feat(ocr): integrate Light-OCR

.github/actions/light-ocr-package-size/action.yml

@@ -0,0 +1,165 @@
+name: Enforce Light OCR package size
+description: Build the pinned pre-OCR baseline and compare real installer artifacts on one runner.
+
+inputs:
+  platform:
+    description: Electron platform name (darwin, linux or win32).
+    required: true
+  arch:
+    description: Target architecture.
+    required: true
+  candidate-commit:
+    description: Full Git SHA of the candidate package.
+    required: true
+  runtime-token:
+    description: Token used only while installing baseline uv/Node/RTK runtimes.
+    required: false
+    default: ''
+  vite-github-client-id:
+    description: GitHub OAuth client ID used for the baseline renderer build.
+    required: false
+    default: ''
+  vite-github-client-secret:
+    description: GitHub OAuth client secret used for the baseline renderer build.
+    required: false
+    default: ''
+  vite-github-redirect-uri:
+    description: GitHub OAuth redirect URI used for the baseline renderer build.
+    required: false
+    default: ''
+  csc-link:
+    description: macOS signing certificate used for the baseline package and nested CUA helper.
+    required: false
+    default: ''
+  csc-key-password:
+    description: Password for the baseline package and nested CUA helper signing certificate.
+    required: false
+    default: ''
+  apple-notary-username:
+    description: Apple account used to notarize the baseline package.
+    required: false
+    default: ''
+  apple-notary-team-id:
+    description: Apple developer team used to notarize the baseline package.
+    required: false
+    default: ''
+  apple-notary-password:
+    description: App-specific password used to notarize the baseline package.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve pinned package baseline
+      id: baseline
+      shell: bash
+      run: |
+        BASELINE_COMMIT="$(node -p "require('./resources/light-ocr-size-budgets.json').baselineCommit")"
+        if ! printf '%s' "$BASELINE_COMMIT" | grep -Eq '^[a-f0-9]{40}$'; then
+          echo 'Invalid Light OCR package-size baseline commit.' >&2
+          exit 1
+        fi
+        echo "commit=$BASELINE_COMMIT" >> "$GITHUB_OUTPUT"
+
+    - name: Check out package baseline
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ steps.baseline.outputs.commit }}
+        path: .ocr-size-base
+        persist-credentials: false
+
+    - name: Install baseline dependencies
+      shell: bash
+      env:
+        TARGET_OS: ${{ inputs.platform }}
+        TARGET_ARCH: ${{ inputs.arch }}
+      run: |
+        pnpm --dir .ocr-size-base install --lockfile=false
+        pnpm --dir .ocr-size-base run install:sharp
+        pnpm --dir .ocr-size-base install --lockfile=false
+
+    - name: Install baseline bundled runtimes
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.runtime-token }}
+        TARGET_PLATFORM: ${{ inputs.platform }}
+        TARGET_ARCH: ${{ inputs.arch }}
+      run: |
+        node scripts/install-runtime.mjs \
+          --platform "$TARGET_PLATFORM" \
+          --arch "$TARGET_ARCH" \
+          --root-dir .ocr-size-base
+
+    - name: Build baseline application
+      shell: bash
+      env:
+        TARGET_PLATFORM: ${{ inputs.platform }}
+        TARGET_ARCH: ${{ inputs.arch }}
+        VITE_GITHUB_CLIENT_ID: ${{ inputs.vite-github-client-id }}
+        VITE_GITHUB_CLIENT_SECRET: ${{ inputs.vite-github-client-secret }}
+        VITE_GITHUB_REDIRECT_URI: ${{ inputs.vite-github-redirect-uri }}
+        NODE_OPTIONS: '--max-old-space-size=4096'
+      run: |
+        pnpm --dir .ocr-size-base run installRuntime:duckdb:vss -- \
+          --platform "$TARGET_PLATFORM" --arch "$TARGET_ARCH"
+        pnpm --dir .ocr-size-base run build
+
+    - name: Bundle baseline CUA plugin
+      if: inputs.platform != 'linux' || inputs.arch != 'arm64'
+      shell: bash
+      env:
+        TARGET_PLATFORM: ${{ inputs.platform }}
+        TARGET_ARCH: ${{ inputs.arch }}
+        CSC_LINK: ${{ inputs.csc-link }}
+        CSC_KEY_PASSWORD: ${{ inputs.csc-key-password }}
+        build_for_release: ${{ inputs.platform == 'darwin' && '2' || '' }}
+      run: |
+        pnpm --dir .ocr-size-base run plugin:bundle -- \
+          --name cua --platform "$TARGET_PLATFORM" --arch "$TARGET_ARCH"
+
+    - name: Bundle baseline Feishu plugin
+      shell: bash
+      env:
+        TARGET_PLATFORM: ${{ inputs.platform }}
+        TARGET_ARCH: ${{ inputs.arch }}
+      run: |
+        pnpm --dir .ocr-size-base run plugin:bundle -- \
+          --name feishu --platform "$TARGET_PLATFORM" --arch "$TARGET_ARCH"
+
+    - name: Package baseline installer
+      shell: bash
+      env:
+        TARGET_PLATFORM: ${{ inputs.platform }}
+        TARGET_ARCH: ${{ inputs.arch }}
+        CSC_LINK: ${{ inputs.csc-link }}
+        CSC_KEY_PASSWORD: ${{ inputs.csc-key-password }}
+        DEEPCHAT_APPLE_NOTARY_USERNAME: ${{ inputs.apple-notary-username }}
+        DEEPCHAT_APPLE_NOTARY_TEAM_ID: ${{ inputs.apple-notary-team-id }}
+        DEEPCHAT_APPLE_NOTARY_PASSWORD: ${{ inputs.apple-notary-password }}
+        build_for_release: '2'
+        NODE_OPTIONS: '--max-old-space-size=4096'
+      run: |
+        case "$TARGET_PLATFORM" in
+          darwin) BUILDER_TARGET='--mac' ;;
+          linux) BUILDER_TARGET='--linux' ;;
+          win32) BUILDER_TARGET='--win' ;;
+          *) echo "Unexpected package target: $TARGET_PLATFORM" >&2; exit 1 ;;
+        esac
+        pnpm --dir .ocr-size-base exec electron-builder \
+          "$BUILDER_TARGET" --"$TARGET_ARCH" --publish=never
+
+    - name: Compare installer sizes
+      shell: bash
+      env:
+        TARGET_PLATFORM: ${{ inputs.platform }}
+        TARGET_ARCH: ${{ inputs.arch }}
+        CANDIDATE_COMMIT: ${{ inputs.candidate-commit }}
+      run: |
+        pnpm run smoke:light-ocr:size -- \
+          --platform "$TARGET_PLATFORM" \
+          --arch "$TARGET_ARCH" \
+          --baseline-dir .ocr-size-base/dist \
+          --candidate-dir dist \
+          --candidate-commit "$CANDIDATE_COMMIT" \
+          --report-path "dist/light-ocr-package-size-${TARGET_PLATFORM}-${TARGET_ARCH}.json"

.github/workflows/build.yml

@@ -14,10 +14,11 @@ on:
           - linux
           - mac
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
-  RTK_INSTALL_GITHUB_TOKEN: ${{ secrets.RTK_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
-  RTK_INSTALL_GITHUB_TOKEN_SOURCE: ${{ secrets.RTK_GITHUB_TOKEN != '' && 'RTK_GITHUB_TOKEN' || 'GITHUB_TOKEN' }}
 
 jobs:
   build-windows:
@@ -68,13 +69,15 @@ jobs:
       - name: Report RTK install token source
         if: matrix.arch == 'x64'
         shell: bash
+        env:
+          RTK_INSTALL_GITHUB_TOKEN_SOURCE: ${{ secrets.RTK_GITHUB_TOKEN != '' && 'RTK_GITHUB_TOKEN' || 'GITHUB_TOKEN' }}
         run: |
           echo "RTK runtime install token source: ${RTK_INSTALL_GITHUB_TOKEN_SOURCE}"
 
       - name: Install Windows runtimes
         run: pnpm run installRuntime:win:${{ matrix.arch }}
         env:
-          GITHUB_TOKEN: ${{ env.RTK_INSTALL_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.RTK_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Install and verify DuckDB VSS for Windows
         run: |
@@ -100,12 +103,37 @@ jobs:
           test -f "$EXTENSION_PATH"
           pnpm run smoke:duckdb:vss -- --platform win32 --arch ${{ matrix.arch }} --extension-path "$EXTENSION_PATH"
 
+      - name: Verify packaged Light OCR for Windows
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $PSNativeCommandUseErrorActionPreference = $true
+          $nodePath = (Resolve-Path 'dist/${{ matrix.unpacked }}/resources/app.asar.unpacked/runtime/node/node.exe').Path
+          $ruleName = "DeepChat-Light-OCR-Smoke-$([guid]::NewGuid())"
+          New-NetFirewallRule -DisplayName $ruleName -Direction Outbound -Program $nodePath -Action Block | Out-Null
+          try {
+            pnpm run smoke:light-ocr -- --platform win32 --arch '${{ matrix.arch }}' --resources-path 'dist/${{ matrix.unpacked }}/resources' --report-path 'dist/light-ocr-smoke-win32-${{ matrix.arch }}.json' --expect-supported --require-execution --require-peak-rss
+          } finally {
+            Remove-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue
+          }
+
       - name: Verify bundled plugins
         shell: bash
         run: |
           pnpm run plugin:verify -- --name cua --platform win32 --arch ${{ matrix.arch }} --plugin-root dist/${{ matrix.unpacked }}/resources/app.asar.unpacked/plugins
           pnpm run plugin:verify -- --name feishu --platform win32 --arch ${{ matrix.arch }} --plugin-root dist/${{ matrix.unpacked }}/resources/app.asar.unpacked/plugins
 
+      - name: Enforce Light OCR package size for Windows
+        uses: ./.github/actions/light-ocr-package-size
+        with:
+          platform: win32
+          arch: ${{ matrix.arch }}
+          candidate-commit: ${{ github.sha }}
+          runtime-token: ${{ secrets.RTK_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          vite-github-client-id: ${{ secrets.DC_GITHUB_CLIENT_ID }}
+          vite-github-client-secret: ${{ secrets.DC_GITHUB_CLIENT_SECRET }}
+          vite-github-redirect-uri: ${{ secrets.DC_GITHUB_REDIRECT_URI }}
+
       - name: Upload artifacts
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
@@ -124,11 +152,11 @@ jobs:
         include:
           - arch: x64
             platform: linux-x64
-            runner: ubuntu-22.04
+            runner: ubuntu-24.04
             unpacked: linux-unpacked
           - arch: arm64
             platform: linux-arm64
-            runner: ubuntu-22.04-arm
+            runner: ubuntu-24.04-arm
             unpacked: linux-arm64-unpacked
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -162,7 +190,7 @@ jobs:
       - name: Install Linux runtimes
         run: pnpm run installRuntime:linux:${{ matrix.arch }}
         env:
-          GITHUB_TOKEN: ${{ env.RTK_INSTALL_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.RTK_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Install and verify DuckDB VSS for Linux
         run: |
@@ -196,13 +224,36 @@ jobs:
       - name: Verify packaged OpenDAL native package for Linux
         run: pnpm run smoke:opendal:native -- --platform linux --arch ${{ matrix.arch }} --resources-path dist/${{ matrix.unpacked }}/resources
 
+      - name: Verify packaged Light OCR for Linux
+        run: |
+          sudo unshare --net --setuid "$(id -u)" --setgid "$(id -g)" -- \
+            env HOME="$HOME" PATH="$PATH" pnpm run smoke:light-ocr -- \
+            --platform linux \
+            --arch "${{ matrix.arch }}" \
+            --resources-path "dist/${{ matrix.unpacked }}/resources" \
+            --report-path "dist/light-ocr-smoke-linux-${{ matrix.arch }}.json" \
+            --expect-supported \
+            --require-execution \
+            --require-peak-rss
+
       - name: Verify bundled CUA plugin
         if: matrix.arch == 'x64'
         run: pnpm run plugin:verify -- --name cua --platform linux --arch ${{ matrix.arch }} --plugin-root dist/${{ matrix.unpacked }}/resources/app.asar.unpacked/plugins
 
       - name: Verify bundled Feishu plugin
         run: pnpm run plugin:verify -- --name feishu --platform linux --arch ${{ matrix.arch }} --plugin-root dist/${{ matrix.unpacked }}/resources/app.asar.unpacked/plugins
 
+      - name: Enforce Light OCR package size for Linux
+        uses: ./.github/actions/light-ocr-package-size
+        with:
+          platform: linux
+          arch: ${{ matrix.arch }}
+          candidate-commit: ${{ github.sha }}
+          runtime-token: ${{ secrets.RTK_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          vite-github-client-id: ${{ secrets.DC_GITHUB_CLIENT_ID }}
+          vite-github-client-secret: ${{ secrets.DC_GITHUB_CLIENT_SECRET }}
+          vite-github-redirect-uri: ${{ secrets.DC_GITHUB_REDIRECT_URI }}
+
       - name: Upload artifacts
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
@@ -253,13 +304,15 @@ jobs:
 
       - name: Report RTK install token source
         shell: bash
+        env:
+          RTK_INSTALL_GITHUB_TOKEN_SOURCE: ${{ secrets.RTK_GITHUB_TOKEN != '' && 'RTK_GITHUB_TOKEN' || 'GITHUB_TOKEN' }}
         run: |
           echo "RTK runtime install token source: ${RTK_INSTALL_GITHUB_TOKEN_SOURCE}"
 
       - name: Install Node Runtime
         run: pnpm run installRuntime:mac:${{ matrix.arch }}
         env:
-          GITHUB_TOKEN: ${{ env.RTK_INSTALL_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.RTK_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Install and verify DuckDB VSS for macOS
         run: |
@@ -297,6 +350,33 @@ jobs:
           test -f "$EXTENSION_BASE64_PATH"
           pnpm run smoke:duckdb:vss -- --platform darwin --arch "$TARGET_ARCH" --extension-base64-path "$EXTENSION_BASE64_PATH"
 
+      - name: Verify packaged Light OCR for macOS
+        shell: bash
+        env:
+          TARGET_ARCH: ${{ matrix.arch }}
+        run: |
+          APP_DIR="dist/mac/DeepChat.app"
+          if [ "$TARGET_ARCH" = "arm64" ]; then
+            APP_DIR="dist/mac-arm64/DeepChat.app"
+          fi
+          sandbox-exec -p '(version 1) (allow default) (deny network*)' \
+            pnpm run smoke:light-ocr -- \
+            --platform darwin \
+            --arch "$TARGET_ARCH" \
+            --resources-path "${APP_DIR}/Contents/Resources" \
+            --report-path "dist/light-ocr-smoke-darwin-${TARGET_ARCH}-offline.json" \
+            --expect-supported \
+            --require-execution
+          pnpm run smoke:light-ocr -- \
+            --platform darwin \
+            --arch "$TARGET_ARCH" \
+            --resources-path "${APP_DIR}/Contents/Resources" \
+            --report-path "dist/light-ocr-smoke-darwin-${TARGET_ARCH}.json" \
+            --expect-supported \
+            --require-execution \
+            --require-peak-rss \
+            --skip-compression
+
       - name: Verify bundled plugins
         shell: bash
         env:
@@ -310,6 +390,22 @@ jobs:
           pnpm run plugin:verify -- --name cua --platform darwin --arch "$TARGET_ARCH" --plugin-root "$PLUGIN_ROOT"
           pnpm run plugin:verify -- --name feishu --platform darwin --arch "$TARGET_ARCH" --plugin-root "$PLUGIN_ROOT"
 
+      - name: Enforce Light OCR package size for macOS
+        uses: ./.github/actions/light-ocr-package-size
+        with:
+          platform: darwin
+          arch: ${{ matrix.arch }}
+          candidate-commit: ${{ github.sha }}
+          runtime-token: ${{ secrets.RTK_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          vite-github-client-id: ${{ secrets.DC_GITHUB_CLIENT_ID }}
+          vite-github-client-secret: ${{ secrets.DC_GITHUB_CLIENT_SECRET }}
+          vite-github-redirect-uri: ${{ secrets.DC_GITHUB_REDIRECT_URI }}
+          csc-link: ${{ secrets.DEEPCHAT_CSC_LINK }}
+          csc-key-password: ${{ secrets.DEEPCHAT_CSC_KEY_PASS }}
+          apple-notary-username: ${{ secrets.DEEPCHAT_APPLE_NOTARY_USERNAME }}
+          apple-notary-team-id: ${{ secrets.DEEPCHAT_APPLE_NOTARY_TEAM_ID }}
+          apple-notary-password: ${{ secrets.DEEPCHAT_APPLE_NOTARY_PASSWORD }}
+
       - name: Upload artifacts
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with: