chore(release): bump version to 1.6.3

.gitea/workflows/release.yml

@@ -4,11 +4,10 @@ on:
   push:
     branches:
       - master
-  workflow_dispatch:
 
 jobs:
   release:
-    runs-on: windows-latest
+    runs-on: windows
 
     steps:
       - name: Checkout
@@ -17,72 +16,106 @@ jobs:
           fetch-depth: 0
           tags: true
 
-      - name: Set up Python
+      - name: Ensure Python 3.13
-        uses: https://git.daemonlord.ru/actions/setup-python@v5
+        shell: powershell
-        with:
+        run: |
-          python-version: "3.13"
+          if (Get-Command python -ErrorAction SilentlyContinue) {
+            python --version
+          } elseif (Get-Command py -ErrorAction SilentlyContinue) {
+            $pyExe = py -3.13 -c "import sys; print(sys.executable)"
+            if (-not $pyExe) {
+              throw "Python 3.13 launcher is available, but interpreter was not found."
+            }
+            Split-Path $pyExe | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+            python --version
+          } else {
+            throw "Python is not installed on runner. Install Python 3.13 and restart runner service."
+          }
 
       - name: Install dependencies
-        shell: bash
+        shell: powershell
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt pyinstaller
 
       - name: Extract app version
         id: extract_version
-        shell: bash
+        shell: powershell
         run: |
-          VERSION=$(python -c "from app_version import APP_VERSION; print(APP_VERSION)")
+          $version = (python -c "from app_version import APP_VERSION; print(APP_VERSION)").Trim()
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
-          echo "Detected version: $VERSION"
+          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "version=$version`n", $utf8NoBom)
+          Write-Host "Detected version: $version"
 
       - name: Stop if version already released
         id: stop
-        shell: bash
+        shell: powershell
         run: |
-          VERSION="${{ steps.extract_version.outputs.version }}"
+          $version = "${{ steps.extract_version.outputs.version }}"
-          if git show-ref --tags --quiet --verify "refs/tags/$VERSION"; then
+          $tag = "v$version"
-            echo "Version $VERSION already released, stopping job."
+          git show-ref --tags --quiet --verify "refs/tags/$tag"
-            echo "CONTINUE=false" >> "$GITHUB_ENV"
+          $tagExists = ($LASTEXITCODE -eq 0)
-          else
+          $global:LASTEXITCODE = 0
-            echo "Version $VERSION not released yet, continuing workflow..."
+          $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
-            echo "CONTINUE=true" >> "$GITHUB_ENV"
+          if ($tagExists) {
-          fi
+            Write-Host "Version $tag already released, stopping job."
+            [System.IO.File]::AppendAllText($env:GITHUB_ENV, "CONTINUE=false`n", $utf8NoBom)
+          } else {
+            Write-Host "Version $tag not released yet, continuing workflow..."
+            [System.IO.File]::AppendAllText($env:GITHUB_ENV, "CONTINUE=true`n", $utf8NoBom)
+          }
+          exit 0
 
       - name: Run tests
         if: env.CONTINUE == 'true'
-        shell: bash
+        shell: powershell
         run: |
           python -m py_compile app_version.py main.py build.py tests/test_auth_relogin_smoke.py
           python -m unittest tests/test_auth_relogin_smoke.py
 
       - name: Build release zip
         if: env.CONTINUE == 'true'
-        shell: bash
+        shell: powershell
         run: |
           python build.py
 
       - name: Ensure archive exists
         if: env.CONTINUE == 'true'
-        shell: bash
+        shell: powershell
         run: |
-          VERSION="${{ steps.extract_version.outputs.version }}"
+          $version = "${{ steps.extract_version.outputs.version }}"
-          test -f "dist/AnabasisManager-$VERSION.zip"
+          $archivePath = "dist/AnabasisManager-$version.zip"
+          if (-not (Test-Path $archivePath)) {
+            throw "Archive not found: $archivePath"
+          }
+
+      - name: Generate SHA256 checksum
+        if: env.CONTINUE == 'true'
+        shell: powershell
+        run: |
+          $version = "${{ steps.extract_version.outputs.version }}"
+          $archiveName = "AnabasisManager-$version.zip"
+          $archivePath = "dist/$archiveName"
+          $checksumPath = "dist/$archiveName.sha256"
+          $hash = (Get-FileHash -Path $archivePath -Algorithm SHA256).Hash.ToLower()
+          "$hash  $archiveName" | Set-Content -Path $checksumPath -Encoding UTF8
+          Write-Host "Checksum created: $checksumPath"
 
       - name: Configure git identity
         if: env.CONTINUE == 'true'
-        shell: bash
+        shell: powershell
         run: |
           git config user.name "gitea-actions"
           git config user.email "gitea-actions@daemonlord.ru"
 
       - name: Create git tag
         if: env.CONTINUE == 'true'
-        shell: bash
+        shell: powershell
         run: |
-          VERSION="${{ steps.extract_version.outputs.version }}"
+          $version = "${{ steps.extract_version.outputs.version }}"
-          git tag "$VERSION"
+          $tag = "v$version"
-          git push origin "$VERSION"
+          git tag "$tag"
+          git push origin "$tag"
 
       - name: Create Gitea Release
         if: env.CONTINUE == 'true'
@@ -91,9 +124,10 @@ jobs:
           server_url: https://git.daemonlord.ru
           repository: ${{ gitea.repository }}
           token: ${{ secrets.API_TOKEN }}
-          tag_name: ${{ steps.extract_version.outputs.version }}
+          tag_name: v${{ steps.extract_version.outputs.version }}
-          name: Release ${{ steps.extract_version.outputs.version }}
+          name: Anabasis Manager ${{ steps.extract_version.outputs.version }}
           body: |
-            Desktop release ${{ steps.extract_version.outputs.version }}
+            Desktop release v${{ steps.extract_version.outputs.version }}
           files: |
             dist/AnabasisManager-${{ steps.extract_version.outputs.version }}.zip
+            dist/AnabasisManager-${{ steps.extract_version.outputs.version }}.zip.sha256

app_version.py

@@ -1 +1 @@
-APP_VERSION = "1.6.1"
+APP_VERSION = "1.6.3"

main.py

@@ -8,6 +8,7 @@ import time
 import auth_webview
 import os
 import re
+import hashlib
 import subprocess
 import threading
 import tempfile
@@ -357,13 +358,30 @@ class UpdateChecker(QObject):
         html_url = release_data.get("html_url") or releases_url
         assets = release_data.get("assets") or []
         download_url = ""
+        download_name = ""
+        checksum_url = ""
         for asset in assets:
             url = asset.get("browser_download_url", "")
             if url.lower().endswith(".zip"):
                 download_url = url
+                download_name = asset.get("name", "")
                 break
         if not download_url and assets:
             download_url = assets[0].get("browser_download_url", "")
+            download_name = assets[0].get("name", "")
+
+        for asset in assets:
+            name = asset.get("name", "").lower()
+            if not name:
+                continue
+            is_checksum_asset = name.endswith(".sha256") or name.endswith(".sha256.txt") or name in ("checksums.txt", "sha256sums.txt")
+            if not is_checksum_asset:
+                continue
+            if download_name and (download_name.lower() in name or name in (f"{download_name.lower()}.sha256", f"{download_name.lower()}.sha256.txt")):
+                checksum_url = asset.get("browser_download_url", "")
+                break
+            if not checksum_url:
+                checksum_url = asset.get("browser_download_url", "")
 
         self.check_finished.emit(
             {
@@ -373,6 +391,8 @@ class UpdateChecker(QObject):
                 "latest_tag": latest_tag,
                 "release_url": html_url,
                 "download_url": download_url,
+                "download_name": download_name,
+                "checksum_url": checksum_url,
                 "has_update": _is_newer_version(latest_version, self.current_version),
             }
         )
@@ -707,9 +727,11 @@ class VkChatManager(QMainWindow):
 
             clicked = message_box.clickedButton()
             download_url = result.get("download_url")
+            checksum_url = result.get("checksum_url")
+            download_name = result.get("download_name")
             release_url = result.get("release_url")
             if clicked is update_now_button and download_url:
-                if not self._start_auto_update(download_url, latest_version):
+                if not self._start_auto_update(download_url, latest_version, checksum_url, download_name):
                     if release_url:
                         QDesktopServices.openUrl(QUrl(release_url))
                 return
@@ -754,6 +776,53 @@ class VkChatManager(QMainWindow):
             with open(destination_path, "wb") as f:
                 shutil.copyfileobj(response, f)
 
+    def _download_update_text(self, url):
+        request = urllib.request.Request(
+            url,
+            headers={"User-Agent": "AnabasisManager-Updater"},
+        )
+        with urllib.request.urlopen(request, timeout=30) as response:
+            return response.read().decode("utf-8", errors="replace")
+
+    @staticmethod
+    def _sha256_file(path):
+        digest = hashlib.sha256()
+        with open(path, "rb") as f:
+            for chunk in iter(lambda: f.read(1024 * 1024), b""):
+                digest.update(chunk)
+        return digest.hexdigest().lower()
+
+    @staticmethod
+    def _extract_sha256_from_text(checksum_text, target_file_name):
+        target = (target_file_name or "").strip().lower()
+        for raw_line in checksum_text.splitlines():
+            line = raw_line.strip()
+            if not line:
+                continue
+            match = re.search(r"\b([A-Fa-f0-9]{64})\b", line)
+            if not match:
+                continue
+            checksum = match.group(1).lower()
+            if not target:
+                return checksum
+            line_lower = line.lower()
+            if target in line_lower:
+                return checksum
+            if os.path.basename(target) in line_lower:
+                return checksum
+        return ""
+
+    def _verify_update_checksum(self, zip_path, checksum_url, download_name):
+        if not checksum_url:
+            raise RuntimeError("В релизе нет файла SHA256. Автообновление остановлено.")
+        checksum_text = self._download_update_text(checksum_url)
+        expected_hash = self._extract_sha256_from_text(checksum_text, download_name or os.path.basename(zip_path))
+        if not expected_hash:
+            raise RuntimeError("Не удалось найти SHA256 для архива обновления.")
+        actual_hash = self._sha256_file(zip_path)
+        if actual_hash != expected_hash:
+            raise RuntimeError("SHA256 не совпадает, обновление отменено.")
+
     def _locate_extracted_root(self, extracted_dir):
         entries = []
         for name in os.listdir(extracted_dir):
@@ -766,7 +835,7 @@ class VkChatManager(QMainWindow):
                 return candidate
         return extracted_dir
 
-    def _build_update_script(self, app_dir, source_dir, exe_name):
+    def _build_update_script(self, app_dir, source_dir, exe_name, target_pid):
         script_path = os.path.join(tempfile.gettempdir(), "anabasis_apply_update.cmd")
         script_lines = [
             "@echo off",
@@ -774,8 +843,15 @@ class VkChatManager(QMainWindow):
             f"set APP_DIR={app_dir}",
             f"set SRC_DIR={source_dir}",
             f"set EXE_NAME={exe_name}",
-            "timeout /t 2 /nobreak >nul",
+            f"set TARGET_PID={target_pid}",
-            "robocopy \"%SRC_DIR%\" \"%APP_DIR%\" /E /NFL /NDL /NJH /NJS /NP /R:3 /W:1 >nul",
+            ":wait_for_exit",
+            "tasklist /FI \"PID eq %TARGET_PID%\" | find \"%TARGET_PID%\" >nul",
+            "if %ERRORLEVEL% EQU 0 (",
+            "  timeout /t 1 /nobreak >nul",
+            "  goto :wait_for_exit",
+            ")",
+            "timeout /t 1 /nobreak >nul",
+            "robocopy \"%SRC_DIR%\" \"%APP_DIR%\" /E /NFL /NDL /NJH /NJS /NP /R:12 /W:2 >nul",
             "set RC=%ERRORLEVEL%",
             "if %RC% GEQ 8 goto :copy_error",
             "start \"\" \"%APP_DIR%\\%EXE_NAME%\"",
@@ -788,7 +864,7 @@ class VkChatManager(QMainWindow):
             f.write("\r\n".join(script_lines) + "\r\n")
         return script_path
 
-    def _start_auto_update(self, download_url, latest_version):
+    def _start_auto_update(self, download_url, latest_version, checksum_url="", download_name=""):
         if os.name != "nt":
             QMessageBox.information(
                 self,
@@ -814,6 +890,7 @@ class VkChatManager(QMainWindow):
         unpack_dir = os.path.join(work_dir, "extracted")
         try:
             self._download_update_archive(download_url, zip_path)
+            self._verify_update_checksum(zip_path, checksum_url, download_name)
             os.makedirs(unpack_dir, exist_ok=True)
             with zipfile.ZipFile(zip_path, "r") as archive:
                 archive.extractall(unpack_dir)
@@ -822,7 +899,7 @@ class VkChatManager(QMainWindow):
             app_exe = sys.executable
             app_dir = os.path.dirname(app_exe)
             exe_name = os.path.basename(app_exe)
-            script_path = self._build_update_script(app_dir, source_dir, exe_name)
+            script_path = self._build_update_script(app_dir, source_dir, exe_name, os.getpid())
 
             creation_flags = 0
             if hasattr(subprocess, "CREATE_NEW_PROCESS_GROUP"):
@@ -841,7 +918,7 @@ class VkChatManager(QMainWindow):
                 "Обновление запущено",
                 "Обновление скачано. Приложение будет перезапущено.",
             )
-            QTimer.singleShot(150, QApplication.instance().quit)
+            QApplication.instance().quit()
             return True
         except Exception as e:
             self._log_event("auto_update_failed", str(e), level="ERROR")

tests/test_auth_relogin_smoke.py

@@ -44,7 +44,10 @@ class AuthReloginSmokeTests(unittest.TestCase):
         self.assertIn("def check_for_updates(self, silent_no_updates=False):", self.source)
         self.assertIn("class UpdateChecker(QObject):", self.source)
         self.assertIn('message_box.addButton("Обновить сейчас", QMessageBox.AcceptRole)', self.source)
-        self.assertIn("def _start_auto_update(self, download_url, latest_version):", self.source)
+        self.assertIn("def _start_auto_update(self, download_url, latest_version, checksum_url=\"\", download_name=\"\"):", self.source)
+        self.assertIn("def _verify_update_checksum(self, zip_path, checksum_url, download_name):", self.source)
+        self.assertIn("def _build_update_script(self, app_dir, source_dir, exe_name, target_pid):", self.source)
+        self.assertIn("set TARGET_PID=", self.source)
 
 
 if __name__ == "__main__":