chore: add attested release workflow

2026-07-22 06:56:38 +00:00 · 2026-05-13 07:39:40 +08:00 · 2026-05-13 07:39:40 +08:00 · 868bb31b41
commit 868bb31b41
parent 7abc5a761c
3 changed files with 183 additions and 58 deletions
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -0,0 +1,95 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    name: Build and publish Obsidian assets
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build
+
+      - name: Validate release asset set
+        run: |
+          test -f main.js
+          test -f manifest.json
+          test -f styles.css
+
+      - name: Attest release assets
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
+      - name: Resolve release metadata
+        id: release_meta
+        shell: bash
+        run: |
+          VERSION="$(node -p "require('./manifest.json').version")"
+          TAG="${GITHUB_REF_NAME}"
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            TAG="v${VERSION}"
+          fi
+          if [[ "${TAG}" != "v${VERSION}" ]]; then
+            echo "Tag ${TAG} does not match manifest version v${VERSION}" >&2
+            exit 1
+          fi
+          {
+            echo "version=${VERSION}"
+            echo "tag=${TAG}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create release if needed
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.release_meta.outputs.tag }}
+          VERSION: ${{ steps.release_meta.outputs.version }}
+        run: |
+          gh release view "$TAG" >/dev/null 2>&1 || \
+            gh release create "$TAG" \
+              --title "AI Model Workbench ${VERSION}" \
+              --notes "Release assets are built from source by GitHub Actions and include only the Obsidian-supported files: main.js, manifest.json, and styles.css."
+
+      - name: Remove unsupported release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.release_meta.outputs.tag }}
+        run: |
+          for asset_id in $(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" --jq '.assets[] | select((.name == "main.js" or .name == "manifest.json" or .name == "styles.css") | not) | .id'); do
+            gh api --method DELETE "repos/${GITHUB_REPOSITORY}/releases/assets/${asset_id}"
+          done
+
+      - name: Upload supported release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.release_meta.outputs.tag }}
+        run: |
+          gh release upload "$TAG" main.js manifest.json styles.css --clobber
--- a/README.md
+++ b/README.md
@ -15,12 +15,13 @@
 - [Quick Start](#quick-start)
 - [Installation](#installation)
 - [Format Support](#format-support)
- [Usage](#usage)
- [Settings](#settings)
- [External Dependencies](#external-dependencies)
- [Technical Details](#technical-details)
- [Known Limitations](#known-limitations)
- [Deployment](#deployment)
+- [Usage](#usage)
+- [Settings](#settings)
+- [External Dependencies](#external-dependencies)
+- [Security & Privacy](#security--privacy)
+- [Technical Details](#technical-details)
+- [Known Limitations](#known-limitations)
+- [Deployment](#deployment)
 - [License](#license)

 ---
@ -163,16 +164,26 @@ ln -s /path/to/ai-model-workbench \
 1. Put a supported model file into the same vault, for example `model.glb`.
 2. In any note inside that vault, embed it like this:

-```markdown
-![[model.glb]]
-![[model.glb|400x300]]
-```
-
---
-
-## Format Support
-
-### Direct Rendering (No External Tools)
+```markdown
+![[model.glb]]
+![[model.glb|400x300]]
+```
+
+---
+
+## Security & Privacy
+
+AI Model Workbench does not collect telemetry, phone home, or run background network sync. Model previews are loaded from files already present in the Obsidian vault, and OBJ material/texture references are resolved from the vault instead of being fetched from the network.
+
+The bundled Babylon.js runtime contains generic loader utilities that are capable of loading URLs for web applications. This plugin passes vault file bytes to Babylon as data URLs and overrides OBJ MTL loading to avoid remote fetches. Optional converter diagnostics and conversions run only after a user action and execute local tools on desktop platforms.
+
+Release assets are limited to the three files Obsidian downloads: `main.js`, `manifest.json`, and `styles.css`. GitHub Actions builds these files from source and publishes artifact attestations for provenance verification.
+
+---
+
+## Format Support
+
+### Direct Rendering (No External Tools)

 | Format | Extension | Features |
 |--------|-----------|----------|
@ -566,19 +577,23 @@ npm run build         # Production build
 npm run typecheck     # TypeScript type check
 ```

-### Build Output
-
-```
-ai-model-workbench/
-├── main.js           # 1.7 MB (minified, Babylon.js core)
-├── manifest.json     # Plugin manifest
-├── styles.css        # Plugin styles
-└── src/              # Source code
-```
-
-### Platform Support
-
-| Platform | Status |
+### Build Output
+
+```
+ai-model-workbench/
+├── main.js           # 1.7 MB (minified, Babylon.js core)
+├── manifest.json     # Plugin manifest
+├── styles.css        # Plugin styles
+└── src/              # Source code
+```
+
+### Release Publishing
+
+Releases are published by the GitHub Actions `Release` workflow. Push a tag that matches `manifest.json`, for example `v0.1.7`, or run the workflow manually. The workflow uploads only `main.js`, `manifest.json`, and `styles.css`, removes unsupported release assets, and generates GitHub artifact attestations for the published files.
+
+### Platform Support
+
+| Platform | Status |
 |----------|--------|
 | Windows | Full support |
 | macOS | Full support |
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@ -15,12 +15,13 @@
 - [快速入门](#快速入门)
 - [安装](#安装)
 - [格式支持](#格式支持)
- [使用方法](#使用方法)
- [设置选项](#设置选项)
- [外部依赖](#外部依赖)
- [技术细节](#技术细节)
- [已知限制](#已知限制)
- [部署指南](#部署指南)
+- [使用方法](#使用方法)
+- [设置选项](#设置选项)
+- [外部依赖](#外部依赖)
+- [安全与隐私](#安全与隐私)
+- [技术细节](#技术细节)
+- [已知限制](#已知限制)
+- [部署指南](#部署指南)
 - [许可证](#许可证)

 ---
@ -163,16 +164,26 @@ ln -s /path/to/ai-model-workbench \
 1. 先把一个受支持的模型文件放进同一个 vault，例如 `model.glb`。
 2. 然后在该 vault 的任意笔记中这样嵌入：

-```markdown
-![[model.glb]]
-![[model.glb|400x300]]
-```
-
---
-
-## 格式支持
-
-### 直接渲染（无需外部工具）
+```markdown
+![[model.glb]]
+![[model.glb|400x300]]
+```
+
+---
+
+## 安全与隐私
+
+AI Model Workbench 不收集遥测数据，不会主动回传，也不会运行后台网络同步。模型预览读取的是已经存在于 Obsidian vault 中的本地文件；OBJ 的 MTL 材质和纹理引用会从 vault 内解析，而不是从网络下载。
+
+打包后的 Babylon.js 运行时包含面向 Web 应用的通用 URL 加载工具。该插件会把 vault 文件字节以 data URL 传给 Babylon，并覆盖 OBJ MTL 加载逻辑以避免远程请求。可选的转换器诊断和格式转换只会在用户主动操作后运行，并且只在桌面端调用本地工具。
+
+发布资产仅限 Obsidian 会下载的三个文件：`main.js`、`manifest.json` 和 `styles.css`。GitHub Actions 会从源码构建这些文件，并为它们发布 artifact attestation，便于验证来源。
+
+---
+
+## 格式支持
+
+### 直接渲染（无需外部工具）

 | 格式 | 扩展名 | 特性 |
 |------|--------|------|
@ -564,19 +575,23 @@ npm run build         # 生产构建
 npm run typecheck     # TypeScript 类型检查
 ```

-### 构建输出
-
-```
-ai-model-workbench/
-├── main.js           # 1.7 MB（压缩后，Babylon.js 核心）
-├── manifest.json     # 插件清单
-├── styles.css        # 插件样式
-└── src/              # 源代码
-```
-
-### 平台支持
-
-| 平台 | 状态 |
+### 构建输出
+
+```
+ai-model-workbench/
+├── main.js           # 1.7 MB（压缩后，Babylon.js 核心）
+├── manifest.json     # 插件清单
+├── styles.css        # 插件样式
+└── src/              # 源代码
+```
+
+### 发布流程
+
+发布由 GitHub Actions 的 `Release` workflow 完成。推送一个与 `manifest.json` 版本匹配的 tag，例如 `v0.1.7`，或手动运行该 workflow。它只上传 `main.js`、`manifest.json` 和 `styles.css`，会删除不受支持的 release asset，并为发布文件生成 GitHub artifact attestation。
+
+### 平台支持
+
+| 平台 | 状态 |
 |------|------|
 | Windows | 完全支持 |
 | macOS | 完全支持 |