From 03f7e0e4736922de12e4a6c82bde27f3d952b9a9 Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:10:41 +0800
Subject: [PATCH 1/8] Add Windows desktop packaging workflow

---
 .github/workflows/desktop-windows.yml         |  86 +++++++++++
 ...20-private-binary-bundle-github-actions.md | 146 ++++++++++--------
 2 files changed, 168 insertions(+), 64 deletions(-)
 create mode 100644 .github/workflows/desktop-windows.yml

diff --git a/.github/workflows/desktop-windows.yml b/.github/workflows/desktop-windows.yml
new file mode 100644
index 0000000..0a9c5b8
--- /dev/null
+++ b/.github/workflows/desktop-windows.yml
@@ -0,0 +1,86 @@
+name: Desktop Windows
+
+on:
+  workflow_dispatch:
+    inputs:
+      binaries_ref:
+        description: Git ref to checkout from YukeonWayne/pg_pgvector_binary
+        required: false
+        default: main
+
+permissions:
+  contents: read
+
+jobs:
+  build-windows:
+    name: Build Windows desktop installer
+    runs-on: windows-latest
+    timeout-minutes: 60
+
+    env:
+      VIFORGE_POSTGRES_PLATFORM_ARCH: win32-x64
+      VIFORGE_REQUIRE_PGVECTOR: '1'
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.3.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Checkout PostgreSQL bundle
+        uses: actions/checkout@v4
+        with:
+          repository: YukeonWayne/pg_pgvector_binary
+          ref: ${{ inputs.binaries_ref }}
+          token: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
+          path: desktop-binaries
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install PostgreSQL bundle
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $platform = $env:VIFORGE_POSTGRES_PLATFORM_ARCH
+          $source = "desktop-binaries/postgres/$platform"
+          $target = "apps/desktop/resources/postgres/$platform"
+
+          if (-not (Test-Path -LiteralPath $source)) {
+            throw "PostgreSQL bundle not found at $source"
+          }
+
+          Remove-Item -LiteralPath $target -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Force -Path "apps/desktop/resources/postgres" | Out-Null
+          Copy-Item -LiteralPath $source -Destination $target -Recurse
+
+      - name: Verify PostgreSQL bundle
+        run: pnpm --filter @viforge/desktop prepare:postgres
+
+      - name: Typecheck API
+        run: pnpm --filter @viforge/api typecheck
+
+      - name: Typecheck web
+        run: pnpm --filter @viforge/web typecheck
+
+      - name: Build Windows installer
+        run: pnpm desktop:dist
+
+      - name: Upload Windows artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: viforge-windows-desktop
+          path: |
+            release/desktop/*.exe
+            release/desktop/*.blockmap
+            release/desktop/latest*.yml
+          if-no-files-found: error
diff --git a/docs/current/20-private-binary-bundle-github-actions.md b/docs/current/20-private-binary-bundle-github-actions.md
index 6fcb318..26591b4 100644
--- a/docs/current/20-private-binary-bundle-github-actions.md
+++ b/docs/current/20-private-binary-bundle-github-actions.md
@@ -2,15 +2,15 @@
 
 如果不想先搭 OSS，可以用一个私有 GitHub 仓库存放 PostgreSQL + pgvector bundle，再让主仓库的 GitHub Actions 在构建时拉取。这个方案适合早期内部发布，配置少，权限清晰。
 
-## 1. 推荐仓库结构
+## 1. 当前二进制仓库
 
-新建一个私有仓库，例如：
+当前使用的私有仓库：
 
 ```text
-YukeonWayne/viforge-desktop-binaries
+YukeonWayne/pg_pgvector_binary
 ```
 
-目录结构建议：
+目录结构约定：
 
 ```text
 postgres/
@@ -56,7 +56,7 @@ PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会
 如果主仓库和二进制仓库都在同一个 GitHub 账号或组织下，推荐创建一个 Fine-grained Personal Access Token：
 
 1. 进入 GitHub `Settings -> Developer settings -> Personal access tokens -> Fine-grained tokens`。
-2. 选择只允许访问 `YukeonWayne/viforge-desktop-binaries`。
+2. 选择只允许访问 `YukeonWayne/pg_pgvector_binary`。
 3. 权限只给 `Contents: Read-only`。
 4. 在主仓库 `YukeonWayne/viforge` 的 `Settings -> Secrets and variables -> Actions` 新增 secret：
 
@@ -64,73 +64,77 @@ PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会
 DESKTOP_BINARIES_TOKEN=<你的 token>
 ```
 
-## 4. Actions 拉取二进制资源
+不要把 token 写入仓库。workflow 只通过 `${{ secrets.DESKTOP_BINARIES_TOKEN }}` 读取。
 
-主仓库 workflow 中增加一个 checkout step，把私有二进制仓库拉到临时目录，再复制对应平台资源：
+## 4. 已配置的 Windows Actions
 
-```yaml
-- name: Checkout desktop binaries
-  uses: actions/checkout@v4
-  with:
-    repository: YukeonWayne/viforge-desktop-binaries
-    token: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
-    path: desktop-binaries
-
-- name: Install PostgreSQL bundle
-  shell: bash
-  run: |
-    PLATFORM_ARCH="${{ matrix.platform_arch }}"
-    rm -rf "apps/desktop/resources/postgres/${PLATFORM_ARCH}"
-    mkdir -p apps/desktop/resources/postgres
-    cp -R "desktop-binaries/postgres/${PLATFORM_ARCH}" "apps/desktop/resources/postgres/${PLATFORM_ARCH}"
+主仓库已提供 Windows 桌面打包 workflow：
+
+```text
+.github/workflows/desktop-windows.yml
 ```
 
-然后执行：
+workflow 使用 `workflow_dispatch` 手动触发，并提供 `binaries_ref` 输入，默认从 `YukeonWayne/pg_pgvector_binary` 的 `main` 分支拉取二进制资源。如果二进制仓库用 tag 固定版本，可以在触发时把 `binaries_ref` 填成对应 tag。
 
-```yaml
-- name: Verify PostgreSQL bundle
-  run: pnpm --filter @viforge/desktop prepare:postgres
-  env:
-    VIFORGE_POSTGRES_PLATFORM_ARCH: ${{ matrix.platform_arch }}
-    VIFORGE_REQUIRE_PGVECTOR: '1'
-
-- name: Build desktop installer
-  run: pnpm desktop:dist
-  env:
-    VIFORGE_POSTGRES_PLATFORM_ARCH: ${{ matrix.platform_arch }}
-```
+核心流程：
+
+1. checkout 主仓库代码。
+2. 安装 pnpm 11.3.0 和 Node.js 22。
+3. 使用 `DESKTOP_BINARIES_TOKEN` checkout `YukeonWayne/pg_pgvector_binary` 到 `desktop-binaries/`。
+4. 复制 `desktop-binaries/postgres/win32-x64` 到 `apps/desktop/resources/postgres/win32-x64`。
+5. 设置 `VIFORGE_POSTGRES_PLATFORM_ARCH=win32-x64` 和 `VIFORGE_REQUIRE_PGVECTOR=1`，运行 `prepare:postgres` 强制校验 PostgreSQL 与 pgvector。
+6. 运行 API 和 Web typecheck。
+7. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
+8. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
 
-## 5. Windows job 示例
+## 5. Windows job 配置
+
+当前 workflow 内容等价于：
 
 ```yaml
-name: Desktop Release
+name: Desktop Windows
 
 on:
   workflow_dispatch:
+    inputs:
+      binaries_ref:
+        description: Git ref to checkout from YukeonWayne/pg_pgvector_binary
+        required: false
+        default: main
+
+permissions:
+  contents: read
 
 jobs:
-  windows:
+  build-windows:
+    name: Build Windows desktop installer
     runs-on: windows-latest
-    strategy:
-      matrix:
-        include:
-          - platform_arch: win32-x64
+    timeout-minutes: 60
+
+    env:
+      VIFORGE_POSTGRES_PLATFORM_ARCH: win32-x64
+      VIFORGE_REQUIRE_PGVECTOR: '1'
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout source
+        uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
           version: 11.3.0
 
-      - uses: actions/setup-node@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: pnpm
 
-      - name: Checkout desktop binaries
+      - name: Checkout PostgreSQL bundle
         uses: actions/checkout@v4
         with:
-          repository: YukeonWayne/viforge-desktop-binaries
+          repository: YukeonWayne/pg_pgvector_binary
+          ref: ${{ inputs.binaries_ref }}
           token: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
           path: desktop-binaries
 
@@ -140,26 +144,40 @@ jobs:
       - name: Install PostgreSQL bundle
         shell: pwsh
         run: |
-          $platform = "${{ matrix.platform_arch }}"
-          Remove-Item -Recurse -Force "apps/desktop/resources/postgres/$platform" -ErrorAction SilentlyContinue
-          New-Item -ItemType Directory -Force "apps/desktop/resources/postgres" | Out-Null
-          Copy-Item -Recurse "desktop-binaries/postgres/$platform" "apps/desktop/resources/postgres/$platform"
+          $ErrorActionPreference = 'Stop'
+          $platform = $env:VIFORGE_POSTGRES_PLATFORM_ARCH
+          $source = "desktop-binaries/postgres/$platform"
+          $target = "apps/desktop/resources/postgres/$platform"
+
+          if (-not (Test-Path -LiteralPath $source)) {
+            throw "PostgreSQL bundle not found at $source"
+          }
+
+          Remove-Item -LiteralPath $target -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Force -Path "apps/desktop/resources/postgres" | Out-Null
+          Copy-Item -LiteralPath $source -Destination $target -Recurse
 
       - name: Verify PostgreSQL bundle
         run: pnpm --filter @viforge/desktop prepare:postgres
-        env:
-          VIFORGE_POSTGRES_PLATFORM_ARCH: ${{ matrix.platform_arch }}
-          VIFORGE_REQUIRE_PGVECTOR: '1'
 
-      - name: Build installer
+      - name: Typecheck API
+        run: pnpm --filter @viforge/api typecheck
+
+      - name: Typecheck web
+        run: pnpm --filter @viforge/web typecheck
+
+      - name: Build Windows installer
         run: pnpm desktop:dist
-        env:
-          VIFORGE_POSTGRES_PLATFORM_ARCH: ${{ matrix.platform_arch }}
 
-      - uses: actions/upload-artifact@v4
+      - name: Upload Windows artifacts
+        uses: actions/upload-artifact@v4
         with:
-          name: viforge-windows
-          path: release/desktop/*
+          name: viforge-windows-desktop
+          path: |
+            release/desktop/*.exe
+            release/desktop/*.blockmap
+            release/desktop/latest*.yml
+          if-no-files-found: error
 ```
 
 ## 6. 本地使用同一个二进制仓库
@@ -167,9 +185,9 @@ jobs:
 本地 Windows 验证时也可以 clone 这个二进制仓库：
 
 ```powershell
-git clone https://github.com/YukeonWayne/viforge-desktop-binaries.git D:\deps\viforge-desktop-binaries
+git clone git@github.com:YukeonWayne/pg_pgvector_binary.git D:\deps\pg_pgvector_binary
 Remove-Item -Recurse -Force apps\desktop\resources\postgres\win32-x64 -ErrorAction SilentlyContinue
-Copy-Item -Recurse D:\deps\viforge-desktop-binaries\postgres\win32-x64 apps\desktop\resources\postgres\win32-x64
+Copy-Item -Recurse D:\deps\pg_pgvector_binary\postgres\win32-x64 apps\desktop\resources\postgres\win32-x64
 $env:VIFORGE_POSTGRES_PLATFORM_ARCH="win32-x64"
 $env:VIFORGE_REQUIRE_PGVECTOR="1"
 pnpm --filter @viforge/desktop prepare:postgres
@@ -180,5 +198,5 @@ pnpm desktop:pack
 
 - 私有二进制仓库不要放数据库运行数据，只放 PostgreSQL 程序文件和 pgvector 扩展文件。
 - 不要把 GitHub token 写进仓库，只放到 GitHub Actions secrets。
-- 二进制仓库建议用 release tag 标记版本，例如 `postgres-16.10-pgvector-0.8.0`。
-- 主仓库 workflow 后续可以固定 checkout 某个 tag，避免二进制资源变化导致同一份代码构建结果不一致。
+- 二进制仓库建议用 git tag 标记版本，例如 `postgres-16.10-pgvector-0.8.0-win32-x64`。
+- 主仓库 workflow 触发时可以把 `binaries_ref` 固定为某个 tag，避免二进制资源变化导致同一份代码构建结果不一致。

From 75754b78cbc3930e3d5a0c207fa255cff4d05b24 Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:10:41 +0800
Subject: [PATCH 2/8] Enable PR validation for desktop workflow

---
 .github/workflows/desktop-windows.yml         | 12 ++++++-
 ...20-private-binary-bundle-github-actions.md | 31 +++++++++++++------
 2 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/desktop-windows.yml b/.github/workflows/desktop-windows.yml
index 0a9c5b8..ea6c92b 100644
--- a/.github/workflows/desktop-windows.yml
+++ b/.github/workflows/desktop-windows.yml
@@ -1,6 +1,16 @@
 name: Desktop Windows
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/desktop-windows.yml
+      - apps/api/**
+      - apps/desktop/**
+      - apps/web/**
+      - packages/shared/**
+      - package.json
+      - pnpm-lock.yaml
+      - pnpm-workspace.yaml
   workflow_dispatch:
     inputs:
       binaries_ref:
@@ -40,7 +50,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: YukeonWayne/pg_pgvector_binary
-          ref: ${{ inputs.binaries_ref }}
+          ref: ${{ inputs.binaries_ref || 'main' }}
           token: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
           path: desktop-binaries
 
diff --git a/docs/current/20-private-binary-bundle-github-actions.md b/docs/current/20-private-binary-bundle-github-actions.md
index 26591b4..e2e3b96 100644
--- a/docs/current/20-private-binary-bundle-github-actions.md
+++ b/docs/current/20-private-binary-bundle-github-actions.md
@@ -74,18 +74,19 @@ DESKTOP_BINARIES_TOKEN=<你的 token>
 .github/workflows/desktop-windows.yml
 ```
 
-workflow 使用 `workflow_dispatch` 手动触发，并提供 `binaries_ref` 输入，默认从 `YukeonWayne/pg_pgvector_binary` 的 `main` 分支拉取二进制资源。如果二进制仓库用 tag 固定版本，可以在触发时把 `binaries_ref` 填成对应 tag。
+workflow 支持两种触发方式：`pull_request` 用于在不改 `main` 的情况下验证配置；`workflow_dispatch` 用于合入默认分支后手动打包。手动触发时可以提供 `binaries_ref` 输入，默认从 `YukeonWayne/pg_pgvector_binary` 的 `main` 分支拉取二进制资源。如果二进制仓库用 tag 固定版本，可以在触发时把 `binaries_ref` 填成对应 tag。
 
 核心流程：
 
-1. checkout 主仓库代码。
-2. 安装 pnpm 11.3.0 和 Node.js 22。
-3. 使用 `DESKTOP_BINARIES_TOKEN` checkout `YukeonWayne/pg_pgvector_binary` 到 `desktop-binaries/`。
-4. 复制 `desktop-binaries/postgres/win32-x64` 到 `apps/desktop/resources/postgres/win32-x64`。
-5. 设置 `VIFORGE_POSTGRES_PLATFORM_ARCH=win32-x64` 和 `VIFORGE_REQUIRE_PGVECTOR=1`，运行 `prepare:postgres` 强制校验 PostgreSQL 与 pgvector。
-6. 运行 API 和 Web typecheck。
-7. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
-8. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
+1. PR 改动相关路径时自动验证，或合入默认分支后手动触发打包。
+2. checkout 主仓库代码。
+3. 安装 pnpm 11.3.0 和 Node.js 22。
+4. 使用 `DESKTOP_BINARIES_TOKEN` checkout `YukeonWayne/pg_pgvector_binary` 到 `desktop-binaries/`。
+5. 复制 `desktop-binaries/postgres/win32-x64` 到 `apps/desktop/resources/postgres/win32-x64`。
+6. 设置 `VIFORGE_POSTGRES_PLATFORM_ARCH=win32-x64` 和 `VIFORGE_REQUIRE_PGVECTOR=1`，运行 `prepare:postgres` 强制校验 PostgreSQL 与 pgvector。
+7. 运行 API 和 Web typecheck。
+8. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
+9. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
 
 ## 5. Windows job 配置
 
@@ -95,6 +96,16 @@ workflow 使用 `workflow_dispatch` 手动触发，并提供 `binaries_ref` 输
 name: Desktop Windows
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/desktop-windows.yml
+      - apps/api/**
+      - apps/desktop/**
+      - apps/web/**
+      - packages/shared/**
+      - package.json
+      - pnpm-lock.yaml
+      - pnpm-workspace.yaml
   workflow_dispatch:
     inputs:
       binaries_ref:
@@ -134,7 +145,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: YukeonWayne/pg_pgvector_binary
-          ref: ${{ inputs.binaries_ref }}
+          ref: ${{ inputs.binaries_ref || 'main' }}
           token: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
           path: desktop-binaries
 

From 0e03ba5af8583687991d031d97877ee301aa848e Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:10:41 +0800
Subject: [PATCH 3/8] Check desktop binary token before packaging

---
 .github/workflows/desktop-windows.yml         |  9 +++++++
 ...20-private-binary-bundle-github-actions.md | 25 +++++++++++++------
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/desktop-windows.yml b/.github/workflows/desktop-windows.yml
index ea6c92b..5ee3510 100644
--- a/.github/workflows/desktop-windows.yml
+++ b/.github/workflows/desktop-windows.yml
@@ -46,6 +46,15 @@ jobs:
           node-version: 22
           cache: pnpm
 
+      - name: Verify desktop binaries token
+        shell: pwsh
+        env:
+          DESKTOP_BINARIES_TOKEN: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:DESKTOP_BINARIES_TOKEN)) {
+            throw "Missing repository secret DESKTOP_BINARIES_TOKEN. Create a fine-grained GitHub token with read-only Contents access to YukeonWayne/pg_pgvector_binary, then add it to this repository's Actions secrets."
+          }
+
       - name: Checkout PostgreSQL bundle
         uses: actions/checkout@v4
         with:
diff --git a/docs/current/20-private-binary-bundle-github-actions.md b/docs/current/20-private-binary-bundle-github-actions.md
index e2e3b96..260f7f0 100644
--- a/docs/current/20-private-binary-bundle-github-actions.md
+++ b/docs/current/20-private-binary-bundle-github-actions.md
@@ -58,7 +58,7 @@ PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会
 1. 进入 GitHub `Settings -> Developer settings -> Personal access tokens -> Fine-grained tokens`。
 2. 选择只允许访问 `YukeonWayne/pg_pgvector_binary`。
 3. 权限只给 `Contents: Read-only`。
-4. 在主仓库 `YukeonWayne/viforge` 的 `Settings -> Secrets and variables -> Actions` 新增 secret：
+4. 在当前主仓库 `tech4idea/viforge` 的 `Settings -> Secrets and variables -> Actions` 新增 secret：
 
 ```text
 DESKTOP_BINARIES_TOKEN=<你的 token>
@@ -81,12 +81,13 @@ workflow 支持两种触发方式：`pull_request` 用于在不改 `main` 的情
 1. PR 改动相关路径时自动验证，或合入默认分支后手动触发打包。
 2. checkout 主仓库代码。
 3. 安装 pnpm 11.3.0 和 Node.js 22。
-4. 使用 `DESKTOP_BINARIES_TOKEN` checkout `YukeonWayne/pg_pgvector_binary` 到 `desktop-binaries/`。
-5. 复制 `desktop-binaries/postgres/win32-x64` 到 `apps/desktop/resources/postgres/win32-x64`。
-6. 设置 `VIFORGE_POSTGRES_PLATFORM_ARCH=win32-x64` 和 `VIFORGE_REQUIRE_PGVECTOR=1`，运行 `prepare:postgres` 强制校验 PostgreSQL 与 pgvector。
-7. 运行 API 和 Web typecheck。
-8. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
-9. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
+4. 检查当前仓库是否配置了 `DESKTOP_BINARIES_TOKEN`。
+5. 使用 `DESKTOP_BINARIES_TOKEN` checkout `YukeonWayne/pg_pgvector_binary` 到 `desktop-binaries/`。
+6. 复制 `desktop-binaries/postgres/win32-x64` 到 `apps/desktop/resources/postgres/win32-x64`。
+7. 设置 `VIFORGE_POSTGRES_PLATFORM_ARCH=win32-x64` 和 `VIFORGE_REQUIRE_PGVECTOR=1`，运行 `prepare:postgres` 强制校验 PostgreSQL 与 pgvector。
+8. 运行 API 和 Web typecheck。
+9. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
+10. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
 
 ## 5. Windows job 配置
 
@@ -141,6 +142,16 @@ jobs:
           node-version: 22
           cache: pnpm
 
+      - name: Verify desktop binaries token
+        shell: pwsh
+        env:
+          DESKTOP_BINARIES_TOKEN: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:DESKTOP_BINARIES_TOKEN)) {
+            throw "Missing repository secret DESKTOP_BINARIES_TOKEN. Create a fine-grained GitHub token with read-only Contents access to YukeonWayne/pg_pgvector_binary, then add it to this repository's Actions secrets."
+          }
+
+
       - name: Checkout PostgreSQL bundle
         uses: actions/checkout@v4
         with:

From e4702c3e4a770a94312ec1b461fa532a97d20483 Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:10:41 +0800
Subject: [PATCH 4/8] Allow public desktop binary checkout

---
 .github/workflows/desktop-windows.yml             | 10 ----------
 .../20-private-binary-bundle-github-actions.md    | 15 ++-------------
 2 files changed, 2 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/desktop-windows.yml b/.github/workflows/desktop-windows.yml
index 5ee3510..00f4078 100644
--- a/.github/workflows/desktop-windows.yml
+++ b/.github/workflows/desktop-windows.yml
@@ -46,21 +46,11 @@ jobs:
           node-version: 22
           cache: pnpm
 
-      - name: Verify desktop binaries token
-        shell: pwsh
-        env:
-          DESKTOP_BINARIES_TOKEN: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
-        run: |
-          if ([string]::IsNullOrWhiteSpace($env:DESKTOP_BINARIES_TOKEN)) {
-            throw "Missing repository secret DESKTOP_BINARIES_TOKEN. Create a fine-grained GitHub token with read-only Contents access to YukeonWayne/pg_pgvector_binary, then add it to this repository's Actions secrets."
-          }
-
       - name: Checkout PostgreSQL bundle
         uses: actions/checkout@v4
         with:
           repository: YukeonWayne/pg_pgvector_binary
           ref: ${{ inputs.binaries_ref || 'main' }}
-          token: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
           path: desktop-binaries
 
       - name: Install dependencies
diff --git a/docs/current/20-private-binary-bundle-github-actions.md b/docs/current/20-private-binary-bundle-github-actions.md
index 260f7f0..0328820 100644
--- a/docs/current/20-private-binary-bundle-github-actions.md
+++ b/docs/current/20-private-binary-bundle-github-actions.md
@@ -53,7 +53,7 @@ PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会
 
 ## 3. GitHub Actions 权限
 
-如果主仓库和二进制仓库都在同一个 GitHub 账号或组织下，推荐创建一个 Fine-grained Personal Access Token：
+如果二进制仓库是 public，GitHub Actions 不需要额外 token，当前 `YukeonWayne/pg_pgvector_binary` 就是 public 仓库。如果后续改回 private，再创建一个 Fine-grained Personal Access Token：
 
 1. 进入 GitHub `Settings -> Developer settings -> Personal access tokens -> Fine-grained tokens`。
 2. 选择只允许访问 `YukeonWayne/pg_pgvector_binary`。
@@ -64,7 +64,7 @@ PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会
 DESKTOP_BINARIES_TOKEN=<你的 token>
 ```
 
-不要把 token 写入仓库。workflow 只通过 `${{ secrets.DESKTOP_BINARIES_TOKEN }}` 读取。
+public 仓库场景不需要配置这个 secret。只有二进制仓库改成 private 时，才需要把 token 放进 Actions secrets；不要把 token 写入仓库。
 
 ## 4. 已配置的 Windows Actions
 
@@ -142,22 +142,11 @@ jobs:
           node-version: 22
           cache: pnpm
 
-      - name: Verify desktop binaries token
-        shell: pwsh
-        env:
-          DESKTOP_BINARIES_TOKEN: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
-        run: |
-          if ([string]::IsNullOrWhiteSpace($env:DESKTOP_BINARIES_TOKEN)) {
-            throw "Missing repository secret DESKTOP_BINARIES_TOKEN. Create a fine-grained GitHub token with read-only Contents access to YukeonWayne/pg_pgvector_binary, then add it to this repository's Actions secrets."
-          }
-
-
       - name: Checkout PostgreSQL bundle
         uses: actions/checkout@v4
         with:
           repository: YukeonWayne/pg_pgvector_binary
           ref: ${{ inputs.binaries_ref || 'main' }}
-          token: ${{ secrets.DESKTOP_BINARIES_TOKEN }}
           path: desktop-binaries
 
       - name: Install dependencies

From 33d2cc931ded98966558d60003cce143899207ba Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:10:42 +0800
Subject: [PATCH 5/8] Download desktop PostgreSQL bundle from release

---
 .github/workflows/desktop-windows.yml         |  40 ++---
 ...20-private-binary-bundle-github-actions.md | 137 ++++++++----------
 2 files changed, 68 insertions(+), 109 deletions(-)

diff --git a/.github/workflows/desktop-windows.yml b/.github/workflows/desktop-windows.yml
index 00f4078..437327a 100644
--- a/.github/workflows/desktop-windows.yml
+++ b/.github/workflows/desktop-windows.yml
@@ -13,10 +13,10 @@ on:
       - pnpm-workspace.yaml
   workflow_dispatch:
     inputs:
-      binaries_ref:
-        description: Git ref to checkout from YukeonWayne/pg_pgvector_binary
+      bundle_release_tag:
+        description: GitHub Release tag from YukeonWayne/pg_pgvector_binary
         required: false
-        default: main
+        default: v18.4-pgvector0.8.3-win32-x64
 
 permissions:
   contents: read
@@ -30,49 +30,29 @@ jobs:
     env:
       VIFORGE_POSTGRES_PLATFORM_ARCH: win32-x64
       VIFORGE_REQUIRE_PGVECTOR: '1'
+      VIFORGE_POSTGRES_BUNDLE_RELEASE_REPO: YukeonWayne/pg_pgvector_binary
+      VIFORGE_POSTGRES_BUNDLE_RELEASE_TAG: ${{ inputs.bundle_release_tag || 'v18.4-pgvector0.8.3-win32-x64' }}
+      VIFORGE_POSTGRES_BUNDLE_ASSET_NAME: postgres-18.4-pgvector-0.8.3-win32-x64.zip
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 11.3.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
 
-      - name: Checkout PostgreSQL bundle
-        uses: actions/checkout@v4
-        with:
-          repository: YukeonWayne/pg_pgvector_binary
-          ref: ${{ inputs.binaries_ref || 'main' }}
-          path: desktop-binaries
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Install PostgreSQL bundle
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $platform = $env:VIFORGE_POSTGRES_PLATFORM_ARCH
-          $source = "desktop-binaries/postgres/$platform"
-          $target = "apps/desktop/resources/postgres/$platform"
-
-          if (-not (Test-Path -LiteralPath $source)) {
-            throw "PostgreSQL bundle not found at $source"
-          }
-
-          Remove-Item -LiteralPath $target -Recurse -Force -ErrorAction SilentlyContinue
-          New-Item -ItemType Directory -Force -Path "apps/desktop/resources/postgres" | Out-Null
-          Copy-Item -LiteralPath $source -Destination $target -Recurse
-
-      - name: Verify PostgreSQL bundle
+      - name: Verify or download PostgreSQL bundle
         run: pnpm --filter @viforge/desktop prepare:postgres
 
       - name: Typecheck API
diff --git a/docs/current/20-private-binary-bundle-github-actions.md b/docs/current/20-private-binary-bundle-github-actions.md
index 0328820..6d0d4a6 100644
--- a/docs/current/20-private-binary-bundle-github-actions.md
+++ b/docs/current/20-private-binary-bundle-github-actions.md
@@ -1,59 +1,58 @@
 # 私有 GitHub 仓库存放桌面二进制资源的打包方案
 
-如果不想先搭 OSS，可以用一个私有 GitHub 仓库存放 PostgreSQL + pgvector bundle，再让主仓库的 GitHub Actions 在构建时拉取。这个方案适合早期内部发布，配置少，权限清晰。
+当前 PostgreSQL + pgvector bundle 存放在独立 GitHub 仓库，再由主仓库的 GitHub Actions 在构建时下载。这个方案适合早期内部发布，配置少，权限清晰。
 
 ## 1. 当前二进制仓库
 
-当前使用的私有仓库：
+当前使用的 public 仓库：
 
 ```text
 YukeonWayne/pg_pgvector_binary
 ```
 
-目录结构约定：
+当前 Windows x64 bundle 通过 GitHub Release 发布：
 
 ```text
-postgres/
-  win32-x64/
-    bin/
-      initdb.exe
-      pg_ctl.exe
-      postgres.exe
-      createdb.exe
-      psql.exe
-      pg_config.exe
-    lib/
-      vector.dll
-      ...
-    share/
-      extension/
-        vector.control
-        vector--0.8.0.sql
-        ...
-  linux-x64/
-    bin/
-    lib/
-    share/
-  darwin-arm64/
-    bin/
-    lib/
-    share/
+release tag: v18.4-pgvector0.8.3-win32-x64
+asset: postgres-18.4-pgvector-0.8.3-win32-x64.zip
 ```
 
-把每个平台的 PostgreSQL 根目录完整放进去。pgvector 不需要单独目录，只要已经安装进对应平台的 PostgreSQL bundle 即可。
+zip 解压后应能找到 PostgreSQL 根目录，目录里至少包含：
+
+```text
+bin/
+  initdb.exe
+  pg_ctl.exe
+  postgres.exe
+  createdb.exe
+  psql.exe
+  pg_config.exe
+lib/
+  vector.dll
+  ...
+share/
+  extension/
+    vector.control
+    vector--0.8.0.sql
+    ...
+```
+
+pgvector 不需要单独目录，只要已经安装进对应平台的 PostgreSQL bundle 即可。
 
 ## 2. 为什么不放主仓库
 
-PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会让代码 clone 变慢，也容易把构建产物和源码混在一起。单独私有仓库更适合：
+PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会让代码 clone 变慢，也容易把构建产物和源码混在一起。单独仓库更适合：
 
 - 单独控制访问权限。
 - 单独更新二进制版本。
-- GitHub Actions 构建时按需 checkout。
+- GitHub Actions 构建时按需下载。
 - 主仓库保持干净。
 
 ## 3. GitHub Actions 权限
 
-如果二进制仓库是 public，GitHub Actions 不需要额外 token，当前 `YukeonWayne/pg_pgvector_binary` 就是 public 仓库。如果后续改回 private，再创建一个 Fine-grained Personal Access Token：
+当前 `YukeonWayne/pg_pgvector_binary` 是 public 仓库，GitHub Actions 不需要额外 token。
+
+如果后续把二进制仓库改回 private，再创建一个 Fine-grained Personal Access Token：
 
 1. 进入 GitHub `Settings -> Developer settings -> Personal access tokens -> Fine-grained tokens`。
 2. 选择只允许访问 `YukeonWayne/pg_pgvector_binary`。
@@ -64,7 +63,7 @@ PostgreSQL bundle 会很大，而且是平台相关二进制。放主仓库会
 DESKTOP_BINARIES_TOKEN=<你的 token>
 ```
 
-public 仓库场景不需要配置这个 secret。只有二进制仓库改成 private 时，才需要把 token 放进 Actions secrets；不要把 token 写入仓库。
+private 仓库场景还需要在 workflow 的下载逻辑里把 token 传给 `VIFORGE_POSTGRES_BUNDLE_GITHUB_TOKEN`。public 仓库场景不需要配置这个 secret，也不要把 token 写入仓库。
 
 ## 4. 已配置的 Windows Actions
 
@@ -74,20 +73,20 @@ public 仓库场景不需要配置这个 secret。只有二进制仓库改成 pr
 .github/workflows/desktop-windows.yml
 ```
 
-workflow 支持两种触发方式：`pull_request` 用于在不改 `main` 的情况下验证配置；`workflow_dispatch` 用于合入默认分支后手动打包。手动触发时可以提供 `binaries_ref` 输入，默认从 `YukeonWayne/pg_pgvector_binary` 的 `main` 分支拉取二进制资源。如果二进制仓库用 tag 固定版本，可以在触发时把 `binaries_ref` 填成对应 tag。
+workflow 支持两种触发方式：`pull_request` 用于在不改默认分支的情况下验证配置；`workflow_dispatch` 用于合入默认分支后手动打包。手动触发时可以提供 `bundle_release_tag` 输入，默认下载 `YukeonWayne/pg_pgvector_binary` 的 `v18.4-pgvector0.8.3-win32-x64` release。
 
 核心流程：
 
 1. PR 改动相关路径时自动验证，或合入默认分支后手动触发打包。
 2. checkout 主仓库代码。
 3. 安装 pnpm 11.3.0 和 Node.js 22。
-4. 检查当前仓库是否配置了 `DESKTOP_BINARIES_TOKEN`。
-5. 使用 `DESKTOP_BINARIES_TOKEN` checkout `YukeonWayne/pg_pgvector_binary` 到 `desktop-binaries/`。
-6. 复制 `desktop-binaries/postgres/win32-x64` 到 `apps/desktop/resources/postgres/win32-x64`。
-7. 设置 `VIFORGE_POSTGRES_PLATFORM_ARCH=win32-x64` 和 `VIFORGE_REQUIRE_PGVECTOR=1`，运行 `prepare:postgres` 强制校验 PostgreSQL 与 pgvector。
-8. 运行 API 和 Web typecheck。
-9. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
-10. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
+4. 运行 `pnpm install --frozen-lockfile`。
+5. 设置 `VIFORGE_POSTGRES_BUNDLE_RELEASE_REPO`、`VIFORGE_POSTGRES_BUNDLE_RELEASE_TAG` 和 `VIFORGE_POSTGRES_BUNDLE_ASSET_NAME`，运行 `prepare:postgres` 自动下载并校验 PostgreSQL + pgvector bundle。
+6. 运行 API 和 Web typecheck。
+7. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
+8. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
+
+workflow 使用 `actions/checkout@v7`、`actions/setup-node@v6` 和 `pnpm/action-setup@v6`，避免 GitHub Actions 对 Node 20 action runtime 的 deprecation warning。
 
 ## 5. Windows job 配置
 
@@ -109,10 +108,10 @@ on:
       - pnpm-workspace.yaml
   workflow_dispatch:
     inputs:
-      binaries_ref:
-        description: Git ref to checkout from YukeonWayne/pg_pgvector_binary
+      bundle_release_tag:
+        description: GitHub Release tag from YukeonWayne/pg_pgvector_binary
         required: false
-        default: main
+        default: v18.4-pgvector0.8.3-win32-x64
 
 permissions:
   contents: read
@@ -126,49 +125,29 @@ jobs:
     env:
       VIFORGE_POSTGRES_PLATFORM_ARCH: win32-x64
       VIFORGE_REQUIRE_PGVECTOR: '1'
+      VIFORGE_POSTGRES_BUNDLE_RELEASE_REPO: YukeonWayne/pg_pgvector_binary
+      VIFORGE_POSTGRES_BUNDLE_RELEASE_TAG: ${{ inputs.bundle_release_tag || 'v18.4-pgvector0.8.3-win32-x64' }}
+      VIFORGE_POSTGRES_BUNDLE_ASSET_NAME: postgres-18.4-pgvector-0.8.3-win32-x64.zip
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: 11.3.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: pnpm
 
-      - name: Checkout PostgreSQL bundle
-        uses: actions/checkout@v4
-        with:
-          repository: YukeonWayne/pg_pgvector_binary
-          ref: ${{ inputs.binaries_ref || 'main' }}
-          path: desktop-binaries
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Install PostgreSQL bundle
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $platform = $env:VIFORGE_POSTGRES_PLATFORM_ARCH
-          $source = "desktop-binaries/postgres/$platform"
-          $target = "apps/desktop/resources/postgres/$platform"
-
-          if (-not (Test-Path -LiteralPath $source)) {
-            throw "PostgreSQL bundle not found at $source"
-          }
-
-          Remove-Item -LiteralPath $target -Recurse -Force -ErrorAction SilentlyContinue
-          New-Item -ItemType Directory -Force -Path "apps/desktop/resources/postgres" | Out-Null
-          Copy-Item -LiteralPath $source -Destination $target -Recurse
-
-      - name: Verify PostgreSQL bundle
+      - name: Verify or download PostgreSQL bundle
         run: pnpm --filter @viforge/desktop prepare:postgres
 
       - name: Typecheck API
@@ -193,21 +172,21 @@ jobs:
 
 ## 6. 本地使用同一个二进制仓库
 
-本地 Windows 验证时也可以 clone 这个二进制仓库：
+本地 Windows 验证时也可以让 `prepare:postgres` 从 release 自动下载：
 
 ```powershell
-git clone git@github.com:YukeonWayne/pg_pgvector_binary.git D:\deps\pg_pgvector_binary
-Remove-Item -Recurse -Force apps\desktop\resources\postgres\win32-x64 -ErrorAction SilentlyContinue
-Copy-Item -Recurse D:\deps\pg_pgvector_binary\postgres\win32-x64 apps\desktop\resources\postgres\win32-x64
 $env:VIFORGE_POSTGRES_PLATFORM_ARCH="win32-x64"
 $env:VIFORGE_REQUIRE_PGVECTOR="1"
+$env:VIFORGE_POSTGRES_BUNDLE_RELEASE_REPO="YukeonWayne/pg_pgvector_binary"
+$env:VIFORGE_POSTGRES_BUNDLE_RELEASE_TAG="v18.4-pgvector0.8.3-win32-x64"
+$env:VIFORGE_POSTGRES_BUNDLE_ASSET_NAME="postgres-18.4-pgvector-0.8.3-win32-x64.zip"
 pnpm --filter @viforge/desktop prepare:postgres
 pnpm desktop:pack
 ```
 
 ## 7. 注意事项
 
-- 私有二进制仓库不要放数据库运行数据，只放 PostgreSQL 程序文件和 pgvector 扩展文件。
-- 不要把 GitHub token 写进仓库，只放到 GitHub Actions secrets。
-- 二进制仓库建议用 git tag 标记版本，例如 `postgres-16.10-pgvector-0.8.0-win32-x64`。
-- 主仓库 workflow 触发时可以把 `binaries_ref` 固定为某个 tag，避免二进制资源变化导致同一份代码构建结果不一致。
+- 二进制仓库不要放数据库运行数据，只放 PostgreSQL 程序文件和 pgvector 扩展文件。
+- public 仓库不需要 GitHub token；private 仓库才需要 token，并且只能放到 GitHub Actions secrets。
+- 二进制仓库建议用 GitHub Release tag 标记版本，例如 `v18.4-pgvector0.8.3-win32-x64`。
+- 主仓库 workflow 触发时可以把 `bundle_release_tag` 固定为某个 release tag，避免二进制资源变化导致同一份代码构建结果不一致。

From a9aded7eb8ff143a2ad44b31f80fc7dc6ce0846b Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:10:42 +0800
Subject: [PATCH 6/8] Use existing logo for desktop icons

---
 apps/desktop/scripts/prepare-icons.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/desktop/scripts/prepare-icons.mjs b/apps/desktop/scripts/prepare-icons.mjs
index efc1e71..bac338e 100644
--- a/apps/desktop/scripts/prepare-icons.mjs
+++ b/apps/desktop/scripts/prepare-icons.mjs
@@ -7,7 +7,7 @@ import sharp from 'sharp';
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const desktopRoot = path.resolve(scriptDir, '..');
 const repoRoot = path.resolve(desktopRoot, '..', '..');
-const sourceSvg = path.join(repoRoot, 'apps', 'web', 'public', 'viforge-logo.svg');
+const sourceSvg = path.join(repoRoot, 'apps', 'web', 'public', 'viforge-logo-full.svg');
 const buildRoot = path.join(desktopRoot, 'build');
 
 await mkdir(buildRoot, { recursive: true });

From 2c542573b538f8d70f8fb6e0ca36b39dc6ef506f Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 19:10:42 +0800
Subject: [PATCH 7/8] Upgrade artifact action runtime

---
 .github/workflows/desktop-windows.yml                   | 2 +-
 docs/current/20-private-binary-bundle-github-actions.md | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/desktop-windows.yml b/.github/workflows/desktop-windows.yml
index 437327a..4f85679 100644
--- a/.github/workflows/desktop-windows.yml
+++ b/.github/workflows/desktop-windows.yml
@@ -65,7 +65,7 @@ jobs:
         run: pnpm desktop:dist
 
       - name: Upload Windows artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: viforge-windows-desktop
           path: |
diff --git a/docs/current/20-private-binary-bundle-github-actions.md b/docs/current/20-private-binary-bundle-github-actions.md
index 6d0d4a6..b5bf22e 100644
--- a/docs/current/20-private-binary-bundle-github-actions.md
+++ b/docs/current/20-private-binary-bundle-github-actions.md
@@ -86,7 +86,7 @@ workflow 支持两种触发方式：`pull_request` 用于在不改默认分支
 7. 运行 `pnpm desktop:dist` 生成 Windows NSIS 安装包。
 8. 上传 `release/desktop/*.exe`、`*.blockmap` 和 `latest*.yml` 为 Actions artifact。
 
-workflow 使用 `actions/checkout@v7`、`actions/setup-node@v6` 和 `pnpm/action-setup@v6`，避免 GitHub Actions 对 Node 20 action runtime 的 deprecation warning。
+workflow 使用 `actions/checkout@v7`、`actions/setup-node@v6`、`pnpm/action-setup@v6` 和 `actions/upload-artifact@v7`，避免 GitHub Actions 对 Node 20 action runtime 的 deprecation warning。
 
 ## 5. Windows job 配置
 
@@ -160,7 +160,7 @@ jobs:
         run: pnpm desktop:dist
 
       - name: Upload Windows artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: viforge-windows-desktop
           path: |

From 43cead1f205f9758be6b0a2874c98fb8b833f4f6 Mon Sep 17 00:00:00 2001
From: XukeWei-cc <301152382+XukeWei-cc@users.noreply.github.com>
Date: Thu, 9 Jul 2026 20:22:24 +0800
Subject: [PATCH 8/8] Run desktop packaging only on main push

---
 .github/workflows/desktop-windows.yml                   | 4 +++-
 docs/current/20-private-binary-bundle-github-actions.md | 8 +++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/desktop-windows.yml b/.github/workflows/desktop-windows.yml
index 4f85679..7630a7d 100644
--- a/.github/workflows/desktop-windows.yml
+++ b/.github/workflows/desktop-windows.yml
@@ -1,7 +1,9 @@
 name: Desktop Windows
 
 on:
-  pull_request:
+  push:
+    branches:
+      - main
     paths:
       - .github/workflows/desktop-windows.yml
       - apps/api/**
diff --git a/docs/current/20-private-binary-bundle-github-actions.md b/docs/current/20-private-binary-bundle-github-actions.md
index b5bf22e..d88bd28 100644
--- a/docs/current/20-private-binary-bundle-github-actions.md
+++ b/docs/current/20-private-binary-bundle-github-actions.md
@@ -73,11 +73,11 @@ private 仓库场景还需要在 workflow 的下载逻辑里把 token 传给 `VI
 .github/workflows/desktop-windows.yml
 ```
 
-workflow 支持两种触发方式：`pull_request` 用于在不改默认分支的情况下验证配置；`workflow_dispatch` 用于合入默认分支后手动打包。手动触发时可以提供 `bundle_release_tag` 输入，默认下载 `YukeonWayne/pg_pgvector_binary` 的 `v18.4-pgvector0.8.3-win32-x64` release。
+workflow 支持两种触发方式：合入 `main` 后通过 `push` 自动打包；也可以通过 `workflow_dispatch` 手动打包。手动触发时可以提供 `bundle_release_tag` 输入，默认下载 `YukeonWayne/pg_pgvector_binary` 的 `v18.4-pgvector0.8.3-win32-x64` release。
 
 核心流程：
 
-1. PR 改动相关路径时自动验证，或合入默认分支后手动触发打包。
+1. 合入 `main` 并改动相关路径时自动打包，或手动触发打包。
 2. checkout 主仓库代码。
 3. 安装 pnpm 11.3.0 和 Node.js 22。
 4. 运行 `pnpm install --frozen-lockfile`。
@@ -96,7 +96,9 @@ workflow 使用 `actions/checkout@v7`、`actions/setup-node@v6`、`pnpm/action-s
 name: Desktop Windows
 
 on:
-  pull_request:
+  push:
+    branches:
+      - main
     paths:
       - .github/workflows/desktop-windows.yml
       - apps/api/**