feat: add managed online updates

.gitea/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
 
           umask 077
           key_file="${RUNNER_TEMP:-/tmp}/kaidi-erp-release-key.pem"
-          cleanup() { rm -f "$key_file" release.json release-payload.json; }
+          cleanup() { rm -f "$key_file" release.json release-payload.json release-notes.md; }
           trap cleanup EXIT
           printf '%s' "$RELEASE_PRIVATE_KEY_B64" | base64 --decode > "$key_file"
           export ERP_RELEASE_PRIVATE_KEY_FILE="$key_file"
@@ -71,6 +71,23 @@ jobs:
           )
           bash scripts/package-release.sh "$version"
 
+          previous_tag="$(git describe --tags --match 'v[0-9]*' --abbrev=0 "${tag}^" 2>/dev/null || true)"
+          change_range="$tag"
+          [[ -z "$previous_tag" ]] || change_range="$previous_tag..$tag"
+          {
+            printf '## 更新内容\n\n'
+            if ! git log --no-merges --format='- %s (`%h`)' "$change_range"; then
+              printf -- '- Kaidi ERP %s 正式发布\n' "$version"
+            fi
+            printf '\n## 安全校验\n\n'
+            printf -- '- 安装包：`kaidi-erp-%s.tar.gz`\n' "$version"
+            printf -- '- 完整性：SHA-256\n'
+            printf -- '- 发布签名：Ed25519\n'
+            if [[ -n "$previous_tag" ]]; then
+              printf '\n上一个正式版本：`%s`\n' "$previous_tag"
+            fi
+          } > release-notes.md
+
           owner="${repository%%/*}"
           repo="${repository#*/}"
           release_api="${api_base%/}/api/v1/repos/$owner/$repo/releases"
@@ -80,13 +97,15 @@ jobs:
             --header "$auth_header" --header 'Accept: application/json' \
             "$release_api/tags/$tag")"
 
-          python3 - "$tag" > release-payload.json <<'PY'
+          python3 - "$tag" release-notes.md > release-payload.json <<'PY'
           import json, sys
           tag = sys.argv[1]
+          with open(sys.argv[2], encoding="utf-8") as handle:
+              notes = handle.read().strip()
           print(json.dumps({
               "tag_name": tag,
-              "name": tag,
-              "body": f"Kaidi ERP {tag}",
+              "name": f"Kaidi ERP {tag}",
+              "body": notes,
               "draft": False,
               "prerelease": "-" in tag.split("+", 1)[0],
           }, separators=(",", ":")))