Ci/discord release announce

[whes1015]

這個 PR 做了什麼

相關 issue

• closes #

怎麼驗

檢查清單

• tool/check/commits.sh origin/main..HEAD 通過
  —— commit 訊息就是更新日誌，格式見 commit.md
• 一個 commit 一件事（這條 gate 驗不了，靠自己和 review）
• mise exec -- flutter analyze 與 mise exec -- flutter test 通過
• 新的使用者可見字串都走 AppLocalizations，沒有寫死
• 有 UI 變更的話：用的是 AppSpacing / AppRadius / AppMotion，
  深色模式看過，文字對比度可接受

[github-actions]

🔍 OpenCodeReview found 5 issue(s) in this PR.

• ✅ Successfully posted inline: 5 comment(s)

[github-actions]

建議將 ${{ steps.publish.outputs.tag }} 透過環境變數傳遞，而非直接在 run 腳本中使用 GitHub Actions 表達式。這可以避免潛在的指令注入（Script Injection）風險。雖然 release 的 tag 通常是可信的，但為了符合安全最佳實踐，建議將所有外部輸入（包含 step outputs）透過 env 區塊傳遞，以確保 shell 執行時將其視為純字串。

Suggestion:

Suggested change

	python3 tool/release/discord.py "${{ steps.publish.outputs.tag }}" ||
	echo "::warning::Discord announcement failed — the release itself is fine"
	env:
	DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
	DPIP_EMOJI_ANDROID: "<:android:1539201870935892028>"
	DPIP_EMOJI_IOS: "<:ios:1539201897766981692>"
	GITHUB_TOKEN: ${{ github.token }}
	TAG: ${{ steps.publish.outputs.tag }}
	run: |
	if [ -z "${DISCORD_WEBHOOK:-}" ]; then
	echo "::notice::DISCORD_WEBHOOK is not set — nothing announced"
	exit 0
	fi
	python3 tool/release/discord.py "$TAG" ||
	echo "::warning::Discord announcement failed — the release itself is fine"

[github-actions]

建議將 ${{ steps.publish.outputs.tag }} 透過環境變數傳遞，而非直接在 run 腳本中使用 GitHub Actions 表達式。這可以避免潛在的指令注入（Script Injection）風險。雖然 release 的 tag 通常是可信的，但為了符合安全最佳實踐，建議將所有外部輸入（包含 step outputs）透過 env 區塊傳遞，以確保 shell 執行時將其視為純字串。

Suggestion:

Suggested change

	python3 tool/release/discord.py "${{ steps.publish.outputs.tag }}" ||
	echo "::warning::Discord announcement failed — the release itself is fine"
	env:
	DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
	DPIP_EMOJI_ANDROID: "<:android:1539201870935892028>"
	DPIP_EMOJI_IOS: "<:ios:1539201897766981692>"
	GITHUB_TOKEN: ${{ github.token }}
	TAG: ${{ steps.publish.outputs.tag }}
	run: |
	if [ -z "${DISCORD_WEBHOOK:-}" ]; then
	echo "::notice::DISCORD_WEBHOOK is not set — nothing announced"
	exit 0
	fi
	python3 tool/release/discord.py "$TAG" ||
	echo "::warning::Discord announcement failed — the release itself is fine"

[github-actions]

在 api 函數中，raise AssertionError("unreachable") 是死碼 (Dead Code)。根據迴圈內的邏輯，當嘗試次數達到上限 (attempt == 2) 時，程式會透過 raise 拋出異常，因此迴圈永遠不會在不拋出異常的情況下正常結束，該行程式碼永遠不會被執行。

[github-actions]

在 fit 函數中，若 room 的值小於 20，room - 20 會為負數。在 rfind(sub, start, end) 中，當 end 為負數時，它代表從字串末尾開始的偏移量。這會導致搜尋範圍出錯，且若 cut 為正數，回傳的字串長度可能依然遠超 room 的限制，違反了截斷字串的初衷。建議加入 max(0, room - 20) 或對 room 的大小進行檢查。

Suggestion:

Suggested change

	def fit(text: str, room: int) -> str:
	"""The per-embed backstop: [share] bounds the message, this bounds one embed.
	Cut on an item boundary. A description cut at the character limit ends
	inside somebody's changelog entry, which reads as a bug in that entry
	rather than as a limit in Discord.
	"""
	if len(text) <= room:
	return text
	cut = text.rfind("\n", 0, room - 20)
	return text[: cut if cut > 0 else room - 20].rstrip() + "\n…"
	def fit(text: str, room: int) -> str:
	if len(text) <= room:
	return text
	search_end = max(0, room - 20)
	cut = text.rfind("\n", 0, search_end)
	return text[: cut if cut > 0 else search_end].rstrip() + "\n…"

[github-actions]

api 函數與 main 函數中的 urllib.request.urlopen 呼叫僅捕捉了 urllib.error.HTTPError。當發生網路連線失敗、DNS 解析問題或連線超時等非 HTTP 錯誤時，會拋出 urllib.error.URLError，這會導致腳本直接崩潰並顯示 Traceback。建議一併捕捉 urllib.error.URLError 以提供更穩定的錯誤處理。

Suggestion:

Suggested change

	try:
	with urllib.request.urlopen(request, timeout=20) as response:
	print(f"discord: HTTP {response.status}")
	return 0
	except urllib.error.HTTPError as error:
	# Discord says what it disliked in the body; the exception alone says
	# only the number, and a stack trace here names urllib rather than the
	# field it rejected.
	print(f"discord: HTTP {error.code}", file=sys.stderr)
	print(error.read().decode(errors="replace")[:800], file=sys.stderr)
	return 1
	try:
	with urllib.request.urlopen(request, timeout=20) as response:
	print(f"discord: HTTP {response.status}")
	return 0
	except (urllib.error.HTTPError, urllib.error.URLError) as error:
	if isinstance(error, urllib.error.HTTPError):
	print(f"discord: HTTP {error.code}", file=sys.stderr)
	print(error.read().decode(errors="replace")[:800], file=sys.stderr)
	else:
	print(f"discord: Network error: {error}", file=sys.stderr)
	return 1