feat: 优化上游规则源与生成流程

.github/workflows/build.yml

@@ -21,6 +21,7 @@ on:
       - 'config/**'
       - 'scripts/**'
       - 'sources/custom/**'
+      - 'sources/builtin/**'
       - 'templates/**'
       - 'tests/**'
   schedule:

.github/workflows/pull-request.yml

@@ -28,5 +28,5 @@ jobs:
       - name: Prepare scripts
         run: find scripts -type f \( -name '*.sh' -o -name '*.py' \) -exec chmod +x {} +
 
-      - name: Quick check
-        run: REQUIRE_SHELLCHECK=1 make lint
+      - name: Validate
+        run: REQUIRE_SHELLCHECK=1 make validate

README.md

@@ -34,12 +34,15 @@ https://raw.githubusercontent.com/KuGouGo/Rules/sing-box/domain/fakeip-filter.sr
 https://raw.githubusercontent.com/KuGouGo/Rules/mihomo/ip/google.mrs
 ```
 
-常用规则包括 `cn`、`geolocation-cn`、`geolocation-!cn`、`google`、`telegram`、`emby-cn`、`emby` 和 `fakeip-filter`。其中 `cn` 与 `geolocation-cn` 在 `domain-list-community` 基础上合并 Loyalsoldier 发布的 `china-list.txt`，补充中国大陆可直连的长尾域名；不合并其宽泛的 `direct/proxy/reject` 列表。同时使用 `emby-cn` 与 `emby` 时，应先加载范围较小的 `emby-cn`。
+常用规则包括 `cn`、`geolocation-cn`、`geolocation-!cn`、`google`、`telegram`、`emby-cn`、`emby` 和 `fakeip-filter`。域名规则以 `domain-list-community` 源码树为主源，保留 include、affiliation 和属性派生；默认 `cn` / `geolocation-cn` 排除 `@ads`、`@!cn`，`geolocation-!cn` 排除 `@ads`、`@cn`，同时继续生成对应属性列表。该策略参考 `domain-list-custom`，但不重复克隆或反解析其 `geosite.dat`。
+
+`china-list` 独立包含 `felixonmars/dnsmasq-china-list` 的 accelerated domains，仅用于有特殊需求的中国大陆 DNS 分流，不合并进 `cn` 或 `geolocation-cn`，也不建议作为路由规则使用。`ruleset.skk.moe` 用于补充 `cn` 中可在中国大陆直连的 `domestic` 域名，以及 AI、Apple 中国服务/CDN、Microsoft 中国 CDN、`apple-intelligence`、`icloudprivaterelay`、`category-game-platforms-download` 和 Apple 服务 IP；上游固定标记域名会在规范化阶段统一剔除。其中国 IP 列表因边际覆盖较低不默认引入，语义混合的 `direct`、宽泛的 `global/reject`、动态测速、通用 CDN 与下载大集合也不会默认引入。同时使用 `emby-cn` 与 `emby` 时，应先加载范围较小的 `emby-cn`。
 
 ## 添加自定义规则
 
 - 域名规则：`sources/custom/domain/*.list`
 - IP 规则：`sources/custom/ip/*.list`
+- 内置稳定规则：`sources/builtin/`（例如无需远端下载的特殊用途网络）
 - 文件名使用小写字母、数字和连字符。
 
 ```text

THIRD_PARTY_NOTICES.md

@@ -5,8 +5,10 @@
 | 内容 | 来源 |
 | --- | --- |
 | 域名规则 | [v2fly/domain-list-community](https://github.com/v2fly/domain-list-community)（MIT） |
-| 中国大陆可直连域名补充 | [Loyalsoldier/v2ray-rules-dat](https://github.com/Loyalsoldier/v2ray-rules-dat) 发布的 `china-list.txt`（GPL-3.0；数据源为 [felixonmars/dnsmasq-china-list](https://github.com/felixonmars/dnsmasq-china-list)） |
-| 中国 IP | <https://ispip.clang.cn/all_cn_ipv46.txt>、<https://ispip.clang.cn/all_cn_ipv46_apnic.txt>、[Loyalsoldier/geoip](https://github.com/Loyalsoldier/geoip) |
+| 域名属性过滤策略参考 | [Loyalsoldier/domain-list-custom](https://github.com/Loyalsoldier/domain-list-custom)（GPL-3.0；不直接分发其构建产物） |
+| 中国大陆 DNS 分流域名 `china-list` | [Loyalsoldier/v2ray-rules-dat](https://github.com/Loyalsoldier/v2ray-rules-dat) 发布的 `china-list.txt`（GPL-3.0；数据源为 [felixonmars/dnsmasq-china-list](https://github.com/felixonmars/dnsmasq-china-list)） |
+| 中国大陆直连域名、Apple Intelligence、iCloud Private Relay、游戏下载及 Apple 服务 IP 补充 | [SukkaW/Surge](https://github.com/SukkaW/Surge) 与其[发布仓库](https://github.com/SukkaLab/ruleset.skk.moe)（仓库代码 AGPL-3.0；发布规则仍按各文件头声明的许可证） |
+| 中国 IP | <https://ispip.clang.cn/all_cn_ipv46.txt>、<https://ispip.clang.cn/all_cn_ipv46_apnic.txt> |
 | Google IP | <https://www.gstatic.com/ipranges/goog.json> |
 | Telegram IP | <https://core.telegram.org/resources/cidr.txt> |
 | Cloudflare IP | <https://www.cloudflare.com/ips-v4>、<https://www.cloudflare.com/ips-v6> |

config/upstreams.json

@@ -13,25 +13,49 @@
       "parser": "domain-suffix-text",
       "url": "https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/china-list.txt",
       "health": { "requirement": "required", "min_raw_bytes": 1000000, "min_entries": 100000, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-apple-intelligence": {
+      "kind": "text", "trust": "community", "parser": "sukka-classical-domain", "url": "https://ruleset.skk.moe/Clash/non_ip/apple_intelligence.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 200, "min_entries": 5, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-icloud-private-relay": {
+      "kind": "text", "trust": "community", "parser": "sukka-domain-set-text", "url": "https://ruleset.skk.moe/Clash/domainset/icloud_private_relay.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 150, "min_entries": 6, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-game-download": {
+      "kind": "text", "trust": "community", "parser": "sukka-domain-set-text", "url": "https://ruleset.skk.moe/Clash/domainset/game-download.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 1000, "min_entries": 50, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-domestic": {
+      "kind": "text", "trust": "community", "parser": "sukka-classical-domain", "url": "https://ruleset.skk.moe/Clash/non_ip/domestic.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 20000, "min_entries": 750, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-ai": {
+      "kind": "text", "trust": "community", "parser": "sukka-classical-domain", "url": "https://ruleset.skk.moe/Clash/non_ip/ai.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 500, "min_entries": 40, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-apple-cdn": {
+      "kind": "text", "trust": "community", "parser": "sukka-domain-set-text", "url": "https://ruleset.skk.moe/Clash/domainset/apple_cdn.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 3000, "min_entries": 150, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-apple-cn": {
+      "kind": "text", "trust": "community", "parser": "sukka-classical-domain", "url": "https://ruleset.skk.moe/Clash/non_ip/apple_cn.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 500, "min_entries": 9, "family": "any", "fallback_policy": "none" }
+    },
+    "sukka-microsoft-cdn": {
+      "kind": "text", "trust": "community", "parser": "sukka-classical-domain", "url": "https://ruleset.skk.moe/Clash/non_ip/microsoft_cdn.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 1500, "min_entries": 50, "family": "any", "fallback_policy": "none" }
     }
   },
   "ip": {
     "cn-ipv46": {
-      "kind": "text", "trust": "registry", "parser": "cidr-text", "url": "https://ispip.clang.cn/all_cn_ipv46.txt",
+      "kind": "text", "trust": "community", "parser": "cidr-text", "url": "https://ispip.clang.cn/all_cn_ipv46.txt",
       "health": { "requirement": "required", "min_raw_bytes": 1000, "min_entries": 100, "family": "dual", "fallback_policy": "none" }
     },
     "cn-ipv46-apnic": {
       "kind": "text", "trust": "registry", "parser": "cidr-text", "url": "https://ispip.clang.cn/all_cn_ipv46_apnic.txt",
       "health": { "requirement": "required", "min_raw_bytes": 1000, "min_entries": 100, "family": "dual", "fallback_policy": "none" }
     },
-    "loyalsoldier-geoip-cn": {
-      "kind": "text", "trust": "community", "parser": "cidr-text", "url": "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/text/cn.txt",
-      "health": { "requirement": "required", "min_raw_bytes": 1000, "min_entries": 5000, "family": "any", "fallback_policy": "none" }
-    },
-    "loyalsoldier-geoip-private": {
-      "kind": "text", "trust": "community", "parser": "cidr-text", "url": "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/text/private.txt",
-      "health": { "requirement": "required", "min_raw_bytes": 100, "min_entries": 15, "family": "any", "fallback_policy": "none" }
-    },
     "google": {
       "kind": "json", "trust": "official", "parser": "google-json", "url": "https://www.gstatic.com/ipranges/goog.json",
       "health": { "requirement": "required", "min_raw_bytes": 100, "min_entries": 80, "family": "dual", "fallback_policy": "none" }
@@ -68,14 +92,18 @@
       "kind": "html", "trust": "official", "parser": "html-cidr", "url": "https://support.apple.com/en-us/101555", "fallback_url": "https://support.apple.com/zh-cn/101555",
       "health": { "requirement": "required", "min_raw_bytes": 100, "min_entries": 3, "family": "any", "fallback_policy": "ordered" }
     },
+    "sukka-apple-services": {
+      "kind": "text", "trust": "community", "parser": "sukka-classical-ip", "url": "https://ruleset.skk.moe/Clash/ip/apple_services.txt",
+      "health": { "requirement": "required", "min_raw_bytes": 300, "min_entries": 10, "family": "ipv4", "fallback_policy": "none" }
+    },
     "ripe-stat": {
       "kind": "json-api", "trust": "registry", "parser": "ripe-stat-json", "base_url": "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS",
       "health": { "requirement": "required", "min_raw_bytes": 50, "min_entries": 1, "family": "any", "fallback_policy": "none" }
     }
   },
   "asn_groups": {
-    "telegram": [44907, 59930, 62014, 62041, 211157],
-    "netflix": [2906, 40027],
+    "telegram": [62041],
+    "netflix": [2906],
     "spotify": [35228, 7441],
     "disney": [13379, 15260, 23344, 25932, 29736, 30311, 53578]
   }

docs/DEVELOPMENT.md

@@ -17,6 +17,7 @@ make clean              # 清理临时文件和产物
 ```text
 sources/custom/domain/  自定义域名规则
 sources/custom/ip/      自定义 IP 规则
+sources/builtin/        不依赖远端下载的稳定内置规则
 config/upstreams.json   上游地址和解析方式
 config/tools-lock.json  sing-box / mihomo 工具版本
 scripts/                同步、转换、校验和发布脚本
@@ -39,9 +40,13 @@ IP-CIDR,192.0.2.0/24
 
 新增上游时修改 `config/upstreams.json`，并按实际情况更新根目录的 `THIRD_PARTY_NOTICES.md`。
 
+上游来源应优先选择官方或注册机构数据，并满足以下条件：能够声明稳定的健康阈值、对最终规则有可量化的边际覆盖、不会仅重复已有来源。共享同一载荷的不同规则集应只下载一次再分别解析；高重叠、低边际或容易引入地域误判的来源应移除。
+
+ASN 补充仅保留官方列表之外仍有覆盖贡献的网络。所有 RIPE Stat ASN 在一次并行批次中下载，每个唯一 ASN 只规范化和检查一次，再由 Telegram、Netflix、Spotify、Disney 规则组复用。
+
 ## 自动构建
 
-- PR：只运行快速检查。
+- PR：运行完整 lint 和测试，阻止未经测试的构建脚本变更合并。
 - `main`：检查、构建并发布五个平台分支。
 - 定时任务：每天同步一次上游。
 - 手动运行：Actions → Sync Rules，可选择 `auto`、`custom` 或 `full`。

scripts/commands/lint-custom-rules.sh

@@ -8,4 +8,8 @@ python3 "$ROOT/scripts/tools/lint-custom-rules.py" \
   --domain-dir "$ROOT/sources/custom/domain" \
   --ip-dir "$ROOT/sources/custom/ip"
 
-echo "custom rule lint passed"
+python3 "$ROOT/scripts/tools/lint-custom-rules.py" \
+  --domain-dir "$ROOT/sources/builtin/domain" \
+  --ip-dir "$ROOT/sources/builtin/ip"
+
+echo "custom and built-in rule lint passed"

scripts/commands/select-build-scope.sh

@@ -218,7 +218,7 @@ collect_deleted_custom_files() {
 }
 
 has_build_relevant_changes() {
-  grep -Eq '^(\.github/workflows/|Makefile$|config/|scripts/|sources/custom/|templates/|tests/)'
+  grep -Eq '^(\.github/workflows/|Makefile$|config/|scripts/|sources/(builtin|custom)/|templates/|tests/)'
 }
 
 has_only_non_build_changes() {