fix(ci): fetch-desktop-bin curl 加固(windows 外网 GFW 抖动)

wintun.net / github 下载偶发超时(curl 28)。retry 3→8、加 --retry-all-errors
+ --retry-connrefused + --connect-timeout 20,拉长重试窗口以命中可达时刻。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/deploy-client.yml

@@ -45,7 +45,8 @@ jobs:
         env:
           RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-        run: bash scripts/ci/compile-android.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-android.sh "$REF_NAME"
 
       - name: Upload android artifact
         uses: actions/upload-artifact@v3
@@ -65,7 +66,9 @@ jobs:
 
       - name: Compile (Windows installer)
         shell: bash
-        run: bash scripts/ci/compile-windows.sh "${{ gitea.ref_name }}"
+        env:
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-windows.sh "$REF_NAME"
 
       - name: Upload windows artifact
         uses: actions/upload-artifact@v3
@@ -80,38 +83,44 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Download android artifact
+      # 一次性下所有 artifact(不带 name),避免同 job 内两次复用 download-artifact
+      # action → act 对其只读缓存 git 仓库做二次操作时 EACCES(pack idx 444)。
+      - name: Download all artifacts
         uses: actions/download-artifact@v3
         with:
-          name: android
-          path: dist/
+          path: dist-raw/
 
-      - name: Download windows artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: windows
-          path: dist/
+      - name: Flatten artifacts into dist/
+        shell: bash
+        run: |
+          mkdir -p dist
+          find dist-raw -type f -exec cp {} dist/ \;
+          echo "dist/ 内容:"; ls -la dist/
 
       - name: Release → Forgejo
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
-        run: bash scripts/ci/release-client.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/release-client.sh "$REF_NAME"
 
       - name: Deploy → pangolin1 (downloads/)
         env:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: bash scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/deploy-client.sh "$REF_NAME"
 
       - name: Notify
         if: always()
         env:
           TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REF_NAME: ${{ gitea.ref_name }}
+          JOB_STATUS: ${{ job.status }}
         run: |
           . scripts/ci/notify.sh
-          if [ "${{ job.status }}" = "success" ]; then
-            notify_ok "client ${{ gitea.ref_name }} released + deployed"
+          if [ "$JOB_STATUS" = "success" ]; then
+            notify_ok "client $REF_NAME released + deployed"
           else
-            notify_fail "client ${{ gitea.ref_name }} pipeline failed"
+            notify_fail "client $REF_NAME pipeline failed"
           fi

app/kernel/fetch-desktop-bin.sh

@@ -140,7 +140,7 @@ fi
 
 # ── 下载二进制压缩包 ──────────────────────────────────────────────────────────
 printf '==> 下载 %s…\n' "${ARCHIVE_FILE}"
-curl -fSL --retry 3 --retry-delay 2 \
+curl -fSL --retry 8 --retry-delay 5 --retry-connrefused --retry-all-errors --connect-timeout 20 \
     -o "${ARCHIVE_CACHE}" \
     "${ARCHIVE_URL}"
 
@@ -197,7 +197,7 @@ if [[ "${TARGET_OS}" == "windows" ]]; then
     if [[ "${FORCE}" == false && -f "${WINTUN_OUT}" ]]; then
         printf '✓ wintun.dll 已存在，跳过（传 --force 重新下载）\n'
     else
-        curl -fSL --retry 3 --retry-delay 2 \
+        curl -fSL --retry 8 --retry-delay 5 --retry-connrefused --retry-all-errors --connect-timeout 20 \
             -o "${WINTUN_ZIP_CACHE}" \
             "${WINTUN_URL}"
 

scripts/ci/compile-windows.sh

@@ -109,9 +109,17 @@ ISS="${BUILD_CLIENT}/windows/installer/pangolin.iss"
 sed -i "s/^#define MyAppVersion .*/#define MyAppVersion \"${VER}\"/" "$ISS"
 
 echo "==> building installer with Inno Setup (version ${VER})"
-# MSYS_NO_PATHCONV / MSYS2_ARG_CONV_EXCL disable Git Bash's automatic conversion
-# of paths, matching jiu's ISCC invocation fix.
-MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*' "$ISCC" "$ISS"
+# ISCC 是原生 Windows 程序,只认 Windows 路径(C:\...);传 MSYS 风格 /c/... 会被它
+# 当成选项 → "Unknown option: /c/...pangolin.iss"。故先用 cygpath 把 .iss 转成
+# Windows 路径再传(jiu 是直接写死 C:\ 字面量;这里用 cygpath 更稳)。
+# 不用 $() 命令替换(仓库约定):cygpath 输出落临时文件、read 读回。
+cygpath -w "$ISS" > /tmp/pangolin_iss_win.$$
+ISS_WIN=""
+read -r ISS_WIN < /tmp/pangolin_iss_win.$$
+rm -f /tmp/pangolin_iss_win.$$
+# MSYS_NO_PATHCONV / MSYS2_ARG_CONV_EXCL 关掉 Git Bash 对 /-开头参数的自动路径转换
+# (否则会把 .iss 里将来可能的 /D 定义也改坏)。ISS_WIN 已是 Windows 路径,原样传即可。
+MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*' "$ISCC" "$ISS_WIN"
 
 # pangolin.iss has no explicit OutputDir -> Inno defaults to {src}\Output
 # (relative to the .iss file), filename OutputBaseFilename=pangolin-setup-<ver>.