chore: adding workflow for updating geosite-cn list automatically

[WendelHime]

Summary by CodeRabbit

• Chores
  • Added automated scheduled and on-demand updates for the China website rule set.
  • Added stricter validation for downloaded artifacts and upstream rule contents to prevent unexpected or unsupported changes.
  • Automatically regenerates the published rule files (CSV and SRS) and commits updates when detected.
  • Includes workflow run summaries with rule counts, update status, and the resulting commit identifier.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9a317e6e-9302-4e11-bba1-92b29bb4a55e

📥 Commits

Reviewing files that changed from the base of the PR and between 64992ca and ab5398b.

📒 Files selected for processing (1)

• .github/workflows/update_geosite_cn.yml

---

📝 Walkthrough

Walkthrough

Adds a scheduled and manually triggered workflow that verifies and decompiles upstream geosite-cn rules, validates and converts them to CSV and SRS artifacts, commits only those outputs, and reports rule and commit details.

Changes

geosite-cn update automation

Layer / File(s)	Summary
Workflow triggers and runner setup .github/workflows/update_geosite_cn.yml	Defines scheduled and manual execution, concurrency, pinned configuration, archive verification, upstream decompilation before checkout, and repository checkout.
Upstream rule conversion and validation .github/workflows/update_geosite_cn.yml	Rejects unsupported fields, excludes the bare cn suffix, writes the CSV, enforces a minimum rule count, and exports RULE_COUNT.
SRS generation and update reporting .github/workflows/update_geosite_cn.yml	Runs csv_to_srs, commits only the generated CSV and SRS files with a pinned action, and records rule count, change status, and commit hash.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant UpstreamRules
  participant SingBox
  participant CsvToSrs
  participant GitRepository
  participant StepSummary
  GitHubActions->>UpstreamRules: download cn.srs
  GitHubActions->>SingBox: verify archive and decompile cn.srs
  SingBox-->>GitHubActions: provide decompiled rules
  GitHubActions->>GitHubActions: validate fields and write geosite-cn.csv
  GitHubActions->>CsvToSrs: generate geosite-cn.srs
  CsvToSrs-->>GitHubActions: return generated artifact
  GitHubActions->>GitRepository: commit CSV and SRS changes
  GitHubActions->>StepSummary: write rule count and commit status

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding an automated workflow to update the geosite-cn list.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/adding-workflow-for-auto-updating-geosite-cn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/update_geosite_cn.yml:
- Around line 86-87: Update the csv_to_srs generator entrypoint in
cmd/csv_to_srs/main.go so filepath.Walk and SRS parse/write errors are
propagated to main and terminate with a nonzero exit status. Ensure the
“Generating SRS files” workflow step cannot succeed or commit changes when
generation fails.
- Line 89: Update the stefanzweifel/git-auto-commit-action reference in the
workflow to a full immutable commit SHA instead of the mutable v7 tag, selecting
the SHA for the intended action version and preserving the existing workflow
behavior.
- Around line 38-42: Update the workflow step before extracting sing-box.tar.gz
to validate the downloaded archive using the official release checksum manifest
or signature, and fail the job when verification fails. Keep tar extraction,
installation, and sing-box version execution after successful verification,
using the existing SING_BOX_VERSION and archive values to select the matching
trusted artifact.
- Line 31: Update the workflow’s actions/checkout@v5 step to set
persist-credentials to false, and remove the contents: write permission unless
it is explicitly required by git-auto-commit-action. Keep the commit step
functional while ensuring later untrusted download and execution steps cannot
access the repository write token.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5cb4f37a-10b9-46b1-892e-34bafa09fbcb

📥 Commits

Reviewing files that changed from the base of the PR and between 681577d and 64992ca.

📒 Files selected for processing (1)

• .github/workflows/update_geosite_cn.yml

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow to keep the geosite-cn ruleset in this repository automatically updated from an upstream SRS source, regenerating the corresponding CSV/SRS outputs and committing changes back to the default branch.

Changes:

• Introduces a scheduled + manual workflow to download, decompile, validate, and rewrite csv/smart-routing/geosite-cn.csv from upstream.
• Regenerates SRS output(s) via cmd/csv_to_srs and auto-commits geosite-cn artifacts when changes are detected.
• Publishes a run summary including rule count, whether changes were detected, and the resulting commit hash.

Comments suppressed due to low confidence (1)

.github/workflows/update_geosite_cn.yml:53

• The upstream ruleset fetch uses curl without retries and allows redirects to non-HTTPS protocols. Adding retry/backoff and HTTPS-only constraints will reduce flaky scheduled failures and prevent unexpected protocol downgrades on redirects.

          curl -fsSL -o cn.srs "$UPSTREAM_URL"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.