From 0eaaa85d4c76bccd1cd4075029c290b46c9c19d3 Mon Sep 17 00:00:00 2001
From: mesalogo <pettygay757@gmail.com>
Date: Mon, 5 Oct 2026 15:05:28 +0800
Subject: [PATCH] ci: provide a real keyring for encrypted Electron settings

---
 .github/workflows/packages.yml                  | 9 +++++++--
 docs/development/release-preparation-0.15.12.md | 9 +++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index cb84f3b7..deb1083c 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -43,7 +43,7 @@ jobs:
       - name: Prepare sandboxed Electron tests
         run: |
           sudo apt-get update
-          sudo apt-get install --no-install-recommends --yes xvfb xauth
+          sudo apt-get install --no-install-recommends --yes xvfb xauth dbus-x11 gnome-keyring
           sandbox="node_modules/electron/dist/chrome-sandbox"
           if [[ ! -f "$sandbox" ]]; then
             rm -rf node_modules/electron/dist
@@ -55,7 +55,12 @@ jobs:
 
       - name: Run validators
         run: |
-          xvfb-run --auto-servernum npm test
+          dbus-run-session -- bash -euo pipefail -c '
+            export XDG_CURRENT_DESKTOP=GNOME
+            # An isolated CI login keyring exercises real safeStorage encryption.
+            head -c 32 /dev/urandom | base64 | gnome-keyring-daemon --unlock --components=secrets
+            xvfb-run --auto-servernum npm test
+          '
           npm run typecheck
           npm run lint
 
diff --git a/docs/development/release-preparation-0.15.12.md b/docs/development/release-preparation-0.15.12.md
index 2e452b1e..64f5f910 100644
--- a/docs/development/release-preparation-0.15.12.md
+++ b/docs/development/release-preparation-0.15.12.md
@@ -63,3 +63,12 @@ writable_schema/defensive 设置，保留行、rowid 和索引；schema 62 仅
 公开核验六平台 Desktop 20 项资产/12 安装包、macOS 签名公证、双源索引、
 网站 12 种标准选择，以及 Agent 三平台目录/签名和生产读取器。
 不下载 Desktop 安装包，不发布已提交宣传稿。
+
+## 精确候选 CI
+
+`36e671a0` 的 Desktop CI `37273689682`：6254 通过、57 跳过、1 失败，
+生产构建未执行；Agent CI `37273689788` 通过。
+唯一失败为 Telegram Electron 探针启动时真实 safeStorage 不可用。
+Ubuntu 验证环境增加 gnome-keyring/D-Bus，在独立会话中以随机临时密码解锁
+CI keyring 后运行 sandboxed Electron 测试；不使用明文回退、不替换加密接口，
+保留生产配置加密保存断言。密码仅经管道交给临时 keyring，不写源码或日志。