fix(ci): pre-release placeholder + fix latest.yml arm64 overwrite

- Add prepare-release job: immediately marks release as pre-release
  with "正在构建中，请勿下载" notice; all build jobs depend on it
- Fix arm64 job channel override: use -c.publish.channel=latest-arm64
  (correct syntax) instead of broken single-quoted CLI arg
- Fix artifactName quoting for both win x64 and arm64 jobs
- Add "Fix latest.yml" step in update-release-notes: downloads x64 exe,
  computes correct sha512/size, uploads latest.yml with --clobber
- Final step in update-release-notes: remove prerelease flag, mark as
  latest official release

Fixes #553

.github/workflows/release.yml

@@ -12,8 +12,27 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
 jobs:
+  prepare-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Mark release as pre-release (building)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG="$GITHUB_REF_NAME"
+          REPO="$GITHUB_REPOSITORY"
+          # Create or update the release as a pre-release with a placeholder note
+          if gh release view "$TAG" --repo "$REPO" > /dev/null 2>&1; then
+            gh release edit "$TAG" --repo "$REPO" --prerelease --notes $'## ⚠️ 正在自动构建中，请勿下载\n\n各平台安装包正在构建，完成后将自动更新本页面并正式发布。\n\n**请勿在此期间下载任何文件。**'
+          else
+            gh release create "$TAG" --repo "$REPO" --prerelease --title "$TAG" --notes $'## ⚠️ 正在自动构建中，请勿下载\n\n各平台安装包正在构建，完成后将自动更新本页面并正式发布。\n\n**请勿在此期间下载任何文件。**'
+          fi
+
   release-mac-arm64:
     runs-on: macos-14
+    needs: prepare-release
 
     steps:
       - name: Check out git repository
@@ -51,6 +70,7 @@ jobs:
 
   release-linux:
     runs-on: ubuntu-latest
+    needs: prepare-release
 
     steps:
       - name: Check out git repository
@@ -87,6 +107,7 @@ jobs:
 
   release:
     runs-on: windows-latest
+    needs: prepare-release
 
     steps:
       - name: Check out git repository
@@ -119,10 +140,11 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npx electron-builder --win nsis --x64 --publish always '--config.artifactName=${productName}-${version}-x64-Setup.${ext}'
+          npx electron-builder --win nsis --x64 --publish always "-c.artifactName=\${productName}-\${version}-x64-Setup.\${ext}"
 
   release-windows-arm64:
     runs-on: windows-latest
+    needs: prepare-release
 
     steps:
       - name: Check out git repository
@@ -155,7 +177,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npx electron-builder --win nsis --arm64 --publish always '--config.publish.channel=latest-arm64' '--config.artifactName=${productName}-${version}-arm64-Setup.${ext}'
+          npx electron-builder --win nsis --arm64 --publish always -c.publish.channel=latest-arm64 "-c.artifactName=\${productName}-\${version}-arm64-Setup.\${ext}"
 
   update-release-notes:
     runs-on: ubuntu-latest
@@ -166,6 +188,53 @@ jobs:
       - release-windows-arm64
 
     steps:
+      - name: Fix latest.yml to point to x64 installer
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG="$GITHUB_REF_NAME"
+          VERSION="${TAG#v}"
+          REPO="$GITHUB_REPOSITORY"
+
+          # Find the x64 exe asset name
+          ASSETS_JSON="$(gh release view "$TAG" --repo "$REPO" --json assets)"
+          X64_ASSET="$(echo "$ASSETS_JSON" | jq -r '[.assets[].name | select(test("x64.*\\.exe$"))][0] // ""')"
+          if [ -z "$X64_ASSET" ]; then
+            X64_ASSET="$(echo "$ASSETS_JSON" | jq -r '[.assets[].name | select(test("\\.exe$")) | select(test("arm64") | not)][0] // ""')"
+          fi
+
+          if [ -z "$X64_ASSET" ]; then
+            echo "ERROR: Could not find x64 exe asset"
+            exit 1
+          fi
+
+          echo "Downloading x64 installer: $X64_ASSET"
+          gh release download "$TAG" --repo "$REPO" --pattern "$X64_ASSET" --dir /tmp/weflow-x64
+
+          SHA512_B64="$(sha512sum "/tmp/weflow-x64/$X64_ASSET" | awk '{print $1}' | xxd -r -p | base64 -w 0)"
+          SIZE="$(stat -c%s "/tmp/weflow-x64/$X64_ASSET")"
+          RELEASE_DATE="$(gh release view "$TAG" --repo "$REPO" --json publishedAt -q .publishedAt)"
+
+          cat > /tmp/latest.yml <<YMLEOF
+          version: $VERSION
+          files:
+            - url: $X64_ASSET
+              sha512: $SHA512_B64
+              size: $SIZE
+          path: $X64_ASSET
+          sha512: $SHA512_B64
+          releaseDate: '$RELEASE_DATE'
+          YMLEOF
+
+          # Strip leading spaces (heredoc indentation)
+          sed -i 's/^          //' /tmp/latest.yml
+          cat /tmp/latest.yml
+
+          gh release upload "$TAG" --repo "$REPO" /tmp/latest.yml --clobber
+          echo "latest.yml updated successfully to point to $X64_ASSET"
+
       - name: Generate release notes with platform download links
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -230,3 +299,11 @@ jobs:
           EOF
 
           gh release edit "$TAG" --repo "$REPO" --notes-file release_notes.md
+
+      - name: Mark release as published (no longer pre-release)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --latest --no-fail-on-no-release --draft=false --prerelease=false