Harden rule build and release governance

.github/dependabot.yml

@@ -2,6 +2,21 @@ version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
+    target-branch: main
     schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
+      interval: monthly
+    open-pull-requests-limit: 1
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+    commit-message:
+      prefix: deps(actions)
+    rebase-strategy: auto

.github/workflows/pull-request.yml

@@ -28,5 +28,47 @@ jobs:
       - name: Prepare scripts
         run: find scripts -type f \( -name '*.sh' -o -name '*.py' \) -exec chmod +x {} +
 
-      - name: Validate scripts and fixtures
-        run: REQUIRE_SHELLCHECK=1 make validate
+      - name: Run preflight validation and text build
+        run: REQUIRE_SHELLCHECK=1 make preflight
+
+  release-candidate:
+    if: github.base_ref == 'main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.11'
+
+      - name: Prepare scripts
+        run: find scripts -type f \( -name '*.sh' -o -name '*.py' \) -exec chmod +x {} +
+
+      - name: Resolve tool versions
+        id: core_versions
+        run: bash ./scripts/commands/resolve-tool-versions.sh
+
+      - name: Restore verified tool cache
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: .bin
+          key: rules-tools-v3-${{ steps.core_versions.outputs.sing_box_version }}-${{ steps.core_versions.outputs.mihomo_version }}-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('config/tools-lock.json') }}
+
+      - name: Build and verify release candidate
+        env:
+          RULES_BUILD_SCOPE: full
+          ARTIFACT_GENERATION_ID: pr-${{ github.event.pull_request.number }}-${{ github.run_attempt }}
+          ARTIFACT_BUILD_ID: ${{ github.run_id }}
+          ARTIFACT_SOURCE_SHA: ${{ github.event.pull_request.head.sha }}
+        run: ./scripts/commands/build-artifacts-transaction.sh
+
+      - name: Show release candidate summary
+        run: |
+          cat .output/build-summary.json
+          cat .output/upstream-summary.json

CONTRIBUTING.md

@@ -4,7 +4,7 @@
 
 ## 开始之前
 
-从最新 `main` 创建范围单一的分支。提交第三方规则、数据或派生内容时，提供原始来源及可核验的许可、条款或授权；无法确认时明确写“未知”，并由维护者在合并和发布前人工决定处置。
+日常变更从临时分支向 `main` 提交 Pull Request，验证通过并合并后发布。提交第三方规则、数据或派生内容时，提供原始来源及可核验的许可、条款或授权；无法确认时明确写“未知”，并由维护者在合并和发布前人工决定处置。
 
 许可审查不是自动检查。CI 不解析 `NOTICE` 或 `THIRD_PARTY_NOTICES.md`，也不会因“未知”状态自动失败。公开 URL、官方来源、`trust` 分类和 CI 通过都不能替代人工许可评审。
 

Makefile

@@ -1,13 +1,15 @@
 SHELL := /usr/bin/env bash
 REQUIRE_SHELLCHECK ?= 0
+BASH_MIN_MAJOR := 5
 
 SHELL_SCRIPTS := $(shell find scripts -type f -name '*.sh' | sort)
 PYTHON_TOOLS := $(shell find scripts/tools -type f -name '*.py' | sort)
 
-.PHONY: help lint lint-shell lint-python lint-config lint-rules test validate preflight build-custom build-custom-text clean
+.PHONY: help check-runtime lint lint-shell lint-python lint-config lint-rules test validate preflight build-custom build-custom-text clean
 
 help:
 	@echo "Available targets:"
+	@echo "  make check-runtime     Verify the supported Bash runtime"
 	@echo "  make lint              Run shell, Python, and custom rule lint checks"
 	@echo "  make test              Run all repository test scripts"
 	@echo "  make validate          Run lint and tests"
@@ -16,7 +18,10 @@ help:
 	@echo "  make build-custom-text Build custom text artifacts without downloading binary compilers"
 	@echo "  make clean             Remove generated artifacts and temporary files"
 
-lint: lint-shell lint-python lint-config lint-rules
+check-runtime:
+	@bash -c 'if (( BASH_VERSINFO[0] < $(BASH_MIN_MAJOR) )); then echo "Bash $(BASH_MIN_MAJOR)+ is required (found $$BASH_VERSION)" >&2; exit 1; fi'
+
+lint: check-runtime lint-shell lint-python lint-config lint-rules
 
 lint-shell:
 	bash -n $(SHELL_SCRIPTS)
@@ -38,17 +43,17 @@ lint-config:
 lint-rules:
 	./scripts/commands/lint-custom-rules.sh
 
-test:
+test: check-runtime
 	./scripts/tests/run.sh
 
 validate: lint test
 
 preflight: validate build-custom-text
 
-build-custom:
+build-custom: check-runtime
 	./scripts/commands/build-custom.sh
 
-build-custom-text:
+build-custom-text: check-runtime
 	RULES_BUILD_CUSTOM_TEXT_ONLY=1 ./scripts/commands/build-custom.sh
 
 clean: