scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-06 08:15:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
1212 commits 212 branches 25 tags 42 MiB
Commit graph

72 commits

Author SHA1 Message Date
XiaoSeS
d36570c344 chore(integration): sync main before observability validation 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-03 09:06:01 +08:00
XiaoSeS
3c151d1065
Merge pull request #635 from iflytek/codex/builtin-skills-content 
feat(builtin-skills): add reviewed starter collection
 2026-07-31 21:32:04 +08:00
XiaoSeS
c6b18c6be6 Merge pull request #668 from feature/identity-account-merge 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-31 17:17:36 +08:00
XiaoSeS
fd49ad9170 feat(auth): add secure account merging 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-31 17:07:43 +08:00
XiaoSeS
bd0aa5f3d7 docs(weekly): refresh W31 evidence metadata 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-31 15:37:14 +08:00
XiaoSeS
c7bd56e77a Merge PR #635: builtin-skills starter collection 2026-07-31 14:35:08 +08:00
wowo-zZ
7885cc568b feat(builtin-skills): add reviewed starter collection 
Signed-off-by: wowo-zZ <zhenggui5228@126.com>
 2026-07-31 14:22:23 +08:00
XiaoSeS
d00fc0ea12 chore(integration): sync main before observability validation 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-31 11:48:43 +08:00
XiaoSeS
09db71ffa7 docs(weekly): mirror reports into project Pages 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-31 11:18:22 +08:00
XiaoSeS
9557478dd8 feat(auth): add explicit identity link and safe unlink flow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-31 07:02:17 +08:00
XiaoSeS
35cfb9f3ea feat(auth): add identity binding v2 expand 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-30 20:34:47 +08:00
XiaoSeS
6817d98007
Merge pull request #367 from xring/fix/postgres-lostfound
Some checks are pending
Deploy Docs / build (push) Waiting to run
Details
Deploy Docs / Deploy (push) Blocked by required conditions
Details
Security / Dependency Review (push) Waiting to run
Details
Security / CodeQL (java-kotlin) (push) Waiting to run
Details
Security / CodeQL (javascript-typescript) (push) Waiting to run
Details
Security / CodeQL (python) (push) Waiting to run
Details 
fix(deploy): isolate PostgreSQL data from volume root
 2026-07-30 09:56:00 +08:00
XiaoSeS
3d90583669 chore(integration): stage PR #505 on big-main 2026-07-29 17:40:55 +08:00
XiaoSeS
3db3c9685f feat(redis): complete cluster connection support 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 17:36:06 +08:00
XiaoSeS
e3057c91f6 chore(integration): stage PR #445 on big-main 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 15:24:41 +08:00
XiaoSeS
87cb05a096 test(ci): cover Helm workflows in security checks 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 15:22:36 +08:00
XiaoSeS
36fb6bf452 test(helm): cover deployment integration scenarios 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 15:22:36 +08:00
XiaoSeS
0efc91b73f test(helm): add reproducible upgrade smoke coverage 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 15:22:36 +08:00
XiaoSeS
2854b26b5d fix(helm): resolve deployment review blockers 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 14:04:26 +08:00
XiaoSeS
e72c17b09f chore(helm): merge current main for validation 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 13:49:18 +08:00
XiaoSeS
e7d43891ce test(deploy): run PostgreSQL storage regression in CI 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 04:22:43 +08:00
XiaoSeS
b24c707330 test(deploy): run PostgreSQL storage regression in CI 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 04:17:50 +08:00
XiaoSeS
e4fb26d4ba fix(nginx): trust forwarded proto only when configured 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-28 20:03:50 +08:00
jangrui
fef740b810 fix(ci): 去掉 kubeconform schema-location 的内层单引号 
单引号被当作字面字符传入，导致 cert-manager Certificate 校验报
"first path segment in URL cannot contain colon"。去掉后本地验证
Errors:1 → 0。
 2026-07-21 00:24:26 +08:00
lhb6540
f3dbb57a80 fix(helm): 修正 CI 渲染与 PostgreSQL 管理员密码引用 
同步 Helm CI matrix 与当前 values schema 和确定性凭据策略。

- 所有 CI 渲染加载测试凭据并迁移 Ingress TLS 数组配置
- PostgreSQL 使用 postgres 用户时引用管理员密码 key
- 增加内置 Secret 和 existingSecret 的管理员用户契约测试

Signed-off-by: lhb6540 <lhb6540@gmail.com>
 2026-07-20 11:36:04 +08:00
lhb6540
5d379dcaaf fix(helm): 修正组件启停与依赖配置并增加 values 校验 
在配置进入 Kubernetes 前完成父 Chart 校验，并补齐剩余的依赖配置契约。

- 让 Service、HPA 和 PDB 正确遵循组件启用状态
- 校验 Ingress、自动扩缩容、外部依赖和共享存储的组合配置
- 增加 values.schema.json 和 Helm 配置契约测试并接入 CI
- 统一 PostgreSQL Primary 与 Read Replica 的 max_connections 配置
- 修正 Redis Sentinel 节点、依赖等待和独立密码配置
- 允许覆盖依赖等待容器镜像，支持完整私有镜像仓库部署
- 兼容现代与旧式 IngressClass，并支持多域名 TLS 和证书 SAN
- 增加 GitOps 稳定 Secret 模式，阻止离线渲染产生随机凭据漂移
- 引用用户可控的 ConfigMap 字符串，并推导 TLS 安全 Cookie 和设备认证默认值
- 补充 Sentinel、RWX 存储、TLS Cookie、PVC 保留、私有镜像和 GitOps 文档
- 增加 Redis 数据密码与 Sentinel 密码分离的应用配置测试

已通过 Helm 严格 lint、渲染场景、配置契约测试、kubeconform、后端测试套件和 Sentinel 专项配置测试。

Signed-off-by: lhb6540 <lhb6540@gmail.com>
 2026-07-15 17:19:24 +08:00
lhb6540
3b3905be63 fix(helm): 修正 Bitnami 依赖连线并同步应用配置 
基于当前 SkillHub 运行时契约和 Bitnami 依赖命名，更新原贡献者提交的 Helm Chart 配置。

- 将 Server 正确连接到实际的 PostgreSQL 和 Redis Service 与 Secret
- 支持依赖组件的 existingSecret 名称和自定义密码 key，避免安装时 lookup
- 同步 S3、匿名下载、Scanner LLM、公开地址、设备认证和直接认证配置
- 将应用版本和 Chart 版本对齐当前发布版本
- 收紧 Chart 发布触发条件和手动版本选择逻辑
- 增加依赖 Service、Secret 和密码 key 的 CI 语义断言

已通过 Helm lint、九组渲染场景、kubeconform、工作流安全检查和后端应用测试套件。

Signed-off-by: lhb6540 <lhb6540@gmail.com>
 2026-07-15 17:19:15 +08:00
dongmucat
bf7c71ad2c fix(scanner): backport local LLM base URL handling for #563 
Also add Python CodeQL coverage in the security workflow so repository-level script regression checks stay green when Python source exists.

Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-29 14:34:55 +08:00
dongmucat
32f34fbf4c fix(ci): remove unsupported Python CodeQL scan 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 14:04:27 +08:00
dongmucat
e50140272b fix(security): close review hardening gaps 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-16 17:48:15 +08:00
dongmucat
7d0402e937 fix(security): address review blockers 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-16 14:19:39 +08:00
dongmucat
40d7de8462 fix(security): harden review findings 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-12 14:40:30 +08:00
jangrui
2b1be5ccf8 fix(ci): kubeconform 加载 CRD schema 修复 cert-manager 校验失败 
ingress-tls-certmanager 场景渲染出 cert-manager 的 Certificate CRD，
kubeconform 默认仅内置原生 k8s schema，遇到 CRD 报 "could not find schema"。

追加 -schema-location 从 datreeio/CRDs-catalog 远程加载 CRD schema，
覆盖整个 catalog 收录的 CRD 资源，9 场景矩阵无需差异化处理。

Signed-off-by: jangrui <admin@jangrui.com>
 2026-06-09 17:17:06 +08:00
jangrui
0605357316 fix(chart): 修复 PR review 反馈项 
- 删除 subchart image block，使用 Bitnami 默认版本
- 移除 Ingress cert-manager annotation，消除双重签发
- 清空默认明文密码，改为空字符串
- 排除 tgz 进 git，CI 添加 helm dependency build
- checksum 改为模板级渲染，修复文件末尾换行
- sentinel default 3，列表生成改用 append+join
- 添加 externalRedis.sentinel.password 字段
- README 补充 existingSecret key 清单
- CI 添加 kubeconform -strict 校验
- RedissonConfig 添加注释，补充空密码测试用例

Signed-off-by: jangrui <admin@jangrui.com>
 2026-06-04 06:35:28 +08:00
Cheney
0b1c366f8d
refactor(cli): improve publish-cli script reliability (#441) 
* refactor(cli): improve publish-cli script reliability

- Move version computation and pre-flight checks before build-and-test
  to fail fast on conflicts (existing branch/tag) instead of wasting
  minutes on lint/test/build
- Add INT/TERM signal handlers to cleanup trap so Ctrl+C during build
  properly restores working tree state
- Update Makefile help text to reflect PR-based workflow

* fix(cli): use git checkout -f for robust cleanup

Address code review feedback from gemini-code-assist bot:

- Use `git checkout -f` in on-release and committed cleanup stages
  to ensure reliable branch switching even when files are staged
  but not committed (e.g., interrupted after `git add` but before
  `git commit`)
- Remove redundant `git checkout -- <file>` in on-release stage
  since `-f` already discards all local changes

This prevents cleanup failures when the script is interrupted
between staging and committing.

* fix(cli): address PR #441 review findings

- Fix ERR trap bypass: remove `if !` wrapper around `gh pr create` so
  set -e triggers the trap and prints pushed-stage recovery instructions
- Fix command injection: all node -e/-p calls now use process.env
  instead of interpolating shell variables into JS string literals
- Rewrite cli/RELEASE.md to document the new PR-based release flow
- Rewrite scripts/tests/publish-cli-test.sh with 10 tests covering
  the new flow (stubs for bun/gh, pre-flight checks, happy path,
  cleanup state machine stages)

* fix(cli): address PR #441 review findings from @dongmucat

- Bind release tag to origin/main: PR body, end-of-run hint, and
  cli/RELEASE.md now use `git tag $TAG origin/main` so the tag is
  always placed on the merged commit, regardless of local branch state
- Reject prerelease tags in version computation: if the latest cli-v*
  tag contains non-X.Y.Z characters (e.g., -rc.1), exit with a clear
  message instead of crashing in node parsing
- Add pr-scripts.yml workflow: runs publish-cli-test.sh on scripts/**
  changes so the release script regression suite gates PRs
- Add Test 11 covering prerelease tag rejection

* fix(cli): compute publish baseline from origin tags only

A failed `git push origin cli-vX.Y.Z` after a successful local tag
leaves an orphan tag locally. The previous `git tag --list` baseline
would then treat it as the latest release, causing skipped versions or
publishes based on an unreleased tag.

Switch to `git ls-remote --tags --refs origin 'cli-v*' | sort -V` so
the baseline reflects only what is actually on origin. Local orphan
tags can still collide with the computed target tag, which fails fast
with a clear message as before.

Adds test 12 covering the orphan-tag scenario.
 2026-06-02 14:30:39 +08:00
jangrui
906c7f9884 feat(chart): 集成 Bitnami 组件并重构高可用配置 
- 使用 Bitnami PostgreSQL/Redis subchart 替代内置 StatefulSet
- 新增 sentinel 模式密码分离（redis-sentinel-password）
- 修复证书 secretName 与 Ingress 动态一致性
- 清理 ConfigMap 未引用字段，Service 模板去重
- CI 矩阵修复 sentinel 参数并扩展至 9 场景
- 命名空间硬编码替换为动态 $.Release.Namespace

Signed-off-by: jangrui <admin@jangrui.com>
 2026-06-01 20:59:58 +08:00
jangrui
5909bc1a1a 修复 Helm：解决 CI 流水线故障与模板边界场景 
- 修复 S3 存储模式下卷挂载条件渲染
- CI 多行参数不再被 YAML 尾随换行符截断
- 移除未使用的 database.architecture 字段
- 简化 Helm Chart 发布工作流

Signed-off-by: jangrui <admin@jangrui.com>
 2026-06-01 20:59:58 +08:00
jangrui
6ed5fb34dc commit -m "fix(ci): 修复 helm lint 缺少路径参数和 grep -c 在 bash -e 下的退出码问题" 
Signed-off-by: jangrui <admin@jangrui.com>
 2026-06-01 20:59:58 +08:00
jangrui
0ddb392086 feat(chart): 添加 Helm Chart 发布工作流 
Signed-off-by: jangrui <admin@jangrui.com>
 2026-06-01 20:59:58 +08:00
jangrui
dd1e87f1f3 feat(chart): 添加 SkillHub Helm Chart 部署方案 
新增 Helm Chart 支持完整的 SkillHub 私有化部署，包括：

- PostgreSQL/Redis 内置 StatefulSet 及外部模式切换
- 零依赖设计，无需 Bitnami 子 Chart
- 支持 standalone/cluster 数据库架构
- NodePort/LoadBalancer/ClusterIP 多种服务类型
- HPA、PDB、ServiceMonitor 完整运维支持
- cert-manager 证书自动签发
- initContainer 等待数据库和 Redis 就绪
- PVC 卸载保护 (helm.sh/resource-policy: keep)
- GitHub Actions: PR 校验 + 发布到 GHCR OCI

Signed-off-by: jangrui <admin@jangrui.com>
 2026-06-01 20:59:58 +08:00
dongmucat
55b38051ce
chore(deps): bump vite/postcss/picomatch/flatted/esbuild to patch Dependabot alerts
Some checks failed
Deploy Docs / build (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
* chore(deps): bump vite/postcss/picomatch/flatted/esbuild to patch Dependabot alerts

web/:
- pnpm.overrides force vite>=6.4.2, postcss>=8.5.10, picomatch>=2.3.2/>=4.0.4, flatted>=3.4.2
- bump devDeps vite to ^6.4.2 and postcss to ^8.5.10

docs/skillhub/:
- npm overrides force vite^6.4.2, postcss^8.5.10, esbuild^0.25.0
- regenerate package-lock.json

Resolves Dependabot alerts:
- web: GHSA-p9ff-h696-f583 (vite high), GHSA-rf6f-7fwh-wjgh (flatted high),
       GHSA-qx2v-qp2m-jg93 (postcss), GHSA-4w7w-66w2-5vf9 (vite),
       GHSA-3v7f-55p6-f55p (picomatch x2)
- docs: GHSA-67mh-4wv8-2f99 (esbuild), GHSA-qx2v-qp2m-jg93 (postcss),
        GHSA-4w7w-66w2-5vf9 (vite)

* chore(deps): bump brace-expansion and add docs-build PR check

web/:
- pnpm.overrides force brace-expansion>=1.1.13 and >=2.0.3
  to address GHSA-f886-m6hf-6m8v (transitive via eslint/typescript-eslint -> minimatch)
- pnpm-lock.yaml resolves brace-expansion 1.1.15 / 2.1.1

ci:
- add docs-build job to pr-tests.yml, gated by docs/skillhub/** path filter
  so docs-only PRs and dependency overrides on docs are exercised before merge
 2026-05-28 10:17:27 +08:00
Cheney
f59a10e36f chore(ci): remove temporary publish-script test workflow 2026-05-13 09:28:28 +08:00
Cheney
1420ffac56 test(ci): add temporary workflow to test publish-cli script 
This workflow runs scripts/tests/publish-cli-test.sh in CI to verify
the publish script changes. Will be removed after verification.
 2026-05-12 17:53:12 +08:00
Cheney
eeb2540a3e fix(cli): align checkout ref across all workflow jobs 
publish-npm and create-release now checkout the same ref as
build-and-test (the input tag or push ref), preventing source
mismatch between npm package and GitHub Release artifacts.
 2026-05-12 17:29:58 +08:00
Cheney
70b962a4c8 fix(cli): harden release pipeline per PR #422 review 
1. npm version check: three-state logic (exists/missing/error) to prevent
   silent skip on network failures, registry 5xx, or auth issues.

2. workflow_dispatch: checkout the specified tag and validate SHA matches,
   preventing builds from wrong ref.

3. Atomic push: use `git push --atomic` and detect unpushed tags via
   `git ls-remote` instead of `--no-merged` (catches branch-pushed-but-
   tag-failed state).
 2026-05-12 17:15:35 +08:00
Cheney
159886b76d fix(cli): ensure create-release depends on publish-npm and rewrite publish-cli tests 
1. Update release-cli.yml to make create-release depend on publish-npm with proper skip_npm handling, preventing half-released state where GitHub Release exists but npm package is unavailable.

2. Rewrite publish-cli-test.sh to cover the new publish flow: main branch check, dirty tree detection, tag baseline sync, version bumping, tag conflict detection, user cancellation, and atomic push verification.
 2026-05-12 16:12:57 +08:00
Cheney
378216c6da feat(cli): add automated build and publish workflow 
- Add release-cli.yml GitHub Actions workflow: build, test, npm publish,
  and GitHub Release triggered by cli-v* tags
- Rewrite scripts/publish-cli.sh: local bump + commit + tag + push,
  enforces main branch, idempotent tag checks
- Add concurrency group and release idempotency to workflow
- Add make publish-cli / publish-cli-minor / publish-cli-major targets
- Add cli/RELEASE.md documenting the full release process
 2026-05-12 10:32:06 +08:00
dongmucat
351dddc912 feat(cli): add SkillHub CLI v1 with full command suite 
Implement complete CLI tool for SkillHub with 12 commands, 7 backend API endpoints, and comprehensive documentation.

CLI Commands:
- help, version: Basic information
- login, logout, whoami: Authentication management
- search: Discover published skills
- install: Install skills to agent directories (14 Tier 1 agents supported)
- list, remove, doctor: Local skill management
- publish: Publish skill packages
- update: Self-update mechanism

Backend API:
- Add /api/cli/v1 endpoints for auth, search, resolve, download, delete, publish
- Implement CliAuthController and CliSkillController
- Add security policies for CLI routes
- Full test coverage (19 backend tests)

CLI Implementation:
- TypeScript with strict mode, Bun runtime
- Pure JS zip handling (fflate) for cross-platform compatibility
- 15 agent profiles (14 Tier 1 + generic fallback)
- Secure token storage (0600 permissions)
- Path safety validation for remove operations
- Comprehensive error handling (404/403/network distinction)
- 41 unit and integration tests

Documentation:
- CLI user guide (Chinese and English)
- README updates with quick start
- GitHub Actions workflow for cross-platform CI

Quality:
- lint: 0 errors
- typecheck: pass
- test: 41/41 pass
- build: 0.30 MB (target=node for npm/npx compatibility)
 2026-04-29 15:37:04 +08:00
XiaoSeS
5bf8750658
feat(ci): add AI-powered release notes generation (#322) 
* feat(ci): add AI-powered release notes generation

- Add GitHub Models integration for automated release notes
- Support bilingual (EN) release notes with highlights extraction
- Fallback to conventional commit grouping when LLM unavailable
- Trigger on tag push or manual workflow dispatch
- Zero configuration: uses GitHub Models (gpt-4o-mini) by default

* chore: pin action versions and update gitignore

- Pin checkout and setup-deno to commit hashes matching project convention
- Add .playwright-mcp/ and .mcp.json to gitignore
 2026-04-17 15:19:48 +08:00
wowo
689e698b89
feat(ci): add PR batch test deployment workflow (#275) 
* feat(ci): add PR batch test deployment workflow

* fix(ci): support local PR batch rehearsal

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-04-09 18:45:14 +08:00