feat(release): complete one-click desktop distribution

Author: Fei-Away

.github/CONTRIBUTING.en.md

@@ -50,7 +50,7 @@ For injection, CSS, launch, or restore changes, also run `macos/scripts/verify-d
 Run the Windows regression suite:
 
 ```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\windows\tests\run-tests.ps1
+powershell.exe -NoProfile -ExecutionPolicy RemoteSigned -File .\windows\tests\run-tests.ps1
 ```
 
 For install, launch, injection, or restore changes, exercise the affected scripts and `windows/scripts/verify-dream-skin.ps1`. Include the Windows version and Codex source in the pull request.

.github/CONTRIBUTING.md

@@ -50,7 +50,7 @@ macos/scripts/doctor-macos.sh
 运行 Windows 回归测试：
 
 ```powershell
-powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\windows\tests\run-tests.ps1
+powershell.exe -NoProfile -ExecutionPolicy RemoteSigned -File .\windows\tests\run-tests.ps1
 ```
 
 改动安装、启动、注入或恢复流程时，请运行对应脚本和 `windows/scripts/verify-dream-skin.ps1`，并在 PR 中注明 Windows 版本与 Codex 来源。

.github/workflows/ci.yml

@@ -18,8 +18,8 @@ jobs:
     name: Static checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
 
@@ -79,6 +79,11 @@ jobs:
             printf 'A runtime script appears to mutate app.asar.\n' >&2
             exit 1
           fi
+          if grep -R -n --include='*.ps1' --include='*.iss' \
+            -F -- '-ExecutionPolicy Bypass' windows/scripts windows/installer >/dev/null; then
+            printf 'Windows runtime or installer code bypasses the PowerShell execution policy.\n' >&2
+            exit 1
+          fi
           if grep -n -E '/usr/bin/python3|(^|[[:space:]])eval([[:space:]]|$)' \
             macos/scripts/common-macos.sh >/dev/null; then
             printf 'The macOS runtime must parse state without python3 or eval.\n' >&2
@@ -89,10 +94,14 @@ jobs:
         shell: bash
         run: |
           expected="$(tr -d '\r\n' < macos/VERSION)"
+          windows_version="$(tr -d '\r\n' < windows/VERSION)"
+          package_version="$(node -p "JSON.parse(require('fs').readFileSync('macos/package.json','utf8')).version")"
           common="$(sed -n 's/^SKIN_VERSION="\([^"]*\)"$/\1/p' macos/scripts/common-macos.sh)"
           macos_injector="$(sed -n 's/^const SKIN_VERSION = "\([^"]*\)";$/\1/p' macos/scripts/injector.mjs)"
           windows_injector="$(sed -n 's/^const SKIN_VERSION = "\([^"]*\)";$/\1/p' windows/scripts/injector.mjs)"
           test -n "$expected"
+          test "$windows_version" = "$expected"
+          test "$package_version" = "$expected"
           test "$common" = "$expected"
           test "$macos_injector" = "$expected"
           test "$windows_injector" = "$expected"
@@ -117,21 +126,56 @@ jobs:
           - name: PowerShell 7
             executable: pwsh.exe
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
 
       - name: Run Windows regression suite
         shell: cmd
-        run: ${{ matrix.executable }} -NoLogo -NoProfile -ExecutionPolicy Bypass -File .\windows\tests\run-tests.ps1
+        run: ${{ matrix.executable }} -NoLogo -NoProfile -ExecutionPolicy RemoteSigned -File .\windows\tests\run-tests.ps1
+
+      - name: Run Windows installer static checks
+        shell: cmd
+        run: ${{ matrix.executable }} -NoLogo -NoProfile -ExecutionPolicy RemoteSigned -File .\windows\tests\installer-static.tests.ps1
+
+      - name: Install pinned Inno Setup
+        if: matrix.executable == 'powershell.exe'
+        shell: pwsh
+        run: |
+          $requiredVersion = '6.7.1'
+          choco upgrade innosetup --version=$requiredVersion --allow-downgrade --no-progress --yes
+          if ($LASTEXITCODE -ne 0) { throw "Could not install Inno Setup $requiredVersion." }
+          $iscc = Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'
+          if (-not (Test-Path -LiteralPath $iscc -PathType Leaf)) { throw 'ISCC.exe is missing.' }
+          $actual = "$((Get-Item -LiteralPath $iscc).VersionInfo.ProductVersion)"
+          if (-not $actual.StartsWith($requiredVersion, [System.StringComparison]::Ordinal)) {
+            throw "Expected Inno Setup $requiredVersion, found $actual."
+          }
+          "ISCC_PATH=$iscc" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Compile Windows Setup.exe
+        if: matrix.executable == 'powershell.exe'
+        shell: pwsh
+        run: |
+          $output = Join-Path $env:RUNNER_TEMP 'codex-dream-skin-ci-installer'
+          & powershell.exe -NoLogo -NoProfile -ExecutionPolicy RemoteSigned `
+            -File .\windows\installer\build-release.ps1 `
+            -OutputDirectory $output -IsccPath $env:ISCC_PATH
+          if ($LASTEXITCODE -ne 0) { throw "Windows release builder failed with exit code $LASTEXITCODE." }
+          $version = [System.IO.File]::ReadAllText((Resolve-Path .\windows\VERSION)).Trim()
+          $artifact = Join-Path $output "CodexDreamSkin-Setup-v$version.exe"
+          if (-not (Test-Path -LiteralPath $artifact -PathType Leaf) -or
+            (Get-Item -LiteralPath $artifact).Length -le 0) {
+            throw 'Windows installer artifact is missing or empty.'
+          }
 
   macos-tests:
     name: macOS repository regressions
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
 
@@ -147,3 +191,9 @@ jobs:
           CODEX_DREAM_SKIN_SKIP_SIGNED_RUNTIME_TESTS: "1"
           CODEX_DREAM_SKIN_SKIP_DOCTOR: "1"
         run: ./macos/tests/run-tests.sh
+
+      - name: Build and test the native menu bar app
+        run: swift test --package-path macos/menubar-app
+
+      - name: Compile and verify the universal DMG
+        run: ./macos/scripts/build-dmg.sh --skip-tests

.github/workflows/release.yml

@@ -20,10 +20,12 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Node.js for manifest checks
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
 
@@ -39,6 +41,12 @@ jobs:
             echo "Release tags must look like v1.2.3: $tag" >&2
             exit 1
           fi
+          main_sha="$(git rev-parse origin/main)"
+          tag_sha="$(git rev-parse HEAD)"
+          if [[ "$tag_sha" != "$main_sha" ]]; then
+            echo "Release tag must point at the current origin/main commit: tag=$tag_sha main=$main_sha" >&2
+            exit 1
+          fi
           version="$(tr -d '[:space:]' < macos/VERSION)"
           windows_version="$(tr -d '[:space:]' < windows/VERSION)"
           package_version="$(node -p "JSON.parse(require('fs').readFileSync('macos/package.json', 'utf8')).version")"
@@ -60,7 +68,12 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Set up Node.js for macOS regressions
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
 
       - name: Build unsigned DMG
         shell: bash
@@ -82,7 +95,7 @@ jobs:
           hdiutil imageinfo "$artifact" >/dev/null
 
       - name: Upload macOS artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: release-macos
           if-no-files-found: error
@@ -95,32 +108,45 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Set up Node.js for Windows regressions
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
 
       - name: Install Inno Setup 6
         shell: pwsh
         run: |
+          $requiredVersion = '6.7.1'
           $iscc = Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'
-          if (-not (Test-Path -LiteralPath $iscc -PathType Leaf)) {
-            choco install innosetup --no-progress --yes
+          $installedVersion = if (Test-Path -LiteralPath $iscc -PathType Leaf) {
+            "$((Get-Item -LiteralPath $iscc).VersionInfo.ProductVersion)"
+          } else { '' }
+          if (-not $installedVersion.StartsWith($requiredVersion, [System.StringComparison]::Ordinal)) {
+            choco upgrade innosetup --version=$requiredVersion --allow-downgrade --no-progress --yes
+            if ($LASTEXITCODE -ne 0) { throw "Could not install Inno Setup $requiredVersion." }
           }
-          $resolved = Get-Command ISCC.exe -ErrorAction SilentlyContinue
-          if ($null -eq $resolved) {
-            $known = @(
-              (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
-              (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
-            ) | Where-Object { Test-Path -LiteralPath $_ -PathType Leaf }
-            if ($known.Count -eq 0) { throw 'Inno Setup 6 (ISCC.exe) is not available on the runner.' }
-            "ISCC_PATH=$($known[0])" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-          } else {
-            "ISCC_PATH=$($resolved.Source)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          $resolved = @(
+            (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe'),
+            (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe'),
+            (Get-Command ISCC.exe -ErrorAction SilentlyContinue).Source
+          ) | Where-Object { $_ -and (Test-Path -LiteralPath $_ -PathType Leaf) } | Select-Object -First 1
+          if (-not $resolved) { throw 'Inno Setup 6 (ISCC.exe) is not available on the runner.' }
+          $resolvedVersion = "$((Get-Item -LiteralPath $resolved).VersionInfo.ProductVersion)"
+          if (-not $resolvedVersion.StartsWith($requiredVersion, [System.StringComparison]::Ordinal)) {
+            throw "Expected Inno Setup $requiredVersion, found $resolvedVersion at $resolved."
           }
+          "ISCC_PATH=$resolved" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Build Setup.exe with pinned Node runtime
         shell: pwsh
         env:
           VERSION: ${{ needs.guard.outputs.version }}
         run: |
+          & powershell.exe -NoLogo -NoProfile -ExecutionPolicy RemoteSigned `
+            -File .\windows\tests\run-tests.ps1
+          if ($LASTEXITCODE -ne 0) { throw "Windows regressions failed with exit code $LASTEXITCODE." }
           & powershell.exe -NoLogo -NoProfile -ExecutionPolicy RemoteSigned `
             -File .\windows\tests\installer-static.tests.ps1
           if ($LASTEXITCODE -ne 0) { throw "Installer static checks failed with exit code $LASTEXITCODE." }
@@ -137,7 +163,7 @@ jobs:
           if ((Get-Item -LiteralPath $artifact).Length -le 0) { throw 'Windows artifact is empty.' }
 
       - name: Upload Windows artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: release-windows
           if-no-files-found: error
@@ -152,10 +178,10 @@ jobs:
       contents: write
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Download release artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: release-*
           path: dist
@@ -171,8 +197,8 @@ jobs:
           test -s "dist/CodexDreamSkin-Setup-v${VERSION}.exe"
           (
             cd dist
-            sha256sum "CodexDreamSkin-v${VERSION}.dmg" "CodexDreamSkin-Setup-v${VERSION}.exe" \
-              | sed 's#  #  #' > SHA256SUMS.txt
+            sha256sum "CodexDreamSkin-v${VERSION}.dmg" \
+              "CodexDreamSkin-Setup-v${VERSION}.exe" > SHA256SUMS.txt
           )
           cat > release-notes.md <<EOF
           ## Codex Dream Skin v${VERSION}
@@ -184,8 +210,8 @@ jobs:
           - [SHA256SUMS.txt](https://github.com/Fei-Away/Codex-Dream-Skin/releases/download/v${VERSION}/SHA256SUMS.txt)
 
           The packages are currently unsigned. Follow the graphical first-run steps in
-          [macOS installation](https://github.com/Fei-Away/Codex-Dream-Skin/blob/main/docs/install-macos.md)
-          or [Windows installation](https://github.com/Fei-Away/Codex-Dream-Skin/blob/main/docs/install-windows.md).
+          [macOS installation](https://github.com/Fei-Away/Codex-Dream-Skin/blob/v${VERSION}/docs/install-macos.md)
+          or [Windows installation](https://github.com/Fei-Away/Codex-Dream-Skin/blob/v${VERSION}/docs/install-windows.md).
           No terminal trust command is required for ordinary users.
 
           This release is created as a draft for a maintainer to review before publishing.
@@ -196,10 +222,25 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ needs.guard.outputs.version }}
         run: |
-          gh release create "v${VERSION}" \
-            --draft \
-            --title "Codex Dream Skin v${VERSION}" \
-            --notes-file release-notes.md \
-            dist/CodexDreamSkin-v${VERSION}.dmg \
-            dist/CodexDreamSkin-Setup-v${VERSION}.exe \
-            dist/SHA256SUMS.txt
+          if gh release view "v${VERSION}" >/dev/null 2>&1; then
+            is_draft="$(gh release view "v${VERSION}" --json isDraft --jq .isDraft)"
+            test "$is_draft" = true || {
+              echo "Refusing to replace an already published v${VERSION} release." >&2
+              exit 1
+            }
+            gh release upload "v${VERSION}" --clobber \
+              dist/CodexDreamSkin-v${VERSION}.dmg \
+              dist/CodexDreamSkin-Setup-v${VERSION}.exe \
+              dist/SHA256SUMS.txt
+            gh release edit "v${VERSION}" --draft \
+              --title "Codex Dream Skin v${VERSION}" \
+              --notes-file release-notes.md
+          else
+            gh release create "v${VERSION}" \
+              --draft \
+              --title "Codex Dream Skin v${VERSION}" \
+              --notes-file release-notes.md \
+              dist/CodexDreamSkin-v${VERSION}.dmg \
+              dist/CodexDreamSkin-Setup-v${VERSION}.exe \
+              dist/SHA256SUMS.txt
+          fi

README.en.md

@@ -17,6 +17,19 @@
   Unofficial. Does not modify <code>.app</code> / <code>app.asar</code> / WindowsApps.
 </p>
 
+## Install directly
+
+Ordinary users first install and quit the official Codex / ChatGPT app once,
+then download from [GitHub Releases](https://github.com/Fei-Away/Codex-Dream-Skin/releases):
+
+- macOS: open `CodexDreamSkin-vX.Y.Z.dmg` and drag the app to Applications.
+- Windows: run `CodexDreamSkin-Setup-vX.Y.Z.exe` and follow the wizard.
+
+No source checkout, Node.js install, `.sh`, or `.ps1` command is required. See
+the [macOS guide](./docs/install-macos.md) or
+[Windows guide](./docs/install-windows.md) for unsigned first-run approval,
+updates, and uninstall steps.
+
 ## Sponsors
 
 <p align="center">
@@ -53,12 +66,7 @@
   <sub>Real injected Codex home screen (preview only)</sub>
 </p>
 
-After installing on macOS, switch from **已保存主题** or run:
-
-```bash
-~/.codex/codex-dream-skin-studio/scripts/switch-theme-macos.sh \
-  --id preset-gothic-void-crusade
-```
+After installing on macOS, switch directly from **Saved Themes** in the menu bar.
 
 ### Arina Hashimoto / 桥本有菜
 
@@ -79,28 +87,13 @@ shown below are native Codex controls.
   <sub>Dark · real injected screenshot; unsent input hidden during capture (preview only)</sub>
 </p>
 
-Install from the repo and switch in one command on macOS:
-
-```bash
-cd macos
-./scripts/install-dream-skin-macos.sh --no-launch
-~/.codex/codex-dream-skin-studio/scripts/switch-theme-macos.sh \
-  --id preset-arina-hashimoto
-```
-
-Windows has a persistent local theme store and system-tray controls, and seeds
-the same Arina Hashimoto preset. For the first repo-based setup:
-
-```powershell
-powershell -ExecutionPolicy Bypass -File .\windows\scripts\install-dream-skin.ps1
-powershell -ExecutionPolicy Bypass -File .\windows\scripts\start-dream-skin.ps1
-```
-
-After launch, switch directly through **已保存主题 → 桥本有菜**; no cross-folder
-manual import is required. **更换背景图** still imports your own UI-free
-wallpaper, which can then be saved for one-click switching.
+This portrait material remains in the source repository for reference and
+rights review; it is excluded from public DMG and Setup.exe assets. Public
+installers seed only the redistributable Gothic Void Crusade preset. Users can
+still choose **Change Background** to import UI-free artwork they are entitled
+to use and save it for one-click switching.
 
-> The downloadable user source is [`docs/images/presets/arina-hashimoto-source.png`](./docs/images/presets/arina-hashimoto-source.png) (`1672 × 941`); the macOS one-click preset uses the normalized derived [`background.jpg`](./macos/presets/preset-arina-hashimoto/background.jpg) (`2560 × 1440`). Do not import either screenshot above: they contain real UI and are previews only. The background is a user-provided AI-generated example, not an official OpenAI/Codex visual or endorsement; confirm likeness and asset rights before redistributing it.
+> The downloadable user source is [`docs/images/presets/arina-hashimoto-source.png`](./docs/images/presets/arina-hashimoto-source.png) (`1672 × 941`); the source-only reference preset uses the normalized derived [`background.jpg`](./macos/presets/preset-arina-hashimoto/background.jpg) (`2560 × 1440`). Do not import either screenshot above: they contain real UI and are previews only. The background is a user-provided AI-generated example, not an official OpenAI/Codex visual or endorsement; do not put it in a public installer without confirmed likeness and asset rights.
 
 ## Concept gallery (not importable backgrounds)