From fea6f822994dcd5994b33139c289ea8c891c0946 Mon Sep 17 00:00:00 2001 From: wangjia <809946525@qq.com> Date: Mon, 7 Sep 2026 00:17:42 +0800 Subject: [PATCH] =?UTF-8?q?feat(ci):=20=E5=A4=9A=E8=B4=A6=E5=8F=B7?= =?UTF-8?q?=E7=AD=BE=E5=90=8D=20Phase=201=E2=80=94=E2=80=94SIGNING=5FACCOU?= =?UTF-8?q?NT=20=E5=BC=80=E5=85=B3=20+=20=E8=B4=A6=E5=8F=B7=E5=AF=86?= =?UTF-8?q?=E9=92=A5=E9=9B=86=E5=88=87=E6=8D=A2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 按 docs/ci-multi-account-signing-design.html 落地: - signing.env 加 SIGNING_ACCOUNT=us|cn(CI 多账号切换的唯一开关)。 - deploy-client.yml 的 macOS/iOS job 各加 "Resolve signing account" 步(从 signing.env 读),证书/ASC 的 env 映射改为按账号三元选:us→SIGN_US_*(用户级)、cn→现有旧通用名 (用户级,不动,供其他 app 继续用)。描述文件是 app 级(绑 bundle id)→ 仓库级,与账号无关,不变。 效果:pangolin(SIGNING_ACCOUNT=us)CI 用美国证书/ASC;其他 app 的独立 workflow 不受影响; 切账号只改 signing.env 一行。注:若 SIGNING_ACCOUNT=us 但 SIGN_US_* 未配,三元会回退到 旧(中国)名 → compile 脚本按 signing.env 的美国 Team 校验会失败(fail-safe,不会误签), 故 US 账号发版前须先配齐 SIGN_US_* 用户级 secret + 仓库级美国描述文件。 YAML 校验通过;codegen 无 drift(SIGNING_ACCOUNT 不参与 gen-signing)。 Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD --- .gitea/workflows/deploy-client.yml | 44 ++++++++++++++++++++---------- scripts/signing.env | 6 ++++ 2 files changed, 35 insertions(+), 15 deletions(-) diff --git a/.gitea/workflows/deploy-client.yml b/.gitea/workflows/deploy-client.yml index 29cb771..3d4b3f5 100644 --- a/.gitea/workflows/deploy-client.yml +++ b/.gitea/workflows/deploy-client.yml @@ -113,18 +113,26 @@ jobs: - name: Checkout uses: actions/checkout@v4 + # 多账号切换(见 docs/ci-multi-account-signing-design.html):从 signing.env + # 单源读 SIGNING_ACCOUNT(us|cn),下方按它选账号的证书/ASC 密钥集。 + - name: Resolve signing account + id: acct + run: | + . scripts/signing.env + echo "account=${SIGNING_ACCOUNT:?signing.env 缺 SIGNING_ACCOUNT}" >> "$GITHUB_OUTPUT" + - name: Compile (macOS System Extension app) env: - # 左=脚本期望的 env 名(勿改),右=实际密钥名。Apple 证书/公证密钥是 - # 账号级、跨项目唯一 → 放【全局(用户级)密钥】用通用短名,pangolin/jiu 各自 - # 在此映射到自己脚本的 env。Developer ID Application 证书=站外分发,一张签所有 app。 - MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.DEVELOPER_ID_P12 }} - MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.P12_PASSWORD }} + # 账号级密钥(Developer ID 证书 + ASC Key,跨该账号所有 app 共享):按 + # SIGNING_ACCOUNT 选——us→SIGN_US_*(用户级)、cn→旧通用名(用户级,不动、 + # 供其他 app 继续用)。描述文件是 app 级(绑 bundle id)→ 仓库级,与账号无关。 + MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_DEVELOPER_ID_P12 || secrets.DEVELOPER_ID_P12 }} + MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_DEVELOPER_ID_PASSWORD || secrets.P12_PASSWORD }} + APPSTORE_API_KEY_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_ID || secrets.APPSTORE_API_KEY_ID }} + APPSTORE_API_ISSUER_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_ISSUER_ID || secrets.APPSTORE_API_ISSUER_ID }} + APPSTORE_API_KEY_P8_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_P8 || secrets.APPSTORE_API_KEY_P8_BASE64 }} MACOS_APP_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_APP_PROVISION_PROFILE_BASE64 }} MACOS_SYSEXT_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_SYSEXT_PROVISION_PROFILE_BASE64 }} - APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }} - APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }} - APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }} REF_NAME: ${{ gitea.ref_name }} run: bash scripts/ci/compile-macos.sh "$REF_NAME" @@ -147,17 +155,23 @@ jobs: - name: Checkout uses: actions/checkout@v4 + - name: Resolve signing account + id: acct + run: | + . scripts/signing.env + echo "account=${SIGNING_ACCOUNT:?signing.env 缺 SIGNING_ACCOUNT}" >> "$GITHUB_OUTPUT" + - name: Compile & upload to TestFlight (iOS) env: - # 证书=账号级 →【全局】通用短名(Apple Distribution 证书,签 iOS App Store/TestFlight); - # 描述文件=与 bundle id 绑定 →【项目级】pangolin 仓库密钥。 - IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_P12 }} - IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_PASSWORD }} + # 账号级(Apple Distribution 证书 + ASC Key)按 SIGNING_ACCOUNT 选; + # 描述文件=与 bundle id 绑定 → 仓库级、与账号无关。 + IOS_DIST_CERT_P12_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_APPLE_DIST_P12 || secrets.IOS_DIST_P12 }} + IOS_DIST_CERT_PASSWORD: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_APPLE_DIST_PASSWORD || secrets.IOS_DIST_PASSWORD }} + APPSTORE_API_KEY_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_ID || secrets.APPSTORE_API_KEY_ID }} + APPSTORE_API_ISSUER_ID: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_ISSUER_ID || secrets.APPSTORE_API_ISSUER_ID }} + APPSTORE_API_KEY_P8_BASE64: ${{ steps.acct.outputs.account == 'us' && secrets.SIGN_US_ASC_KEY_P8 || secrets.APPSTORE_API_KEY_P8_BASE64 }} IOS_APP_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_APP_PROVISIONING_PROFILE_BASE64 }} IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64 }} - APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }} - APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }} - APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }} REF_NAME: ${{ gitea.ref_name }} run: bash scripts/ci/compile-ios.sh "$REF_NAME" # No artifact upload — compile-ios.sh uploads straight to TestFlight via diff --git a/scripts/signing.env b/scripts/signing.env index 068334c..b8c1030 100644 --- a/scripts/signing.env +++ b/scripts/signing.env @@ -11,6 +11,12 @@ # drift 闸:ci/check-codegen-drift.sh 跑 `gen-signing.mjs --check`,防改了 env 没重生成 / # 手改了原生标识符。非机密(Team ID / 实体名 / Bundle ID 本就编进产物、公开),入 git。 +# 用哪个 Apple 账号的 CI 密钥集(gitea 里 SIGN__* 的 )。us|cn。 +# 这是 CI 多账号切换的唯一开关:改这行 = 换 CI 用的证书/ASC Key(见 +# docs/ci-multi-account-signing-design.html)。同时下面的 Team/Bundle 等身份也要 +# 一并改成该账号的并跑 gen-signing.mjs——账号密钥与身份必须匹配。 +SIGNING_ACCOUNT="us" + # 10 位 Team ID(developer.apple.com → Membership details)。 SIGNING_TEAM_ID="44WULXM6SV"