test(macos): read XML entitlements and cache verified QQ image

.github/tests/macos-qq/runtime.py

@@ -14,11 +14,11 @@ application = Path(sys.argv[1]).resolve()
 distribution = Path(sys.argv[2]).resolve()
 evidence = Path('qq-runtime-evidence')
 evidence.mkdir(exist_ok=True)
-signature = subprocess.run(['/usr/bin/codesign', '-d', '--entitlements', '-', str(application)],
+signature = subprocess.run(['/usr/bin/codesign', '-d', '--entitlements', ':-', str(application)],
                            capture_output=True, check=True, timeout=20)
-entitlements = plistlib.loads(signature.stdout)
 (evidence / 'entitlements.plist').write_bytes(signature.stdout)
 (evidence / 'signature.txt').write_bytes(signature.stderr)
+entitlements = plistlib.loads(signature.stdout)
 print(json.dumps({'entitlements': entitlements}, ensure_ascii=False), flush=True)
 
 documents = Path.home() / 'Library/Containers/com.tencent.qq/Data/Documents'

.github/workflows/macos-qq-runtime.yml

@@ -32,12 +32,19 @@ jobs:
       QQ_SHA256: d270b78f0b210532637076532a883dc8659851b6daa92451983985ab9f3216f0
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/cache@v4
+        id: qq-cache
+        with:
+          path: QQ.dmg
+          key: macos-qq-d270b78f0b210532
       - name: Download verified QQ and NapCat
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          curl -fLsS --connect-timeout 20 --max-time 300 \
-            https://github.com/A-Randomm-User/macOS-save/releases/download/qq/QQ_v7.0.2.53644.dmg -o QQ.dmg
+          if [ ! -f QQ.dmg ]; then
+            curl -fLsS --connect-timeout 20 --max-time 300 \
+              https://github.com/A-Randomm-User/macOS-save/releases/download/qq/QQ_v7.0.2.53644.dmg -o QQ.dmg
+          fi
           echo "$QQ_SHA256  QQ.dmg" | shasum -a 256 -c -
           gh release download "$NAPCAT_VERSION" --repo NapNeko/NapCatQQ --pattern NapCat.Shell.zip
           mkdir NapCat