diff --git a/apps/desktop/scripts/desktop-publication-summary.ts b/apps/desktop/scripts/desktop-publication-summary.ts
index 19b55a8f7d..4d2d437dd3 100644
--- a/apps/desktop/scripts/desktop-publication-summary.ts
+++ b/apps/desktop/scripts/desktop-publication-summary.ts
@@ -5,7 +5,7 @@ import type { DesktopRetainedSource } from './desktop-release-store.ts'
import type { DesktopUploadPlan } from './desktop-upload-plan.ts'
function text(value: string): string {
- return value.replace(/[&<>"'|`\r\n]/gu, character => `&#${character.charCodeAt(0)};`)
+ return value.replace(/[&<>"'|`\r\n\\*_\[\]()!~:]/gu, character => `&#${character.charCodeAt(0)};`)
}
function code(value: string): string { return `${text(value)}` }
@@ -14,15 +14,16 @@ function link(url: string, label = url): string { return ` {
+ const origin = new URL(plan.publicUrl).origin
const url = (key: string) => `${origin}/${key.split('/').map(encodeURIComponent).join('/')}`
const files = []
for (const file of plan.artifacts) {
@@ -65,6 +66,6 @@ export async function desktopPublicationSummary(
`审批摘要 SHA-256：${code(approval)}`, '',
`共 ${plan.artifacts.length} 个文件；大小及 SHA-256 对应实际上传字节，包括更新后的 YAML 内容。`, '',
'| 文件 | 大小 | SHA-256 |', '| --- | --- | --- |', ...files, '', '', '',
- '此摘要在公开仓库中可公开查看，包含下载路径及 test 发布的 release ID。随机前缀不能替代访问鉴权。', '',
+ '若仓库为公开仓库，此摘要中的下载路径及 test 发布的 release ID 也会公开。随机前缀不能替代访问鉴权。', '',
].join('\n')
}
diff --git a/apps/desktop/scripts/publish-desktop-ci.ts b/apps/desktop/scripts/publish-desktop-ci.ts
index eb4018858f..29057f8c01 100644
--- a/apps/desktop/scripts/publish-desktop-ci.ts
+++ b/apps/desktop/scripts/publish-desktop-ci.ts
@@ -62,8 +62,8 @@ if (process.argv[1] !== undefined && resolve(process.argv[1]) === import.meta.fi
if (mode === '--publish' && !env.DESKTOP_APPROVED_PACKAGE) throw new Error('desktop publish: approved package digest is required')
if (mode === '--check') {
if (env.GITHUB_OUTPUT) await appendFile(env.GITHUB_OUTPUT, `approval=${approval}\nlabel=${plan.version} → ${manifest.source.channel} / ${plan.target} / ${plan.environment}\n`)
- if (env.GITHUB_STEP_SUMMARY) await appendFile(env.GITHUB_STEP_SUMMARY,
- await desktopPublicationSummary(manifest.source, plan, config.origin, approval))
+ if (env.GITHUB_STEP_SUMMARY && !env.DESKTOP_APPROVED_PACKAGE) await appendFile(env.GITHUB_STEP_SUMMARY,
+ await desktopPublicationSummary(manifest.source, plan, approval))
if (env.GITHUB_OUTPUT && config.githubApp) await appendFile(env.GITHUB_OUTPUT,
`app-client-id=${config.githubApp.clientId}\napp-key-file=${config.githubApp.privateKeyFile}\n`)
process.stdout.write(`desktop publish: verified ${plan.target} ${plan.version}; no credentials read or COS requests made\n`)
diff --git a/apps/desktop/tests/desktop-publication-preflight.spec.ts b/apps/desktop/tests/desktop-publication-preflight.spec.ts
index 29c07ea347..39e717a827 100644
--- a/apps/desktop/tests/desktop-publication-preflight.spec.ts
+++ b/apps/desktop/tests/desktop-publication-preflight.spec.ts
@@ -20,7 +20,7 @@ it.each(['mac-arm64', 'win-x64'] as const)('preflights a complete retained %s bu
const releaseId = 'a'.repeat(32)
await writeFile(join(configRoot, 'presets/test.env'), `DSH_DESKTOP_AUTO_UPDATE_ENV=test\nDOWNLOAD_TEST_RELEASE_ID=${releaseId}\n`)
await writeFile(join(configRoot, 'publishing/test.json'), JSON.stringify({
- bucket: 'fixture-1250000000', origin: 'https://example.com', credentialsFile: join(root, 'absent-credentials.json'),
+ bucket: 'fixture-1250000000', origin: 'https://EXAMPLE.com:443/', credentialsFile: join(root, 'absent-credentials.json'),
}))
const commit = 'b'.repeat(40)
const base = `deepseek-harness-1.0.0-${target}`
@@ -52,11 +52,12 @@ it.each(['mac-arm64', 'win-x64'] as const)('preflights a complete retained %s bu
expect(prepared.plan.version).toBe('1.0.0')
expect(prepared.plan.artifacts.every(file => file.path.startsWith(retained))).toBe(true)
expect(signatureChecks).toBe(1)
- const summary = await desktopPublicationSummary(prepared.manifest.source, prepared.plan, prepared.config.origin, 'c'.repeat(64))
+ const summary = await desktopPublicationSummary(prepared.manifest.source, prepared.plan, 'c'.repeat(64))
await expect(summary).toMatchFileSnapshot(`./expected/publication-${target}.md`)
const feed = prepared.plan.artifacts.find(file => file.channelMetadata)!
expect(summary).toContain(createHash('sha256').update(feed.contents!).digest('hex'))
- expect(summary).toContain('https://github.com/owner/repo/actions/runs/10/attempts/2')
+ expect(summary).toContain('https://github.com/owner/repo/actions/runs/10/attempts/2')
+ expect(summary).not.toContain('example.com//')
expect(summary).not.toContain(root)
expect(summary).not.toContain('absent-credentials')
await expect(prepareDesktopPublication({ ...env, DESKTOP_APPROVED_PACKAGE: 'wrong' }, signature)).rejects.toThrow(/changed after approval/u)
diff --git a/apps/desktop/tests/desktop-publication-summary.spec.ts b/apps/desktop/tests/desktop-publication-summary.spec.ts
index 4f467f5ca7..5267d29034 100644
--- a/apps/desktop/tests/desktop-publication-summary.spec.ts
+++ b/apps/desktop/tests/desktop-publication-summary.spec.ts
@@ -13,7 +13,7 @@ const plan: DesktopUploadPlan = {
environment: 'production', target: 'win-x64', version: '1.0.0', bucket: 'production-1234567890',
publicUrl: 'https://download.example.com/dsh-desk/feeds/win-x64/', secretIdEnvName: 'SECRET_ID', secretKeyEnvName: 'SECRET_KEY',
artifacts: [
- { path: '/not-read/installer.exe', filename: 'Harness 1.0.0.exe', key: 'dsh-desk/bin/win-x64/latest/Harness 1.0.0.exe',
+ { path: '/not-read/installer.exe', filename: 'deepseek-harness-1.0.0-win-x64.exe', key: 'dsh-desk/bin/win-x64/latest/deepseek-harness-1.0.0-win-x64.exe',
contents: 'installer bytes', contentType: 'application/octet-stream', channelMetadata: false },
{ path: '/not-read/latest.yml', filename: 'latest.yml', key: 'dsh-desk/feeds/win-x64/latest.yml',
contents: 'version: 1.0.0\n', contentType: 'application/yaml', channelMetadata: true },
@@ -21,10 +21,10 @@ const plan: DesktopUploadPlan = {
}
it('shows production destinations and tag after approval with upload-byte fingerprints', async () => {
- const summary = await desktopPublicationSummary(source, plan, 'https://download.example.com', 'c'.repeat(64))
+ const summary = await desktopPublicationSummary(source, plan, 'c'.repeat(64))
await expect(summary).toMatchFileSnapshot('./expected/publication-production.md')
- expect(summary).toContain('/latest/Harness%201.0.0.exe')
- expect(summary).toContain('https://download.example.com/dsh-desk/feeds/win-x64/latest.yml')
+ expect(summary).toContain('/latest/deepseek-harness-1.0.0-win-x64.exe')
+ expect(summary).toContain('https://download.example.com/dsh-desk/feeds/win-x64/latest.yml')
expect(summary).toContain(createHash('sha256').update('version: 1.0.0\n').digest('hex'))
expect(summary).not.toContain('测试 release ID |')
expect(summary).not.toContain('SECRET_KEY')
@@ -32,15 +32,15 @@ it('shows production destinations and tag after approval with upload-byte finger
})
it('escapes runner display text without adding Markdown rows or HTML elements', async () => {
- const summary = await desktopPublicationSummary({ ...source, runnerName: 'runner|\n