ci: recursive PyArmor for scripts/ and copy references/assets; release.ps1 preflight check

Made-with: Cursor

tools/release.ps1

@@ -24,6 +24,10 @@
 
 .NOTES
   Requires: git, PowerShell 5+
+
+  加密与 ZIP 内容由 CI 工作流 reusable-release-skill.yaml 的「Encrypt Source Code」步骤执行：
+  对 scripts/ 递归 PyArmor（-r），并复制 SKILL.md、references/、assets/（若存在）。
+  本脚本在打 tag 前会做一次 scripts/ 结构自检，避免子目录未提交却仍发布。
 #>
 
 [CmdletBinding()]
@@ -113,6 +117,42 @@ function Get-NextTag {
 }
 
 
+function Assert-SkillReleasePackagingSources {
+  param([Parameter(Mandatory = $true)][string]$SkillRoot)
+
+  $scriptsDir = Join-Path $SkillRoot "scripts"
+  $mainPy = Join-Path $scriptsDir "main.py"
+  if (-not (Test-Path -LiteralPath $mainPy)) {
+    return
+  }
+
+  $text = Get-Content -LiteralPath $mainPy -Raw -Encoding UTF8 -ErrorAction SilentlyContinue
+  if ([string]::IsNullOrWhiteSpace($text)) {
+    return
+  }
+
+  $need = @()
+  if ($text -match '(?m)^\s*from\s+cli\.') { $need += 'cli' }
+  if ($text -match '(?m)^\s*import\s+cli\b') { $need += 'cli' }
+  if ($text -match '(?m)^\s*from\s+service\.') { $need += 'service' }
+  if ($text -match '(?m)^\s*import\s+service\b') { $need += 'service' }
+  if ($text -match '(?m)^\s*from\s+db\.') { $need += 'db' }
+  if ($text -match '(?m)^\s*import\s+db\b') { $need += 'db' }
+  if ($text -match '(?m)^\s*from\s+util\.') { $need += 'util' }
+  if ($text -match '(?m)^\s*import\s+util\b') { $need += 'util' }
+
+  foreach ($p in ($need | Select-Object -Unique)) {
+    $folder = Join-Path $scriptsDir $p
+    if (-not (Test-Path -LiteralPath $folder)) {
+      throw "Release check failed: scripts/main.py imports from '$p' but folder is missing: $folder"
+    }
+  }
+
+  $pyFiles = @(Get-ChildItem -LiteralPath $scriptsDir -Filter *.py -Recurse -File -ErrorAction SilentlyContinue)
+  Write-Host "Packaging check: $($pyFiles.Count) Python file(s) under scripts/ (CI will obfuscate all recursively)." -ForegroundColor DarkGray
+}
+
+
 function Ensure-CleanOrAutoCommit {
   param(
     [switch]$DoAutoCommit,
@@ -171,6 +211,11 @@ try {
 
   Ensure-CleanOrAutoCommit -DoAutoCommit:$AutoCommit -NeedClean:$RequireClean -IsDryRun:$DryRun -Msg $CommitMessage
 
+  $skillRoot = (Get-GitOutput "rev-parse --show-toplevel" | Select-Object -First 1).Trim()
+  if (Test-Path -LiteralPath (Join-Path $skillRoot "SKILL.md")) {
+    Assert-SkillReleasePackagingSources -SkillRoot $skillRoot
+  }
+
   $upstream = (& git rev-parse --abbrev-ref --symbolic-full-name "@{u}" 2>$null)
   $hasUpstream = ($LASTEXITCODE -eq 0)