Publish Linux package to GitHub Releases on v*.*.* tags

[pashippercode]

推送 v*.*.* 标签时，Linux CI 会构建 MajdataViewAlpha-Linux-*.tar.gz 并发布到 GitHub Releases。

v0.4.2 已发布：https://github.com/pashippercode/MajdataViewAlpha/releases/tag/v0.4.2

改动

• Linux 构建 job 保持 contents: read；只有 tag 触发的 publish-release job 有 contents: write
• 发布触发从 v* 改为 v*.*.*；带 - 的标签（如 v0.4.3-rc1）标为 prerelease，不替换 latest
• action-gh-release 钉到 v3.0.3 SHA
• linux-release.sh 打包前清空 dist/linux，避免旧 tarball 被一起上传
• majdata doctor 兼容发布包布局 tools/Maicaiyin
• README 补充 Linux Release 下载与 tag 规则

包内为 Avalonia 编辑器、majdata CLI、Maicaiyin 与 simai_parser。不含 Unity Linux 播放器与 Windows WPF / 桌宠启动器。

  

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[pashippercode]

@cursoragent review it

[cursor]

审查已写在 PR #2 上。结论是 可以合，但下次发版前建议先改两点。

没问题的部分

• majdata doctor 已改用 AutoOnsetRunner.ResolveToolDirectory()，解压后的包能找到 tools/Maicaiyin。
• 成品包组装完成后再跑 doctor，避免再踩到空目录。
• 推送 v* 会上传 tarball 和 SHA256SUMS。CI 绿，v0.4.2 已经从这条分支发过一次。

建议先改

1. .github/workflows/linux.yml 给整个 workflow（含 PR）开了 contents: write。同仓库 PR 跑的是 PR 头上的 workflow，以后如果有人把 if: github.ref_type == 'tag' 放宽，就能覆盖已发布的 Release。发布权限应只给 tag job，PR / main 构建保持 contents: read。
2. draft: false + make_latest: true + v* 会让任何 v 开头的 tag（包括 rc 或打错的 tag）立刻变成 latest。更稳妥的是限制 v*.*.*，或对带 - 的 tag 标 prerelease。

小问题

• softprops/action-gh-release@v2 是浮动 tag，有写权限时最好钉 SHA。
• README 写死了 pashippercode/MajdataViewAlpha，合回上游会指错仓库。
• squash merge 后 v0.4.2 不会落在 main 上，一般不用重打 tag。

没有挡发布的功能问题。完整意见在 #2 。要的话我可以直接改那两个 should-fix。

  

[cursor]

Review

Overall this is a solid, small PR: tag-triggered Linux releases, a real doctor check against the assembled package, and SHA256SUMS. CI is green, and v0.4.2 already published successfully from this branch.

Verdict: approve, with two should-fix items before relying on this for every future tag.

What works

• majdata doctor now uses AutoOnsetRunner.ResolveToolDirectory(), so it finds tools/Maicaiyin in the tarball instead of only MajdataEdit/tools/Maicaiyin.
• The packaged doctor run is after Maicaiyin/assets are copied. Running it earlier was a real miss.
• linux-release.sh writes SHA256SUMS next to the archive; the release action uploads both.
• Tag-only publish is gated with if: github.ref_type == 'tag'. Empty MAJDATA_VERSION on branch/PR builds correctly falls back to git describe.

Should fix

1. contents: write is granted to every Linux CI run, including pull_request.
   In .github/workflows/linux.yml the workflow-level permissions: contents: write applies to PRs and main pushes, not just tags. Same-repo PRs execute the workflow file from the PR head, so a later change that loosens the if: can overwrite a published release.
   Prefer a tag-only job (or a separate release.yml on push: tags) with contents: write, and keep the PR/main build job at contents: read.

2. Every v* tag publishes immediately and becomes latest.
   draft: false + make_latest: true + v* means v0.4.3-rc1 or a typo tag replaces the latest release with no review gate. Consider v*.*.* (or an explicit release tag convention), prerelease: ${{ contains(github.ref_name, '-') }}, or draft: true if you want a human to hit Publish.

Nits

• softprops/action-gh-release@v2 is a moving tag. Pin a commit SHA if this token can create releases.
• fetch-depth: 0 on every PR is only needed for git describe on non-tag builds. Tag builds already set MAJDATA_VERSION.
• README hardcodes pashippercode/MajdataViewAlpha for Linux downloads. Correct for this fork; wrong if this is merged back to Jian04/MajdataViewAlpha.
• linux-release.sh leaves older dist/linux/*.tar.gz in place and rewrites SHA256SUMS for the current version only. Fine on a fresh CI runner; locally the glob can attach leftover archives.

Process note

v0.4.2 already points at ce2d928 on this branch. A squash merge will leave that tag off main. No need to retag unless you want main and the release to share a commit.

No blocking functional issues for the Linux tarball path. The two should-fix items are about not letting the next tag (or a workflow edit) accidentally clobber a release.

[pashippercode]

@cursoragent 继续修复

[cursor]

审查里的两点已经改完，并推到当前分支。

权限： 默认 contents: read。只有 tag 上的 publish-release job 有 contents: write。这次 PR CI 里 linux-tools 通过，publish-release 被跳过，符合预期。

发版规则： 只响应 v*.*.*。v0.4.2 仍是正式版；v0.4.3-rc1 会标 prerelease，不会顶掉 latest。

另外钉了 softprops/action-gh-release 到 v3.0.3（efb35369…），打包前会清空 dist/linux，避免旧 tarball 被一起上传。

本地验证：stale 包被清掉，majdata doctor 通过。CI：https://github.com/pashippercode/MajdataViewAlpha/actions/runs/33299969928