完善egui相关内容

.github/actions/cache-npm/action.yml

@@ -0,0 +1,25 @@
+name: Cache npm from beta
+description: Reuse the baseline npm download cache without creating per-PR copies.
+runs:
+  using: composite
+  steps:
+    - name: Resolve npm cache identity
+      id: npm
+      shell: bash
+      run: |
+        echo "path=$(npm config get cache)" >> "$GITHUB_OUTPUT"
+        echo "arch=$(node -p process.arch)" >> "$GITHUB_OUTPUT"
+    # Keep setup-node's existing key and path so the current beta cache remains
+    # reusable. Cache lookup falls back to the PR base/default branch on a miss.
+    - name: Restore npm outside beta builds
+      if: github.ref != 'refs/heads/beta' || (github.event_name != 'push' && github.event_name != 'workflow_dispatch')
+      uses: actions/cache/restore@v4
+      with:
+        path: ${{ steps.npm.outputs.path }}
+        key: node-cache-${{ runner.os }}-${{ steps.npm.outputs.arch }}-npm-${{ hashFiles('openless-all/app/package-lock.json') }}
+    - name: Maintain npm cache on beta builds
+      if: github.ref == 'refs/heads/beta' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+      uses: actions/cache@v4
+      with:
+        path: ${{ steps.npm.outputs.path }}
+        key: node-cache-${{ runner.os }}-${{ steps.npm.outputs.arch }}-npm-${{ hashFiles('openless-all/app/package-lock.json') }}

.github/workflows/android-apk.yml

@@ -16,10 +16,14 @@ name: Android APK (debug)
 
 on:
   push:
-    branches:
-      - '**'
+    # Same reasoning as release-tauri: an APK per branch push cost 13-18 minutes
+    # and duplicated the Gradle + Rust trees that `android-check` already keeps
+    # warm. Tags, a weekly smoke build and explicit dispatch cover it.
     tags:
       - 'v*-tauri'
+  schedule:
+    # Monday 05:23 UTC: weekly APK smoke build (debug-grade, not published).
+    - cron: '23 5 * * 1'
   workflow_dispatch:
     inputs:
       abis:

.github/workflows/cache-maintenance.yml

@@ -38,4 +38,9 @@ jobs:
           REPO: ${{ github.repository }}
           LIMIT_GB: '8'
         working-directory: openless-all/app
-        run: bash scripts/ci-cache-usage.sh --prune --repo "$REPO" --limit-gb "$LIMIT_GB"
+        # `--keep-family 2` also drops superseded generations inside the branch
+        # scope: only the two newest keys of one (branch, key family) pair stay,
+        # because `restore-keys` never needs more than the previous generation.
+        run: >-
+          bash scripts/ci-cache-usage.sh
+          --prune --keep-family 2 --repo "$REPO" --limit-gb "$LIMIT_GB"

.github/workflows/check-linux-egui.yml

@@ -1,4 +1,4 @@
-name: Linux egui build and backend checks
+name: Linux Core, egui and deb/rpm checks
 
 # CI and independent manual Linux builds share this deb/rpm verification path.
 # No standalone push trigger: a Linux PR must show one combined Linux check.
@@ -12,9 +12,30 @@ on:
         required: false
         type: string
         default: full
+      # The tag whose commit is being packaged. Set by the release entry point so
+      # the version assertion and the GitHub Release linkage cannot be skipped by
+      # dispatching the workflow on a branch instead.
+      release_tag:
+        required: false
+        type: string
+        default: ''
+      # Attach the verified packages to that Release. Linux used to be
+      # administrator-attached only; the packages now ship in the same Release as
+      # the desktop and Android assets.
+      publish:
+        required: false
+        type: boolean
+        default: false
+      checkout_ref:
+        required: false
+        type: string
+        default: ''
 
-permissions:
-  contents: read
+# No `permissions:` here on purpose: a reusable workflow inherits its caller's
+# grant, and the release caller needs `contents: write` for `gh release upload`
+# while CI keeps `contents: read`. Asking for more than the caller grants is
+# rejected before the run starts (`startup_failure`, zero jobs); asking for less
+# silently breaks the upload.
 
 concurrency:
   group: linux-egui-build-${{ github.workflow }}-${{ github.ref }}
@@ -27,16 +48,20 @@ jobs:
     # A cold dependency tree costs ~18 minutes; anything past this is a hang.
     timeout-minutes: 90
     env:
-      RELEASE_TAG: ${{ github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') && endsWith(github.ref, '-tauri') && github.ref_name || '' }}
+      RELEASE_TAG: ${{ inputs.release_tag || (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') && endsWith(github.ref, '-tauri') && github.ref_name || '') }}
       # Debug info dominates both compile time and cache size for this host, and
       # the gate below never reads it. The Linux job keeps its own cache so a
       # red run still starts warm.
       CARGO_PROFILE_DEV_DEBUG: 0
       CARGO_PROFILE_TEST_DEBUG: 0
+      # The standalone TLS contract otherwise recompiles common dependencies in
+      # src-tauri/backend-tests/target, outside the host's restored cache.
+      CARGO_TARGET_DIR: ${{ github.workspace }}/openless-all/app/target
     steps:
       - uses: actions/checkout@v6
         with:
           submodules: false
+          ref: ${{ inputs.checkout_ref || github.ref }}
 
       - name: Install native build and packaging dependencies
         if: inputs.scope != 'none'
@@ -85,14 +110,17 @@ jobs:
       - uses: swatinem/rust-cache@v2
         if: inputs.scope != 'none'
         with:
-          workspaces: 'openless-all/app -> target'
-          # Saving after a failed test step keeps the next push incremental
-          # instead of repeating a cold build of the whole dependency tree.
+          workspaces: |
+            openless-all/app -> target
+            openless-all/app/src-tauri/backend-tests -> ../../target
+          # Failed beta checks can still warm the shared tree. PRs never write
+          # their own copy, even when tests fail or dependencies change.
           cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/beta' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
 
       - name: Build and test fcitx5 plugin
         if: inputs.scope != 'none'
-        working-directory: openless-all/scripts/linux-fcitx5-plugin
+        working-directory: openless-all/app/scripts/linux-fcitx5-plugin
         run: |
           cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr
           cmake --build build --parallel
@@ -109,10 +137,12 @@ jobs:
           cargo clippy --locked -p openless-core --all-targets -- -D warnings
           cargo test --locked -p openless-linux-egui --all-targets
           cargo clippy --locked -p openless-linux-egui --all-targets -- -D warnings
-          cargo check --locked -p openless-linux-egui --all-targets
           node scripts/linux-egui-tauri-free-contract.test.mjs
           node scripts/linux-egui-release-contract.test.mjs
           node scripts/ci-changed-areas.test.mjs
+          node scripts/ci-cache-usage.test.mjs
+          node scripts/ci-cache-sharing.test.mjs
+          node scripts/harmony-release-contract.test.mjs
           node scripts/tauri-linux-free-contract.test.mjs
           pwsh -NoProfile -File ./scripts/check-core-deps.ps1
           pwsh -NoProfile -File ./scripts/check-core-deps.ps1 openless-linux-egui
@@ -156,6 +186,9 @@ jobs:
           set -euo pipefail
           OUTPUT=target/linux-egui-packages
           ( cd "$OUTPUT" && sha256sum ./*.deb ./*.rpm > SHA256SUMS )
+          # Release attachment name: the desktop and Android assets carry their own
+          # SHA256SUMS, so the Linux one is published under a distinct name.
+          cp "$OUTPUT/SHA256SUMS" "$OUTPUT/SHA256SUMS-linux"
           bash scripts/verify-linux-egui-packages.sh
 
       - name: Stage direct download aliases
@@ -184,6 +217,39 @@ jobs:
           path: openless-all/app/target/linux-egui-packages/*
           if-no-files-found: error
 
+      - name: Attach Linux packages to the GitHub Release
+        # Runs only for the release entry point, which pins the tag; PR and push
+        # builds never publish.
+        if: inputs.scope != 'none' && inputs.publish && inputs.release_tag != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        working-directory: openless-all/app
+        run: |
+          set -euo pipefail
+          # The desktop workflow creates the Release for this tag; wait for it
+          # instead of racing it, and fail loudly if it never appears.
+          for attempt in $(seq 1 40); do
+            if gh release view "$RELEASE_TAG" --json isDraft > /dev/null 2>&1; then
+              break
+            fi
+            if [ "$attempt" = 40 ]; then
+              echo "::error::release $RELEASE_TAG was not created by the desktop workflow"
+              exit 1
+            fi
+            sleep 15
+          done
+          output=target/linux-egui-packages
+          alias_dir="$RUNNER_TEMP/openless-linux-egui-direct-download"
+          gh release upload "$RELEASE_TAG" \
+            "$output"/OpenLess-Linux-egui-*.deb \
+            "$output"/OpenLess-Linux-egui-*.rpm \
+            "$output"/SHA256SUMS-linux \
+            "$alias_dir"/OpenLess_linux_x86_64.deb \
+            "$alias_dir"/OpenLess_linux_x86_64.rpm \
+            --clobber
+          echo "attached Linux assets to $RELEASE_TAG"
+
       - name: Upload direct download aliases
         if: inputs.scope != 'none' && (github.event_name != 'push' || env.RELEASE_TAG != '')
         uses: actions/upload-artifact@v7