ci: split PR quality, main integration, and release candidate

.github/workflows/ci.yml

@@ -3,9 +3,7 @@ name: CI
 on:
   pull_request:
   push:
-    branches:
-      - main
-  workflow_dispatch:
+    branches: [main]
 
 permissions:
   contents: read
@@ -16,43 +14,36 @@ concurrency:
 
 jobs:
   quality:
-    name: Quality and build
+    name: Quality
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-
       - name: Install pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
       - name: Install Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .node-version
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-
-      - name: Check source
-        run: pnpm check
-
-      - name: Run fake RPC smoke
+      - name: Typecheck
+        run: pnpm typecheck
+      - name: Lint
+        run: pnpm lint
+      - name: Format check
+        run: pnpm format:check
+      - name: Test
+        run: pnpm test
+      - name: Fake RPC smoke
         run: OMP_RPC_FAKE=1 node scripts/rpc-smoke.mjs
-
-      - name: Download and verify OMP Runtime
-        run: pnpm runtime:download
-
-      - name: Run real OMP RPC smoke without model API
-        run: OMP_RPC_TEST_CONFIG=1 node scripts/rpc-smoke.mjs
-
-      - name: Build application
+      - name: Build
         run: pnpm build
-
       - name: Check production output
         shell: bash
         run: |
@@ -66,8 +57,9 @@ jobs:
             exit 1
           fi
 
-  linux-package:
-    name: Linux x64 packages
+  linux-integration:
+    name: Linux integration and packages
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: quality
     runs-on: ubuntu-24.04
     timeout-minutes: 30
@@ -86,37 +78,36 @@ jobs:
           cache-dependency-path: pnpm-lock.yaml
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-      - name: Download Runtime and build packages
-        run: pnpm runtime:download && pnpm package:linux && pnpm package:check
+      - name: Download and verify OMP Runtime
+        run: pnpm runtime:download && pnpm runtime:check
+      - name: Real RPC smoke
+        run: OMP_RPC_TEST_CONFIG=1 node scripts/rpc-smoke.mjs
+      - name: Build x64 packages
+        run: pnpm package:linux && pnpm package:check
       - name: Inspect package metadata
         shell: bash
         run: |
           set -euo pipefail
           deb="$(find dist -maxdepth 1 -name '*.deb' -print -quit)"
           dpkg-deb --info "$deb"
-          dpkg-deb --contents "$deb" | tee dist/deb-contents.txt
-          if rg -n 'tests/|tmp/|omp-linux-arm64|\.map$' dist/deb-contents.txt; then
-            echo '安装包包含测试、临时、arm64 或 source map 文件' >&2
-            exit 1
-          fi
           test "$(dpkg-deb -f "$deb" Architecture)" = amd64
           test "$(dpkg-deb -f "$deb" Package)" = omp-desktop
       - name: Upload packages
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: linux-x64-packages
+          name: main-linux-x64-${{ github.sha }}
           path: |
             dist/*.AppImage
             dist/*.deb
             dist/*.sha256
             dist/build-metrics.json
-            dist/deb-contents.txt
           if-no-files-found: error
           retention-days: 7
 
   linux-display-smoke:
-    name: Linux ${{ matrix.ubuntu }} / ${{ matrix.arch }} / ${{ matrix.display }}
-    needs: quality
+    name: Ubuntu ${{ matrix.ubuntu }} x64 ${{ matrix.display }} smoke
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: linux-integration
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 20
     strategy:
@@ -125,89 +116,47 @@ jobs:
         include:
           - runner: ubuntu-22.04
             ubuntu: '22.04'
-            arch: x64
             display: x11
-          - runner: ubuntu-22.04
-            ubuntu: '22.04'
-            arch: x64
-            display: wayland
           - runner: ubuntu-24.04
             ubuntu: '24.04'
-            arch: x64
-            display: x11
-          - runner: ubuntu-24.04
-            ubuntu: '24.04'
-            arch: x64
-            display: wayland
-          - runner: ubuntu-22.04-arm
-            ubuntu: '22.04'
-            arch: arm64
-            display: x11
-          - runner: ubuntu-22.04-arm
-            ubuntu: '22.04'
-            arch: arm64
-            display: wayland
-          - runner: ubuntu-24.04-arm
-            ubuntu: '24.04'
-            arch: arm64
-            display: x11
-          - runner: ubuntu-24.04-arm
-            ubuntu: '24.04'
-            arch: arm64
             display: wayland
     steps:
-      - name: Checkout
+      - name: Checkout smoke scripts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
+          sparse-checkout: |
+            scripts
+            .node-version
       - name: Install Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .node-version
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build application
-        run: pnpm build
-
-      - name: Configure Electron sandbox
-        shell: bash
-        run: |
-          set -euo pipefail
-          electron_dir="$(dirname "$(node -p "require('electron')")")"
-          sandbox_path="$electron_dir/chrome-sandbox"
-          test -f "$sandbox_path"
-          sudo chown root:root "$sandbox_path"
-          sudo chmod 4755 "$sandbox_path"
-          stat -c '%U:%G %a %n' "$sandbox_path"
-
-      - name: Install X11 test dependencies
-        if: matrix.display == 'x11'
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends dbus-x11 xauth xvfb
-
-      - name: Install Wayland test dependencies
-        if: matrix.display == 'wayland'
+      - name: Download main packages
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: main-linux-x64-${{ github.sha }}
+          path: candidate
+      - name: Verify candidate checksums
+        working-directory: candidate
+        run: sha256sum -c *.deb.sha256
+      - name: Install candidate deb
+        run: sudo apt-get update && sudo apt-get install --yes ./candidate/*.deb
+      - name: Install display dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends dbus-x11 weston
-
-      - name: Run display smoke
-        run: dbus-run-session -- bash scripts/ci-linux-display-smoke.sh "${{ matrix.display }}"
-
+          if [[ '${{ matrix.display }}' == x11 ]]; then
+            sudo apt-get install --yes --no-install-recommends dbus-x11 xauth xvfb
+          else
+            sudo apt-get install --yes --no-install-recommends dbus-x11 weston
+          fi
+      - name: Run packaged display smoke
+        run: dbus-run-session -- bash scripts/ci-linux-display-smoke.sh '${{ matrix.display }}' '/opt/OMP Desktop/omp-desktop'
       - name: Upload smoke diagnostics
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: linux-${{ matrix.ubuntu }}-${{ matrix.arch }}-${{ matrix.display }}
+          name: main-${{ matrix.ubuntu }}-${{ matrix.display }}-smoke
           path: |
             ${{ runner.temp }}/omp-ci/**
             tests/artifacts/*.png