Skip to content

Codex/modernize pyside6 uv #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chroming wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Codex/modernize pyside6 uv #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6a2e641
modernize project with PySide6 and uv
chroming Jul 26, 2026
dfeaf5c
test: strengthen regression and packaging coverage
chroming Jul 26, 2026
d3b93eb
fix(gui): cover PySide6 interaction contracts
chroming Jul 26, 2026
d985f8c
fix: restore PySide6 GUI and Linux release reliability
chroming Jul 26, 2026
3dcd1a3
test: add PySide6 desktop end-to-end journey
chroming Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/scripts/install-linux-qt-deps.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/usr/bin/env bash

set -euo pipefail

sudo apt-get update
sudo apt-get install --yes \
libdbus-1-3 \
libegl1 \
libgl1 \
libxkbcommon-x11-0 \
libxcb-cursor0 \
libxcb-xinerama0
67 changes: 29 additions & 38 deletions .github/workflows/linux-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,67 +1,58 @@
name: Build linux release
name: Build Linux release

on:
push:
tags:
- 'v*'
release:
types: [ published ]
- "v*"

permissions:
contents: write
Comment on lines 8 to 9

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

工作流由 tag 推送触发，但没有设置 concurrency 控制。若短时间内连续推送多个版本标签，可能产生多个并发构建运行，导致资源浪费和潜在的发布产物冲突。建议添加 concurrency: release-${{ github.ref }} 并设置 cancel-in-progress: true，确保同一 tag 只有一个构建在运行。

Suggestion:

Suggested change
permissions:
contents: write
concurrency:
group: release-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: write

Comment on lines 3 to 9

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

工作流缺少 concurrency 控制。虽然仅由 tag push 触发，但重复推送 tag 会产生并行构建。建议添加 concurrency 组以自动取消冗余运行。

Suggestion:

Suggested change
on:
push:
tags:
- 'v*'
release:
types: [ published ]
- "v*"
permissions:
contents: write
on:
push:
tags:
- "v*"
concurrency:
group: linux-release-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: write


jobs:
deploy:

runs-on: ubuntu-22.04

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

deploy 作业未设置 timeout-minutes。若构建过程出现死锁或网络问题（如 apt 安装卡住、pyinstaller 挂起），作业会持续运行直至达到 GitHub Actions 默认的 6 小时上限，浪费宝贵的 CI 分钟数。建议设置合理的超时时间，例如 timeout-minutes: 30（参考项目中 open-code-review.yml 的设置）。

Suggestion:

Suggested change
runs-on: ubuntu-22.04
runs-on: ubuntu-22.04
timeout-minutes: 30

Comment on lines 12 to 13

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

deploy 作业未设置 timeout-minutes，若构建或测试步骤卡死将无限消耗 runner 资源。建议添加 timeout-minutes: 30。

Suggestion:

Suggested change
deploy:
runs-on: ubuntu-22.04
deploy:
runs-on: ubuntu-22.04
timeout-minutes: 30


steps:
- uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v3
- uses: actions/checkout@v6

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout@v6 不存在，当前最新主版本为 v4。使用不存在的版本会导致工作流启动时直接失败，阻断整个发布流程。建议改为 actions/checkout@v4。

Suggestion:

Suggested change
- uses: actions/checkout@v6
- uses: actions/checkout@v4

with:
python-version: '3.10'
fetch-depth: 0

- name: Install dependencies
# install libxcb-xinerama0 to fix "Could not load the Qt platform plugin 'xcb'"
# https://forum.qt.io/post/610967
- name: Set up Python
uses: actions/setup-python@v6

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/setup-python@v6 不存在，当前最新主版本为 v5。使用不存在的版本会导致工作流启动时直接失败。建议改为 actions/setup-python@v5。

Suggestion:

Suggested change
uses: actions/setup-python@v6
uses: actions/setup-python@v5

with:
python-version: "3.10"
Comment on lines +20 to +23

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

未配置 uv 缓存，每次运行都会重新下载所有依赖。可在 Set up Python 步骤中添加 cache: 'pip' 或使用专用缓存步骤缓存 ~/.cache/uv，减少重复构建时间。

Suggestion:

Suggested change
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.10"
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
cache: 'pip'


- name: Install system and project dependencies
run: |
sudo apt-get install libxcb-xinerama0
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_build_addon.txt
bash .github/scripts/install-linux-qt-deps.sh
python -m pip install uv
uv sync --locked --group build

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uv sync --locked 要求 uv.lock 文件存在且与 pyproject.toml 同步。如果 lockfile 未被提交到仓库（本次变更中未出现 uv.lock），此步骤将失败。请确认 uv.lock 已加入版本控制，或考虑在不需要严格复现时移除 --locked 标志。

Suggestion:

Suggested change
uv sync --locked --group build
uv sync --frozen --group build

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uv sync --locked 要求 uv.lock 文件存在且与 pyproject.toml 同步。本次变更中未包含 uv.lock 文件，此步骤将失败。建议：要么将 uv.lock 提交到仓库，要么在 CI 中移除 --locked 标志（改为 uv sync --group build），让 uv 自动解析依赖。

Suggestion:

Suggested change
uv sync --locked --group build
uv sync --group build


- name: Determine Version
id: get_version
- name: Test
env:
QT_QPA_PLATFORM: offscreen
run: uv run pytest -q

- name: Determine version
shell: bash
run: |
VERSION=$(git describe --tags --always --dirty)
echo "VERSION=${VERSION}" >> $GITHUB_ENV
echo "Version determined: $VERSION"
echo "__version__ = '${{ env.VERSION }}'" > src/version.py
cat src/version.py


- name: Build package
run: pyinstaller -F run_gui.py -i "pdf.ico" --exclude config.ini --distpath . -n "pdfdir" --noconsole

- name: Build debug package
run: pyinstaller -F run_gui.py -i "pdf.ico" --exclude config.ini --distpath . -n "pdfdir_debug"
echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
echo "__version__ = '${VERSION}'" > src/version.py

- name: Prepare file
- name: Build packages
run: |
chmod +x pdfdir
zip -r pdfdir_ubuntu.zip pdfdir
uv run pyinstaller -F run_gui.py -i pdf.ico --add-data "pdf.ico:src" --add-data "src/language:src/language" --distpath . -n pdfdir --noconfirm --clean --noconsole
uv run pyinstaller -F run_gui.py -i pdf.ico --add-data "pdf.ico:src" --add-data "src/language:src/language" --distpath . -n pdfdir_debug --noconfirm --clean

- name: Prepare debug file
- name: Prepare archives
run: |
chmod +x pdfdir_debug
zip -r pdfdir_debug_ubuntu.zip pdfdir_debug
chmod +x pdfdir pdfdir_debug
zip pdfdir_ubuntu.zip pdfdir
zip pdfdir_debug_ubuntu.zip pdfdir_debug

- name: Upload package
uses: softprops/action-gh-release@v1
if: startsWith(github.ref, 'refs/tags/')
- name: Upload packages
uses: softprops/action-gh-release@v3

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

softprops/action-gh-release@v3 不存在，当前最新主版本为 v2（v1 已弃用）。使用不存在的版本会导致上传发布产物步骤失败，构建好的包无法发布。建议改为 softprops/action-gh-release@v2。

Suggestion:

Suggested change
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@v2

with:
files: |
pdfdir_ubuntu.zip
Expand Down
60 changes: 0 additions & 60 deletions .github/workflows/mac-py310-release.yml
View file
Open in desktop

This file was deleted.

68 changes: 29 additions & 39 deletions .github/workflows/mac-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,66 +1,56 @@
name: Build mac release
name: Build macOS Intel release

on:
push:
tags:
- 'v*'
release:
types: [ published ]
- "v*"
Comment on lines 3 to +6

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

工作流缺少 concurrency 控制。虽然该工作流由标签推送触发，并发风险较低，但若运维过程中快速连续推送相同标签（如 force push），仍可能产生冗余运行。建议添加 concurrency 组以取消进行中的旧运行。

Suggestion:

Suggested change
on:
push:
tags:
- 'v*'
release:
types: [ published ]
- "v*"
on:
push:
tags:
- "v*"
concurrency:
group: mac-release-${{ github.ref }}
cancel-in-progress: true


permissions:
contents: write

jobs:
deploy:

runs-on: macos-13
runs-on: macos-15-intel
Comment on lines 12 to +13

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

deploy 作业缺少 timeout-minutes 设置。若构建或归档步骤卡住，作业将无限运行（默认 6 小时），浪费 runner 资源并阻塞其他作业。建议添加 timeout-minutes: 30。

Suggestion:

Suggested change
deploy:
runs-on: macos-13
runs-on: macos-15-intel
deploy:
runs-on: macos-15-intel
timeout-minutes: 30

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

macos-15-intel 运行器标签不存在。GitHub 的 macOS 15 运行器均为 Apple Silicon (arm64)，没有 Intel 版本。鉴于该工作流专门用于 Intel 构建（项目另有 mac-silicon-release.yml 处理 Apple Silicon），应使用最后一个支持 Intel 的 macOS 运行器：macos-13。使用不存在的标签将导致作业永远无法启动。

Suggestion:

Suggested change
runs-on: macos-15-intel
runs-on: macos-13

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

作业缺少 timeout-minutes 设置。若构建过程因意外原因挂起（如 PyInstaller 打包卡死、网络请求阻塞），将耗尽运行器资源长达 6 小时（GitHub 默认上限）。建议根据构建经验设置合理的超时时间（如 30 分钟）。

Suggestion:

Suggested change
runs-on: macos-15-intel
deploy:
timeout-minutes: 30
runs-on: macos-13


steps:
- uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v3
- uses: actions/checkout@v6

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout 最新版本为 v4，v6 不存在。工作流将在运行第一步时立即失败，导致所有 macOS Intel 发布构建被阻塞。请改为 actions/checkout@v4。

Suggestion:

Suggested change
- uses: actions/checkout@v6
- uses: actions/checkout@v4

with:
python-version: '3.7'
fetch-depth: 0

- name: Set up Python
uses: actions/setup-python@v6

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/setup-python 最新版本为 v5，v6 不存在。工作流将在此步骤失败。请改为 actions/setup-python@v5。

Suggestion:

Suggested change
uses: actions/setup-python@v6
uses: actions/setup-python@v5

with:
python-version: "3.10"
Comment on lines +20 to +23

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

依赖安装步骤未利用缓存（如 actions/cache 或 actions/setup-python 内置的 cache: uv）。每次运行都会重新解析和下载所有依赖包，延长构建时间并增加网络失败风险。建议启用 setup-python 的内置 uv 缓存。

Suggestion:

Suggested change
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: "3.10"
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
cache: pip


- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_build_addon.txt
pip install Pillow
python -m pip install uv
uv sync --locked --group build
Comment on lines 25 to +28

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uv 依赖安装未配置缓存，每次运行都会重新下载所有 Python 包，增加构建时间和网络故障风险。建议在 setup-python 步骤中添加 cache: 'pip'，或使用 actions/cache 缓存 ~/.cache/uv 目录。

Suggestion:

Suggested change
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_build_addon.txt
pip install Pillow
python -m pip install uv
uv sync --locked --group build
- name: Install dependencies
run: |
python -m pip install uv
uv sync --locked --group build
env:
UV_CACHE_DIR: /tmp/.uv-cache
- name: Cache uv dependencies
uses: actions/cache@v4
with:
path: /tmp/.uv-cache
key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
restore-keys: |
${{ runner.os }}-uv-

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uv sync --locked 要求仓库中存在 uv.lock 锁文件，但当前项目根目录下不存在该文件。这会导致依赖安装步骤直接失败。建议：要么将 uv.lock 纳入版本控制（推荐），要么移除 --locked 参数以允许自动解析依赖。

Suggestion:

Suggested change
uv sync --locked --group build
uv sync --group build


- name: Determine Version
id: get_version
shell: bash
- name: Test
env:
QT_QPA_PLATFORM: offscreen
run: uv run pytest -q

- name: Determine version
run: |
VERSION=$(git describe --tags --always --dirty)
echo "VERSION=${VERSION}" >> $GITHUB_ENV
echo "Version determined: $VERSION"
echo "__version__ = '${{ env.VERSION }}'" > src/version.py
cat src/version.py

- name: Build package
run: pyinstaller -D run_gui.py -i "pdf.ico" --exclude config.ini --distpath . -n "pdfdir" --noconsole
echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
echo "__version__ = '${VERSION}'" > src/version.py

- name: Build debug package
run: pyinstaller -D run_gui.py -i "pdf.ico" --exclude config.ini --distpath . -n "pdfdir_debug"

- name: Prepare file
- name: Build packages
run: |
chmod +x pdfdir.app
zip -r pdfdir_mac.zip pdfdir.app
uv run pyinstaller -D run_gui.py -i pdf.ico --add-data "pdf.ico:src" --add-data "src/language:src/language" --distpath . -n pdfdir --noconfirm --clean --noconsole
uv run pyinstaller -D run_gui.py -i pdf.ico --add-data "pdf.ico:src" --add-data "src/language:src/language" --distpath . -n pdfdir_debug --noconfirm --clean

- name: Prepare debug file
- name: Prepare archives
run: |
chmod +x pdfdir_debug
zip -r pdfdir_debug_mac.zip pdfdir_debug

ditto -c -k --sequesterRsrc --keepParent pdfdir.app pdfdir_mac_intel.zip
ditto -c -k --sequesterRsrc --keepParent pdfdir_debug pdfdir_debug_mac_intel.zip

- name: Upload package
uses: softprops/action-gh-release@v1
if: startsWith(github.ref, 'refs/tags/')
- name: Upload packages
uses: softprops/action-gh-release@v3

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

softprops/action-gh-release 是第三方 action，仅使用标签 @V3 而非完整 commit SHA。标签可被覆盖，存在供应链安全风险。建议锁定到具体 commit SHA，如 @c95fe14。

Suggestion:

Suggested change
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v3

with:
files: |
pdfdir_mac.zip
pdfdir_debug_mac.zip
pdfdir_mac_intel.zip
pdfdir_debug_mac_intel.zip
58 changes: 26 additions & 32 deletions .github/workflows/mac-silicon-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,57 +1,51 @@
name: Build macos-14 release
name: Build macOS Apple Silicon release

on:
push:
tags:
- 'v*'
release:
types: [ published ]
- "v*"

permissions:
contents: write
Comment on lines 8 to 9

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

工作流缺少 concurrency 控制。当快速连续推送多个标签时，会触发多个并行构建，不仅浪费资源，还可能导致版本号竞争或上传冲突。建议添加并发组，参考项目中 open-code-review.yml 的做法，使用 cancel-in-progress: true 自动取消冗余运行。

Suggestion:

Suggested change
permissions:
contents: write
permissions:
contents: write
concurrency:
group: mac-silicon-release-${{ github.ref }}
cancel-in-progress: true


jobs:
deploy:
Comment on lines 11 to 12

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

缺少并发控制 (concurrency)。连续推送多个标签时可能产生并行运行，导致版本号冲突或重复上传。建议添加基于 github.ref 的并发组并启用 cancel-in-progress: true。

Suggestion:

Suggested change
jobs:
deploy:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
deploy:


runs-on: macos-14
runs-on: macos-15
Comment on lines 12 to +13

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

deploy job 未设置 timeout-minutes。若构建或测试步骤因网络问题、依赖解析失败等原因卡死，将无限占用 macos-15 运行器资源，可能导致高额费用。建议参考 open-code-review.yml 设置合理的超时时间（如 30 分钟）。

Suggestion:

Suggested change
deploy:
runs-on: macos-14
runs-on: macos-15
deploy:
runs-on: macos-15
timeout-minutes: 30


steps:
- uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v3
- uses: actions/checkout@v6

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout@v6 版本不存在。actions/checkout 当前最新主版本为 v4（如 v4.2.2），使用 v6 将导致工作流因找不到该版本而直接报错失败。建议改为 actions/checkout@v4。

此问题同时存在于 linux-release.yml、mac-release.yml、windows-release.yml 中。

Suggestion:

Suggested change
- uses: actions/checkout@v6
- uses: actions/checkout@v4

with:
python-version: '3.10'
fetch-depth: 0

- name: Determine Version
id: get_version
shell: bash
run: |
VERSION=$(git describe --tags --always --dirty)
echo "VERSION=${VERSION}" >> $GITHUB_ENV
echo "Version determined: $VERSION"
echo "__version__ = '${{ env.VERSION }}'" > src/version.py
cat src/version.py
- name: Set up Python
uses: actions/setup-python@v6

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/setup-python@v6 版本不存在。actions/setup-python 当前最新主版本为 v5（如 v5.5.0），使用 v6 将导致工作流因找不到该版本而直接报错失败。建议改为 actions/setup-python@v5。

此问题同时存在于 linux-release.yml、mac-release.yml、windows-release.yml 中。

Suggestion:

Suggested change
uses: actions/setup-python@v6
uses: actions/setup-python@v5

with:
python-version: "3.10"

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_build_addon.txt
pip install Pillow
python -m pip install uv
uv sync --locked --group build
Comment on lines 25 to +28

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

未对 uv 依赖进行缓存优化。每次运行都会重新解析和下载所有依赖，可能因网络波动导致构建不稳定。建议利用 uv 的内置缓存机制，在 Install dependencies 步骤前添加缓存步骤，例如设置 UV_CACHE_DIR 环境变量并通过 actions/cache 持久化。

Suggestion:

Suggested change
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements_build_addon.txt
pip install Pillow
python -m pip install uv
uv sync --locked --group build
- name: Cache uv dependencies
uses: actions/cache@v4
with:
path: ~/.cache/uv
key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
restore-keys: uv-${{ runner.os }}-
- name: Install dependencies
run: |
python -m pip install uv
uv sync --locked --group build


- name: Build package
run: pyinstaller -D run_gui.py -i "pdf.ico" --exclude config.ini --distpath . -n "pdfdir" --noconsole
- name: Test
env:
QT_QPA_PLATFORM: offscreen
run: uv run pytest -q

- name: Prepare file
- name: Determine version
run: |
VERSION=$(git describe --tags --always --dirty)
echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
echo "__version__ = '${VERSION}'" > src/version.py

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

echo "__version__ = '${VERSION}'" > src/version.py 使用单引号包裹变量值。如果 git 标签名包含单引号（虽然罕见但并非不可能），将导致生成的 Python 文件出现语法错误。建议改用双引号包裹，与 src/version.py 现有格式 __version__ = "v0.3.0-beta40" 保持一致。

Suggestion:

Suggested change
echo "__version__ = '${VERSION}'" > src/version.py
echo "__version__ = \"${VERSION}\"" > src/version.py


- name: Build package
run: |
chmod +x pdfdir.app
zip -r pdfdir_mac_silicon.zip pdfdir.app
uv run pyinstaller -D run_gui.py -i pdf.ico --add-data "pdf.ico:src" --add-data "src/language:src/language" --distpath . -n pdfdir --noconfirm --clean --noconsole

- name: Prepare archive
run: ditto -c -k --sequesterRsrc --keepParent pdfdir.app pdfdir_mac_silicon.zip

- name: Upload package
uses: softprops/action-gh-release@v1
if: startsWith(github.ref, 'refs/tags/')
uses: softprops/action-gh-release@v3

@github-actions github-actions Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

第三方 action softprops/action-gh-release@v3 使用可变的版本标签而非固定提交 SHA。标签可被篡改，攻击者若控制了该仓库的 v3 标签，就能在发布流程中以 write 权限执行任意代码。建议固定到具体 commit SHA，参考项目中 open-code-review.yml 的做法。

Suggestion:

Suggested change
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@<commit-sha> # v3

with:
files: |
pdfdir_mac_silicon.zip
files: pdfdir_mac_silicon.zip
Loading
Loading