feat(release): 自动准备版本 PR 并支持手动发布

.github/workflows/check.yaml

@@ -6,13 +6,20 @@ on:
     branches:
       - '**'
   workflow_call:
+    inputs:
+      ref:
+        type: string
+        required: true
+      publish:
+        type: boolean
+        default: false
 
 permissions:
   contents: read
 
 concurrency:
-  group: check-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref_type != 'tag' }}
+  group: check-${{ github.workflow }}-${{ inputs.ref || github.ref }}
+  cancel-in-progress: ${{ !inputs.publish }}
 
 jobs:
   check:
@@ -29,6 +36,8 @@ jobs:
     steps:
       - name: 检出代码
         uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref || github.sha }}
       - name: 安装 JDK
         uses: actions/setup-java@v5
         with:

.github/workflows/prepare-release.yaml

@@ -0,0 +1,44 @@
+name: Prepare Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: '待发布的新版本（SemVer，不带 v，例如 0.1.0 或 0.1.0-rc.1）'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: prepare-release
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: 准备版本并创建发布 PR
+    runs-on: ubuntu-24.04
+    steps:
+      - name: 限定主分支入口
+        env:
+          RELEASE_REF: ${{ github.ref }}
+        run: |
+          if [ "$RELEASE_REF" != 'refs/heads/master' ]; then
+            echo '请从 master 手动运行 Prepare Release。'
+            exit 1
+          fi
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: .bun-version
+      - name: 创建或恢复发布准备 PR
+        id: prepare
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: bun scripts/prepare-release.ts

.github/workflows/publish.yaml

@@ -0,0 +1,31 @@
+name: Publish
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  request:
+    name: 确认发布入口
+    runs-on: ubuntu-24.04
+    steps:
+      - name: 仅允许从 master 发布
+        env:
+          RELEASE_REF: ${{ github.ref }}
+          RELEASE_SHA: ${{ github.sha }}
+        run: |
+          if [ "$RELEASE_REF" != 'refs/heads/master' ]; then
+            echo '请在 master 分支手动运行 Publish 工作流。'
+            exit 1
+          fi
+          echo "发布提交：$RELEASE_SHA" >> "$GITHUB_STEP_SUMMARY"
+
+  publish:
+    needs: request
+    permissions:
+      contents: write
+    uses: ./.github/workflows/release.yaml
+    with:
+      publish: true

.github/workflows/release.yaml

@@ -1,69 +1,76 @@
-name: Release
+name: Release Verify
 
 on:
   push:
-    tags:
-      - 'v*'
     branches:
       - '**'
     paths:
       - '.github/workflows/release.yaml'
       - '.github/workflows/check.yaml'
+      - '.github/workflows/publish.yaml'
+      - '.github/workflows/prepare-release.yaml'
       - 'scripts/compile.ts'
       - 'scripts/checksum.ts'
       - 'scripts/platforms.ts'
       - 'scripts/release.ts'
+      - 'scripts/publish-release.ts'
+      - 'scripts/prepare-release.ts'
       - 'scripts/smoke.ts'
       - 'docs/installation.md'
       - 'LICENSE*'
       - 'tests/compile.test.ts'
       - 'tests/release.test.ts'
+      - 'tests/publish-release.test.ts'
+      - 'tests/prepare-release.test.ts'
       - 'package.json'
       - 'bun.lockb'
       - 'bump.config.ts'
       - '.bun-version'
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      publish:
+        description: 验收通过后创建标签并发布
+        type: boolean
+        default: false
 
 permissions:
   contents: read
 
 concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref_type != 'tag' }}
+  group: release-${{ inputs.publish && 'publish' || github.ref }}
+  cancel-in-progress: ${{ !inputs.publish }}
 
 jobs:
   metadata:
     name: 校验版本与发布目标
     runs-on: ubuntu-24.04
     outputs:
-      tag: ${{ steps.metadata.outputs.tag }}
-      prerelease: ${{ steps.metadata.outputs.prerelease }}
       matrix: ${{ steps.metadata.outputs.matrix }}
     steps:
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: .bun-version
-      - name: 校验标签并生成产物清单
+      - name: 校验版本并生成产物清单
         id: metadata
-        run: bun scripts/release.ts metadata
-      - name: 检查发布状态
-        if: github.event_name == 'push' && github.ref_type == 'tag'
+        run: bun scripts/release.ts metadata ${{ inputs.publish && '--publish' || '' }}
+      - name: 检查发布请求、主分支与已有版本
+        if: inputs.publish
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ steps.metadata.outputs.tag }}
-        run: |
-          if state=$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft); then
-            if [ "$state" != 'true' ]; then
-              echo '该标签已经公开发布，请使用新版本标签。'
-              exit 1
-            fi
-          fi
+        run: bun scripts/publish-release.ts check
 
   checks:
     needs: metadata
-    if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
+    if: inputs.publish || github.event_name == 'workflow_dispatch'
     uses: ./.github/workflows/check.yaml
+    with:
+      ref: ${{ github.sha }}
+      publish: ${{ inputs.publish || false }}
 
   build:
     name: 验收 ${{ matrix.name }}
@@ -81,6 +88,8 @@ jobs:
     steps:
       - name: 检出待验收提交
         uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
       - name: 安装固定版本 Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -138,6 +147,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: .bun-version
@@ -165,19 +176,20 @@ jobs:
           overwrite: true
 
   release:
-    name: 发布完整标签产物
+    name: 创建标签并发布已验收产物
     needs: [metadata, checks, artifacts]
-    if: github.event_name == 'push' && github.ref_type == 'tag'
+    if: inputs.publish
     runs-on: ubuntu-24.04
     permissions:
       contents: write
     env:
       GH_TOKEN: ${{ github.token }}
       GH_REPO: ${{ github.repository }}
-      RELEASE_TAG: ${{ needs.metadata.outputs.tag }}
-      RELEASE_PRERELEASE: ${{ needs.metadata.outputs.prerelease }}
     steps:
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: .bun-version
@@ -188,34 +200,5 @@ jobs:
       - name: 核对待上传文件
         working-directory: dist
         run: sha256sum --check SHA256SUMS
-      - name: 生成下载与安装说明
-        run: |
-          bun scripts/release.ts notes > release-notes.md
-          gh api --method POST "repos/$GH_REPO/releases/generate-notes" \
-            -f tag_name="$RELEASE_TAG" --jq .body >> release-notes.md
-      - name: 创建或恢复未公开草稿
-        run: |
-          if state=$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft); then
-            if [ "$state" != 'true' ]; then
-              echo '该标签已经公开发布，请使用新版本标签。'
-              exit 1
-            fi
-            gh release edit "$RELEASE_TAG" --title "java-run $RELEASE_TAG" \
-              --notes-file release-notes.md --prerelease="$RELEASE_PRERELEASE"
-          else
-            gh release create "$RELEASE_TAG" --verify-tag --draft \
-              --notes-file release-notes.md --title "java-run $RELEASE_TAG" \
-              --prerelease="$RELEASE_PRERELEASE"
-          fi
-      - name: 上传完整资产并核对草稿
-        run: |
-          gh release upload "$RELEASE_TAG" dist/* --clobber
-          gh release view "$RELEASE_TAG" --json assets --jq '[.assets[].name]' \
-            | bun scripts/release.ts verify-assets
-      - name: 公开已验收版本
-        run: |
-          if [ "$RELEASE_PRERELEASE" = 'true' ]; then
-            gh release edit "$RELEASE_TAG" --draft=false --prerelease=true --latest=false
-          else
-            gh release edit "$RELEASE_TAG" --draft=false --prerelease=false
-          fi
+      - name: 创建标签、上传草稿资产并公开版本
+        run: bun scripts/publish-release.ts publish