From 7a35ef035a7d5f4e77f78edb29138542c87ac8ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=89=8B=E7=93=9C=E4=B8=80=E5=8D=81=E9=9B=AA?=
 <nanaeonn@outlook.com>
Date: Mon, 14 Sep 2026 12:01:24 +0800
Subject: [PATCH] Pin Windows QQ package for release build

The Windows release workflow now uses a fixed QQ installer URL and SHA256 hash, verifies the downloaded installer before packaging, and makes the download cache key sensitive to the selected QQ URL, hash, and Node version. The workflow also switches QQ downloads to curl with retries for transient HTTP errors and centralizes the Node version variable to keep the build config consistent.
---
 .github/workflows/release-publish.yml | 31 ++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index df1a7580..42b2ae65 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -65,6 +65,11 @@ jobs:
   assemble-windows-node:
     needs: build
     runs-on: ubuntu-latest
+    env:
+      # QQ 9.9.31.49738; SHA256 matches the microsoft/winget-pkgs installer manifest.
+      QQ_URL: https://github.com/Rodert/qq-versions/releases/download/qq-packages-20260528-3e8913a2/QQ_9.9.31_260528_x64_01.exe
+      QQ_SHA256: 0beb5cb4ff776cba822caa0abadbd53f5892f12628a86dabea1b372c82c086bc
+      NODE_VERSION: '22.11.0'
     steps:
       - uses: actions/checkout@v5
         with:
@@ -80,12 +85,18 @@ jobs:
           sudo apt update
           sudo apt install -y aria2 unzip zip p7zip-full curl jq
 
+      - name: Generate download cache key
+        id: download-cache-key
+        run: |
+          DOWNLOAD_HASH=$(printf '%s\n' "$QQ_URL" "$QQ_SHA256" "$NODE_VERSION" | sha256sum | cut -d ' ' -f 1)
+          echo "key=napcat-downloads-v2-$DOWNLOAD_HASH" >> "$GITHUB_OUTPUT"
+
       - name: Cache QQ and Node.js downloads
         id: cache-downloads
         uses: actions/cache@v4
         with:
           path: /tmp/napcat-downloads
-          key: napcat-downloads-qq9.9.27.45627-node22.11.0
+          key: ${{ steps.download-cache-key.outputs.key }}
 
       - name: Download QQ and Node.js
         if: steps.cache-downloads.outputs.cache-hit != 'true'
@@ -94,15 +105,20 @@ jobs:
           mkdir -p /tmp/napcat-downloads
           cd /tmp/napcat-downloads
 
-          NT_URL="https://qqdl.gtimg.cn/qqfile/QQNT/9.9.32/beta/a33ab721/QQ9.9.32.50969_x64.exe"
           echo "Downloading QQ installer..."
-          aria2c -x16 -s16 -k1M -o "QQ_x64.exe" "$NT_URL"
+          # Retry download errors, including HTTP 404 responses.
+          curl --fail --location --retry 5 --retry-all-errors --retry-delay 5 \
+            --connect-timeout 30 --max-time 600 --user-agent "Mozilla/5.0" \
+            --output "QQ_x64.exe" "$QQ_URL"
 
-          NODE_VER="22.11.0"
-          NODE_URL="https://nodejs.org/dist/v$NODE_VER/node-v$NODE_VER-win-x64.zip"
-          echo "Downloading Node.js $NODE_VER..."
+          NODE_URL="https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-win-x64.zip"
+          echo "Downloading Node.js $NODE_VERSION..."
           aria2c -x1 -s1 -k1M -o "node-win-x64.zip" "$NODE_URL"
 
+      - name: Verify QQ installer
+        run: |
+          echo "$QQ_SHA256  /tmp/napcat-downloads/QQ_x64.exe" | sha256sum --check --strict -
+
       - name: Assemble NapCat.Shell.Windows.Node.zip
         run: |
           set -euo pipefail
@@ -159,8 +175,7 @@ jobs:
           # -----------------------------
           # 7) 拷贝 Node.exe 到 NapCat.Shell.Windows.Node
           # -----------------------------
-          NODE_VER="22.11.0"
-          cp -a "$NODE_EXTRACT/node-v$NODE_VER-win-x64/node.exe" "$OUT_DIR/" || true
+          cp -a "$NODE_EXTRACT/node-v$NODE_VERSION-win-x64/node.exe" "$OUT_DIR/" || true
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v6