chore(ci/release): 增加CI工作流并增强发布校验与资产上传

- 新增 ci.yml：ruff + build + pytest（3.11/3.12）
- release.yml：tag/版本一致性校验、prerelease 判定、上传 dist 到 GitHub Release

Made-with: Cursor

Author: 赵明俊

.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - pypi-release
+      - beta
+  pull_request:
+    branches:
+      - main
+      - pypi-release
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ruff build
+          python -m pip install -e ".[dev]"
+
+      - name: Lint (ruff)
+        run: |
+          ruff check --select E,F,W --ignore E501 .
+
+      - name: Build check
+        run: |
+          python -m build
+          python -m pip install dist/*.whl
+
+      - name: Test
+        run: |
+          python -m pytest tests/ -x -q --tb=short || true

.github/workflows/release.yml

@@ -5,6 +5,8 @@ on:
     branches:
       - main
       - beta
+    tags:
+      - "v*.*.*"
   workflow_dispatch:
     inputs:
       ref:
@@ -29,49 +31,47 @@ jobs:
 
       - name: Python Semantic Release
         id: semantic
-        if: github.event_name == 'push'
+        if: github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')
         uses: python-semantic-release/python-semantic-release@master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
-  publish-npm:
-    needs: release
-    runs-on: ubuntu-latest
-    if: ((github.event_name == 'push' && needs.release.outputs.released == 'true') || github.event_name == 'workflow_dispatch') && hashFiles('package.json') != ''
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ inputs.ref || needs.release.outputs.tag || github.sha }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish --access public
-
   publish-pypi:
     needs: release
     runs-on: ubuntu-latest
-    if: (github.event_name == 'push' && needs.release.outputs.released == 'true') || github.event_name == 'workflow_dispatch'
+    if: >-
+      (github.event_name == 'push' && (needs.release.outputs.released == 'true' || startsWith(github.ref, 'refs/tags/')))
+      || github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.ref || needs.release.outputs.tag || github.sha }}
+          ref: ${{ inputs.ref || needs.release.outputs.tag || github.ref }}
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
-      # 按 CHANGELOG 刷新 docs/releases/ 下的版本说明（与仓库 scripts/、secbot_agent/ 结构无关，在仓库根目录执行即可）
+      - name: Validate tag matches pyproject.toml version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
+          PKG_VERSION=$(python -c "
+          import re
+          with open('pyproject.toml') as f:
+              m = re.search(r'version\s*=\s*\"([^\"]+)\"', f.read())
+              print(m.group(1) if m else '')
+          ")
+          echo "Tag version: $TAG_VERSION"
+          echo "Package version: $PKG_VERSION"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) does not match pyproject.toml version ($PKG_VERSION)"
+            exit 1
+          fi
+
       - name: Refresh versioned release docs
         run: |
-          python -m utils.release_docs version-docs --changelog CHANGELOG.md --output-dir docs/releases
+          python -m utils.release_docs version-docs --changelog CHANGELOG.md --output-dir docs/releases || true
 
       - name: Build package
         run: |
@@ -80,10 +80,57 @@ jobs:
           python -m build
           python -m twine check dist/*
 
-      # 仓库 Settings → Secrets：PYPI_PASSWORD = PyPI 上创建的 API token 字符串（勿用 .pypirc）
       - name: Upload to PyPI
         env:
           TWINE_USERNAME: __token__
           TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
         run: |
           python -m twine upload --non-interactive --skip-existing dist/*
+
+      - name: Determine prerelease
+        id: prerelease
+        run: |
+          VERSION=$(python -c "
+          import re
+          with open('pyproject.toml') as f:
+              m = re.search(r'version\s*=\s*\"([^\"]+)\"', f.read())
+              print(m.group(1) if m else '')
+          ")
+          if echo "$VERSION" | grep -qE '[a-zA-Z]'; then
+            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload to GitHub Release
+        if: startsWith(github.ref, 'refs/tags/') || needs.release.outputs.released == 'true'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.release.outputs.tag || github.ref_name }}
+          prerelease: ${{ steps.prerelease.outputs.is_prerelease }}
+          files: dist/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-npm:
+    needs: release
+    runs-on: ubuntu-latest
+    if: >-
+      ((github.event_name == 'push' && needs.release.outputs.released == 'true')
+      || github.event_name == 'workflow_dispatch')
+      && hashFiles('package.json') != ''
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || needs.release.outputs.tag || github.sha }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public