release: prepare August 1 Android RC

2026-07-29 00:35:15 +08:00
parent 9ae5f750c8
commit 9ea5d79a62
41 changed files with 2322 additions and 71 deletions
@@ -1,13 +1,77 @@
-import { readFileSync, existsSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
+import { relative, resolve } from 'node:path';
+import {
+  validateAndroidPrivacyDocument,
+  validateLegalUrlPair
+} from './app-legal-config.mjs';

 const projectRoot = resolve(import.meta.dirname, '..');
 const manifestPath = resolve(projectRoot, 'src/manifest.json');
 const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
 const requirePrivacy = process.argv.includes('--require-privacy');
+const checkLegalUrls = process.argv.includes('--check-legal-urls');
 const failures = [];
+let releaseLegalUrls;

 const fail = (message) => failures.push(message);
+const compiledAppRoot = resolve(projectRoot, 'dist/build/app');
+const releaseTextExtensions = new Set(['.css', '.html', '.js', '.json', '.txt', '.xml']);
+const releaseSensitiveFilePattern = /(^|[\\/])(?:\.env(?:\.|$)|id_rsa$)|\.(?:jks|keystore|p12|pfx|pem)$/i;
+const releaseSensitiveContentPatterns = [
+  ['private key', /BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY/],
+  ['cloud access key', /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/],
+  ['GitHub token', /\b(?:ghp_|github_pat_)[A-Za-z0-9_]{20,}\b/],
+  ['model API key', /\bsk-[A-Za-z0-9_-]{20,}\b/],
+  ['mobile number', /(?<!\d)1[3-9]\d{9}(?!\d)/],
+  ['fixed test SMS code', /测试验证码.{0,24}\b\d{4,8}\b/]
+];
+
+const compiledTextFiles = (root) => {
+  if (!existsSync(root)) return [];
+  const result = [];
+  const visit = (directory) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const absolutePath = resolve(directory, entry.name);
+      if (entry.isDirectory()) {
+        visit(absolutePath);
+      } else if (releaseTextExtensions.has(entry.name.slice(entry.name.lastIndexOf('.')).toLowerCase())) {
+        result.push(absolutePath);
+      }
+    }
+  };
+  visit(root);
+  return result;
+};
+
+const scanCompiledAppForSensitiveValues = () => {
+  if (!existsSync(compiledAppRoot)) {
+    fail('compiled App resource directory is missing; run build:app before release verification');
+    return;
+  }
+  const allFiles = [];
+  const visit = (directory) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const absolutePath = resolve(directory, entry.name);
+      if (entry.isDirectory()) visit(absolutePath);
+      else allFiles.push(absolutePath);
+    }
+  };
+  visit(compiledAppRoot);
+  for (const file of allFiles) {
+    const relativePath = relative(compiledAppRoot, file);
+    if (releaseSensitiveFilePattern.test(relativePath)) {
+      fail(`compiled App contains a sensitive file: ${relativePath}`);
+    }
+  }
+  for (const file of compiledTextFiles(compiledAppRoot)) {
+    const content = readFileSync(file, 'utf8');
+    for (const [label, pattern] of releaseSensitiveContentPatterns) {
+      if (pattern.test(content)) {
+        fail(`compiled App contains a possible ${label}: ${relative(compiledAppRoot, file)}`);
+      }
+    }
+  }
+};
 const readPng = (relativePath) => {
  if (typeof relativePath !== 'string' || !relativePath) {
    fail('manifest is missing an App asset path');
@@ -49,10 +113,54 @@ const app = manifest['app-plus'];
 const distribute = app?.distribute;
 const icons = distribute?.icons;
 const splashscreen = distribute?.splashscreen;
+const android = distribute?.android;
+const modules = app?.modules;

 if (!Array.isArray(app?.screenOrientation) || !app.screenOrientation.includes('portrait-primary')) {
  fail('app-plus.screenOrientation must include portrait-primary');
 }
+if (splashscreen?.useOriginalMsgbox !== true) {
+  fail('app-plus.distribute.splashscreen.useOriginalMsgbox must enable the native privacy prompt');
+}
+if (app?.ssl?.untrustedca !== 'refuse') {
+  fail('app-plus.ssl.untrustedca must remain refuse');
+}
+if (!/^\d+\.\d+\.\d+$/.test(String(manifest.versionName || ''))) {
+  fail('versionName must use semantic numeric form such as 0.1.6');
+}
+if (!/^[1-9]\d*$/.test(String(manifest.versionCode || ''))) {
+  fail('versionCode must be a positive integer');
+}
+if (android?.packagename !== 'com.yincheng.wygj') {
+  fail('Android package name must remain com.yincheng.wygj');
+}
+if (android?.targetSdkVersion !== 35) {
+  fail('Android targetSdkVersion must be 35 for the August 1 test package');
+}
+const expectedAndroidAbis = ['arm64-v8a', 'armeabi-v7a'];
+const actualAndroidAbis = Array.isArray(android?.abiFilters)
+  ? [...android.abiFilters].sort()
+  : [];
+if (JSON.stringify(actualAndroidAbis) !== JSON.stringify(expectedAndroidAbis)) {
+  fail('Android abiFilters must include exactly armeabi-v7a and arm64-v8a');
+}
+if (android?.permissionExternalStorage?.request !== 'none') {
+  fail('Android external storage permission must not be requested at startup');
+}
+if (android?.permissionPhoneState?.request !== 'none') {
+  fail('Android phone state permission must not be requested at startup');
+}
+if (!Object.hasOwn(modules || {}, 'Camera') || !Object.hasOwn(modules || {}, 'Record')) {
+  fail('App modules must include Camera and Record for user-triggered media features');
+}
+const declaredAndroidPermissions = Array.isArray(android?.permissions)
+  ? android.permissions.join('\n')
+  : '';
+for (const permission of ['android.permission.RECORD_AUDIO', 'android.permission.MODIFY_AUDIO_SETTINGS']) {
+  if (!declaredAndroidPermissions.includes(permission)) {
+    fail(`Android permissions must include ${permission}`);
+  }
+}

 const androidIcons = [
  ['hdpi', 72], ['xhdpi', 96], ['xxhdpi', 144], ['xxxhdpi', 192]
@@ -85,21 +193,102 @@ const splashPaths = [
 ];
 for (const [relativePath, width, height] of splashPaths) expectPng(relativePath, width, height);

-const privacyPath = resolve(projectRoot, 'androidPrivacy.json');
+const privacyPath = resolve(projectRoot, 'src/androidPrivacy.json');
+const compiledPrivacyPath = resolve(projectRoot, 'dist/build/app/androidPrivacy.json');
 if (requirePrivacy) {
+  if (String(process.env.VITE_DEV_SMS_HINT_ENABLED || '').toLowerCase() === 'true') {
+    fail('VITE_DEV_SMS_HINT_ENABLED must be disabled for release builds');
+  }
+  if (String(process.env.VITE_DEV_SMS_HINT_VALUE || '').trim()) {
+    fail('VITE_DEV_SMS_HINT_VALUE must not be present for release builds');
+  }
+  try {
+    releaseLegalUrls = validateLegalUrlPair(
+      process.env.VITE_APP_TERMS_URL,
+      process.env.VITE_APP_PRIVACY_URL
+    );
+  } catch (error) {
+    fail(`release build legal URL environment is invalid: ${error instanceof Error ? error.message : String(error)}`);
+  }
+
  if (!existsSync(privacyPath)) {
-    fail('androidPrivacy.json is required for release; copy androidPrivacy.json.example and replace both legal links');
+    fail('src/androidPrivacy.json is required for release; run configure:app-privacy with final legal URLs');
  } else {
    try {
      const privacy = JSON.parse(readFileSync(privacyPath, 'utf8'));
-      const links = [...String(privacy.message || '').matchAll(/href="([^"]+)"/g)].map((match) => match[1]);
-      if (privacy.prompt !== 'template' || links.length < 2 || links.some((link) => !/^https:\/\//.test(link) || link.includes('__'))) {
-        fail('androidPrivacy.json must use prompt=template and two final HTTPS legal links');
+      const privacyLegalUrls = validateAndroidPrivacyDocument(privacy);
+      if (
+        releaseLegalUrls
+        && (
+          privacyLegalUrls.termsUrl !== releaseLegalUrls.termsUrl
+          || privacyLegalUrls.privacyUrl !== releaseLegalUrls.privacyUrl
+        )
+      ) {
+        fail('androidPrivacy.json legal links must match VITE_APP_TERMS_URL and VITE_APP_PRIVACY_URL');
      }
-    } catch {
-      fail('androidPrivacy.json must be valid JSON without comments');
+      releaseLegalUrls = privacyLegalUrls;
+    } catch (error) {
+      fail(`androidPrivacy.json is invalid: ${error instanceof Error ? error.message : String(error)}`);
    }
  }
+
+  if (!existsSync(compiledPrivacyPath)) {
+    fail('compiled App resource is missing androidPrivacy.json; run build:app after configure:app-privacy');
+  } else {
+    try {
+      const compiledPrivacy = JSON.parse(readFileSync(compiledPrivacyPath, 'utf8'));
+      const compiledLegalUrls = validateAndroidPrivacyDocument(compiledPrivacy);
+      if (
+        releaseLegalUrls
+        && (
+          compiledLegalUrls.termsUrl !== releaseLegalUrls.termsUrl
+          || compiledLegalUrls.privacyUrl !== releaseLegalUrls.privacyUrl
+        )
+      ) {
+        fail('compiled App androidPrivacy.json must match the source privacy configuration');
+      }
+    } catch (error) {
+      fail(`compiled App androidPrivacy.json is invalid: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  scanCompiledAppForSensitiveValues();
+}
+
+const checkRemoteLegalPage = async (url, label, expectedText) => {
+  try {
+    const response = await fetch(url, {
+      method: 'GET',
+      redirect: 'follow',
+      signal: AbortSignal.timeout(10000),
+      headers: { 'user-agent': 'Bangdao-App-Release-Preflight/1.0' }
+    });
+    if (!response.ok) {
+      fail(`${label} returned HTTP ${response.status}`);
+      return;
+    }
+    if (!String(response.url).startsWith('https://')) {
+      fail(`${label} redirected away from HTTPS`);
+      return;
+    }
+    const contentType = String(response.headers.get('content-type') || '').toLowerCase();
+    if (!contentType.includes('text/html') && !contentType.includes('application/xhtml+xml')) {
+      fail(`${label} must return an HTML document`);
+      return;
+    }
+    const body = await response.text();
+    if (body.trim().length < 100 || !expectedText.test(body)) {
+      fail(`${label} does not contain recognizable final legal content`);
+    }
+  } catch (error) {
+    fail(`${label} is not publicly reachable: ${error instanceof Error ? error.message : String(error)}`);
+  }
+};
+
+if (requirePrivacy && checkLegalUrls && releaseLegalUrls) {
+  await Promise.all([
+    checkRemoteLegalPage(releaseLegalUrls.termsUrl, 'service agreement URL', /服务协议|用户协议/),
+    checkRemoteLegalPage(releaseLegalUrls.privacyUrl, 'privacy policy URL', /隐私政策|个人信息保护/)
+  ]);
 }

 if (failures.length) {