ci(release): OSS 发布通道迁移至 FC 预签名上传，移除 CI 侧 AK/SK

- oss-direct-upload.mjs 重写为 FC client：OIDC token → release-prepare
  预签名 → runner 直传 OSS → release-finalize（FC 侧 HEAD 对账 +
  stable manifest 版本守卫），删除全部 V1 签名代码
- publish.yml 移除 7 个 BAILIAN_OSS_* secrets，改用共享 FC_TRIGGER_URL
  + FC_RELEASE_AUDIENCE（复用 npm OIDC 的 id-token: write）
- publish.md 补充 FC 通道章节与配置面说明

Author: gujieye

.github/workflows/publish.yml

@@ -70,17 +70,15 @@ jobs:
       - name: publish-stable
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # OSS release channel runs fully in CI: upload + reconcile + manifest.json.
-          # All values come from repo Settings → Secrets — no OSS defaults live in
-          # code. Leave AK/SK unset to skip the OSS channel; once enabled,
-          # bucket/region/prefix are required.
-          BAILIAN_OSS_AK: ${{ secrets.BAILIAN_OSS_AK }}
-          BAILIAN_OSS_SK: ${{ secrets.BAILIAN_OSS_SK }}
-          BAILIAN_OSS_BUCKET: ${{ secrets.BAILIAN_OSS_BUCKET }}
-          BAILIAN_OSS_REGION: ${{ secrets.BAILIAN_OSS_REGION }}
-          BAILIAN_OSS_ENDPOINT: ${{ secrets.BAILIAN_OSS_ENDPOINT }}
-          BAILIAN_RELEASE_PREFIX: ${{ secrets.BAILIAN_RELEASE_PREFIX }}
-          BAILIAN_STATIC_PREFIX: ${{ secrets.BAILIAN_STATIC_PREFIX }}
+          # OSS release channel goes through the FC release function (presigned
+          # upload + reconcile + manifest.json): this repo holds no OSS
+          # credentials, the job only presents its GitHub OIDC token (requires
+          # id-token: write above). The trigger URL is the shared
+          # FC_TRIGGER_URL (same function serves publish-skills; actions are
+          # routed by URL path); leave it unset to skip the OSS channel.
+          # Bucket / prefix / allowlists live in the FC function.
+          FC_TRIGGER_URL: ${{ vars.FC_TRIGGER_URL }}
+          FC_RELEASE_AUDIENCE: ${{ vars.FC_RELEASE_AUDIENCE }}
         run: node tools/release/publish-stable.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }}
 
   publish-channel:
@@ -130,14 +128,10 @@ jobs:
       - name: publish-channel
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # OSS release channel — same Settings-injected values as stable.
-          BAILIAN_OSS_AK: ${{ secrets.BAILIAN_OSS_AK }}
-          BAILIAN_OSS_SK: ${{ secrets.BAILIAN_OSS_SK }}
-          BAILIAN_OSS_BUCKET: ${{ secrets.BAILIAN_OSS_BUCKET }}
-          BAILIAN_OSS_REGION: ${{ secrets.BAILIAN_OSS_REGION }}
-          BAILIAN_OSS_ENDPOINT: ${{ secrets.BAILIAN_OSS_ENDPOINT }}
-          BAILIAN_RELEASE_PREFIX: ${{ secrets.BAILIAN_RELEASE_PREFIX }}
-          BAILIAN_STATIC_PREFIX: ${{ secrets.BAILIAN_STATIC_PREFIX }}
+          # OSS release channel — same FC-backed flow as stable; no OSS
+          # credentials in this repo (see publish-stable env notes).
+          FC_TRIGGER_URL: ${{ vars.FC_TRIGGER_URL }}
+          FC_RELEASE_AUDIENCE: ${{ vars.FC_RELEASE_AUDIENCE }}
         run: node tools/release/publish-channel.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} --channel "${{ inputs.channel }}"
 
   # bailian-kb-dsh is the dsh plugin (downstream host adapter): independent version,

docs/agents/publish.md

@@ -19,11 +19,33 @@ publish-stable.mjs / publish-channel.mjs   ← 唯一发版入口
         └─ binary（lib/binary-release
               → binary-build
               → gh-release
-              → oss-direct-upload）
+              → oss-direct-upload → FC release 通道）
 ```
 
 `tools/release/lib/binary-release.mjs` 等是实现，一般不要单独当发版入口（调试可用）。
 
+### OSS 通道：FC 预签名上传（仓库不持有任何 OSS 凭据）
+
+二进制与静态文件（changelog）上 OSS 不再由 CI 持 AK/SK 直传，而是经 FC 函数
+（bailian-docs-llm-wiki-crawl 的 `release-prepare` / `release-finalize` action）：
+
+1. CI 用本 job 的 GitHub OIDC token（`id-token: write`）调 `release-prepare`；FC 验签
+   （白名单仓库 + ref）后返回 OSS 预签名 PUT URL（30 分钟过期）
+2. runner 拿 URL 直传 OSS（文件体不经过 FC）
+3. CI 调 `release-finalize`：FC 用函数角色 STS 凭证做 HEAD 字节数对账；stable 额外
+   维护 `manifest.json` / `latest.json`（newer-version 守卫在 FC 侧）
+
+配置面：
+
+| 位置             | 变量                                                                                                                        | 说明                                                                                             |
+| ---------------- | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
+| GitHub Variables | 触发 URL 复用共享的 `FC_TRIGGER_URL`（publish-skills 同源，同一 FC 函数按 URL 路径路由 action）；另需 `FC_RELEASE_AUDIENCE` | 未设 URL 则跳过 OSS 通道（不阻塞 npm 发布）；复用意味着 FC 部署完成前不要合入 release 工具链改动 |
+| FC 函数 env      | `RELEASE_OIDC_AUD` / `RELEASE_ALLOWED_REPOS` / `RELEASE_ALLOWED_REFS`                                                       | 鉴权策略；audience 需与 CI 侧一致                                                                |
+| FC 函数 env      | `OSS_BUCKET` / `OSS_REGION` / `OSS_RELEASE_PREFIX` / `OSS_STATIC_PREFIX`                                                    | bucket 与 key 前缀（原七组 OSS secrets 收敛至此）                                                |
+
+改动 FC 侧逻辑（验签策略 / 对账 / manifest 守卫）去 bailian-docs-llm-wiki-crawl 仓库；
+本仓库只维护 client（`tools/release/lib/oss-direct-upload.mjs`）。
+
 ### bailian-kb-dsh（独立版本、npm-only）
 
 同一个 Publish 入口，`package=bailian-kb-dsh`。它走单独的 `tools/release/publish-kb-dsh.mjs`，不复用 `publish-stable.mjs` / `publish-channel.mjs`（版本独立、无 binary、无 OSS CDN）。详见 [dsh-plugin.md](dsh-plugin.md#发布)。
@@ -88,7 +110,7 @@ node tools/release/publish-channel.mjs --channel test --knowledge --dry-run
 
 ## CI 基础设施
 
-- **认证**：npm OIDC Trusted Publishing（无 token），需要 `id-token: write` 权限
+- **认证**：npm OIDC Trusted Publishing（无 token），需要 `id-token: write` 权限；OSS 通道复用同一 OIDC token 向 FC 证明身份（见上文「OSS 通道」）
 - **GitHub Release**：`contents: write` + `GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}`（stable / channel 均需）
 - **Node 版本**：24（npm 11.5+ 才支持 OIDC token 交换）
 - **Bun**：`oven-sh/setup-bun`，版本钉死在 workflow 中

packages/core/src/install/cdn.ts

@@ -1,7 +1,8 @@
 /**
  * End-user binary download base (OSS). CI publishes release assets and rolling
- * channel manifests here directly (tools/release/lib/oss-direct-upload.mjs);
- * no external FC is involved.
+ * channel manifests here via the FC release channel
+ * (tools/release/lib/oss-direct-upload.mjs): the runner uploads through
+ * FC-presigned URLs and holds no OSS credentials itself.
  *
  * Layout under the base:
  *   v<version>/<asset>.zip —— immutable per-version binaries + SHA256SUMS

tools/release/lib/binary-release.mjs

@@ -13,8 +13,9 @@
  * `v<betaVersion>` Release (identical binaries).
  *
  * Re-runs are idempotent via `gh release upload --clobber` (see gh-release.mjs).
- * After the GitHub upload the same assets are pushed straight to OSS from the
- * runner and HEAD-reconciled — all in-process, no external FC (see oss-direct-upload.mjs).
+ * After the GitHub upload the same assets go to OSS through the FC release
+ * channel: FC-presigned PUT URLs + FC-side HEAD reconcile, so the runner holds
+ * no OSS credentials (see oss-direct-upload.mjs).
  *
  * Called by publish-stable.mjs / publish-channel.mjs.
  * Debug:
@@ -245,9 +246,9 @@ export async function releaseBinaryArtifacts(rawOptions = {}) {
     filePaths: [join(ROOT, "CHANGELOG.md"), join(ROOT, "CHANGELOG.zh.md")],
     dryRun,
   });
-  // Push the exact Release assets straight to OSS from the runner, then
-  // HEAD-reconcile. Stable releases additionally maintain release/manifest.json
-  // (newer-version guard). Throws on failure — CI is the only OSS writer.
+  // Mirror the exact Release assets to OSS through the FC channel (presigned
+  // upload + FC-side HEAD reconcile). Stable releases additionally maintain
+  // release/manifest.json (newer-version guard, FC-side). Throws on failure.
   const plans = ossMirrorPlans({ dir, version, mode, files });
   const mirror = await mirrorReleaseAssetsToOss({ plans, dryRun });
   if (mode === "stable" && !mirror.skipped) {