_enabled}" == true && -n "${remote}" ]]; then
+            printf -v cleanup_remote_command 'rm -rf -- %q' "${remote_stage}"
+            ssh "${ssh_options[@]}" "${remote}" "${cleanup_remote_command}" >/dev/null 2>&1 || true
+          fi
+          rm -rf -- "${ssh_dir}" "${stage_dir}"
+          exit "${exit_code}"
+        }
+        trap cleanup EXIT

        [[ "${MIRROR_SSH_PORT}" =~ ^[0-9]+$ ]] || {
          echo "Invalid mirror SSH port" >&2
@@ -92,15 +121,44 @@ runs:
          --app-manifest "${MIRROR_APP_MANIFEST}"
          --output "${stage_dir}"
        )
-        if [[ -n "${MIRROR_DRIVER_LATEST_INDEX}" && -s "${MIRROR_DRIVER_LATEST_INDEX}" ]]; then
-          effective_driver_tag="${MIRROR_DRIVER_TAG}"
-          prepare_args+=(
-            --driver-tag "${effective_driver_tag}"
-            --driver-dir "${MIRROR_DRIVER_DIR}"
-            --driver-version-index "${MIRROR_DRIVER_VERSION_INDEX}"
-            --driver-latest-index "${MIRROR_DRIVER_LATEST_INDEX}"
-          )
-        fi
+        case "${MIRROR_DRIVER_ENABLED}" in
+          true)
+            [[ -n "${MIRROR_DRIVER_TAG}" ]] || {
+              echo "Driver mirror publication is enabled but driver-tag is empty" >&2
+              exit 1
+            }
+            [[ -n "${MIRROR_DRIVER_DIR}" && -d "${MIRROR_DRIVER_DIR}" ]] || {
+              echo "Driver mirror publication is enabled but driver-dir is missing" >&2
+              exit 1
+            }
+            [[ -n "$(find "${MIRROR_DRIVER_DIR}" -maxdepth 1 -type f -print -quit)" ]] || {
+              echo "Driver mirror publication is enabled but driver-dir is empty" >&2
+              exit 1
+            }
+            [[ -n "${MIRROR_DRIVER_VERSION_INDEX}" && -s "${MIRROR_DRIVER_VERSION_INDEX}" ]] || {
+              echo "Driver mirror publication is enabled but driver-version-index is missing or empty" >&2
+              exit 1
+            }
+            [[ -n "${MIRROR_DRIVER_LATEST_INDEX}" && -s "${MIRROR_DRIVER_LATEST_INDEX}" ]] || {
+              echo "Driver mirror publication is enabled but driver-latest-index is missing or empty" >&2
+              exit 1
+            }
+            effective_driver_tag="${MIRROR_DRIVER_TAG}"
+            prepare_args+=(
+              --driver-tag "${effective_driver_tag}"
+              --driver-dir "${MIRROR_DRIVER_DIR}"
+              --driver-version-index "${MIRROR_DRIVER_VERSION_INDEX}"
+              --driver-latest-index "${MIRROR_DRIVER_LATEST_INDEX}"
+            )
+            ;;
+          false)
+            echo "Driver mirror publication explicitly disabled"
+            ;;
+          *)
+            echo "Invalid driver-enabled value: ${MIRROR_DRIVER_ENABLED}" >&2
+            exit 1
+            ;;
+        esac
        python3 "${GITHUB_WORKSPACE}/tools/prepare-vps-release-payload.py" "${prepare_args[@]}"
        cp "${GITHUB_WORKSPACE}/tools/vps-release-commit.sh" "${stage_dir}/vps-release-commit.sh"
        chmod 0755 "${stage_dir}/vps-release-commit.sh"
@@ -114,6 +172,17 @@ runs:
          -o "UserKnownHostsFile=${ssh_dir}/known_hosts"
        )
        remote="${MIRROR_SSH_USER}@${MIRROR_SSH_HOST}"
+        printf -v stale_cleanup_script '%s\n' \
+          'set -euo pipefail' \
+          "root=$(printf '%q' "${mirror_root}")" \
+          'marker="$(cat "${root}/.gonavi-mirror-root" 2>/dev/null || true)"' \
+          '[[ "${marker}" == "gonavi-download-mirror-v1" ]] || { echo "mirror root marker is missing or invalid" >&2; exit 1; }' \
+          'incoming="${root}/.incoming"' \
+          'mkdir -p "${incoming}"' \
+          'find "${incoming}" -mindepth 1 -maxdepth 1 -type d -mmin +1440 -exec rm -rf -- {} +'
+        printf -v stale_cleanup_command 'bash -c %q' "${stale_cleanup_script}"
+        ssh "${ssh_options[@]}" "${remote}" "${stale_cleanup_command}"
+
        payload_bytes="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["payloadBytes"])' "${stage_dir}/deployment.json")"
        available_kib="$(ssh "${ssh_options[@]}" "${remote}" "LC_ALL=C df -Pk '${mirror_root}' | awk 'NR == 2 { print \$4 }'")"
        [[ "${available_kib}" =~ ^[0-9]+$ ]] || {
@@ -127,6 +196,7 @@ runs:
          exit 1
        fi

+        remote_cleanup_enabled=true
        ssh "${ssh_options[@]}" "${remote}" "mkdir -p '${remote_stage}'"
        rsync -rlt --delete --partial \
          --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
@@ -141,5 +211,3 @@ runs:
          "${MIRROR_APP_TAG}" \
          "${effective_driver_tag}"
        ssh "${ssh_options[@]}" "${remote}" "${remote_command}"
-
-        rm -rf "${ssh_dir}" "${stage_dir}"
--- a/.github/workflows/dev-build.yml
+++ b/.github/workflows/dev-build.yml
@@ -1492,6 +1492,7 @@ jobs:
          app-tag: ${{ steps.version.outputs.version }}
          app-dir: release-assets
          app-manifest: release-assets/latest-dev.json
+          driver-enabled: ${{ steps.driver_assets.outputs.has_driver_assets }}
          driver-tag: ${{ steps.version.outputs.version }}
          driver-dir: driver-release-assets
          driver-version-index: ${{ runner.temp }}/driver-dev-latest-index.json
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -159,6 +159,7 @@ jobs:
        uses: actions/checkout@v5

      - name: Prepare and verify stable mirror payload
+        id: mirror_payload
        env:
          GH_TOKEN: ${{ github.token }}
          DRIVER_RELEASE_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
@@ -201,6 +202,7 @@ jobs:
              exit 1
              ;;
          esac
+          echo "has_driver_release=${has_driver_release}" >> "$GITHUB_OUTPUT"

          jq -e \
            --arg tag "${RELEASE_TAG}" \
@@ -325,6 +327,7 @@ jobs:
          app-tag: ${{ steps.validate.outputs.tag }}
          app-dir: ${{ runner.temp }}/gonavi-release
          app-manifest: ${{ runner.temp }}/gonavi-release/latest.json
+          driver-enabled: ${{ steps.mirror_payload.outputs.has_driver_release }}
          driver-tag: ${{ steps.validate.outputs.tag }}
          driver-dir: ${{ runner.temp }}/driver-release
          driver-version-index: ${{ runner.temp }}/driver-release/GoNavi-DriverAgents-Index.json