源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

.github/workflows/expedited-release-audit.yml

@@ -0,0 +1,96 @@
+name: Expedited Release Audit
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to audit
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+
+    steps:
+      - name: Checkout
+        # Pinned to an immutable commit: this job holds an issues-write token.
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+
+      - name: Fetch dev
+        run: git fetch origin dev
+
+      - name: Audit release path
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+          TRIGGER_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+
+          # Release App triggers on v*, but only semver tags are releases.
+          # Stray tags (e.g. vffe6fee-dev) must not open audit issues.
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "$TAG is not a semver release tag; skipping" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          if git merge-base --is-ancestor "$(git rev-list -n1 "$TAG")" origin/dev; then
+            echo "PR-first release; tag commit is on dev; no action" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          existing_issue="$(gh issue list \
+            --repo "$GITHUB_REPOSITORY" \
+            --label emergency-change \
+            --state all \
+            --search "in:title \"Post-hoc review: $TAG\"" \
+            --limit 1 \
+            --json url \
+            --jq '.[0].url // ""')"
+          if [[ -n "$existing_issue" ]]; then
+            echo "Post-hoc review issue already exists: $existing_issue" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          gh label create emergency-change \
+            --repo "$GITHUB_REPOSITORY" \
+            --color D93F0B \
+            --description "Expedited change requiring post-hoc review (SOC 2 evidence)" || true
+
+          release_runs_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/workflows/release-macos-aarch64.yml?query=branch%3A$TAG"
+          tag_commit="$(git rev-list -n1 "$TAG")"
+
+          body_file="$RUNNER_TEMP/post-hoc-review.md"
+          cat > "$body_file" <<EOF
+          This tag points at a commit that was not on \`dev\` when it was released
+          (tag-first expedited path — versions live in tags, so no bump commit exists).
+
+          - [ ] Reason / incident link:
+          - [ ] Release App run: $release_runs_url
+          - [ ] Triggering audit run: $TRIGGER_RUN_URL
+          - [ ] Tagged commit ($tag_commit) landed on \`dev\` through a reviewed PR
+          - [ ] Reviewed by someone other than the release actor
+
+          Release actor: @$ACTOR
+
+          Only the reviewer closes this issue, per [the emergency-change policy]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/blob/dev/docs/EMERGENCY-CHANGES.md).
+          EOF
+
+          issue_url="$(gh issue create \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "Post-hoc review: $TAG (tag-first release)" \
+            --label emergency-change \
+            --body-file "$body_file")"
+          gh issue edit "$issue_url" --add-assignee "$ACTOR" || true
+          echo "Post-hoc review issue: $issue_url" >> "$GITHUB_STEP_SUMMARY"