From 5980137546d8b8260db0045685922528a4d76c2c Mon Sep 17 00:00:00 2001
From: freelw <“freelw81@qq.com“>
Date: Wed, 12 Aug 2026 16:48:20 +0800
Subject: [PATCH] Improve COS release upload reliability

---
 .github/workflows/release.yml    |  1 +
 scripts/upload-release-to-cos.sh | 17 +++++++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1706547..c250171 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,6 +61,7 @@ jobs:
   publish:
     needs: [build-macos, build-windows]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     environment: cos-release
     steps:
       - uses: actions/checkout@v5
diff --git a/scripts/upload-release-to-cos.sh b/scripts/upload-release-to-cos.sh
index 059e2a8..8bc99ab 100755
--- a/scripts/upload-release-to-cos.sh
+++ b/scripts/upload-release-to-cos.sh
@@ -34,8 +34,21 @@ curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location --retry
 printf '%s  %s\n' "${coscli_sha256}" "${coscli_path}" | sha256sum --check --strict
 chmod 0700 "${coscli_path}"
 
-"${coscli_path}" cp "${source_dir}/" "cos://${COS_BUCKET}/${remote_path}/" \
-  --recursive \
+while read -r _ file_name; do
+  file_name="${file_name#\*}"
+  [[ "${file_name}" != */* && -n "${file_name}" ]] || { echo "Invalid manifest filename: ${file_name}" >&2; exit 3; }
+  "${coscli_path}" cp "${source_dir}/${file_name}" "cos://${COS_BUCKET}/${remote_path}/${file_name}" \
+    --part-size 1 \
+    --thread-num 4 \
+    --endpoint "cos.${COS_REGION}.myqcloud.com" \
+    --secret-id "${TENCENT_CLOUD_SECRET_ID}" \
+    --secret-key "${TENCENT_CLOUD_SECRET_KEY}" \
+    --init-skip=true \
+    --disable-log
+done <"${source_dir}/SHA256SUMS"
+
+# Publish the manifest last so clients never discover checksums for incomplete uploads.
+"${coscli_path}" cp "${source_dir}/SHA256SUMS" "cos://${COS_BUCKET}/${remote_path}/SHA256SUMS" \
   --endpoint "cos.${COS_REGION}.myqcloud.com" \
   --secret-id "${TENCENT_CLOUD_SECRET_ID}" \
   --secret-key "${TENCENT_CLOUD_SECRET_KEY}" \