ci: 精简 PR 检查并修复依赖审计漏洞

.github/pull_request_template.md

@@ -1,50 +1,11 @@
-## 目的 / Why
+## 改了什么，为什么 / What and why
 
-<!-- 为什么需要这项修改？它解决了什么问题或使用场景？ / Why is this change needed? -->
+<!-- 简述问题和改动；有 Issue 时附链接。 / Describe the problem and change; link an issue if applicable. -->
 
-## 关联 Issue / Related issue
+## 如何验证 / Validation
 
-<!-- 如适用，请使用 Closes #123 等格式关联 Issue。 / If applicable, link the issue with "Closes #123" or similar. -->
+<!-- 写出实际运行的测试及结果，未运行的相关检查及原因。UI 改动可附截图。无需填写无关项目。 / Tests and results, relevant checks not run and why. Screenshots help for UI changes. Omit unrelated items. -->
 
-## 改动 / Changes
+## 数据影响（如有） / Data impact (if any)
 
-<!-- 列出关键改动，保持范围明确。 / List the key changes and keep the scope focused. -->
-
-## 影响范围 / Impact
-
-<!-- 勾选所有适用项。 / Check all that apply. -->
-
-- [ ] Node.js CLI
-- [ ] Shared .NET Core
-- [ ] Windows GUI
-- [ ] macOS GUI
-- [ ] WSL / SQLite paths
-- [ ] Backup / restore
-- [ ] CI / GitHub Actions
-- [ ] Documentation
-
-### 数据写入 / Data writes
-
-<!-- 是否修改 config.toml、rollout、SQLite、备份或其它用户数据？没有则写“无”。 / Describe any writes to user data, or write "None". -->
-
-
-## 验证 / Validation
-
-### Automated
-
-<!-- 写出实际运行的命令和结果，例如 npm test: 100 passed。 / List the commands actually run and their results. -->
-
-### Manual
-
-<!-- 写出平台、操作步骤和结果；GUI 改动还请注明缩放比例并附前后截图。 / Include platform, steps, and results; for GUI changes, also include display scaling and screenshots. -->
-
-### Not run
-
-<!-- 未运行的测试、原因以及剩余风险。没有则写“无”。 / List tests not run, why, and any remaining risk; otherwise write "None". -->
-
-## 检查清单 / Checklist
-
-- [ ] PR 只包含相关修改 / This PR contains only related changes
-- [ ] 已补充相关测试，或说明不需要测试的原因 / Tests were added or the reason they are unnecessary is explained
-- [ ] 如有用户可见变化，已更新相关文档 / Relevant documentation was updated for user-facing changes
-- [ ] 未提交未脱敏的凭据、会话、SQLite、备份、日志或个人信息 / No unredacted credentials, sessions, databases, backups, logs, or personal data are included
+<!-- 涉及 config.toml、rollout、SQLite 或备份写入时，说明影响和对应验证；无影响可删除此节。请勿提交真实凭据或用户数据。 / For config, rollout, SQLite or backup writes, describe the impact and validation. Delete this section if inapplicable. Never include real credentials or user data. -->

.github/workflows/ci.yml

@@ -19,6 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       mode: ${{ steps.scope.outputs.mode }}
+      jobs: ${{ steps.scope.outputs.jobs }}
+      platforms: ${{ steps.scope.outputs.platforms }}
+      electron_platforms: ${{ steps.scope.outputs.electron_platforms }}
+      node_versions: ${{ steps.scope.outputs.node_versions }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -54,17 +58,13 @@ jobs:
 
   test:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'test')
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - windows-latest
-          - ubuntu-latest
-        node-version:
-          - "16.20.2"
-          - "24"
+        os: ${{ fromJSON(needs.change-scope.outputs.platforms) }}
+        node-version: ${{ fromJSON(needs.change-scope.outputs.node_versions) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -84,14 +84,12 @@ jobs:
 
   workspace-contract:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'workspace-contract')
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - windows-latest
-          - ubuntu-latest
+        os: ${{ fromJSON(needs.change-scope.outputs.platforms) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -104,14 +102,12 @@ jobs:
 
   root-package-compat:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'root-package-compat')
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - windows-latest
-          - ubuntu-latest
+        os: ${{ fromJSON(needs.change-scope.outputs.platforms) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -126,14 +122,12 @@ jobs:
 
   web-build:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'web-build')
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - windows-latest
-          - ubuntu-latest
+        os: ${{ fromJSON(needs.change-scope.outputs.platforms) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -145,7 +139,7 @@ jobs:
 
   web-browser:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'web-browser')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -160,15 +154,12 @@ jobs:
 
   electron-desktop:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'electron-desktop')
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - windows-latest
-          - ubuntu-latest
-          - macos-latest
+        os: ${{ fromJSON(needs.change-scope.outputs.electron_platforms) }}
     env:
       CSC_IDENTITY_AUTO_DISCOVERY: "false"
     steps:
@@ -222,7 +213,7 @@ jobs:
 
   electron-release-candidate:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: github.event_name == 'push' && needs.change-scope.outputs.mode == 'full'
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
@@ -315,7 +306,7 @@ jobs:
 
   electron-candidate-set:
     needs: [change-scope, electron-release-candidate]
-    if: needs.change-scope.outputs.mode == 'full'
+    if: github.event_name == 'push' && needs.change-scope.outputs.mode == 'full'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -342,7 +333,7 @@ jobs:
 
   dependency-audit:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'dependency-audit')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -358,7 +349,7 @@ jobs:
 
   cross-runtime-fixtures:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'cross-runtime-fixtures')
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -376,12 +367,8 @@ jobs:
       - run: dotnet build desktop/CodexProviderSync.Core.Tests/CrashHost/CodexProviderSync.CrashHost.csproj --configuration Release
       - run: npm run fixtures:cross-runtime
       - run: npm run fixtures:historical-tags
-      - name: Refuse hosted Release binary execution for an untrusted fork
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
-        shell: pwsh
-        run: throw 'Hosted historical binaries are verified only from a same-repository branch; a maintainer must run the release-evidence gate from trusted repository code.'
       - name: Verify a hosted formal Release backup with current Node Restore
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'push'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: npm run fixtures:historical-formal-release
@@ -393,7 +380,7 @@ jobs:
           if-no-files-found: error
           retention-days: 30
       - name: Upload hosted formal Release backup evidence
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name == 'push'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: historical-formal-release-backup-evidence
@@ -403,7 +390,7 @@ jobs:
 
   desktop-test:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'desktop-test')
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -423,7 +410,7 @@ jobs:
 
   desktop-macos:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'desktop-macos')
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -439,7 +426,7 @@ jobs:
 
   desktop-linux-lock:
     needs: change-scope
-    if: needs.change-scope.outputs.mode == 'full'
+    if: contains(fromJSON(needs.change-scope.outputs.jobs), 'desktop-linux-lock')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -449,7 +436,7 @@ jobs:
       - run: dotnet test desktop/CodexProviderSync.Core.Tests/CodexProviderSync.Core.Tests.csproj --filter FullyQualifiedName~LockServiceTests
 
   c10-evidence-bundle:
-    if: ${{ always() && needs.change-scope.result == 'success' && needs.change-scope.outputs.mode == 'full' }}
+    if: ${{ always() && github.event_name == 'push' && needs.change-scope.result == 'success' && needs.change-scope.outputs.mode == 'full' }}
     needs:
       - change-scope
       - test

AGENTS.md

@@ -90,19 +90,22 @@ On Windows, `\\wsl.localhost\...` and `\\wsl$\...` SQLite Homes are diagnostic-o
 - Only a verified P0 finding from a Codex PR review blocks merge or release. Fix that finding and run the checks relevant to the fix; do not trigger another full Codex review by default.
 - P1/P2/P3 findings and advisory suggestions do not block delivery or require repeated modifications. Record relevant follow-up items without expanding the approved scope.
 - This policy governs Codex review overhead. Required local checks, CI, release-container acceptance, and explicit publication authorization still apply; never weaken those gates to satisfy a review preference.
+- GitHub conversation resolution is advisory, not a required merge rule. Maintainers decide which comments require action; verified P0 findings still block delivery.
 
 ## Mandatory Provider I/O regression gate
 
 - Follow PIO-1 through PIO-6 in the current Core guide. Sync reads bounded first-line metadata, not full chat streams. No public `sync --provider`, `--fast` or `syncMode`.
 - Eligible equal-byte-length JSON Provider literals must use the existing in-place descriptor/handle path. Preserve file identity, size and body hash; character-count equality alone is insufficient. Do not fall back to whole-file replacement after an in-place failure.
 - Ineligible but valid headers use streaming tail copy and atomic replacement with byte-identical bodies. Invalid/changed/locked targets must not be forcibly rewritten.
 - Run `npm run architecture:check` and `npm test` for Core changes; platform skips and failures must be reported. The first command reuses workspace boundary checks and Provider I/O tests, not a second rule engine.
-- Behavior changes require an explicit ADR/contract/fixture update and matching user docs. Do not weaken an invariant test to bless accidental drift. README is not a substitute for the current Core guide.
+- Behavior changes require applicable contract/fixture updates and matching user docs; add or amend an ADR for architectural decisions or safety-boundary changes. Routine fixes restoring an existing contract do not require a new ADR. Maintainers may help contributors complete these updates. Do not weaken an invariant test to bless accidental drift. README is not a substitute for the current Core guide.
 
 ## Mandatory local preflight and release flow
 
 Follow this order: **local preflight passes → CI cross-platform and real installation acceptance passes → publish with explicit authorization**. See [Windows release procedure](docs/WINDOWS_ELECTRON_RELEASE_ZH.md) for commands and evidence requirements.
 
+- PR checks and release acceptance are separate: ordinary documentation checks local links (formal release notes additionally validate versions and metadata). Web, desktop renderer, shared UI, Electron runtime/packaging and Legacy .NET changes use the scopes in `scripts/ci-docs.mjs`; UI uses Linux/Node 24 workspace checks and Windows desktop smoke. Core/storage, shared contracts/dependencies, CI, unknown paths and cross-domain changes retain full code checks. Four-target candidates, hosted formal Release evidence and C10 run on main pushes only; main retains complete final-SHA acceptance before publication.
+
 - Before pushing, review all affected contracts, test expectations and build modes together, then run the relevant local tests. Do not use Actions as the first check for failures reproducible locally. Report unavailable local checks explicitly and leave them to the matching CI environment.
 - Desktop changes require relevant production-bundle checks, not just development-mode tests. Update changes must cover both portable/manual and authorized installed-updater modes; derive expectations from the intended channel/container, never from the application's returned value.
 - Reuse an existing build for repeated local checks only when its product sources, dependencies, build configuration and version are unchanged. Test-script or documentation-only edits do not require another local package build. Record the build provenance; an old local package is not release evidence for a new SHA.

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 本文件记录面向用户和集成方的重要变化。完整的发布叙事、升级说明和下载入口见对应版本的中文发布说明；实现证据和测试门禁见技术发布说明。
 
+## [Unreleased]
+
+- 更新 Electron 44.9.3、Vite、Zod、Vitest 及受影响的间接依赖，修复依赖审计发现的安全问题；桌面发布审计与清单同步记录新的 Electron 版本。
+- 按改动范围精简 PR 检查，完整候选包与 C10 发布取证保留在 main 验证；简化贡献说明和审查对话要求。
+
 ## [1.0.4] - 2026-09-28
 
 Windows x64 Electron 修复版本。发布状态和下载以 [GitHub Release](https://github.com/Dailin521/codex-provider-sync/releases/tag/v1.0.4) 为准；[升级说明](docs/release-notes/v1.0.4-zh.md)。