ci: organize GitHub automation (#466)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,97 @@
+name: Bug report
+description: Report reproducible incorrect or unexpected ReMe behavior
+title: "[Bug]: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve ReMe. Please remove secrets, API keys, and private memory content before submitting.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened, and what did you expect instead?
+      placeholder: Describe the observed and expected behavior.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Provide the smallest configuration and command sequence that reproduces the problem.
+      placeholder: |
+        1. Configure ...
+        2. Run ...
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: config
+    attributes:
+      label: Relevant configuration
+      description: Include only relevant values and redact credentials, tokens, endpoints, and private paths.
+      render: yaml
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or traceback
+      description: Paste relevant output after removing secrets and private workspace content.
+      render: shell
+
+  - type: input
+    id: reme-version
+    attributes:
+      label: ReMe version
+      placeholder: e.g. 0.4.1.8 or a commit SHA
+    validations:
+      required: true
+
+  - type: input
+    id: python-version
+    attributes:
+      label: Python version
+      placeholder: e.g. 3.11.9
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected area
+      options:
+        - CLI or configuration
+        - HTTP, MCP, or local service
+        - Memory or workspace files
+        - Search, catalog, graph, or index
+        - Model or agent integration
+        - ReMe Studio
+        - Plugin or external integration
+        - Packaging or installation
+        - Other
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Data safety
+      options:
+        - label: I removed credentials and private memory content from this report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: ReMe documentation
+    url: https://reme.agentscope.io
+    about: Read the installation, configuration, and usage guides.
+  - name: Existing issues
+    url: https://github.com/agentscope-ai/ReMe/issues
+    about: Search for existing reports and discussions before opening a new issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,64 @@
+name: Feature request
+description: Propose a focused enhancement to ReMe
+title: "[Feature]: "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user problem or limitation should this change address?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe the desired behavior and its user-visible contract.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - CLI or configuration
+        - Jobs or steps
+        - Memory or workspace files
+        - Search, catalog, graph, or index
+        - Service or client
+        - Model or agent integration
+        - ReMe Studio
+        - Plugin or external integration
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: ownership
+    attributes:
+      label: Local-first and compatibility considerations
+      description: Explain any effect on user-owned files, rebuildable state, configuration, schemas, or service interfaces.
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Describe workarounds or alternative designs you considered.
+
+  - type: textarea
+    id: examples
+    attributes:
+      label: Example usage
+      description: Show the proposed CLI, configuration, API, or UI behavior when useful.
+      render: shell
+
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Contribution
+      options:
+        - label: I am willing to help implement or test this feature.

.github/ISSUE_TEMPLATE/question.yml

@@ -0,0 +1,53 @@
+name: Usage question
+description: Ask for help using or configuring ReMe
+title: "[Question]: "
+labels: [question]
+body:
+  - type: markdown
+    attributes:
+      value: Please check the documentation and existing issues before asking a new question.
+
+  - type: textarea
+    id: goal
+    attributes:
+      label: What are you trying to achieve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: attempted
+    attributes:
+      label: What have you tried?
+      description: Include relevant commands or configuration, with secrets and private memory content removed.
+    validations:
+      required: true
+
+  - type: input
+    id: reme-version
+    attributes:
+      label: ReMe version
+      placeholder: e.g. 0.4.1.8 or a commit SHA
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Installation
+        - Configuration
+        - CLI or service usage
+        - Memory and workspace management
+        - Search and retrieval
+        - ReMe Studio
+        - Plugin or integration
+        - Other
+
+  - type: checkboxes
+    id: checked
+    attributes:
+      label: Before submitting
+      options:
+        - label: I checked the [ReMe documentation](https://reme.agentscope.io) and searched existing issues.
+          required: true
+        - label: I removed credentials and private memory content.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,35 @@
+## Summary
+
+<!-- Explain the problem and the smallest coherent change that addresses it. -->
+
+## Related issue
+
+<!-- Use "Fixes #123" when applicable. -->
+
+## Contract and data impact
+
+- [ ] No public configuration, schema, CLI, endpoint, streaming, or workspace-layout contract changes
+- [ ] No user-owned memory files are deleted or rewritten
+- [ ] Derived indexes, catalogs, graphs, caches, and metadata remain rebuildable
+
+<!-- If any item is unchecked, describe the impact and migration or recovery path. -->
+
+## Validation
+
+<!-- List the exact checks run and their results. Explain relevant checks that were not run. -->
+
+- [ ] Focused tests pass
+- [ ] Unit tests pass, or omitted tests are explained below
+- [ ] `pre-commit run --all-files` passes, or omitted checks are explained below
+- [ ] Frontend checks were run when `website/` changed
+
+## Checklist
+
+- [ ] I reviewed the diff for unrelated changes and sensitive data
+- [ ] Tests cover intentional behavior changes
+- [ ] Defaults, schemas, and concise documentation were updated together when required
+- [ ] Long-lived clients, tasks, services, and executors follow the application lifecycle
+
+## Screenshots or additional notes
+
+<!-- Include UI screenshots, compatibility notes, or follow-up work when relevant. -->

.github/README.md

@@ -0,0 +1,16 @@
+# Repository automation
+
+GitHub requires workflow files to live directly in `.github/workflows`, so filenames provide the organization:
+
+- `ci-*`: automatically triggered validation, with a manual rerun entry point where useful.
+- `policy-*`: repository contribution policies.
+- `deploy-*`: deployment workflows.
+- `release-*`: package and integration publishing workflows.
+- `security-*`: security scanning and scheduled security checks.
+- `_build-*`: reusable implementation workflows called by the entry-point workflows above.
+
+Keep trigger selection, permissions, concurrency, and path filters in the entry-point workflow. Put repeated build and
+verification jobs in a reusable workflow. A reusable workflow should use `workflow_call` and must not publish by itself.
+
+Release workflows validate versions and build artifacts before publishing. Publishing credentials and environment
+protection remain repository settings and must not be committed here.

.github/dependabot.yml

@@ -0,0 +1,98 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      actions-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      python-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: pip
+    directory: /packages/reme_ai_studio
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      python-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: pip
+    directory: /plugins/auto-fin
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      python-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: npm
+    directory: /website
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      npm-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: npm
+    directory: /github-pages
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      npm-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: npm
+    directory: /integrations/dsh
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      npm-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: npm
+    directory: /skills/dingtalk-message
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Asia/Shanghai
+    groups:
+      npm-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]

.github/workflows/_build-docs.yml

@@ -0,0 +1,56 @@
+name: _Build documentation
+
+on:
+  workflow_call:
+    inputs:
+      run_tests:
+        description: Run the documentation test suite before building
+        required: false
+        default: true
+        type: boolean
+      upload_pages_artifact:
+        description: Upload the build for a later GitHub Pages deployment job
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build documentation
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: github-pages
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.13'
+          cache: npm
+          cache-dependency-path: github-pages/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        if: inputs.run_tests
+        run: npm test
+
+      - name: Build documentation
+        run: npm run build
+
+      - name: Configure Pages
+        if: inputs.upload_pages_artifact
+        uses: actions/configure-pages@v6
+
+      - name: Upload Pages artifact
+        if: inputs.upload_pages_artifact
+        uses: actions/upload-pages-artifact@v4
+        with:
+          path: github-pages/dist

.github/workflows/_build-python-packages.yml

@@ -1,48 +1,32 @@
-name: Package Check
+name: _Build Python packages
 
 on:
-  push:
-    branches: [main, master, dev, develop]
-    paths:
-      - '.github/workflows/package-check.yml'
-      - '.github/workflows/python-publish.yml'
-      - 'packages/reme_ai_studio/**'
-      - 'pyproject.toml'
-      - 'reme/__init__.py'
-      - 'reme/utils/web_static.py'
-      - 'scripts/bump_version.py'
-      - 'scripts/package_studio.py'
-      - 'tests/unit/test_package_versions.py'
-      - 'website/**'
-      - 'LICENSE'
-  pull_request:
-    branches: [main, master, dev, develop]
-    paths:
-      - '.github/workflows/package-check.yml'
-      - '.github/workflows/python-publish.yml'
-      - 'packages/reme_ai_studio/**'
-      - 'pyproject.toml'
-      - 'reme/__init__.py'
-      - 'reme/utils/web_static.py'
-      - 'scripts/bump_version.py'
-      - 'scripts/package_studio.py'
-      - 'tests/unit/test_package_versions.py'
-      - 'website/**'
-      - 'LICENSE'
-  workflow_dispatch:
+  workflow_call:
+    inputs:
+      expected_version:
+        description: Expected release version; omit for a consistency-only check
+        required: false
+        default: ''
+        type: string
+      upload_artifacts:
+        description: Upload distributions for later publish jobs
+        required: false
+        default: false
+        type: boolean
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+permissions:
+  contents: read
 
 jobs:
   distributions:
+    name: Build Python distributions
     runs-on: ubuntu-latest
+
     steps:
       - uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22.13'
           cache: npm
@@ -58,9 +42,16 @@ jobs:
           python -m pip install --upgrade pip
           python -m pip install build packaging pytest twine
 
-      - name: Validate release versions
+      - name: Validate package versions
+        if: inputs.expected_version == ''
         run: python scripts/bump_version.py --check
 
+      - name: Validate release version
+        if: inputs.expected_version != ''
+        env:
+          EXPECTED_VERSION: ${{ inputs.expected_version }}
+        run: python scripts/bump_version.py --check --expected-version "${EXPECTED_VERSION}"
+
       - name: Run package tests
         run: PYTHONPATH=. python -m pytest tests/unit/test_package_versions.py -q
 
@@ -95,3 +86,19 @@ jobs:
             "import reme; from reme_ai_studio import static_dir; assert (static_dir() / 'index.html').is_file()"
           "${RUNNER_TEMP}/reme-package-smoke/bin/python" -c \
             "from reme.utils import resolve_web_static_dir; assert (resolve_web_static_dir() / 'index.html').is_file()"
+
+      - name: Upload ReMe Studio distributions
+        if: inputs.upload_artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: reme-studio-distributions
+          path: dist/studio/
+          if-no-files-found: error
+
+      - name: Upload ReMe distributions
+        if: inputs.upload_artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: reme-distributions
+          path: dist/reme/
+          if-no-files-found: error

.github/workflows/ci-docs.yml

@@ -1,10 +1,11 @@
-name: GitHub Pages Check
+name: CI / Documentation
 
 on:
   push:
     branches: [main, master, dev, develop]
     paths:
-      - '.github/workflows/github-pages-check.yml'
+      - '.github/workflows/ci-docs.yml'
+      - '.github/workflows/_build-docs.yml'
       - 'AGENTS.md'
       - 'README.md'
       - 'README_ZH.md'
@@ -18,7 +19,8 @@ on:
   pull_request:
     branches: [main, master, dev, develop]
     paths:
-      - '.github/workflows/github-pages-check.yml'
+      - '.github/workflows/ci-docs.yml'
+      - '.github/workflows/_build-docs.yml'
       - 'AGENTS.md'
       - 'README.md'
       - 'README_ZH.md'
@@ -35,27 +37,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
-  test-and-build:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: github-pages
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: '22.13'
-          cache: npm
-          cache-dependency-path: github-pages/package-lock.json
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Build documentation
-        run: npm run build
+  documentation:
+    name: Test and build documentation
+    uses: ./.github/workflows/_build-docs.yml
+    with:
+      run_tests: true

.github/workflows/ci-packages.yml

@@ -0,0 +1,46 @@
+name: CI / Python packages
+
+on:
+  push:
+    branches: [main, master, dev, develop]
+    paths:
+      - '.github/workflows/ci-packages.yml'
+      - '.github/workflows/_build-python-packages.yml'
+      - '.github/workflows/release-python.yml'
+      - 'packages/reme_ai_studio/**'
+      - 'pyproject.toml'
+      - 'reme/__init__.py'
+      - 'reme/utils/web_static.py'
+      - 'scripts/bump_version.py'
+      - 'scripts/package_studio.py'
+      - 'tests/unit/test_package_versions.py'
+      - 'website/**'
+      - 'LICENSE'
+  pull_request:
+    branches: [main, master, dev, develop]
+    paths:
+      - '.github/workflows/ci-packages.yml'
+      - '.github/workflows/_build-python-packages.yml'
+      - '.github/workflows/release-python.yml'
+      - 'packages/reme_ai_studio/**'
+      - 'pyproject.toml'
+      - 'reme/__init__.py'
+      - 'reme/utils/web_static.py'
+      - 'scripts/bump_version.py'
+      - 'scripts/package_studio.py'
+      - 'tests/unit/test_package_versions.py'
+      - 'website/**'
+      - 'LICENSE'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  distributions:
+    name: Build and verify distributions
+    uses: ./.github/workflows/_build-python-packages.yml

.github/workflows/ci-python-quality.yml

@@ -0,0 +1,37 @@
+name: CI / Python quality
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pre-commit:
+    name: Pre-commit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+          cache: pip
+
+      - name: Update setuptools
+        run: |
+          pip install -U setuptools wheel
+
+      - name: Install
+        run: |
+          pip install -q -e packages/reme_ai_studio -e ".[dev,core]"
+
+      - name: Pre-commit starts
+        run: pre-commit run --all-files

.github/workflows/ci-python-tests.yml

@@ -1,4 +1,4 @@
-name: Tests ReMe
+name: CI / Python tests
 
 on:
   push:
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     name: Unit Tests - py${{ matrix.python-version }}
@@ -21,10 +24,10 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'

.github/workflows/ci-website.yml

@@ -1,14 +1,23 @@
-name: NPM Format
+name: CI / Website
 
 on:
   push:
     paths:
       - "website/**"
-      - ".github/workflows/npm-format.yml"
+      - ".github/workflows/ci-website.yml"
   pull_request:
     paths:
       - "website/**"
-      - ".github/workflows/npm-format.yml"
+      - ".github/workflows/ci-website.yml"
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   website:
@@ -19,10 +28,10 @@ jobs:
         working-directory: website
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: npm

.github/workflows/ci-windows.yml

@@ -1,4 +1,4 @@
-name: Windows Smoke
+name: CI / Windows
 
 on:
   push:
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   cli-smoke:
     name: CLI smoke - py${{ matrix.python-version }}
@@ -21,17 +24,17 @@ jobs:
         python-version: ["3.11"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: npm
           cache-dependency-path: website/package-lock.json
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'

.github/workflows/deploy-docs.yml

@@ -0,0 +1,51 @@
+name: Deploy / Documentation
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "github-pages/**"
+      - "docs/**"
+      - "README.md"
+      - "README_ZH.md"
+      - "website/README*.md"
+      - "website/public/og.jpg"
+      - "plugins/*/README*.md"
+      - "benchmark/*/README*.md"
+      - "skills/reme_memory/SKILL.md"
+      - "AGENTS.md"
+      - ".github/workflows/deploy-docs.yml"
+      - ".github/workflows/_build-docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build documentation
+    uses: ./.github/workflows/_build-docs.yml
+    with:
+      run_tests: false
+      upload_pages_artifact: true
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@v5

.github/workflows/pages.yml

@@ -1,68 +0,0 @@
-name: Deploy ReMe documentation
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - "github-pages/**"
-      - "docs/**"
-      - "README.md"
-      - "README_ZH.md"
-      - "website/README*.md"
-      - "website/public/og.jpg"
-      - "plugins/*/README*.md"
-      - "benchmark/*/README*.md"
-      - "skills/reme_memory/SKILL.md"
-      - "AGENTS.md"
-      - ".github/workflows/pages.yml"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "22.13"
-          cache: npm
-          cache-dependency-path: github-pages/package-lock.json
-
-      - name: Install dependencies
-        working-directory: github-pages
-        run: npm ci
-
-      - name: Build documentation
-        working-directory: github-pages
-        run: npm run build
-
-      - name: Configure Pages
-        uses: actions/configure-pages@v5
-
-      - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v4
-        with:
-          path: github-pages/dist
-
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Deploy
-        id: deployment
-        uses: actions/deploy-pages@v4

.github/workflows/policy-pr-title.yml

@@ -1,10 +1,14 @@
-name: PR Title Check
+name: Policy / PR title
 
 on:
   pull_request:
     branches: [main, master, dev, develop]
     types: [opened, edited, synchronize, reopened]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   check-pr-title:
     runs-on: ubuntu-latest

.github/workflows/pre-commit.yml

@@ -1,31 +0,0 @@
-name: Pre-commit
-
-on: [ push, pull_request ]
-
-jobs:
-  run:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: True
-      matrix:
-        os: [ ubuntu-latest ]
-    env:
-      OS: ${{ matrix.os }}
-      PYTHON: '3.11'
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-      - name: Update setuptools
-        run: |
-          pip install -U setuptools wheel
-      - name: Install
-        run: |
-          pip install -q -e packages/reme_ai_studio -e ".[dev,core]"
-      - name: Install pre-commit
-        run: |
-          pre-commit install
-      - name: Pre-commit starts
-        run: pre-commit run --all-files

.github/workflows/python-publish.yml

@@ -1,123 +0,0 @@
-name: Publish Python packages to PyPI
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: Release version
-        required: true
-        type: string
-  release:
-    types: [published]
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    env:
-      RELEASE_VERSION: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.version }}
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22.13'
-          cache: npm
-          cache-dependency-path: website/package-lock.json
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Install build dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install build packaging twine
-
-      - name: Validate release version
-        run: python scripts/bump_version.py --check --expected-version "${RELEASE_VERSION}"
-
-      - name: Build Studio static workspace
-        working-directory: website
-        run: |
-          npm ci
-          npm run build:static
-
-      - name: Prepare and build distributions
-        run: |
-          python scripts/package_studio.py
-          mkdir -p dist/reme dist/studio
-          python -m build --outdir dist/reme
-          python -m build packages/reme_ai_studio --outdir dist/studio
-          python -m twine check dist/reme/* dist/studio/*
-
-      - name: Verify distributions and isolated installation
-        run: |
-          REME_WHEEL="$(pwd)/$(ls dist/reme/reme_ai-[0-9]*.whl)"
-          STUDIO_WHEEL="$(pwd)/$(ls dist/studio/reme_ai_studio-*.whl)"
-          STUDIO_SDIST="$(pwd)/$(ls dist/studio/reme_ai_studio-*.tar.gz)"
-          python -m zipfile -l "${REME_WHEEL}" | (! grep 'reme/web/')
-          python -m zipfile -l "${STUDIO_WHEEL}" | grep 'reme_ai_studio/static/index.html'
-          python -m zipfile -l "${STUDIO_WHEEL}" | grep 'dist-info/licenses/LICENSE'
-          python -m tarfile -l "${STUDIO_SDIST}" | grep '/LICENSE'
-          python -m venv "${RUNNER_TEMP}/reme-release-smoke"
-          "${RUNNER_TEMP}/reme-release-smoke/bin/python" -m pip install \
-            --find-links "$(pwd)/dist/studio" "${REME_WHEEL}[core]"
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/reme-release-smoke/bin/python" -c \
-            "import reme; from reme_ai_studio import static_dir; assert (static_dir() / 'index.html').is_file()"
-          "${RUNNER_TEMP}/reme-release-smoke/bin/python" -c \
-            "from reme.utils import resolve_web_static_dir; assert (resolve_web_static_dir() / 'index.html').is_file()"
-
-      - name: Upload ReMe Studio distributions
-        uses: actions/upload-artifact@v4
-        with:
-          name: reme-studio-distributions
-          path: dist/studio/
-
-      - name: Upload ReMe distributions
-        uses: actions/upload-artifact@v4
-        with:
-          name: reme-distributions
-          path: dist/reme/
-
-  publish-studio:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download ReMe Studio distributions
-        uses: actions/download-artifact@v4
-        with:
-          name: reme-studio-distributions
-          path: dist/studio
-
-      - name: Publish ReMe Studio
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
-          packages-dir: dist/studio
-          skip-existing: true
-
-  publish-reme:
-    needs: publish-studio
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download ReMe distributions
-        uses: actions/download-artifact@v4
-        with:
-          name: reme-distributions
-          path: dist/reme
-
-      - name: Publish ReMe
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
-          packages-dir: dist/reme
-          skip-existing: true

.github/workflows/release-auto-fin.yml

@@ -2,13 +2,13 @@
 # 1. 先将 plugins/auto-fin/pyproject.toml 中的 project.version 更新为待发布版本并合入目标分支。
 # 2. 确认插件依赖的 reme-ai 版本已经发布到 PyPI；本工作流会在构建阶段验证该依赖可下载。
 # 3. 确认仓库 Actions Secret 已配置 PYPI_API_TOKEN，且 PyPI 上不存在相同版本。
-# 4. 在 GitHub 仓库的 Actions 页面选择“Publish reme-auto-fin to PyPI”，点击“Run workflow”。
+# 4. 在 GitHub 仓库的 Actions 页面选择“Release / Auto Fin plugin”，点击“Run workflow”。
 # 5. 输入与 project.version 完全一致的版本号（例如 0.1.0）后运行；版本也可以带 v 前缀。
 #
 # 推荐发布顺序：reme-ai -> reme-auto-fin -> QwenPaw 更新依赖并通过 plugins: [auto-fin] 启用。
 # 当前仅支持 workflow_dispatch 手动触发，不会因 push、tag 或 release 自动发布。
 
-name: Publish reme-auto-fin to PyPI
+name: Release / Auto Fin plugin
 
 run-name: Publish reme-auto-fin ${{ inputs.version }}
 

.github/workflows/release-dsh.yml

@@ -4,7 +4,7 @@
 # 3. Run this workflow manually with the exact package version (an optional v prefix is accepted).
 # 4. Use the `next` tag for prereleases and `latest` only for stable releases.
 
-name: Publish ReMe DSH integration to npm
+name: Release / DSH integration
 
 run-name: Publish ReMe DSH integration ${{ inputs.version }} (${{ inputs.npm_tag }})
 

.github/workflows/release-python.yml

@@ -0,0 +1,58 @@
+name: Release / Python packages
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version
+        required: true
+        type: string
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and verify distributions
+    uses: ./.github/workflows/_build-python-packages.yml
+    with:
+      expected_version: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.version }}
+      upload_artifacts: true
+
+  publish-studio:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download ReMe Studio distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: reme-studio-distributions
+          path: dist/studio
+
+      - name: Publish ReMe Studio
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          packages-dir: dist/studio
+          skip-existing: true
+
+  publish-reme:
+    needs: publish-studio
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download ReMe distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: reme-distributions
+          path: dist/reme
+
+      - name: Publish ReMe
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          packages-dir: dist/reme
+          skip-existing: true

.github/workflows/security-codeql.yml

@@ -0,0 +1,45 @@
+name: Security / CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 1 * * 1'
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+  security-events: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript-typescript]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-and-quality
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:${{ matrix.language }}

github-pages/README.md

@@ -75,7 +75,7 @@ github-pages/
 
 ## Deployment
 
-The repository workflow `.github/workflows/pages.yml` builds this directory and publishes `dist/` to GitHub Pages.
+The repository workflow `.github/workflows/deploy-docs.yml` builds this directory and publishes `dist/` to GitHub Pages.
 It runs after relevant documentation or site files change on `main`, and it can also be started manually from the
 GitHub Actions page.