Build the production Release 0.5.0 pipeline

.gitattributes

@@ -0,0 +1,43 @@
+* text=auto
+
+*.bat text eol=crlf
+*.cmd text eol=crlf
+
+*.css text eol=lf
+*.html text eol=lf
+*.js text eol=lf
+*.json text eol=lf
+*.json5 text eol=lf
+*.jsx text eol=lf
+*.kt text eol=lf
+*.kts text eol=lf
+*.md text eol=lf
+*.mjs text eol=lf
+*.properties text eol=lf
+*.ps1 text eol=lf
+*.py text eol=lf
+*.rs text eol=lf
+*.sh text eol=lf
+*.svg text eol=lf
+*.toml text eol=lf
+*.ts text eol=lf
+*.tsx text eol=lf
+*.txt text eol=lf
+*.xml text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+
+.python-version text eol=lf
+.gitattributes text eol=lf
+.gitignore text eol=lf
+*.gitkeep text eol=lf
+VERSION text eol=lf
+uv.lock text eol=lf
+web/package-lock.json text eol=lf
+web/src-tauri/Cargo.lock text eol=lf
+packaging/third-party-licenses/uv-LICENSE-MIT.txt text eol=lf
+
+*.exe binary
+*.ico binary
+*.jar binary
+*.png binary

.github/workflows/ci.yml

@@ -0,0 +1,299 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  UV_NO_PROGRESS: "1"
+
+jobs:
+  version-and-dependency-check:
+    name: Version and dependency gates
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          python-version: "3.11"
+          version: "0.9.21"
+
+      - name: Validate version identity
+        run: uv run --frozen --extra dev python scripts/check-version.py
+
+      - name: Validate locked release dependencies
+        run: |
+          uv lock --check
+          git ls-files --error-unmatch uv.lock
+          uv run --frozen --extra dev python scripts/check-release-dependencies.py
+          uv run --frozen --extra dev python -c "from PIL import Image, ImageOps; print(Image.__version__); print(ImageOps.__name__)"
+
+      - name: Validate runtime profile catalog
+        run: uv run --frozen --extra dev python scripts/check-runtime-profiles.py
+
+  secret-scan:
+    name: Secret scan
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Scan commits for secrets
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: "false"
+
+  release-profile-check:
+    name: Release profiles (${{ matrix.os }}, Python ${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-24.04
+          - windows-2025
+        python-version:
+          - "3.11"
+          - "3.12"
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+          version: "0.9.21"
+
+      - name: Validate every locked optional profile for this platform
+        shell: pwsh
+        run: |
+          $profiles = @(
+            "dev",
+            "asr-api-vad",
+            "uvr",
+            "local-asr",
+            "local-llm",
+            "hf-local-inference",
+            "local-models"
+          )
+          foreach ($profile in $profiles) {
+            Write-Host "Validating release profile: $profile"
+            uv sync --frozen --dry-run --extra $profile
+            if ($LASTEXITCODE -ne 0) {
+              exit $LASTEXITCODE
+            }
+          }
+
+  backend-test:
+    name: Backend tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - "3.11"
+          - "3.12"
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+          version: "0.9.21"
+
+      - name: Synchronize frozen environment
+        run: uv sync --frozen --extra dev
+
+      - name: Run backend tests
+        run: uv run --frozen pytest
+
+      - name: Compile Python sources
+        run: |
+          uv run --frozen python -m compileall -q backend tests
+          uv run --frozen python -m py_compile scripts/check-desktop-runtime.py scripts/check-release-dependencies.py scripts/check-runtime-profiles.py scripts/check-version.py scripts/set-version.py scripts/smoke-installed-runtime.py
+
+      - name: Run Ruff
+        run: uv run --frozen ruff check backend tests scripts/check-desktop-runtime.py scripts/check-release-dependencies.py scripts/check-runtime-profiles.py scripts/check-version.py scripts/set-version.py scripts/smoke-installed-runtime.py
+
+  web-test:
+    name: Web tests and production build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install web dependencies
+        run: npm ci
+
+      - name: Run ESLint
+        run: npm run lint
+
+      - name: Run Vitest
+        run: npm test
+
+      - name: Build production web assets
+        run: npm run build
+
+  android-test:
+    name: Android tests, lint, and debug APK
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: android
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Java
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Configure Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          cache-provider: basic
+
+      - name: Run Android verification
+        run: bash ./gradlew --no-daemon testDebugUnitTest lintDebug assembleDebug
+
+  tauri-check:
+    name: Desktop runtime and Tauri Rust checks
+    runs-on: windows-2025
+    timeout-minutes: 45
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          python-version: "3.11"
+          version: "0.9.21"
+
+      - name: Install Web dependencies
+        run: npm --prefix web ci
+
+      - name: Build and stage pinned desktop runtime
+        shell: pwsh
+        run: |
+          $env:MPP_BUNDLED_UV = (Get-Command uv -ErrorAction Stop).Source
+          npm --prefix web run prepare:desktop-runtime
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Verify desktop runtime manifest
+        shell: pwsh
+        run: |
+          $python = (& uv python find 3.11).Trim()
+          if ($LASTEXITCODE -ne 0 -or -not $python) {
+            throw "Python 3.11 could not be resolved through uv"
+          }
+          & $python scripts/check-desktop-runtime.py web/src-tauri/resources/runtime `
+            --verify-tools `
+            --expected-source-commit $env:GITHUB_SHA
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Synchronize isolated smoke environment
+        env:
+          UV_PROJECT_ENVIRONMENT: ${{ runner.temp }}\mpp-desktop-runtime-venv
+        run: uv sync --frozen --extra dev
+
+      - name: Run installed runtime smoke with bundled uv
+        shell: pwsh
+        env:
+          UV_PROJECT_ENVIRONMENT: ${{ runner.temp }}\mpp-desktop-runtime-venv
+        run: |
+          $runtimeRoot = (Resolve-Path web/src-tauri/resources/runtime).Path
+          $bundledUv = Join-Path $runtimeRoot "bin\uv.exe"
+          & $bundledUv run --frozen --no-sync --project $runtimeRoot python `
+            scripts/smoke-installed-runtime.py `
+            --runtime-root $runtimeRoot `
+            --timeout 90
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: "1.91.1"
+          components: rustfmt
+
+      - name: Check Rust formatting
+        run: cargo fmt --manifest-path web/src-tauri/Cargo.toml -- --check
+
+      - name: Prepare formal desktop release dependencies
+        shell: pwsh
+        run: |
+          & scripts/build-desktop.ps1 -Phase Prepare -NoBundle -Ci
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Run formal offline release no-bundle gate
+        shell: pwsh
+        run: |
+          # B5 TODO: extend this formal entry with signed MSI/NSIS bundle and install tests.
+          & scripts/build-desktop.ps1 -Phase Build -NoBundle -Ci
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Check Tauri compilation
+        run: cargo check --locked --manifest-path web/src-tauri/Cargo.toml
+
+      - name: Run Rust tests
+        run: cargo test --locked --manifest-path web/src-tauri/Cargo.toml

.gitignore

@@ -40,10 +40,10 @@ htmlcov/
 .ruff_cache/
 
 # uv
-uv.lock
+# Track uv.lock for reproducible application, server, and release builds.
 
 # Data directories (processing files, media, outputs)
-data/
+/data/
 *.wav
 *.mp3
 *.mp4
@@ -65,6 +65,7 @@ nul
 # doc/
 
 .claude/
+.codex/
 
 # Experiment outputs (frames, crops, results)
 experiment/*/out/
@@ -84,6 +85,20 @@ tmp-electron-run/
 # Electron build outputs
 release/
 MPP.exe
+MPP.exe.attestation.json
+/MPP.exe.next
+/MPP.exe.previous
+/runtime/
+/runtime.next/
+/runtime.previous/
+
+# Generated desktop runtime staging (assembled from a strict release whitelist)
+/web/src-tauri/resources/runtime/*
+!/web/src-tauri/resources/runtime/.gitkeep
+/web/src-tauri/resources/.runtime-stage.lock
+/web/src-tauri/resources/.release-build.lock
+/web/src-tauri/resources/.runtime-stage-*/
+/web/src-tauri/resources/.runtime-previous-*/
 
 # Local browser automation and extraction artifacts
 .playwright-cli/

README.md

@@ -116,7 +116,8 @@ cd web && npm install && npm run dev
 cd web && npm run tauri:build
 ```
 
-构建成功后会将最新桌面程序复制到项目根目录的 `MPP.exe`，后续构建直接替换该文件。
+构建成功后会将同一次构建产生的 `MPP.exe` 与 `runtime/` 复制到项目根目录。
+两者共同组成便携版桌面程序；使用 `start-tauri.bat` 启动时会先检查运行时清单。
 
 **方式 2: 后端 + 浏览器**
 

VERSION

@@ -0,0 +1 @@
+0.4.1