feat: add cross-platform release pipeline [CI SKIP]

.gitignore

@@ -1,4 +1,5 @@
 artifacts/
+.release/
 bin/
 obj/
 *.user

.woodpecker/gitea-release.yml

@@ -0,0 +1,27 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+depends_on:
+  - linux-release
+  - windows-release
+
+steps:
+  - name: publish-gitea-release
+    image: bash
+    environment:
+      GITEA_BASE: http://192.168.2.162:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - bash ci/publish-gitea-release.sh

.woodpecker/linux-release.yml

@@ -0,0 +1,56 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+concurrency: 1
+
+steps:
+  - name: linux-amd64-backend
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/.nuget/packages
+      ZOT_REGISTRY: 192.168.2.162:5000
+      ZOT_USERNAME:
+        from_secret: zot_username
+      ZOT_PASSWORD:
+        from_secret: zot_password
+    commands:
+      - bash ci/release-linux.sh amd64 backend
+    depends_on: []
+
+  - name: linux-arm64-backend
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/.nuget/packages
+      ZOT_REGISTRY: 192.168.2.162:5000
+      ZOT_USERNAME:
+        from_secret: zot_username
+      ZOT_PASSWORD:
+        from_secret: zot_password
+    commands:
+      - bash ci/release-linux.sh arm64 backend
+    depends_on: []
+
+  - name: backend-multiarch-index
+    image: bash
+    environment:
+      ZOT_REGISTRY: 192.168.2.162:5000
+      ZOT_USERNAME:
+        from_secret: zot_username
+      ZOT_PASSWORD:
+        from_secret: zot_password
+    commands:
+      - bash ci/index-backend-image.sh
+    depends_on:
+      - linux-amd64-backend
+      - linux-arm64-backend

.woodpecker/verify.yml

@@ -0,0 +1,30 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: [push, pull_request]
+
+steps:
+  - name: backend-tests
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/.nuget/packages
+    commands:
+      - cd backend && dotnet test --solution Monitor.slnx -c Release
+
+  - name: web-build
+    image: bash
+    environment:
+      NPM_CONFIG_CACHE: /home/justme/.npm
+    commands:
+      - npm ci --prefix web --prefer-offline
+      - npm run build --prefix web
+      - npm run lint:css --prefix web
+    depends_on: []

.woodpecker/windows-release.yml

@@ -0,0 +1,246 @@
+labels:
+  ci: domain-windows
+  platform: windows/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: tag
+    ref: refs/tags/v*
+
+concurrency: 1
+
+steps:
+  - name: build-linux-x64-agent
+    image: powershell
+    environment: &build-environment
+      GITEA_BASE: http://localhost:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      NUGET_PACKAGES: 'C:\Users\JustMe-NAS\.nuget\packages'
+      RID: linux-x64
+      COMPONENT: agent
+    commands: &build-commands
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/release-cross-platform.ps1 -RuntimeIdentifier $env:RID -Component $env:COMPONENT
+    depends_on: []
+
+  - name: build-linux-x64-probe
+    image: powershell
+    environment: &rid-linux-x64-probe
+      <<: *build-environment
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-x64-enroll
+    image: powershell
+    environment: &rid-linux-x64-enroll
+      <<: *build-environment
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-arm64-agent
+    image: powershell
+    environment: &rid-linux-arm64-agent
+      <<: *build-environment
+      RID: linux-arm64
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-arm64-probe
+    image: powershell
+    environment: &rid-linux-arm64-probe
+      <<: *rid-linux-arm64-agent
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-arm64-enroll
+    image: powershell
+    environment: &rid-linux-arm64-enroll
+      <<: *rid-linux-arm64-agent
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-musl-x64-agent
+    image: powershell
+    environment: &rid-linux-musl-x64-agent
+      <<: *build-environment
+      RID: linux-musl-x64
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-musl-x64-probe
+    image: powershell
+    environment: &rid-linux-musl-x64-probe
+      <<: *rid-linux-musl-x64-agent
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-musl-x64-enroll
+    image: powershell
+    environment: &rid-linux-musl-x64-enroll
+      <<: *rid-linux-musl-x64-agent
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-musl-arm64-agent
+    image: powershell
+    environment: &rid-linux-musl-arm64-agent
+      <<: *build-environment
+      RID: linux-musl-arm64
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-musl-arm64-probe
+    image: powershell
+    environment: &rid-linux-musl-arm64-probe
+      <<: *rid-linux-musl-arm64-agent
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-linux-musl-arm64-enroll
+    image: powershell
+    environment: &rid-linux-musl-arm64-enroll
+      <<: *rid-linux-musl-arm64-agent
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-macos-x64-agent
+    image: powershell
+    environment: &rid-macos-x64-agent
+      <<: *build-environment
+      RID: osx-x64
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-macos-x64-probe
+    image: powershell
+    environment: &rid-macos-x64-probe
+      <<: *rid-macos-x64-agent
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-macos-x64-enroll
+    image: powershell
+    environment: &rid-macos-x64-enroll
+      <<: *rid-macos-x64-agent
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-macos-arm64-agent
+    image: powershell
+    environment: &rid-macos-arm64-agent
+      <<: *build-environment
+      RID: osx-arm64
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-macos-arm64-probe
+    image: powershell
+    environment: &rid-macos-arm64-probe
+      <<: *rid-macos-arm64-agent
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-macos-arm64-enroll
+    image: powershell
+    environment: &rid-macos-arm64-enroll
+      <<: *rid-macos-arm64-agent
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-windows-x64-agent
+    image: powershell
+    environment: &rid-windows-x64-agent
+      <<: *build-environment
+      RID: win-x64
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-windows-x64-probe
+    image: powershell
+    environment: &rid-windows-x64-probe
+      <<: *rid-windows-x64-agent
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-windows-x64-enroll
+    image: powershell
+    environment: &rid-windows-x64-enroll
+      <<: *rid-windows-x64-agent
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-windows-arm64-agent
+    image: powershell
+    environment: &rid-windows-arm64-agent
+      <<: *build-environment
+      RID: win-arm64
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-windows-arm64-probe
+    image: powershell
+    environment: &rid-windows-arm64-probe
+      <<: *rid-windows-arm64-agent
+      COMPONENT: probe
+    commands: *build-commands
+    depends_on: []
+
+  - name: build-windows-arm64-enroll
+    image: powershell
+    environment: &rid-windows-arm64-enroll
+      <<: *rid-windows-arm64-agent
+      COMPONENT: fleet-enroll
+    commands: *build-commands
+    depends_on: []
+
+  - name: package-and-upload
+    image: powershell
+    environment: *build-environment
+    commands:
+      - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
+      - ./ci/package-cross-platform.ps1
+    depends_on:
+      - build-linux-x64-agent
+      - build-linux-x64-probe
+      - build-linux-x64-enroll
+      - build-linux-arm64-agent
+      - build-linux-arm64-probe
+      - build-linux-arm64-enroll
+      - build-linux-musl-x64-agent
+      - build-linux-musl-x64-probe
+      - build-linux-musl-x64-enroll
+      - build-linux-musl-arm64-agent
+      - build-linux-musl-arm64-probe
+      - build-linux-musl-arm64-enroll
+      - build-macos-x64-agent
+      - build-macos-x64-probe
+      - build-macos-x64-enroll
+      - build-macos-arm64-agent
+      - build-macos-arm64-probe
+      - build-macos-arm64-enroll
+      - build-windows-x64-agent
+      - build-windows-x64-probe
+      - build-windows-x64-enroll
+      - build-windows-arm64-agent
+      - build-windows-arm64-probe
+      - build-windows-arm64-enroll

README.md

@@ -23,7 +23,6 @@ Probe <──测量会话──> Agent ──长连接与数据上报──> Bac
 ## 快速开始
 
 ### 环境要求
-[README.md](backend/README.md)
 - .NET SDK 10；项目使用 `backend/global.json` 指定 SDK 版本和滚动策略。
 - Node.js 与 npm，用于构建 Web 前端。
 
@@ -43,7 +42,9 @@ npm ci --prefix web
 npm run build --prefix web
 ```
 
-前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 发布还需要对应平台的 C/C++ 工具链；Linux 发布脚本和 RID 说明见 [`docs/deployment.md`](docs/deployment.md)。
+前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 目标平台和 Windows 上使用 AotAnywhere 交叉构建的说明见 [`docs/deployment.md`](docs/deployment.md)。
+
+Backend 以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 发布 Linux glibc/musl x64、arm64，macOS x64/arm64，以及 Windows x64/arm64 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
 
 ### 本地运行
 

backend/Directory.Build.props

@@ -5,6 +5,8 @@
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <DebugType>none</DebugType>
+    <DebugSymbols>false</DebugSymbols>
     <AnalysisLevel>latest-recommended</AnalysisLevel>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <InvariantGlobalization>true</InvariantGlobalization>

backend/README.md

@@ -36,7 +36,9 @@ dotnet test --solution Monitor.slnx
 dotnet publish src/Monitor.Backend -c Release -r <RID> -p:PublishAot=true
 ```
 
-例如 `<RID>` 可为 `win-x64`、`linux-x64` 或 `linux-musl-x64`。NativeAOT 发布需要对应平台的 C/C++ 工具链。仓库根目录的 `scripts/publish.sh` 也提供发布和容器构建流程，详见 [`../docs/deployment.md`](../docs/deployment.md)。
+例如 `<RID>` 可为 `win-x64`、`linux-x64` 或 `linux-arm64`。NativeAOT 发布需要对应平台的 C/C++ 工具链。仓库根目录的 `scripts/publish.sh backend <RID>` 可构建单个平台的 Backend 可执行文件；容器发布由 Woodpecker tag 流水线完成，详见 [`../docs/deployment.md`](../docs/deployment.md)。
+
+正式发布通过 Woodpecker tag 流水线生成 Linux/amd64 与 Linux/arm64 OCI 镜像，容器内监听 `8080`，数据写入挂载的 `/data` 卷。Agent 与 Probe 的多平台二进制包单独发布，不包含在 Backend 镜像中。
 
 ## 本地运行
 

backend/agent/src/Monitor.Agent/Monitor.Agent.csproj

@@ -1,4 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <AssemblyName>monitor-agent</AssemblyName>
@@ -11,4 +14,7 @@
     <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
     <ProjectReference Include="..\..\..\shared\Monitor.Measurement\Monitor.Measurement.csproj" />
   </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
 </Project>

backend/fleet/tools/fleet-enroll/fleet-enroll.csproj

@@ -1,4 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <AssemblyName>fleet-enroll</AssemblyName>
@@ -8,4 +11,7 @@
   <ItemGroup>
     <ProjectReference Include="..\..\src\Fleet.Enrollment.Client\Fleet.Enrollment.Client.csproj" />
   </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
 </Project>

backend/global.json

@@ -3,6 +3,9 @@
     "version": "10.0.200",
     "rollForward": "latestFeature"
   },
+  "msbuild-sdks": {
+    "StuDev.AotAnywhere": "1.0.5"
+  },
   "test": {
     "runner": "Microsoft.Testing.Platform"
   }

backend/probe/src/Monitor.Probe/Monitor.Probe.csproj

@@ -1,4 +1,7 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.props" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <AssemblyName>monitor-probe</AssemblyName>
@@ -11,4 +14,7 @@
     <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
     <ProjectReference Include="..\..\..\shared\Monitor.Measurement\Monitor.Measurement.csproj" />
   </ItemGroup>
+  <Import Project="Sdk.targets" Sdk="Microsoft.NET.Sdk" />
+  <Import Project="Sdk.targets" Sdk="StuDev.AotAnywhere"
+          Condition="'$(RuntimeIdentifier)' == 'linux-x64' Or '$(RuntimeIdentifier)' == 'linux-arm64' Or '$(RuntimeIdentifier)' == 'linux-arm' Or '$(RuntimeIdentifier)' == 'linux-musl-x64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm64' Or '$(RuntimeIdentifier)' == 'linux-musl-arm' Or '$(RuntimeIdentifier)' == 'osx-x64' Or '$(RuntimeIdentifier)' == 'osx-arm64' Or '$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == 'win-arm64'" />
 </Project>

backend/tests/Monitor.Backend.Tests/AgentEndToEndTests.cs

@@ -252,9 +252,32 @@ public sealed class AgentEndToEndTests
         await using ProbeSimulator probe = await agent.ConnectProbeAsync();
         await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["probe_connected"]!.GetValue<bool>());
 
-        using HttpResponseMessage accepted = await _backend.Admin.PostAsync($"/api/admin/lines/{agent.Id}~{probe.ProbeId}/tests", BackendFixture.Json(new JsonObject { ["plan"] = "hy2_ladder", ["params"] = new JsonObject { ["size"] = 1000 } }));
-        Assert.True(accepted.StatusCode == System.Net.HttpStatusCode.Accepted, await accepted.Content.ReadAsStringAsync());
-        string testId = JsonNode.Parse(await accepted.Content.ReadAsStringAsync())!["id"]!.GetValue<string>();
+        HttpResponseMessage? accepted = null;
+        string? startFailure = null;
+        for (int attempt = 0; attempt < 5; attempt++)
+        {
+            accepted = await _backend.Admin.PostAsync($"/api/admin/lines/{agent.Id}~{probe.ProbeId}/tests", BackendFixture.Json(new JsonObject { ["plan"] = "hy2_ladder", ["params"] = new JsonObject { ["size"] = 1000 } }));
+            if (accepted.StatusCode == System.Net.HttpStatusCode.Accepted)
+            {
+                break;
+            }
+
+            startFailure = await accepted.Content.ReadAsStringAsync();
+            string? code = JsonNode.Parse(startFailure)?["code"]?.GetValue<string>();
+            accepted.Dispose();
+            accepted = null;
+            if (code != "probe_offline" || attempt == 4)
+            {
+                Assert.Fail($"The test request was rejected: {startFailure}");
+            }
+
+            await BackendFixture.EventuallyAsync(async () => (await AgentViewAsync(agent))["probe_connected"]!.GetValue<bool>(), TimeSpan.FromSeconds(15), "the probe should reconnect after a transient disconnect");
+        }
+
+        HttpResponseMessage acceptedResponse = accepted ?? throw new InvalidOperationException("The test request was not accepted.");
+        using (acceptedResponse)
+        {
+            string testId = JsonNode.Parse(await acceptedResponse.Content.ReadAsStringAsync())!["id"]!.GetValue<string>();
 
         JsonNode test = null!;
         await BackendFixture.EventuallyAsync(
@@ -273,6 +296,7 @@ public sealed class AgentEndToEndTests
         await BackendFixture.EventuallyAsync(
             async () => (await _backend.GetJsonAsync(_backend.Admin, $"/api/admin/raw/chunks?agent_id={agent.Id}"))["items"]!.AsArray().Count(c => c!["kind"]!.GetValue<string>() == "udp_train") == agent.App.Counters.Fragments,
             because: (await _backend.GetJsonAsync(_backend.Admin, $"/api/admin/events?agent_id={agent.Id}")).ToJsonString() + $" fragments={agent.App.Counters.Fragments} discarded={agent.App.Counters.FragmentsDiscarded} pending={agent.App.Link.Outbox.PendingCount}/{agent.App.Link.Outbox.PendingBytes} dropped={agent.App.Link.Outbox.Dropped} link={agent.App.Link.IsConnected}");
+        }
     }
 
     [Fact]

backend/tests/Monitor.Backend.Tests/ApiBasicsTests.cs

@@ -199,3 +199,6 @@ public sealed class ApiBasicsTests
 
 [CollectionDefinition("backend")]
 public sealed class BackendCollection : ICollectionFixture<BackendFixture>;
+
+[CollectionDefinition("probe-e2e")]
+public sealed class ProbeEndToEndCollection : ICollectionFixture<BackendFixture>;

backend/tests/Monitor.Backend.Tests/ArchitectureTests.cs

@@ -36,10 +36,13 @@ public sealed class ArchitectureTests
                     Path.GetFileNameWithoutExtension(path),
                     path,
                     Path.GetDirectoryName(path)!,
-                    [.. items.Where(e => e.Name == "ProjectReference").Select(e => Path.GetFileNameWithoutExtension((string?)e.Attribute("Include") ?? ""))],
+                    [.. items.Where(e => e.Name == "ProjectReference").Select(e => Path.GetFileNameWithoutExtension(NormalizePath((string?)e.Attribute("Include") ?? "")))],
                     [.. items.Where(e => e.Name == "PackageReference").Select(e => (string?)e.Attribute("Include") ?? "")]);
             })];
 
+    private static string NormalizePath(string path) =>
+        path.Replace('\\', Path.DirectorySeparatorChar).Replace('/', Path.DirectorySeparatorChar);
+
     private static bool IsTest(Project p) => p.Path.Contains(Path.DirectorySeparatorChar + "tests" + Path.DirectorySeparatorChar, StringComparison.Ordinal);
 
     private static bool IsFleet(Project p) => p.Name.StartsWith("Fleet.", StringComparison.Ordinal) && !IsTest(p);

backend/tests/Monitor.Backend.Tests/ProbeEndToEndTests.cs

@@ -3,7 +3,7 @@ using System.Text.Json.Nodes;
 namespace Monitor.Backend.Tests;
 
 /// <summary>真实的后端 + 真实的 Agent + 真实的 Probe（都在进程内，回环网络）。</summary>
-[Collection("backend")]
+[Collection("probe-e2e")]
 public sealed class ProbeEndToEndTests
 {
     private readonly BackendFixture _backend;

ci/Monitor.Tar/Monitor.Tar.csproj

@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+</Project>

ci/Monitor.Tar/Program.cs

@@ -0,0 +1,38 @@
+using System.Formats.Tar;
+using System.IO.Compression;
+
+if (args.Length < 3)
+{
+    Console.Error.WriteLine("usage: Monitor.Tar <source-directory> <archive-path> <executable-relative-path>...");
+    return 2;
+}
+
+string sourceDirectory = Path.GetFullPath(args[0]);
+string archivePath = Path.GetFullPath(args[1]);
+HashSet<string> executables = args.Skip(2).Select(path => path.Replace('\\', '/')).ToHashSet(StringComparer.Ordinal);
+UnixFileMode executableMode = UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute |
+                              UnixFileMode.GroupRead | UnixFileMode.GroupExecute |
+                              UnixFileMode.OtherRead | UnixFileMode.OtherExecute;
+UnixFileMode regularMode = UnixFileMode.UserRead | UnixFileMode.UserWrite |
+                           UnixFileMode.GroupRead | UnixFileMode.OtherRead;
+
+Directory.CreateDirectory(Path.GetDirectoryName(archivePath)!);
+using FileStream fileStream = File.Create(archivePath);
+using GZipStream gzipStream = new(fileStream, CompressionLevel.Optimal, leaveOpen: true);
+using TarWriter writer = new(gzipStream, TarEntryFormat.Pax, leaveOpen: true);
+
+foreach (string filePath in Directory.EnumerateFiles(sourceDirectory, "*", SearchOption.AllDirectories))
+{
+    string relativePath = Path.GetRelativePath(sourceDirectory, filePath).Replace('\\', '/');
+    PaxTarEntry entry = new(TarEntryType.RegularFile, relativePath)
+    {
+        Mode = executables.Contains(relativePath) ? executableMode : regularMode,
+        DataStream = File.OpenRead(filePath)
+    };
+    using (entry.DataStream)
+    {
+        writer.WriteEntry(entry);
+    }
+}
+
+return 0;

ci/index-backend-image.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Publish a multi-architecture OCI index for the two architecture-specific
+# Backend images already pushed by release-linux.sh.
+set -euo pipefail
+
+version="${CI_COMMIT_TAG#v}"
+[[ "${CI_COMMIT_TAG:-}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+scheme="${ZOT_SCHEME:-http}"
+image="monitor/monitor-backend"
+auth_file="$(mktemp)"
+chmod 600 "$auth_file"
+trap 'rm -f "$auth_file"' EXIT
+printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_PASSWORD" > "$auth_file"
+
+accept='application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json'
+
+manifest_head() {
+  local tag="$1"
+  curl --silent --show-error --fail --head --netrc-file "$auth_file" \
+    -H "Accept: $accept" "$scheme://$registry/v2/$image/manifests/$tag" \
+    | tr -d '\r' | awk '
+      tolower($1)=="docker-content-digest:" { digest=$2 }
+      tolower($1)=="content-length:" { size=$2 }
+      tolower($1)=="content-type:" { media=$2 }
+      END { if (digest && size && media) print digest, size, media; else exit 1 }'
+}
+
+amd="$(manifest_head "$version-amd64")"
+arm="$(manifest_head "$version-arm64")"
+read -r amd_digest amd_size amd_media <<< "$amd"
+read -r arm_digest arm_size arm_media <<< "$arm"
+index_media='application/vnd.oci.image.index.v1+json'
+body="$(printf '{"schemaVersion":2,"mediaType":"%s","manifests":[{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"%s","digest":"%s","size":%s,"platform":{"architecture":"arm64","os":"linux"}}]}' \
+  "$index_media" "$amd_media" "$amd_digest" "$amd_size" "$arm_media" "$arm_digest" "$arm_size")"
+
+put_tag() {
+  local tag="$1" code
+  code="$(curl --silent --show-error --netrc-file "$auth_file" -o /dev/null -w '%{http_code}' \
+    -H "Content-Type: $index_media" -X PUT --data-binary "$body" \
+    "$scheme://$registry/v2/$image/manifests/$tag")"
+  case "$code" in
+    200|201) echo "published $image:$tag" ;;
+    *) echo "failed to publish $image:$tag (HTTP $code)" >&2; return 1 ;;
+  esac
+}
+
+put_tag "$version"
+if [[ "$version" != *-* ]]; then
+  put_tag latest
+fi

ci/package-cross-platform.ps1

@@ -0,0 +1,172 @@
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
+    throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
+}
+if (-not $env:GITEA_TOKEN) {
+    throw 'GITEA_TOKEN is required.'
+}
+$version = $Matches[1]
+$root = Split-Path -Parent $PSScriptRoot
+$backend = Join-Path $root 'backend'
+$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '<Version>([^<]+)</Version>').Groups[1].Value
+if ($version -ne $projectVersion) {
+    throw "Tag version $version does not match project version $projectVersion."
+}
+
+$tarProject = Join-Path $PSScriptRoot 'Monitor.Tar\Monitor.Tar.csproj'
+$tarTool = Join-Path $PSScriptRoot 'Monitor.Tar\bin\Release\net10.0\Monitor.Tar.dll'
+& dotnet build $tarProject -c Release --nologo
+if ($LASTEXITCODE -ne 0) {
+    throw 'Could not build the cross-platform tar helper.'
+}
+$giteaBase = if ($env:GITEA_BASE) { $env:GITEA_BASE.TrimEnd('/') } else { 'http://localhost:3100' }
+$netrc = Join-Path $env:TEMP ("monitor-gitea-$([guid]::NewGuid().ToString('N')).netrc")
+$giteaHost = ([Uri]$giteaBase).Host
+Set-Content -LiteralPath $netrc -Value "machine $giteaHost login justme password $($env:GITEA_TOKEN)" -Encoding ascii -NoNewline
+
+function New-TarGzArchive([string]$SourceDirectory, [string]$ArchivePath, [string[]]$Executables) {
+    & dotnet $tarTool $SourceDirectory $ArchivePath @Executables
+    if ($LASTEXITCODE -ne 0) {
+        throw "Could not create tar archive $ArchivePath."
+    }
+}
+
+try {
+    $targets = @(
+        @{ Rid = 'linux-x64'; Os = 'linux'; Arch = 'amd64'; Windows = $false },
+        @{ Rid = 'linux-arm64'; Os = 'linux'; Arch = 'arm64'; Windows = $false },
+        @{ Rid = 'linux-musl-x64'; Os = 'linux'; Arch = 'musl-amd64'; Windows = $false },
+        @{ Rid = 'linux-musl-arm64'; Os = 'linux'; Arch = 'musl-arm64'; Windows = $false },
+        @{ Rid = 'osx-x64'; Os = 'macos'; Arch = 'x64'; Windows = $false },
+        @{ Rid = 'osx-arm64'; Os = 'macos'; Arch = 'arm64'; Windows = $false },
+        @{ Rid = 'win-x64'; Os = 'windows'; Arch = 'amd64'; Windows = $true },
+        @{ Rid = 'win-arm64'; Os = 'windows'; Arch = 'arm64'; Windows = $true }
+    )
+    $packageRoot = Join-Path $root '.release\packages'
+    $null = New-Item -ItemType Directory -Force -Path $packageRoot
+    $uploadFiles = [System.Collections.Generic.List[string]]::new()
+    foreach ($target in $targets) {
+        $agentDirectory = Join-Path $root ".release\publish\$($target.Rid)\agent"
+        $probeDirectory = Join-Path $root ".release\publish\$($target.Rid)\probe"
+        $enrollDirectory = Join-Path $root ".release\publish\$($target.Rid)\fleet-enroll"
+        foreach ($path in @($agentDirectory, $probeDirectory, $enrollDirectory)) {
+            if (-not (Test-Path -LiteralPath $path -PathType Container)) {
+                throw "Build output is missing: $path"
+            }
+        }
+
+        foreach ($role in @('agent', 'probe')) {
+            $stage = Join-Path $root ".release\stage\$($target.Rid)\$role"
+            $null = New-Item -ItemType Directory -Force -Path $stage
+            $extension = if ($target.Windows) { '.exe' } else { '' }
+            Copy-Item -LiteralPath (Join-Path (Join-Path $root ".release\publish\$($target.Rid)\$role") "monitor-$role$extension") -Destination $stage
+            Copy-Item -LiteralPath (Join-Path $root 'LICENSE') -Destination $stage
+            Copy-Item -LiteralPath (Join-Path $root "backend\$role\README.md") -Destination $stage
+
+            $executables = @("monitor-$role$extension")
+            if ($role -eq 'agent') {
+                $enrollName = if ($target.Windows) { 'fleet-enroll.exe' } else { 'fleet-enroll' }
+                Copy-Item -LiteralPath (Join-Path $enrollDirectory $enrollName) -Destination $stage
+                $executables += $enrollName
+            }
+            if ($target.Os -eq 'linux') {
+                Copy-Item -LiteralPath (Join-Path $root 'packaging/install.sh') -Destination $stage
+                $executables += 'install.sh'
+                $systemd = Join-Path $stage 'systemd'
+                $null = New-Item -ItemType Directory -Force -Path $systemd
+                Copy-Item -LiteralPath (Join-Path $root "packaging/systemd/monitor-$role.service") -Destination $systemd
+                if ($role -eq 'probe') {
+                    $openwrt = Join-Path $stage 'openwrt'
+                    $null = New-Item -ItemType Directory -Force -Path $openwrt
+                    Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor-probe.init') -Destination $openwrt
+                    Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor.keep') -Destination $openwrt
+                }
+            }
+            elseif ($target.Os -eq 'macos') {
+                @'
+This macOS NativeAOT binary is not signed with a Developer ID certificate and
+has not been notarized by Apple. Apple Silicon builds receive an ad-hoc code
+signature; Intel builds are unsigned. Gatekeeper may block browser-downloaded
+files. A Developer ID signature and notarization are required for a seamless
+consumer install.
+'@ | Set-Content -LiteralPath (Join-Path $stage 'MACOS-SECURITY.txt') -Encoding utf8
+            }
+
+            $archiveName = if ($target.Windows) { "monitor-$role-v$version-windows-$($target.Arch).zip" } else { "monitor-$role-v$version-$($target.Os)-$($target.Arch).tar.gz" }
+            $archive = Join-Path $packageRoot $archiveName
+            if ($target.Windows) {
+                Compress-Archive -Path (Join-Path $stage '*') -DestinationPath $archive -CompressionLevel Optimal -Force
+            }
+            else {
+                New-TarGzArchive $stage $archive $executables
+            }
+            $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
+            $checksum = "$hash  $archiveName`n"
+            $checksumPath = "$archive.sha256"
+            [IO.File]::WriteAllText($checksumPath, $checksum, [Text.UTF8Encoding]::new($false))
+            [void]$uploadFiles.Add($archive)
+            [void]$uploadFiles.Add($checksumPath)
+        }
+    }
+
+    $uploadScript = @'
+param([string]$File, [string]$Base, [string]$PackageVersion, [string]$Netrc)
+$ErrorActionPreference = 'Stop'
+$name = [IO.Path]::GetFileName($File)
+$url = "$Base/api/packages/justme/generic/monitor-node/$PackageVersion/$name"
+$status = & curl.exe --silent --show-error --retry 3 --netrc-file $Netrc --upload-file $File --output NUL --write-out '%{http_code}' $url
+if ($LASTEXITCODE -ne 0) {
+    throw "Gitea package upload failed for $name (curl exit $LASTEXITCODE)."
+}
+if ($status -match '^2') {
+    "uploaded Gitea package $name"
+}
+elseif ($status -eq '409') {
+    "Gitea package $name already exists; reusing the existing release file"
+}
+else {
+    throw "Gitea package upload failed for $name (HTTP $status)."
+}
+'@
+    $runspacePool = [RunspaceFactory]::CreateRunspacePool(1, 8)
+    $runspacePool.Open()
+    $pendingUploads = [System.Collections.Generic.List[object]]::new()
+    try {
+        foreach ($file in $uploadFiles) {
+            $powerShell = [PowerShell]::Create()
+            $powerShell.RunspacePool = $runspacePool
+            [void]$powerShell.AddScript($uploadScript).AddArgument($file).AddArgument($giteaBase).AddArgument($version).AddArgument($netrc)
+            $pendingUploads.Add([pscustomobject]@{ PowerShell = $powerShell; Handle = $powerShell.BeginInvoke() })
+        }
+
+        $uploadErrors = [System.Collections.Generic.List[string]]::new()
+        foreach ($pending in $pendingUploads) {
+            try {
+                foreach ($message in $pending.PowerShell.EndInvoke($pending.Handle)) {
+                    Write-Output $message
+                }
+                foreach ($errorRecord in $pending.PowerShell.Streams.Error) {
+                    $uploadErrors.Add($errorRecord.ToString())
+                }
+            }
+            catch {
+                $uploadErrors.Add($_.Exception.Message)
+            }
+        }
+        if ($uploadErrors.Count -gt 0) {
+            throw "One or more Gitea package uploads failed:`n$($uploadErrors -join "`n")"
+        }
+    }
+    finally {
+        foreach ($pending in $pendingUploads) {
+            $pending.PowerShell.Dispose()
+        }
+        $runspacePool.Close()
+        $runspacePool.Dispose()
+    }
+}
+finally {
+    Remove-Item -LiteralPath $netrc -Force -ErrorAction SilentlyContinue
+}

ci/publish-gitea-release.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Create/update the Gitea Release after all platform package workflows succeed.
+set -euo pipefail
+
+tag="${CI_COMMIT_TAG:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+
+version="${tag#v}"
+gitea_base="${GITEA_BASE:-http://192.168.2.162:3100}"
+gitea_base="${gitea_base%/}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+api="$gitea_base/api/v1/repos/justme/MyMonitor"
+tmp="$(mktemp -d)"
+netrc="$tmp/netrc"
+release_json="$tmp/release.json"
+assets_json="$tmp/assets.json"
+chmod 700 "$tmp"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+chmod 600 "$netrc"
+trap 'rm -rf "$tmp"' EXIT
+
+release_body="Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). macOS binaries are not Developer ID signed or notarized. Backend OCI images: registry.oeo.one/monitor/monitor-backend:$version (linux/amd64 and linux/arm64)."
+payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MyMonitor %s","body":"%s","draft":false,"prerelease":false}' \
+  "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
+release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+  --output "$release_json" --write-out '%{http_code}' "$api/releases/tags/$tag")"
+release_created=false
+if [[ "$release_status" == 404 ]]; then
+  release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+    --header 'Content-Type: application/json' --data "$payload" \
+    --output "$release_json" --write-out '%{http_code}' "$api/releases")"
+  release_created=true
+fi
+[[ "$release_status" =~ ^2 ]] || {
+  echo "Gitea Release lookup/create failed (HTTP $release_status)" >&2
+  cat "$release_json" >&2
+  exit 1
+}
+release_id="$(grep -o '"id":[[:space:]]*[0-9][0-9]*' "$release_json" | head -1 | tr -cd '0-9')"
+[[ -n "$release_id" ]] || { echo "Could not read Gitea Release ID" >&2; exit 1; }
+if [[ "$release_created" == false ]]; then
+  update_response="$tmp/release-update.json"
+  update_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+    --request PATCH --header 'Content-Type: application/json' --data "$payload" \
+    --output "$update_response" --write-out '%{http_code}' "$api/releases/$release_id")"
+  [[ "$update_status" =~ ^2 ]] || {
+    echo "Gitea Release update failed (HTTP $update_status)" >&2
+    cat "$update_response" >&2
+    exit 1
+  }
+fi
+curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+  "$api/releases/$release_id/assets" -o "$assets_json"
+
+assets=(
+  "monitor-agent-v$version-linux-amd64.tar.gz"
+  "monitor-agent-v$version-linux-arm64.tar.gz"
+  "monitor-probe-v$version-linux-amd64.tar.gz"
+  "monitor-probe-v$version-linux-arm64.tar.gz"
+  "monitor-agent-v$version-linux-musl-amd64.tar.gz"
+  "monitor-probe-v$version-linux-musl-amd64.tar.gz"
+  "monitor-agent-v$version-linux-musl-arm64.tar.gz"
+  "monitor-probe-v$version-linux-musl-arm64.tar.gz"
+  "monitor-agent-v$version-macos-x64.tar.gz"
+  "monitor-probe-v$version-macos-x64.tar.gz"
+  "monitor-agent-v$version-macos-arm64.tar.gz"
+  "monitor-probe-v$version-macos-arm64.tar.gz"
+  "monitor-agent-v$version-windows-amd64.zip"
+  "monitor-agent-v$version-windows-arm64.zip"
+  "monitor-probe-v$version-windows-amd64.zip"
+  "monitor-probe-v$version-windows-arm64.zip"
+)
+
+upload_release_asset() {
+  local name="$1" file="$tmp/$1" upload_response="$tmp/$1.upload.json" status
+  curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+    "$gitea_base/api/packages/justme/generic/monitor-node/$version/$name" -o "$file"
+  status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \
+    --request POST --header 'Content-Type: application/octet-stream' --data-binary "@$file" \
+    --output "$upload_response" --write-out '%{http_code}' \
+    "$api/releases/$release_id/assets?name=$name")"
+  case "$status" in
+    2*) echo "attached $name" ;;
+    *) echo "Gitea Release asset upload failed for $name (HTTP $status)" >&2; cat "$upload_response" >&2; return 1 ;;
+  esac
+}
+
+pids=()
+for archive in "${assets[@]}"; do
+  for name in "$archive" "$archive.sha256"; do
+    if grep -Eq "\"name\"[[:space:]]*:[[:space:]]*\"$name\"" "$assets_json"; then
+      echo "release asset $name already exists; keeping the existing asset"
+      continue
+    fi
+    upload_release_asset "$name" &
+    pids+=("$!")
+    if ((${#pids[@]} >= 8)); then
+      wait "${pids[0]}"
+      pids=("${pids[@]:1}")
+    fi
+  done
+done
+for pid in "${pids[@]}"; do
+  wait "$pid"
+done
+
+echo "published Gitea Release $tag: https://git.oeo.one/justme/MyMonitor/releases/tag/$tag"

ci/release-cross-platform.ps1

@@ -0,0 +1,75 @@
+param(
+    [Parameter(Mandatory)]
+    [ValidateSet(
+        'linux-x64', 'linux-arm64',
+        'linux-musl-x64', 'linux-musl-arm64',
+        'osx-x64', 'osx-arm64', 'win-x64', 'win-arm64'
+    )]
+    [string]$RuntimeIdentifier,
+    [Parameter(Mandatory)]
+    [ValidateSet('agent', 'probe', 'fleet-enroll')]
+    [string]$Component
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
+    throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
+}
+$version = $Matches[1]
+$root = Split-Path -Parent $PSScriptRoot
+$backend = Join-Path $root 'backend'
+$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '<Version>([^<]+)</Version>').Groups[1].Value
+if ($version -ne $projectVersion) {
+    throw "Tag version $version does not match project version $projectVersion."
+}
+
+if ($RuntimeIdentifier -in @('win-x64', 'win-arm64')) {
+    $vcArchitecture = if ($RuntimeIdentifier -eq 'win-x64') { 'x64' } else { 'arm64' }
+    $vsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+    $vsPath = & $vsWhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+    if (-not $vsPath) {
+        throw 'Visual Studio C++ Build Tools were not found.'
+    }
+    $devCmd = Join-Path $vsPath 'Common7\Tools\VsDevCmd.bat'
+    $environmentLines = & cmd.exe /d /s /c "call `"$devCmd`" -no_logo -arch=$vcArchitecture -host_arch=x64 && set"
+    foreach ($line in $environmentLines) {
+        $separator = $line.IndexOf('=')
+        if ($separator -gt 0) {
+            [Environment]::SetEnvironmentVariable($line.Substring(0, $separator), $line.Substring($separator + 1), 'Process')
+        }
+    }
+}
+
+$project = switch ($Component) {
+    'agent' { 'agent/src/Monitor.Agent' }
+    'probe' { 'probe/src/Monitor.Probe' }
+    'fleet-enroll' { 'fleet/tools/fleet-enroll' }
+}
+$output = Join-Path $root ".release\publish\$RuntimeIdentifier\$Component"
+$buildRoot = Join-Path $root ".release\build\$RuntimeIdentifier-$Component"
+$null = New-Item -ItemType Directory -Force -Path $output
+
+Push-Location $backend
+try {
+    & dotnet publish $project `
+        -m:1 `
+        -c Release `
+        -r $RuntimeIdentifier `
+        --self-contained true `
+        -p:PublishAot=true `
+        -p:StripSymbols=true `
+        -p:DebugType=none `
+        -p:DebugSymbols=false `
+        --artifacts-path $buildRoot `
+        -o $output
+    if ($LASTEXITCODE -ne 0) {
+        throw "NativeAOT publish failed for $project ($RuntimeIdentifier)."
+    }
+}
+finally {
+    Pop-Location
+}
+
+Write-Output "built $Component for $RuntimeIdentifier"

ci/release-linux.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Publish one framework-dependent Backend OCI image for the requested arch.
+set -euo pipefail
+
+arch="${1:?usage: release-linux.sh <amd64|arm64>}"
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tag="${CI_COMMIT_TAG:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || {
+  echo "Zot credentials are required" >&2; exit 2;
+}
+case "$arch" in
+  amd64|arm64) ;;
+  *) echo "unsupported architecture: $arch" >&2; exit 2 ;;
+esac
+
+version="${tag#v}"
+project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
+if [[ "$version" != "$project_version" ]]; then
+  echo "tag version $version does not match project version $project_version" >&2
+  exit 1
+fi
+
+registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+image="$registry/monitor/monitor-backend"
+output="$root/.release/linux-$arch/backend"
+build_root="$root/.release/build/linux-$arch-backend"
+container_context="$root/.release/container/linux-$arch"
+mkdir -p "$output" "$build_root" "$container_context/app" "$container_context/data"
+
+(cd "$root/backend" && dotnet publish src/Monitor.Backend \
+  -m:3 -c Release --no-self-contained \
+  -p:DebugType=none -p:DebugSymbols=false \
+  -p:UseAppHost=false -p:OpenApiGenerateDocuments=false \
+  --artifacts-path "$build_root" -o "$output")
+find "$output" -type f -name '*.pdb' -delete
+cp -a "$output/." "$container_context/app/"
+: > "$container_context/data/.keep"
+
+export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
+mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
+logged_in=false
+for attempt in 1 2 3 4; do
+  if buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null; then
+    logged_in=true
+    break
+  fi
+  if [[ "$attempt" -lt 4 ]]; then
+    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+    sleep 3
+  fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+local_image="localhost/monitor-backend:$version-$arch"
+buildah bud --tls-verify=false --arch "$arch" \
+  --build-arg "APP_VERSION=$version" \
+  -f "$root/packaging/container/Backend.Containerfile" \
+  -t "$local_image" "$container_context" >/dev/null
+pushed=false
+for attempt in 1 2 3; do
+  if buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null; then
+    pushed=true
+    break
+  fi
+  if [[ "$attempt" -lt 3 ]]; then
+    echo "Zot push attempt $attempt failed; retrying in 5 seconds" >&2
+    sleep 5
+  fi
+done
+[[ "$pushed" == true ]] || { echo "could not push image to Zot after 3 attempts" >&2; exit 1; }
+echo "pushed Zot image $image:$version-$arch"

compose.yaml

@@ -0,0 +1,26 @@
+services:
+  backend:
+    image: registry.oeo.one/monitor/monitor-backend:${MONITOR_VERSION:-0.1.0}
+    container_name: monitor-backend
+    restart: unless-stopped
+    init: true
+    ports:
+      - "127.0.0.1:8080:8080"
+    environment:
+      ASPNETCORE_HTTP_PORTS: "8080"
+      Monitor__DataDirectory: /data
+      Monitor__InitialAdminUser: ${MONITOR_ADMIN_USER:-admin}
+      Monitor__InitialAdminPassword: "${MONITOR_ADMIN_PASSWORD:?Set MONITOR_ADMIN_PASSWORD in the environment}"
+    volumes:
+      - monitor-data:/data
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    stop_grace_period: 30s
+
+volumes:
+  monitor-data:

docs/deployment.md

@@ -11,12 +11,32 @@ scripts/package.sh <agent|probe> <rid>                           → backend/art
 
 | rid | 目标 | 构建方式 |
 | --- | --- | --- |
-| `linux-musl-x64` | Alpine、OpenWrt x86 | Alpine 的 NativeAOT SDK 容器（任何有 Docker 的主机，包括 Windows） |
-| `linux-x64` | Debian、Ubuntu 等 glibc 发行版 | Ubuntu noble 的 NativeAOT SDK 容器 |
-| `win-x64` | Windows | 在 Windows 上直接 `dotnet publish -p:PublishAot=true`（需要 VS 的 C++ 工具链，`vswhere.exe` 所在目录要在 PATH 里） |
-| `linux-musl-arm64`、`linux-arm64` | 路由器、树莓派 | 需要在 arm64 主机（或 CI 的 arm64 runner）上运行同一个脚本；脚本在 x64 主机上会拒绝并说明 |
+| `linux-x64`、`linux-arm64` | Debian/Ubuntu glibc 服务器 | Windows CI 主机通过 AotAnywhere 交叉编译 |
+| `linux-musl-x64`、`linux-musl-arm64` | Alpine、amd64 OpenWrt、aarch64 OpenWrt 路由器 | Windows CI 主机通过 AotAnywhere 交叉编译 |
+| `osx-x64`、`osx-arm64` | Intel Mac、Apple Silicon | Windows CI 主机通过 AotAnywhere 交叉编译；发布包未做 Developer ID 签名或 Apple 公证 |
+| `win-x64`、`win-arm64` | Windows x64、ARM64 | Windows CI 主机上的 Visual Studio C++ 工具链 |
 
-NativeAOT 不能交叉编译到别的操作系统；MIPS 不支持（见 `project-layout.md`）。
+macOS 的 Apple Silicon 产物带临时 ad-hoc 签名，Intel 产物未签名。通过浏览器下载时，macOS Gatekeeper 可能阻止启动；面向普通用户分发前需要 Developer ID 签名和 Apple 公证。MIPS 不在当前目标列表中（见 `project-layout.md`）。
+
+仓库内的 `scripts/publish.sh` 面向本机目标平台；Woodpecker 的 tag 流水线在 Windows runner 上构建 Agent、Probe 和 `fleet-enroll` 的所有发布目标，Backend OCI 镜像仍在 Linux runner 上构建。
+
+## Backend 容器
+
+Backend 使用 OCI 标准镜像，通过 `registry.oeo.one/monitor/monitor-backend:<version>` 分发，支持 `linux/amd64` 和 `linux/arm64`。容器基于 .NET 10 ASP.NET noble-chiseled-extra 运行时镜像，以非 root 用户运行，在 `8080/tcp` 提供 HTTP 服务；数据库和原始数据统一写入 `/data`。`extra` 变体带 IANA 时区数据，供按时区查询使用。将 `/data` 挂载为持久卷，并在反向代理处配置 HTTPS。
+
+在部署目录保存此仓库的 `compose.yaml`，先通过部署平台的环境变量或密钥管理设置 `MONITOR_ADMIN_PASSWORD`（可选设置 `MONITOR_ADMIN_USER`、`MONITOR_VERSION`），然后启动：
+
+```sh
+docker compose up -d
+```
+
+Compose 将容器端口只绑定到宿主机 `127.0.0.1:8080`，适合由同机 HTTPS 反向代理转发；数据保存在 Docker 命名卷 `monitor-data`。首次启动成功创建管理员后，改密应在管理端完成。
+
+健康检查端点为 `GET /healthz`。容器定义见 [`../packaging/container/Backend.Containerfile`](../packaging/container/Backend.Containerfile)。
+
+## 节点二进制发布
+
+Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上，由 Windows runner 使用 AotAnywhere 并行构建 Agent/Probe 的 Linux glibc、Linux musl、macOS 和 Windows 产物。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 归档带有安装脚本和 systemd/OpenWrt 单元；Windows 产物为 `.zip`，Linux/macOS 产物为 `.tar.gz`。所有平台产物和 Backend OCI 镜像成功后，CI 会创建对应的 Gitea Release，并附上压缩包和 SHA-256 校验文件。macOS 产物目前未签名/公证。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
 
 实测体积（`StackTraceSupport=false`、`IlcFoldIdenticalMethodBodies=true`、`OptimizationPreference=Size`）：
 

packaging/container/Backend.Containerfile

@@ -0,0 +1,20 @@
+FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=unknown
+LABEL org.opencontainers.image.title="Monitor Backend" \
+      org.opencontainers.image.description="Self-hosted network path quality monitoring backend" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="$APP_VERSION"
+
+WORKDIR /app
+COPY --chown=1654:1654 app/ /app/
+COPY --chown=1654:1654 data/.keep /data/.keep
+
+ENV ASPNETCORE_HTTP_PORTS=8080 \
+    Monitor__DataDirectory=/data \
+    DOTNET_EnableDiagnostics=0
+
+USER 1654:1654
+VOLUME ["/data"]
+EXPOSE 8080
+ENTRYPOINT ["dotnet", "/app/monitor-backend.dll"]

scripts/publish.sh

@@ -17,7 +17,7 @@ case "$project" in
 esac
 
 out="backend/artifacts/publish/$project/$rid"
-args=(publish "$csproj" -c Release -r "$rid" -p:PublishAot=true -p:DebugType=none -o "/src/$out" --artifacts-path /artifacts -nologo -v q)
+args=(publish "$csproj" -c Release -r "$rid" -p:PublishAot=true -p:DebugType=none -p:DebugSymbols=false -o "/src/$out" --artifacts-path /artifacts -nologo -v q)
 
 case "$rid" in
   linux-musl-x64)
@@ -34,7 +34,7 @@ case "$rid" in
     ;;
   *)
     cd "$root/backend"  # global.json 在 backend/ 下
-    dotnet publish "${csproj#backend/}" -c Release -r "$rid" -p:PublishAot=true -o "$root/$out" -nologo -v q
+    dotnet publish "${csproj#backend/}" -c Release -r "$rid" -p:PublishAot=true -p:DebugType=none -p:DebugSymbols=false -o "$root/$out" -nologo -v q
     ;;
 esac