clash-verge-rev/.github/workflows/release.yml

name: Release Build

on:
  pull_request:
    types: [edited]
    branches: [main]
  push:
    # -rc tag 时预览发布, 跳过 telegram 通知、跳过 winget 提交、跳过 latest.json 文件更新
    tags:
      - 'v*.*.*'
permissions: write-all
env:
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: short
  HUSKY: 0
concurrency:
  group: release-publication
  cancel-in-progress: false

jobs:
  prepare_release:
    name: Approve Snapshot and Prepare Draft Release
    if: >-
      ${{ github.event_name == 'push' ||
          (github.event.changes.body &&
           github.event.pull_request.head.repo.full_name == github.repository &&
           github.event.pull_request.user.login == 'github-actions[bot]' &&
           startsWith(github.event.pull_request.head.ref, 'publish/v') &&
           contains(github.event.pull_request.body, '[x] Publish this approved release')) }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    outputs:
      release_tag: ${{ steps.source.outputs.release_tag }}
      source_sha: ${{ steps.source.outputs.source_sha }}
      channel: ${{ steps.source.outputs.channel }}
      release_id: ${{ steps.draft.outputs.id }}
    steps:
      - name: Checkout trusted release tooling
        uses: actions/checkout@v7
        with:
          ref: refs/heads/dev
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'
      - name: Validate source and publish the approved snapshot
        id: source
        env:
          RELEASE_COMMAND: ${{ github.event_name == 'push' && 'validate-tag' || 'publish' }}
        run: node scripts-workflow/release.mjs "$RELEASE_COMMAND"

      - name: Create or reuse draft release
        id: draft
        env:
          RELEASE_TAG: ${{ steps.source.outputs.release_tag }}
          SOURCE_SHA: ${{ steps.source.outputs.source_sha }}
        run: node scripts-workflow/release.mjs prepare-draft

  update_tag:
    name: Publish Completed Release
    env:
      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
    outputs:
      source_sha: ${{ needs.prepare_release.outputs.source_sha }}
      channel: ${{ needs.prepare_release.outputs.channel }}
    runs-on: ubuntu-latest
    needs:
      [
        prepare_release,
        release,
        release-for-linux-arm,
        release-for-fixed-webview2,
      ]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Group changelog platforms
        run: bash ./scripts-workflow/group_platforms.sh

      - name: Fetch UPDATE logs
        id: fetch_update_logs
        run: bash ./scripts/extract_update_logs.sh
        shell: bash

      - name: Set Env
        run: |
          echo "BUILDTIME=$(TZ=Asia/Shanghai date)" >> $GITHUB_ENV
          TAG_REF="$RELEASE_TAG"
          echo "TAG_NAME=$TAG_REF" >> $GITHUB_ENV
          VERSION=$(echo "$TAG_REF" | sed 's/^v//')
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "DOWNLOAD_URL=https://github.com/clash-verge-rev/clash-verge-rev/releases/download/$TAG_REF" >> $GITHUB_ENV
        shell: bash

      - run: |
          if [ -z "$UPDATE_LOGS" ]; then
            echo "No update logs found, using default message"
            UPDATE_LOGS="More new features are now supported. Check for detailed changelog soon."
          else
            echo "Using found update logs"
          fi

          cat > release.txt << EOF
          $UPDATE_LOGS

          ## 下载地址

          ### Windows (不再支持Win7)
          #### 正常版本(推荐)
          - [64位(常用)](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_x64-setup.exe) | [ARM64(不常用)](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_arm64-setup.exe)

          #### 内置Webview2版(体积较大，仅在企业版系统或无法安装webview2时使用)
          - [64位](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_x64_fixed_webview2-setup.exe) | [ARM64](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_arm64_fixed_webview2-setup.exe)

          ### macOS
          - [Apple M芯片](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_aarch64.dmg) | [Intel芯片](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_x64.dmg)

          ### Linux
          #### DEB包(Debian系) 使用 apt ./路径 安装
          - [64位](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_amd64.deb) | [ARM64](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_arm64.deb) | [ARMv7](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_armhf.deb)

          #### RPM包(Redhat系) 使用 dnf ./路径 安装
          - [64位](${{ env.DOWNLOAD_URL }}/Clash.Verge-${{ env.VERSION }}-1.x86_64.rpm) | [ARM64](${{ env.DOWNLOAD_URL }}/Clash.Verge-${{ env.VERSION }}-1.aarch64.rpm) | [ARMv7](${{ env.DOWNLOAD_URL }}/Clash.Verge-${{ env.VERSION }}-1.armhfp.rpm)

          ### FAQ
          - [常见问题](https://clash-verge-rev.github.io/faq/windows.html)

          ### 稳定机场VPN推荐
          - [狗狗加速](https://cvr.dginv.click/#/register?code=oaxsAGo6)

          Created at ${{ env.BUILDTIME }}.
          EOF

      - name: Verify release tag still points to the approved source
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SOURCE_SHA: ${{ needs.prepare_release.outputs.source_sha }}
        run: node scripts-workflow/release.mjs verify-target

      - name: Publish Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PRERELEASE: ${{ contains(env.RELEASE_TAG, '-rc') }}
        run: |
          release_id="${{ needs.prepare_release.outputs.release_id }}"

          if [ -z "$release_id" ]; then
            echo "::error::No prepared release ID found for $TAG_NAME."
            exit 1
          fi

          release_info=$(gh api repos/{owner}/{repo}/releases/"$release_id" --jq '[.tag_name, .draft, (.assets | length), .html_url] | @tsv')
          IFS=$'\t' read -r release_tag _ asset_count release_url <<< "$release_info"

          if [ "$release_tag" != "$TAG_NAME" ]; then
            echo "::error::Prepared release $release_id belongs to $release_tag, expected $TAG_NAME."
            exit 1
          fi

          echo "Publishing release $release_id ($release_url) with $asset_count assets."

          gh api --method PATCH repos/{owner}/{repo}/releases/"$release_id" \
            -f name="Clash Verge Rev $TAG_NAME" \
            -F body=@release.txt \
            -F draft=false \
            -F prerelease="$PRERELEASE" \
            --silent

  release:
    name: Release Build
    needs: [prepare_release]
    env:
      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
          - os: windows-latest
            target: aarch64-pc-windows-msvc
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu

    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Install Rust Stable
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: '1.99.1'
          targets: ${{ matrix.target }}

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          save-if: ${{ github.ref == 'refs/heads/dev' }}
          prefix-key: 'v1-rust'
          key: 'rust-shared-stable-${{ matrix.os }}-${{ matrix.target }}'
          workspaces: |
            . -> target
          cache-all-crates: true
          cache-workspace-crates: true

      - name: Install dependencies (ubuntu only)
        if: matrix.os == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libxslt1.1 libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf

      - name: Install Node
        uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false

      - name: Pnpm install and check
        run: |
          pnpm i
          pnpm run prebuild ${{ matrix.target }}

      - name: Add Rust Target
        run: |
          rustup target add ${{ matrix.target }} --toolchain 1.99.1 || rustup target add ${{ matrix.target }}
          rustup target list --installed
          echo "Rust target ${{ matrix.target }} installed."

      - name: Tauri build
        uses: tauri-apps/tauri-action@v1.0.0
        env:
          NODE_OPTIONS: '--max_old_space_size=4096'
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        with:
          releaseId: ${{ needs.prepare_release.outputs.release_id }}
          tagName: ${{ env.RELEASE_TAG }}
          releaseBody: 'Draft release, will be updated later.'
          releaseDraft: true
          prerelease: ${{ needs.prepare_release.outputs.channel == 'rc' }}
          releaseCommitish: ${{ needs.prepare_release.outputs.source_sha }}
          tauriScript: pnpm
          args: --target ${{ matrix.target }}
          uploadUpdaterJson: ${{ needs.prepare_release.outputs.channel == 'stable' }}

      - name: Attest Windows bundles
        if: matrix.os == 'windows-latest'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: target/${{ matrix.target }}/release/bundle/nsis/*setup*

      - name: Attest macOS bundles
        if: matrix.os == 'macos-latest'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: target/${{ matrix.target }}/release/bundle/dmg/*.dmg

      - name: Attest Linux bundles
        if: matrix.os == 'ubuntu-22.04'
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            target/${{ matrix.target }}/release/bundle/deb/*.deb
            target/${{ matrix.target }}/release/bundle/rpm/*.rpm

  release-for-linux-arm:
    name: Release Build for Linux ARM
    needs: [prepare_release]
    env:
      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            target: aarch64-unknown-linux-gnu
            arch: arm64
          - os: ubuntu-22.04
            target: armv7-unknown-linux-gnueabihf
            arch: armhf
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Install Rust Stable
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: '1.99.1'
          targets: ${{ matrix.target }}

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          save-if: ${{ github.ref == 'refs/heads/dev' }}
          prefix-key: 'v1-rust'
          key: 'rust-shared-stable-${{ matrix.os }}-${{ matrix.target }}'
          workspaces: |
            . -> target
          cache-all-crates: true
          cache-workspace-crates: true

      - name: Install Node
        uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'

      - name: Install pnpm
        uses: pnpm/action-setup@v6
        with:
          run_install: false

      - name: Pnpm install and check
        run: |
          pnpm i
          pnpm run prebuild ${{ matrix.target }}

      - name: 'Setup for linux'
        run: |-
          sudo ls -lR /etc/apt/

          cat > /tmp/sources.list << EOF
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy main multiverse universe restricted
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy-security main multiverse universe restricted
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy-updates main multiverse universe restricted
          deb [arch=amd64,i386] http://archive.ubuntu.com/ubuntu jammy-backports main multiverse universe restricted

          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy main multiverse universe restricted
          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main multiverse universe restricted
          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main multiverse universe restricted
          deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-backports main multiverse universe restricted
          EOF

          sudo mv /etc/apt/sources.list /etc/apt/sources.list.default
          sudo mv /tmp/sources.list /etc/apt/sources.list

          sudo dpkg --add-architecture ${{ matrix.arch }}
          sudo apt update

          sudo apt install -y \
            libxslt1.1:${{ matrix.arch }} \
            libwebkit2gtk-4.1-dev:${{ matrix.arch }} \
            libayatana-appindicator3-dev:${{ matrix.arch }} \
            libssl-dev:${{ matrix.arch }} \
            patchelf:${{ matrix.arch }} \
            librsvg2-dev:${{ matrix.arch }}

      - name: 'Install aarch64 tools'
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt install -y \
            gcc-aarch64-linux-gnu \
            g++-aarch64-linux-gnu

      - name: 'Install armv7 tools'
        if: matrix.target == 'armv7-unknown-linux-gnueabihf'
        run: |
          sudo apt install -y \
            gcc-arm-linux-gnueabihf \
            g++-arm-linux-gnueabihf

      - name: Add Rust Target
        run: |
          rustup target add ${{ matrix.target }} --toolchain 1.99.1 || rustup target add ${{ matrix.target }}
          rustup target list --installed
          echo "Rust target ${{ matrix.target }} installed."

      - name: Build for Linux
        run: |
          export PKG_CONFIG_ALLOW_CROSS=1
          if [ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]; then
            export PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig/:$PKG_CONFIG_PATH
            export PKG_CONFIG_SYSROOT_DIR=/usr/aarch64-linux-gnu/
          elif [ "${{ matrix.target }}" == "armv7-unknown-linux-gnueabihf" ]; then
            export PKG_CONFIG_PATH=/usr/lib/arm-linux-gnueabihf/pkgconfig/:$PKG_CONFIG_PATH
            export PKG_CONFIG_SYSROOT_DIR=/usr/arm-linux-gnueabihf/
          fi
          pnpm build --target ${{ matrix.target }}
        env:
          NODE_OPTIONS: '--max_old_space_size=4096'
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}

      - name: Attest Linux bundles
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            target/${{ matrix.target }}/release/bundle/deb/*.deb
            target/${{ matrix.target }}/release/bundle/rpm/*.rpm

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "$RELEASE_TAG" \
            target/${{ matrix.target }}/release/bundle/deb/*.deb \
            target/${{ matrix.target }}/release/bundle/rpm/*.rpm \
            --clobber

  release-for-fixed-webview2:
    name: Release Build for Fixed WebView2
    needs: [prepare_release]
    env:
      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            arch: x64
          - os: windows-latest
            target: aarch64-pc-windows-msvc
            arch: arm64
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare_release.outputs.source_sha }}

      - name: Install Rust Stable
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: '1.99.1'
          targets: ${{ matrix.target }}

      - name: Add Rust Target
        run: rustup target add ${{ matrix.target }}

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2
        with:
          save-if: ${{ github.ref == 'refs/heads/dev' }}
          prefix-key: 'v1-rust'
          key: 'rust-shared-stable-${{ matrix.os }}-${{ matrix.target }}'
          workspaces: |
            . -> target
          cache-all-crates: true
          cache-workspace-crates: true

      - name: Install Node
        uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false

      - name: Pnpm install and check
        run: |
          pnpm i
          pnpm run prebuild ${{ matrix.target }}

      - name: Download WebView2 Runtime
        run: |
          invoke-webrequest -uri https://github.com/westinyang/WebView2RuntimeArchive/releases/download/133.0.3065.92/Microsoft.WebView2.FixedVersionRuntime.133.0.3065.92.${{ matrix.arch }}.cab -outfile Microsoft.WebView2.FixedVersionRuntime.133.0.3065.92.${{ matrix.arch }}.cab
          Expand .\Microsoft.WebView2.FixedVersionRuntime.133.0.3065.92.${{ matrix.arch }}.cab -F:* ./src-tauri
          Remove-Item .\src-tauri\tauri.windows.conf.json
          Rename-Item .\src-tauri\webview2.${{ matrix.arch }}.json tauri.windows.conf.json

      - name: Add Rust Target
        run: |
          rustup target add ${{ matrix.target }} --toolchain 1.99.1 || rustup target add ${{ matrix.target }}
          rustup target list --installed
          echo "Rust target ${{ matrix.target }} installed."

      - name: Tauri build
        uses: tauri-apps/tauri-action@v1.0.0
        env:
          NODE_OPTIONS: '--max_old_space_size=4096'
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
        with:
          tauriScript: pnpm
          args: --target ${{ matrix.target }}

      - name: Rename
        run: |
          $files = Get-ChildItem ".\target\${{ matrix.target }}\release\bundle\nsis\*-setup.exe"
          foreach ($file in $files) {
            $newName = $file.Name -replace "-setup\.exe$", "_fixed_webview2-setup.exe"
            Rename-Item $file.FullName $newName
          }

          $files = Get-ChildItem ".\target\${{ matrix.target }}\release\bundle\nsis\*.nsis.zip"
          foreach ($file in $files) {
            $newName = $file.Name -replace "-setup\.nsis\.zip$", "_fixed_webview2-setup.nsis.zip"
            Rename-Item $file.FullName $newName
          }

          $files = Get-ChildItem ".\target\${{ matrix.target }}\release\bundle\nsis\*-setup.exe.sig"
          foreach ($file in $files) {
            $newName = $file.Name -replace "-setup\.exe\.sig$", "_fixed_webview2-setup.exe.sig"
            Rename-Item $file.FullName $newName
          }

      - name: Attest Windows bundles
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: target/${{ matrix.target }}/release/bundle/nsis/*setup*

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $files = Get-ChildItem "target\${{ matrix.target }}\release\bundle\nsis\*setup*" | Select-Object -ExpandProperty FullName
          gh release upload "$env:RELEASE_TAG" $files --clobber
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

  prepare-next-dev:
    name: Prepare Next Dev Version
    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
    needs: [prepare_release, update_tag]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    concurrency:
      group: prepare-release
      cancel-in-progress: false
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      RELEASE_TAG: ${{ needs.prepare_release.outputs.release_tag }}
      SOURCE_SHA: ${{ needs.prepare_release.outputs.source_sha }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: refs/heads/dev
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'
      - uses: pnpm/action-setup@v6
        with:
          run_install: false
      - name: Prepare version and changelog PR
        run: |
          pnpm install --frozen-lockfile --ignore-scripts
          node scripts-workflow/release.mjs next-dev

  release-update:
    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
    name: Release Update
    runs-on: ubuntu-latest
    needs: [update_tag]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.update_tag.outputs.source_sha }}

      - name: Install Node
        uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false

      - name: Pnpm install
        run: pnpm i

      - name: Release updater file
        run: pnpm updater
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-update-for-fixed-webview2:
    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
    runs-on: ubuntu-latest
    needs: [update_tag]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.update_tag.outputs.source_sha }}

      - name: Install Node
        uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false

      - name: Pnpm install
        run: pnpm i

      - name: Release updater file
        run: pnpm updater-fixed-webview2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  submit-to-winget:
    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
    name: Submit to Winget
    runs-on: ubuntu-latest
    needs: [update_tag, release-update]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.update_tag.outputs.source_sha }}
          fetch-depth: 0
      - name: Get Version
        run: |
          sudo apt-get update
          sudo apt-get install jq
          echo "VERSION=$(cat package.json | jq '.version' | tr -d '"')" >> $GITHUB_ENV
      - name: Submit to Winget
        uses: vedantmgoyal9/winget-releaser@main
        with:
          identifier: ClashVergeRev.ClashVergeRev
          version: ${{env.VERSION}}
          release-tag: v${{env.VERSION}}
          installers-regex: '_(arm64|x64|x86)-setup\.exe$'
          token: ${{ secrets.WINGET_TOKEN  }}

  notify-telegram:
    if: ${{ needs.update_tag.outputs.channel == 'stable' }}
    name: Notify Telegram
    runs-on: ubuntu-latest
    needs:
      [
        update_tag,
        release-update,
        release-update-for-fixed-webview2,
        submit-to-winget,
      ]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.update_tag.outputs.source_sha }}

      - name: Group changelog platforms
        run: bash ./scripts-workflow/group_platforms.sh

      - name: Fetch UPDATE logs
        id: fetch_update_logs
        run: bash ./scripts/extract_update_logs.sh
        shell: bash

      - name: Install Node
        uses: actions/setup-node@v7
        with:
          node-version: '26.13.0'

      - uses: pnpm/action-setup@v6
        name: Install pnpm
        with:
          run_install: false

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get Version and Release Info
        run: |
          sudo apt-get update
          sudo apt-get install jq
          echo "VERSION=$(cat package.json | jq '.version' | tr -d '"')" >> $GITHUB_ENV
          echo "DOWNLOAD_URL=https://github.com/clash-verge-rev/clash-verge-rev/releases/download/v$(cat package.json | jq '.version' | tr -d '"')" >> $GITHUB_ENV
          echo "BUILDTIME=$(TZ=Asia/Shanghai date)" >> $GITHUB_ENV

      - name: Generate release.txt
        run: |
          if [ -z "$UPDATE_LOGS" ]; then
            echo "No update logs found, using default message"
            UPDATE_LOGS="More new features are now supported. Check for detailed changelog soon."
          else
            echo "Using found update logs"
          fi

          cat > release.txt << EOF
          $UPDATE_LOGS

          ## 下载地址

          ### Windows (不再支持Win7)
          #### 正常版本(推荐)
          - [64位(常用)](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_x64-setup.exe) | [ARM64(不常用)](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_arm64-setup.exe)

          #### 内置Webview2版(体积较大，仅在企业版系统或无法安装webview2时使用)
          - [64位](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_x64_fixed_webview2-setup.exe) | [ARM64](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_arm64_fixed_webview2-setup.exe)

          ### macOS
          - [Apple M芯片](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_aarch64.dmg) | [Intel芯片](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_x64.dmg)

          ### Linux
          #### DEB包(Debian系) 使用 apt ./路径 安装
          - [64位](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_amd64.deb) | [ARM64](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_arm64.deb) | [ARMv7](${{ env.DOWNLOAD_URL }}/Clash.Verge_${{ env.VERSION }}_armhf.deb)

          #### RPM包(Redhat系) 使用 dnf ./路径 安装
          - [64位](${{ env.DOWNLOAD_URL }}/Clash.Verge-${{ env.VERSION }}-1.x86_64.rpm) | [ARM64](${{ env.DOWNLOAD_URL }}/Clash.Verge-${{ env.VERSION }}-1.aarch64.rpm) | [ARMv7](${{ env.DOWNLOAD_URL }}/Clash.Verge-${{ env.VERSION }}-1.armhfp.rpm)

          ### FAQ
          - [常见问题](https://clash-verge-rev.github.io/faq/windows.html)

          ### 稳定机场VPN推荐
          - [狗狗加速](https://cvr.dginv.click/#/register?code=oaxsAGo6)

          Created at ${{ env.BUILDTIME }}.
          EOF

      - name: Send Telegram Notification
        run: node scripts/telegram.mjs
        env:
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          BUILD_TYPE: release
          VERSION: ${{ env.VERSION }}
          DOWNLOAD_URL: ${{ env.DOWNLOAD_URL }}