Codex/hardened build 20260828

.github/workflows/build.yml

@@ -1,133 +1,63 @@
-name: Build and Release
+name: Hardened build verification
 
 on:
-  push:
-    tags:
-      - 'v*'
   workflow_dispatch:
+  pull_request:
 
 permissions:
-  contents: write
-  packages: write
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
-
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Set up Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: '1.21'
-
-    - name: Get version from tag
-      id: version
-      run: |
-        if [[ "${{ github.ref }}" == refs/tags/* ]]; then
-          VERSION=${GITHUB_REF#refs/tags/}
-        else
-          VERSION="dev-$(date +%Y%m%d-%H%M%S)"
-        fi
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-        echo "Building version: $VERSION"
-
-    - name: Get build time
-      id: build_time
-      run: |
-        BUILD_TIME=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
-        echo "time=$BUILD_TIME" >> $GITHUB_OUTPUT
-
-    - name: Build for multiple platforms
-      run: |
-        # 创建输出目录
-        mkdir -p dist
-
-        # 设置版本信息
-        VERSION="${{ steps.version.outputs.version }}"
-        COMMIT=$(git rev-parse --short HEAD)
-        BUILD_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-
-        # 构建标志 - 添加静态编译选项解决GLIBC兼容性问题
-        LDFLAGS="-X RealityChecker/internal/version.Version=$VERSION -X RealityChecker/internal/version.Commit=$COMMIT -X RealityChecker/internal/version.BuildTime=$BUILD_TIME -s -w"
-
-        # Linux AMD64 - 静态编译
-        CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "$LDFLAGS" -tags netgo -installsuffix netgo -o reality-checker .
-        chmod +x reality-checker
-        zip -j dist/reality-checker-linux-amd64.zip reality-checker
-        rm reality-checker
-
-        # Linux ARM64 - 静态编译
-        CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "$LDFLAGS" -tags netgo -installsuffix netgo -o reality-checker .
-        chmod +x reality-checker
-        zip -j dist/reality-checker-linux-arm64.zip reality-checker
-        rm reality-checker
-
-        # 显示构建结果
-        ls -la dist/
-
-    - name: Create Release
-      if: startsWith(github.ref, 'refs/tags/')
-      uses: softprops/action-gh-release@v1
-      with:
-        files: |
-          dist/*
-        body: |
-          ## Reality协议目标网站检测工具 ${{ steps.version.outputs.version }}
-
-          ### 使用方法
-
-          详细使用方法请参考 [README.md](https://github.com/V2RaySSR/RealityChecker/blob/main/README.md)
-
-          **下载说明：**
-          - `reality-checker-linux-amd64.zip` - Linux x86_64
-          - `reality-checker-linux-arm64.zip` - Linux ARM64
-
-          **基本命令：**
-          ```bash
-          # 单域名检测
-          ./reality-checker check example.com
-
-          # 批量检测
-          ./reality-checker batch domain1 domain2 domain3
-
-          # CSV文件检测
-          ./reality-checker csv domains.csv
-          ```
-
-          **推荐工作流程：**
-          1. 使用 [RealiTLScanner](https://github.com/XTLS/RealiTLScanner) 扫描VPS IP：
-             ```bash
-             ./RealiTLScanner -addr <VPS IP> -port 443 -thread 100 -timeout 5 -out file.csv
-             ```
-          2. 使用本工具检测生成的CSV文件：
-             ```bash
-             ./reality-checker csv file.csv
-             ```
-
-          **重要提示：**
-          - RealiTLScanner 尽量在本地运行，不要在远端
-          - 多次运行RealiTLScanner时，请更改输出文件名，如：`file1.csv`、`file2.csv`、`file3.csv` 等
-          - 如果使用相同的文件名，可能会导致文件导出失败或覆盖之前的扫描结果
-
-          ### 版本信息
-          - **版本**: ${{ steps.version.outputs.version }}
-          - **提交**: ${{ github.sha }}
-          - **构建时间**: ${{ steps.build_time.outputs.time }}
-
-          ---
-
-          **注意**: 本工具仅用于技术研究和学习目的，请遵守当地法律法规。
-        draft: false
-        prerelease: false
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Upload artifacts (for non-tag builds)
-      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-      uses: actions/upload-artifact@v4
-      with:
-        name: reality-checker-builds
-        path: dist/
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.27.0"
+          check-latest: false
+
+      - name: Test
+        run: go test ./...
+
+      - name: Vulnerability scan
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
+          govulncheck ./...
+
+      - name: Build packages
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="hardened-${GITHUB_SHA::12}"
+          commit="${GITHUB_SHA}+hardened"
+          build_time="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          ldflags="-s -w -buildid= -X RealityChecker/internal/version.Version=${version} -X RealityChecker/internal/version.Commit=${commit} -X RealityChecker/internal/version.BuildTime=${build_time}"
+
+          mkdir -p dist staging
+          build_package() {
+            local goos="$1"
+            local goarch="$2"
+            local suffix="$3"
+            local dir="staging/${goos}-${goarch}"
+            mkdir -p "${dir}/data"
+            cp data/cdn_keywords.txt data/Country.mmdb data/gfwlist.conf data/hot_websites.txt "${dir}/data/"
+            cp SECURITY-HARDENING.md "${dir}/"
+            CGO_ENABLED=0 GOOS="${goos}" GOARCH="${goarch}" \
+              go build -trimpath -buildvcs=false -tags netgo -ldflags "${ldflags}" -o "${dir}/reality-checker${suffix}" .
+            (cd "${dir}" && zip -qr "../../dist/RealityChecker-hardened-${goos}-${goarch}.zip" .)
+          }
+
+          build_package windows amd64 .exe
+          build_package linux amd64 ""
+          build_package linux arm64 ""
+          (cd dist && sha256sum *.zip > SHA256SUMS.txt)
+
+      - name: Upload verification artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: RealityChecker-hardened
+          path: dist/*