From 2569d98b6d94424e879d8b50b91bdf5f04c0e59f Mon Sep 17 00:00:00 2001
From: HyxiaoGe <18889592303@163.com>
Date: Mon, 31 Aug 2026 15:19:17 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=85=BC=E5=AE=B9=20Windows=20PowerShel?=
 =?UTF-8?q?l=20=E8=84=9A=E6=9C=AC=E7=BC=96=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

背景：master 发布在 Windows PowerShell 5.1 解析无 BOM UTF-8 临时脚本时损坏中文字符串，Docker 检查尚未执行即失败。

改动：Docker 检查提示改为纯 ASCII；含非 ASCII 的清理脚本增加 UTF-8 BOM；新增编码契约防止同类回归。

验证：关联配置测试 85 项及 15 个子测试通过；ruff、git diff --check 与 BOM 内容哈希校验通过。

Co-Authored-By: Codex <noreply@anthropic.com>
---
 .github/scripts/windows-cleanup.ps1    |  2 +-
 .github/workflows/deploy.yml           |  4 ++--
 test/test_ci_cd_permission_boundary.py | 22 ++++++++++++++++++++++
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/.github/scripts/windows-cleanup.ps1 b/.github/scripts/windows-cleanup.ps1
index 5f050335..413c191c 100644
--- a/.github/scripts/windows-cleanup.ps1
+++ b/.github/scripts/windows-cleanup.ps1
@@ -1,4 +1,4 @@
-param(
+param(
     [Parameter(Mandatory = $true)]
     [string]$ImageName,
 
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index df0a55d6..f25c0086 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -144,13 +144,13 @@ jobs:
         run: |
           docker version
           if ($LASTEXITCODE -ne 0) {
-            Write-Host "当前 Runner 未提供可用的 Docker Engine；请先完成 Runner 预配置"
+            Write-Host "Docker Engine is unavailable on this runner."
             exit $LASTEXITCODE
           }
 
           docker ps
           if ($LASTEXITCODE -ne 0) {
-            Write-Host "当前 Runner 无权访问 Docker Engine；请先修复 Runner 权限"
+            Write-Host "The runner cannot access Docker Engine."
             exit $LASTEXITCODE
           }
 
diff --git a/test/test_ci_cd_permission_boundary.py b/test/test_ci_cd_permission_boundary.py
index d5c74e80..1617aa86 100644
--- a/test/test_ci_cd_permission_boundary.py
+++ b/test/test_ci_cd_permission_boundary.py
@@ -389,6 +389,28 @@ def test_windows_publish_requires_preconfigured_docker_engine(self) -> None:
             with self.subTest(forbidden_command=forbidden_command):
                 self.assertNotIn(forbidden_command, script)
 
+    def test_windows_powershell_51_inline_docker_check_is_ascii_only(self) -> None:
+        publish_job = self.release_document["jobs"]["publish"]
+        verify_step = workflow_step(publish_job, "Verify Docker access")
+
+        self.assertTrue(
+            verify_step["run"].isascii(),
+            "Windows PowerShell 5.1 会错误解码 GitHub Actions 生成的无 BOM UTF-8 临时脚本",
+        )
+
+    def test_non_ascii_windows_powershell_files_have_utf8_bom(self) -> None:
+        for script_path in (BUILD_SCRIPT, CLEANUP_SCRIPT):
+            raw_script = script_path.read_bytes()
+            if raw_script.isascii():
+                continue
+
+            with self.subTest(script=script_path.name):
+                self.assertTrue(
+                    raw_script.startswith(b"\xef\xbb\xbf"),
+                    "含非 ASCII 字符的 Windows PowerShell 5.1 脚本必须使用 UTF-8 BOM",
+                )
+                raw_script.decode("utf-8-sig")
+
     def test_release_runs_are_never_cancelled_mid_deployment(self) -> None:
         self.assertRegex(
             self.release_workflow,