feat(upgrade): SHA-256校验、Intel mac 交叉编译、全平台后发布

- upgrade: 下载后校验 .sha256 摘要再安装
- workflow: ARM mac 同时产出 aarch64/x86_64 双架构，补全 Intel mac 产物
- workflow: 各平台上传主资产及 .sha256，Linux/macOS/Windows 全成功才发布 Release
- upgrade: 补充 parse_tag_version、parse_checksum_file、extract_from_targz 单元测试
- docs: README/AGENTS 同步 upgrade 与平台说明

Made-with: Cursor

.gitea/workflows/secrets.yml

@@ -204,9 +204,13 @@ jobs:
           bin="target/x86_64-unknown-linux-musl/release/${{ env.BINARY_NAME }}"
           archive="${{ env.BINARY_NAME }}-${tag}-x86_64-linux-musl.tar.gz"
           tar -czf "$archive" -C "$(dirname "$bin")" "$(basename "$bin")"
+          sha256sum "$archive" > "${archive}.sha256"
           curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
             -F "attachment=@${archive}" \
             "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
+          curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
+            -F "attachment=@${archive}.sha256" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
 
       - name: 飞书通知
         if: always()
@@ -229,7 +233,7 @@ jobs:
           curl -sS -H "Content-Type: application/json" -X POST -d "$payload" "$WEBHOOK_URL"
 
   build-macos:
-    name: Build (aarch64-apple-darwin)
+    name: Build (macOS aarch64 + x86_64)
     needs: [version, check]
     runs-on: darwin-arm64
     timeout-minutes: 15
@@ -241,6 +245,7 @@ jobs:
           fi
           source "$HOME/.cargo/env" 2>/dev/null || true
           rustup target add aarch64-apple-darwin
+          rustup target add x86_64-apple-darwin
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       - uses: actions/checkout@v4
@@ -253,12 +258,14 @@ jobs:
             ~/.cargo/registry/cache
             ~/.cargo/git/db
             target
-          key: cargo-aarch64-apple-darwin-${{ hashFiles('Cargo.lock') }}
+          key: cargo-macos-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
-            cargo-aarch64-apple-darwin-
+            cargo-macos-
 
       - run: cargo build --release --locked --target aarch64-apple-darwin
+      - run: cargo build --release --locked --target x86_64-apple-darwin
       - run: strip -x target/aarch64-apple-darwin/release/${{ env.BINARY_NAME }}
+      - run: strip -x target/x86_64-apple-darwin/release/${{ env.BINARY_NAME }}
 
       - name: 上传 Release 产物
         if: needs.version.outputs.release_id != ''
@@ -267,12 +274,29 @@ jobs:
         run: |
           [ -z "$RELEASE_TOKEN" ] && exit 0
           tag="${{ needs.version.outputs.tag }}"
-          bin="target/aarch64-apple-darwin/release/${{ env.BINARY_NAME }}"
-          archive="${{ env.BINARY_NAME }}-${tag}-aarch64-macos.tar.gz"
-          tar -czf "$archive" -C "$(dirname "$bin")" "$(basename "$bin")"
+          release_id="${{ needs.version.outputs.release_id }}"
+
+          arm_bin="target/aarch64-apple-darwin/release/${{ env.BINARY_NAME }}"
+          arm_archive="${{ env.BINARY_NAME }}-${tag}-aarch64-macos.tar.gz"
+          tar -czf "$arm_archive" -C "$(dirname "$arm_bin")" "$(basename "$arm_bin")"
+          shasum -a 256 "$arm_archive" > "${arm_archive}.sha256"
           curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
-            -F "attachment=@${archive}" \
-            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
+            -F "attachment=@${arm_archive}" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
+          curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
+            -F "attachment=@${arm_archive}.sha256" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
+
+          intel_bin="target/x86_64-apple-darwin/release/${{ env.BINARY_NAME }}"
+          intel_archive="${{ env.BINARY_NAME }}-${tag}-x86_64-macos.tar.gz"
+          tar -czf "$intel_archive" -C "$(dirname "$intel_bin")" "$(basename "$intel_bin")"
+          shasum -a 256 "$intel_archive" > "${intel_archive}.sha256"
+          curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
+            -F "attachment=@${intel_archive}" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
+          curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
+            -F "attachment=@${intel_archive}.sha256" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${release_id}/assets"
 
       - name: 飞书通知
         if: always()
@@ -285,8 +309,9 @@ jobs:
           url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
           result="${{ job.status }}"
           if [ "$result" = "success" ]; then icon="✅"; else icon="❌"; fi
-          msg="secrets macOS 构建${icon}
+          msg="secrets macOS 双架构构建${icon}
           版本：${tag}
+          目标：aarch64-apple-darwin, x86_64-apple-darwin
           提交：${commit}
           作者：${{ github.actor }}
           详情：${url}"
@@ -338,10 +363,15 @@ jobs:
           $bin = "target\x86_64-pc-windows-msvc\release\${{ env.BINARY_NAME }}.exe"
           $archive = "${{ env.BINARY_NAME }}-${tag}-x86_64-windows.zip"
           Compress-Archive -Path $bin -DestinationPath $archive -Force
+          $hash = (Get-FileHash -Algorithm SHA256 $archive).Hash.ToLower()
+          Set-Content -Path "${archive}.sha256" -Value "$hash  $archive" -NoNewline
           $url = "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
           Invoke-RestMethod -Uri $url -Method Post `
             -Headers @{ "Authorization" = "token $env:RELEASE_TOKEN" } `
             -Form @{ attachment = Get-Item $archive }
+          Invoke-RestMethod -Uri $url -Method Post `
+            -Headers @{ "Authorization" = "token $env:RELEASE_TOKEN" } `
+            -Form @{ attachment = Get-Item "${archive}.sha256" }
 
       - name: 飞书通知
         if: always()
@@ -362,7 +392,7 @@ jobs:
 
   publish-release:
     name: 发布草稿 Release
-    needs: [version, build-linux]
+    needs: [version, build-linux, build-macos, build-windows]
     if: always() && needs.version.outputs.release_id != ''
     runs-on: debian
     timeout-minutes: 5
@@ -376,8 +406,11 @@ jobs:
           [ -z "$RELEASE_TOKEN" ] && exit 0
 
           linux_r="${{ needs.build-linux.result }}"
-          if [ "$linux_r" != "success" ]; then
-            echo "Linux 构建未成功 (${linux_r})，保留草稿 Release"
+          macos_r="${{ needs.build-macos.result }}"
+          windows_r="${{ needs.build-windows.result }}"
+          if [ "$linux_r" != "success" ] || [ "$macos_r" != "success" ] || [ "$windows_r" != "success" ]; then
+            echo "存在未成功的构建任务，保留草稿 Release"
+            echo "linux=${linux_r} macos=${macos_r} windows=${windows_r}"
             exit 0
           fi
 
@@ -408,15 +441,16 @@ jobs:
           commit=$(git log -1 --pretty=format:"%s" 2>/dev/null || echo "N/A")
           url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}"
 
-          check_r="${{ needs.version.result }}"
           linux_r="${{ needs.build-linux.result }}"
+          macos_r="${{ needs.build-macos.result }}"
+          windows_r="${{ needs.build-windows.result }}"
           publish_r="${{ job.status }}"
 
           icon() { case "$1" in success) echo "✅";; skipped) echo "⏭";; *) echo "❌";; esac; }
 
-          if [ "$linux_r" = "success" ] && [ "$publish_r" = "success" ]; then
+          if [ "$linux_r" = "success" ] && [ "$macos_r" = "success" ] && [ "$windows_r" = "success" ] && [ "$publish_r" = "success" ]; then
             status="发布成功 ✅"
-          elif [ "$linux_r" != "success" ]; then
+          elif [ "$linux_r" != "success" ] || [ "$macos_r" != "success" ] || [ "$windows_r" != "success" ]; then
             status="构建失败 ❌"
           else
             status="发布失败 ❌"
@@ -430,7 +464,7 @@ jobs:
 
           msg="secrets ${status}
           ${version_line}
-          linux $(icon "$linux_r") | Release $(icon "$publish_r")
+          linux $(icon "$linux_r") | macOS $(icon "$macos_r") | windows $(icon "$windows_r") | Release $(icon "$publish_r")
           提交：${commit}
           作者：${{ github.actor }}
           详情：${url}"