chore: release 0.9.32

.github/workflows/auto-tag-on-release.yml

@@ -67,7 +67,8 @@ jobs:
       # dispatch Release / Docker Publish / Desktop Package (workflow_dispatch
       # is exempt). FnOS FPK is cascaded from Release after the GitHub Release
       # exists (reuses Release wheel + waits for GHCR image from Docker Publish).
-      # Desktop builds in parallel; its release job upserts zips onto the same v*.
+      # Desktop and FnOS upsert their packages onto the same v* GitHub Release
+      # after it exists (FnOS is dispatched from Release.yml).
       - name: Trigger Release, Docker Publish, and Desktop Package
         if: steps.check_tag.outputs.should_publish == 'true'
         env:

.github/workflows/ci.yml

@@ -1,8 +1,9 @@
 name: CI
 
+# Pull requests only. GitHub runs PR checks on the merge result, so a push
+# build on main would re-test content that the release / feature PR already
+# proved green.
 on:
-  push:
-    branches: [main]
   pull_request:
 
 concurrency:
@@ -13,6 +14,9 @@ jobs:
   quality:
     name: "Python ${{ matrix.python-version }}"
     runs-on: ubuntu-latest
+    # Post-release main → develop sync PRs carry main's already-tested tree and
+    # are auto-merged by the bot before checks finish. See sync-main-to-develop.
+    if: ${{ !startsWith(github.head_ref, 'chore/sync-develop-after-') }}
     strategy:
       fail-fast: false
       matrix:
@@ -40,6 +44,7 @@ jobs:
   test-windows:
     name: Windows / Python 3.12
     runs-on: windows-latest
+    if: ${{ !startsWith(github.head_ref, 'chore/sync-develop-after-') }}
     steps:
       - uses: actions/checkout@v4
 
@@ -65,8 +70,8 @@ jobs:
     runs-on: ubuntu-latest
     # Only the main repo may access secrets; fork PRs get none and must skip.
     if: >-
-      github.event_name == 'push' ||
-      github.event.pull_request.head.repo.full_name == github.repository
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      !startsWith(github.head_ref, 'chore/sync-develop-after-')
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/fnos-build-fpk.yml

@@ -3,18 +3,19 @@ name: Build Octop FPK
 # FnOS (飞牛 NAS) 安装包流水线。
 #
 # 触发：
-#   - Release 工作流在 GitHub Release 创建成功后自动 dispatch（推荐）
-#   - 亦可手动 workflow_dispatch（需对应版本镜像已在 GHCR）
+#   - Release 工作流在 GitHub Release（v*）创建成功后自动 dispatch（推荐）
+#   - 亦可手动 workflow_dispatch（需对应版本镜像已在 GHCR，且 v* Release 已存在）
 #
 # 制品复用：
 #   - Docker 镜像：不再重建，等待 docker-publish 推送的
 #     ghcr.io/tencentcloud/octop:{version|latest}
 #   - Native wheel：优先从同版本 GitHub Release（v*）下载；
 #     缺失时再回退到本仓源码构建
+#   - 产物挂到同一个 v* GitHub Release（与 wheel / 桌面包并列），不再单独打 fnos-* tag
 #
 # Jobs：
 #   version → ensure-image → fpk（Docker 版 .fpk，仅打包 compose）
-#           ↘ native（本地版 .fpk）→ release（按版本号发布 fnos-<ver>）
+#           ↘ native（本地版 .fpk）→ release（把 .fpk 挂到已有的 v* GitHub Release）
 
 on:
   workflow_dispatch:
@@ -48,9 +49,9 @@ jobs:
           IMAGE="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
           echo "version=$VER" >> "$GITHUB_OUTPUT"
           echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
-          echo "tag=fnos-${VER}" >> "$GITHUB_OUTPUT"
+          echo "tag=v${VER}" >> "$GITHUB_OUTPUT"
           echo "pkg_ver=${VER}" >> "$GITHUB_OUTPUT"
-          echo "[version] VER=$VER, TAG=fnos-${VER}"
+          echo "[version] VER=$VER, TAG=v${VER}"
 
   # 复用 docker-publish 已推送的镜像，不在此重新 build/push。
   ensure-image:
@@ -256,52 +257,28 @@ jobs:
           cp artifacts/docker-fpk/*.fpk dist/ || true
           cp artifacts/native-fpk/*.fpk dist/ || true
           ls -lh dist
+          if ! ls dist/*.fpk >/dev/null 2>&1; then
+            echo "::error::No .fpk files to attach."
+            exit 1
+          fi
 
-      - name: Generate changelog
-        id: changelog
+      - name: Require existing v* GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.version.outputs.tag }}
         run: |
-          VER="${{ needs.version.outputs.version }}"
-          IMAGE="${{ needs.version.outputs.image }}"
-          PREV_TAG=""
-          for t in $(git tag --list "fnos-*" --sort=-creatordate); do
-            [ "$t" = "fnos-latest" ] && continue
-            if git merge-base --is-ancestor "$t" HEAD 2>/dev/null; then
-              PREV_TAG="$t"
-              break
-            fi
-          done
-          echo "prev_tag=$PREV_TAG" >> "$GITHUB_OUTPUT"
-          {
-            echo "## 安装说明"
-            echo ""
-            echo "1. 飞牛应用中心 → 设置 → 手动安装应用，选择对应 .fpk。"
-            echo "2. Docker 版 **Octop-fnos-docker-${VER}.fpk**（约 80KB）：飞牛自动从 GHCR 拉取 \`${IMAGE}:latest\`。"
-            echo "3. 本地版 **Octop-fnos-native-${VER}.fpk**（约 200MB）：非 Docker，原生运行在飞牛主机；安装时自动关联系统 Python 3.12 开发工具；浏览器、远程桌面等附加组件在 Octop 应用内按需安装。"
-            echo ""
-            echo "---"
-            echo "按版本号下载对应 .fpk 即可（如 \`Octop-fnos-docker-${VER}.fpk\` / \`Octop-fnos-native-${VER}.fpk\`）。"
-            echo ""
-            echo "## 本次更新（v${VER}）"
-            echo ""
-            if [ -n "$PREV_TAG" ]; then
-              git log --oneline --no-merges "$PREV_TAG"..HEAD | head -30
-            else
-              git log --oneline --no-merges -30 HEAD
-            fi
-          } > /tmp/release-body.md
-          cat /tmp/release-body.md
+          set -euo pipefail
+          if ! gh release view "$TAG" --repo "${{ github.repository }}" >/dev/null; then
+            echo "::error::GitHub Release ${TAG} does not exist yet. Run this after Release.yml creates it."
+            exit 1
+          fi
 
-      - name: Publish versioned release
+      - name: Attach fpk to GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ needs.version.outputs.tag }}
-          target_commitish: ${{ github.sha }}
-          name: Octop (FnOS) v${{ needs.version.outputs.pkg_ver }}
-          body_path: /tmp/release-body.md
           files: dist/*.fpk
-          draft: false
-          prerelease: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          fail_on_unmatched_files: true
+          generate_release_notes: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/octop-desktop.yml

@@ -1,10 +1,8 @@
 name: Octop Desktop Package
 
-# 正式发版：Auto Tag 在打 v* 后与 Release / Docker Publish 一并 dispatch（GITHUB_TOKEN
-# 打的 tag 不会触发 push workflow）。产物由本 workflow 的 release job upsert 到同一
-# GitHub Release。workflow_dispatch 保留给手工补包 / 按平台重跑。
-# 不要对任意分支 push 跑六平台矩阵。
-# pull_request（desktop/**）打 darwin-* + windows-*，不跑 linux。
+# 正式发版：Auto Tag 在打 v* 后与 Release / Docker Publish 一并 dispatch。
+# 产物 upsert 到同一 GitHub Release。手工补包：workflow_dispatch + release_tag
+# （不必跑在 v* ref 上）。attach_from_run 只挂已有 artifact、不重打。
 
 on:
   push:
@@ -22,12 +20,12 @@ on:
         default: "all"
         type: string
       attach_release:
-        description: "If running on a v* tag, also upload zips to that GitHub Release"
+        description: "Upload artifacts to a GitHub Release (v* ref, or pass release_tag)"
         required: false
         default: true
         type: boolean
       release_tag:
-        description: "GitHub Release tag to attach to (e.g. v0.9.27). Defaults to the current v* tag ref."
+        description: "GitHub Release tag to attach to (e.g. v0.9.31). Used when not running on a v* ref."
         required: false
         default: ""
         type: string
@@ -40,9 +38,15 @@ on:
 permissions:
   contents: read
 
+# Builds on the same ref cancel each other (PR retrigger / accidental double
+# dispatch). Attach-only runs use a different group so they cannot cancel an
+# in-flight six-platform package on develop.
 concurrency:
-  group: green-portable-${{ github.ref }}
-  cancel-in-progress: true
+  group: >-
+    green-portable-${{
+      github.event.inputs.attach_from_run != '' && 'attach' || 'build'
+    }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.attach_from_run == '' }}
 
 env:
   # Prefer GitHub upstream on Actions runners (npmmirror is for CN local builds).
@@ -67,7 +71,7 @@ jobs:
       - name: Build frontend → src/octop/dashboard
         run: make build-frontend
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: dashboard-dist
           path: src/octop/dashboard/
@@ -139,7 +143,14 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/download-artifact@v5
+      - name: Read package version
+        run: |
+          set -euo pipefail
+          VER=$(sed -nE 's/^version[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' pyproject.toml | head -1)
+          echo "OCTOP_VERSION=${VER}" >> "$GITHUB_ENV"
+          echo "version=${VER}"
+
+      - uses: actions/download-artifact@v8
         with:
           name: dashboard-dist
           path: src/octop/dashboard
@@ -219,28 +230,39 @@ jobs:
       - name: Install Wails v3 CLI
         run: go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.13
 
+      - name: Install NSIS
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          choco install nsis --yes --no-progress
+          $nsis = "${env:ProgramFiles(x86)}\NSIS"
+          if (-not (Test-Path "$nsis\makensis.exe")) {
+            throw "makensis.exe missing after NSIS install"
+          }
+          Add-Content -Path $env:GITHUB_PATH -Value $nsis
+
       - name: Package desktop app with bundled portable runtime
         working-directory: desktop/src
         run: >-
           wails3 task package
           ARCH=${{ matrix.arch }}
-          PORTABLE_ZIP=../portable/release/Octop-${{ matrix.plat }}.zip
+          VERSION=${{ env.OCTOP_VERSION }}
+          PORTABLE_ZIP=../portable/release/Octop-portable-${{ matrix.plat }}-${{ env.OCTOP_VERSION }}.zip
 
       # archive: false — upload the prebuilt zip as-is. Default archive=true would
-      # wrap it again, so Actions UI / "Download artifact" becomes zip-in-zip
-      # (Octop-<plat>.zip containing another Octop-<plat>.zip). Affects every plat.
+      # wrap it again, so Actions UI / "Download artifact" becomes zip-in-zip.
       # With archive:false, artifact name is the filename (name: is ignored).
       - uses: actions/upload-artifact@v7
         with:
-          path: desktop/portable/release/Octop-${{ matrix.plat }}.zip
+          path: desktop/portable/release/Octop-portable-${{ matrix.plat }}-${{ env.OCTOP_VERSION }}.zip
           archive: false
           if-no-files-found: error
           retention-days: 14
 
       - name: Upload bundled desktop package
         uses: actions/upload-artifact@v7
         with:
-          path: desktop/src/bin/Octop-Desktop-${{ matrix.plat }}.*
+          path: desktop/src/bin/Octop-desktop-${{ matrix.plat }}-${{ env.OCTOP_VERSION }}.*
           archive: false
           if-no-files-found: error
           retention-days: 14
@@ -256,6 +278,9 @@ jobs:
       (
         (github.event_name == 'workflow_dispatch' &&
          github.event.inputs.attach_from_run != '') ||
+        (github.event_name == 'workflow_dispatch' &&
+         github.event.inputs.attach_release == 'true' &&
+         github.event.inputs.release_tag != '') ||
         (startsWith(github.ref, 'refs/tags/v') &&
          (github.event_name == 'push' ||
           (github.event_name == 'workflow_dispatch' &&
@@ -281,7 +306,7 @@ jobs:
           echo "tag=${tag}" >> "$GITHUB_OUTPUT"
 
       # v8 required for archive:false artifacts. skip-decompress keeps the
-      # uploaded .zip / .tar / .dmg / .exe intact — default unzip turns portable
+      # uploaded .zip / .tar.gz / .dmg / .exe intact — default unzip turns portable
       # zips into directories, so files: release-assets/* would skip them.
       - uses: actions/download-artifact@v8
         with:

.github/workflows/release.yml

@@ -122,6 +122,9 @@ jobs:
               echo '```'
             } > .release-notes.md
           fi
+          if ! grep -q '^## Downloads' .release-notes.md; then
+            python3 scripts/release_download_links.py "$version" >> .release-notes.md
+          fi
 
       - name: Create release
         uses: softprops/action-gh-release@v2
@@ -134,29 +137,28 @@ jobs:
   # started via GITHUB_TOKEN workflow_dispatch (Auto Tag). Explicitly cascade.
   #
   # This job intentionally has no checkout: pass --repo so `gh` does not need a
-  # local .git (bare runner → "fatal: not a git repository"). continue-on-error
-  # keeps a cascade miss from marking PyPI/GitHub release as failed.
+  # local .git (bare runner → "fatal: not a git repository"). Dispatch failure
+  # must fail this workflow so a missed sync is visible.
   sync-develop:
     name: Trigger sync main into develop
     needs: github-release
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - name: Dispatch Sync Main Into Develop
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh workflow run sync-main-to-develop.yml \
             --repo "${{ github.repository }}" \
-            --ref main
+            --ref main \
+            -f version="${{ github.ref_name }}"
 
   # FnOS FPK：复用本 Release 的 wheel + docker-publish 的 GHCR 镜像。
-  # 与 sync-develop 并行；失败不阻断发版。
+  # 与 sync-develop 并行。Dispatch 失败必须让本 workflow 变红（PyPI 已发布仍如此）。
   trigger-fnos:
     name: Trigger FnOS FPK build
     needs: github-release
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - name: Dispatch Build Octop FPK
         env: