feat(release): reuse CUA helper builds with matching source bytes

.github/workflows/cua-helper-package.yml

@@ -8,6 +8,13 @@ on:
         type: string
         default: master
         required: true
+      cua_run_id:
+        description: >-
+          填写要复用的 CUA helper 构建运行编号（run ID，即运行页面 URL 中 /actions/runs/ 后的数字）。
+          留空自动查找逐字节一致的源码构建出来的产物，找不到时重新构建。
+        type: string
+        required: false
+        default: ''
       preset:
         description: '机器上的签名配置'
         type: choice
@@ -19,16 +26,26 @@ on:
       source_ref:
         type: string
         required: true
+      cua_run_id:
+        type: string
+        default: ''
       preset:
         type: string
         default: production
     outputs:
-      artifact:
-        description: '包含两个架构的已签名、公证 helper 归档'
-        value: ${{ jobs.package.outputs.artifact }}
+      artifact-id:
+        description: '包含两个架构的已签名、公证 helper 的产物编号'
+        value: ${{ jobs.package.outputs.artifact-id }}
+      run-id:
+        description: '产物所属的构建运行编号'
+        value: ${{ jobs.package.outputs.run-id }}
+      build-key:
+        description: '源码和构建配置的摘要'
+        value: ${{ jobs.package.outputs.build-key }}
 
 permissions:
   contents: read
+  actions: read
 
 # Desktop uses the same keychain search list and optional system proxy transaction.
 concurrency:
@@ -40,7 +57,9 @@ jobs:
     runs-on: [self-hosted, macOS, ARM64, dsh-mac-package-trial]
     timeout-minutes: 60
     outputs:
-      artifact: ${{ steps.artifact.outputs.name }}
+      artifact-id: ${{ steps.retained.outputs.artifact-id || steps.upload.outputs.artifact-id }}
+      run-id: ${{ steps.retained.outputs.run-id || github.run_id }}
+      build-key: ${{ steps.retained.outputs.build-key }}
     env:
       DSH_PACKAGING_PRESET: ${{ inputs.preset }}
       DSH_TELEMETRY_DISABLED: '1'
@@ -53,31 +72,47 @@ jobs:
           clean: true
       - name: Validate source selection
         run: |
-          node -e 'const cp=require("node:child_process"); const fs=require("node:fs"); const ref=process.env.PACKAGE_SOURCE_REF;
+          node -e 'const fs=require("node:fs"); const ref=process.env.PACKAGE_SOURCE_REF;
           if(ref.startsWith("refs/pull/") || /^[a-f0-9]{40}$/i.test(ref)) throw Error("Select a trusted repository branch or release tag");
           const tag=ref.replace(/^refs\/tags\//, "");
           if(tag.startsWith("dsh-v") && tag!=="dsh-v"+JSON.parse(fs.readFileSync("package.json","utf8")).version) throw Error("Release tag must match product version");
           if(!["test","production"].includes(process.env.DSH_PACKAGING_PRESET)) throw Error("Invalid preset");'
-      - uses: pnpm/[email protected]
-        with:
-          dest: ${{ runner.temp }}/setup-pnpm-cua-${{ github.run_id }}-${{ github.run_attempt }}
       - uses: actions/[email protected]
         with:
           node-version: '24'
           package-manager-cache: false
+      - name: Find reusable CUA helper
+        id: retained
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CUA_RUN_ID: ${{ inputs.cua_run_id }}
+        run: node scripts/cua-helper/select-artifact.ts
+      - uses: pnpm/[email protected]
+        if: steps.retained.outputs.artifact-id == ''
+        with:
+          dest: ${{ runner.temp }}/setup-pnpm-cua-${{ github.run_id }}-${{ github.run_attempt }}
       - name: Install locked dependencies
+        if: steps.retained.outputs.artifact-id == ''
         run: pnpm install --frozen-lockfile
       - name: Build and verify notarized applications
+        if: steps.retained.outputs.artifact-id == ''
+        env:
+          CUA_EXPECTED_BUILD_KEY: ${{ steps.retained.outputs.build-key }}
         run: |
           mkdir -p dist
           pnpm exec tsx scripts/cua-helper/package.ts --out dist/cua-helper
-      - name: Name retained artifact
-        id: artifact
-        run: echo "name=cua-helper-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"
       - uses: actions/[email protected]
+        if: steps.retained.outputs.artifact-id == ''
+        id: upload
         with:
-          name: ${{ steps.artifact.outputs.name }}
+          name: cua-helper-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.retained.outputs.build-key }}
           path: dist/cua-helper/*
           if-no-files-found: error
           compression-level: 0
           retention-days: 14
+      - name: Record newly built artifact
+        if: steps.retained.outputs.artifact-id == ''
+        env:
+          CUA_ARTIFACT_ID: ${{ steps.upload.outputs.artifact-id }}
+        run: |
+          printf '已构建 CUA helper，run ID `%s`，artifact ID `%s`。\n' "$GITHUB_RUN_ID" "$CUA_ARTIFACT_ID" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-publish.yml

@@ -9,23 +9,21 @@ on:
   workflow_dispatch:
     inputs:
       cua_run_id:
-        description: '已有 CUA 打包 run ID：留空重新打包；填写时复用同一源码和版本的已验证产物'
-        type: string
-        required: false
-        default: ''
-      cua_run_attempt:
-        description: 'CUA 打包 attempt：仅与 run ID 一起使用；留空选择最新一次，不回退到更早的成功构建'
+        description: >-
+          填写要复用的 CUA helper 构建运行编号（run ID，即运行页面 URL 中 /actions/runs/ 后的数字）。
+          留空自动查找逐字节一致的源码构建出来的产物，找不到时重新构建。
         type: string
         required: false
         default: ''
       skip-tag-check:
-        description: Skip release tag validation for the selected ref; other publication checks still apply.
+        description: '跳过所选分支或 tag 的发布 tag 校验，仍执行其余发布检查。'
         type: boolean
         required: false
         default: false
 
 permissions:
   contents: read
+  actions: read
 
 env:
   PRIMARY_NODE_VERSION: '24'
@@ -33,18 +31,16 @@ env:
 
 jobs:
   cua-helper:
-    if: (startsWith(github.ref, 'refs/tags/dsh-v') || inputs.skip-tag-check) && inputs.cua_run_id == '' && inputs.cua_run_attempt == ''
+    if: startsWith(github.ref, 'refs/tags/dsh-v') || inputs.skip-tag-check
     uses: ./.github/workflows/cua-helper-package.yml
     with:
       source_ref: ${{ github.ref }}
       preset: production
+      cua_run_id: ${{ inputs.cua_run_id }}
 
   pack:
     name: Pack npm tarballs
     needs: cua-helper
-    if: >-
-      ${{ !cancelled() && (needs.cua-helper.result == 'success'
-        || (needs.cua-helper.result == 'skipped' && (inputs.cua_run_id != '' || inputs.cua_run_attempt != ''))) }}
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -87,33 +83,20 @@ jobs:
           RELEASE_PUBLISH: 'true'
         run: pnpm run release:verify --family dsh ${{ inputs.skip-tag-check && '--skip-tag-check' || '' }}
 
-      - name: Select retained CUA helper
-        if: inputs.cua_run_id != '' || inputs.cua_run_attempt != ''
-        id: retained-cua
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: pnpm exec tsx scripts/cua-helper/select-artifact.ts
-
-      - name: Download retained CUA helper
-        if: inputs.cua_run_id != '' || inputs.cua_run_attempt != ''
+      - name: Download selected CUA helper
         uses: actions/[email protected]
         with:
-          artifact-ids: ${{ steps.retained-cua.outputs.artifact-id }}
-          run-id: ${{ inputs.cua_run_id }}
+          artifact-ids: ${{ needs.cua-helper.outputs.artifact-id }}
+          run-id: ${{ needs.cua-helper.outputs.run-id }}
           github-token: ${{ github.token }}
           path: dist/cua-helper
 
       - name: Build
         run: pnpm run build:official --serial
 
-      - name: Download freshly built CUA helper
-        if: inputs.cua_run_id == '' && inputs.cua_run_attempt == ''
-        uses: actions/[email protected]
-        with:
-          name: ${{ needs.cua-helper.outputs.artifact }}
-          path: dist/cua-helper
-
       - name: Stage verified native helper applications
+        env:
+          CUA_EXPECTED_BUILD_KEY: ${{ needs.cua-helper.outputs.build-key }}
         run: |
           mkdir dist/cua-helper/extracted
           tar -xzf dist/cua-helper/cua-helper.tgz -C dist/cua-helper/extracted
@@ -121,13 +104,13 @@ jobs:
 
       - name: Record CUA source and publication retry instructions
         env:
-          CUA_RUN_ID: ${{ inputs.cua_run_id || github.run_id }}
-          CUA_RUN_ATTEMPT: ${{ steps.retained-cua.outputs.attempt || github.run_attempt }}
+          CUA_RUN_ID: ${{ needs.cua-helper.outputs.run-id }}
+          CUA_ARTIFACT_ID: ${{ needs.cua-helper.outputs.artifact-id }}
         run: |
           {
-            printf 'CUA helper: run `%s`, attempt `%s`.\n\n' "$CUA_RUN_ID" "$CUA_RUN_ATTEMPT"
+            printf '采用 CUA helper 构建 run ID `%s`，artifact ID `%s`。\n\n' "$CUA_RUN_ID" "$CUA_ARTIFACT_ID"
             printf '%s\n\n' 'npm 部分发布失败时，只重跑 Publish to npm job，复用原 dsh-npm-tarballs；不要重跑全部 job。'
-            printf '若需新建发布运行，填写 `cua_run_id=%s`、`cua_run_attempt=%s`，并使用相同源码 commit 和版本。\n' "$CUA_RUN_ID" "$CUA_RUN_ATTEMPT"
+            printf '需要重新打包时，可留空自动查找，或填写 `cua_run_id=%s` 指定该 helper；源码和构建配置必须匹配。\n' "$CUA_RUN_ID"
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Pack release tarballs