feat: import Chinese-localized Buzz source snapshot

Signed-off-by: cls_宁波本机 <908705107@qq.com>
2026-08-13 18:34:25 +08:00
parent 61c3fa1df9
commit 9dfa06ffee
3785 changed files with 1085458 additions and 2 deletions
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+workflow="$repo_root/.github/workflows/signed-macos-canary.yml"
+
+grep -Fq 'workflow_dispatch:' "$workflow"
+# The literal GitHub expression is the contract we are checking.
+# shellcheck disable=SC2016
+grep -Fq 'SOURCE_REF: ${{ github.ref }}' "$workflow"
+grep -Fq '"refs/heads/main"' "$workflow"
+grep -Fq 'contents: read' "$workflow"
+grep -Fq 'id-token: write' "$workflow"
+grep -Fq 'block/apple-codesign-action@' "$workflow"
+grep -Fq 'actions/upload-artifact@' "$workflow"
+grep -Fq 'retention-days: 7' "$workflow"
+grep -Fq '"createUpdaterArtifacts": false' "$workflow"
+
+if grep -Eq 'contents: write|gh release|buzz-desktop-latest|latest\.json|TAURI_SIGNING_PRIVATE_KEY|verify-release-ref\.sh|refs/tags/' "$workflow"; then
+  echo "signed canary workflow gained a release or publishing capability" >&2
+  exit 1
+fi
+
+on_block=$(
+  awk '
+    /^on:$/ { in_on = 1; next }
+    in_on && /^[^[:space:]#]/ { exit }
+    in_on && NF && $0 !~ /^[[:space:]]*#/ {
+      gsub(/[[:space:]]/, "")
+      print
+    }
+  ' "$workflow"
+)
+if [[ "$on_block" != "workflow_dispatch:" ]]; then
+  echo "signed canary workflow must have workflow_dispatch as its only trigger" >&2
+  printf 'found on block:\n%s\n' "$on_block" >&2
+  exit 1
+fi
+
+echo "signed canary contract passed"