XiaoSeS
d824a0498c
fix(skill): harden SkillHub CLI guide bootstrap ( #842 )
...
Deploy Docs / build (push) Waiting to run
Deploy Docs / Deploy (push) Blocked by required conditions
Security / Dependency Review (push) Waiting to run
Security / CodeQL (java-kotlin) (push) Waiting to run
Security / CodeQL (javascript-typescript) (push) Waiting to run
Security / CodeQL (python) (push) Waiting to run
* fix(skill): harden SkillHub CLI guide bootstrap
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
* test(web): support exact preview browser checks
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
* test(skill): enforce guide safety contracts
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
* fix(skill): verify CLI package provenance
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
* test(web): align CLI provenance assertions
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
---------
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-09-09 20:25:50 +08:00
XiaoSeS
0ae50f30d7
feat(skill): add first-party SkillHub CLI guide
...
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-09-09 09:24:21 +08:00
XiaoSeS
3364869b6f
Merge pull request #812 from FenjuFu/fix/issue-810-spa-cache
...
fix(web): revalidate SPA entry point after upgrades
2026-09-04 16:31:53 +08:00
FenjuFu
3c9eda199c
fix(web): preserve LF endings in nginx assets
...
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-09-04 11:56:16 +08:00
FenjuFu
12dba95764
fix(web): revalidate SPA entry point
...
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
2026-09-04 11:29:23 +08:00
XiaoSeS
7069e87e3b
fix(skill): validate derived registry hosts
...
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-09-04 11:23:03 +08:00
XiaoSeS
b4616e60fd
fix(skill): derive registry URL for default installs
...
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-09-04 11:23:03 +08:00
XiaoSeS
613d449d38
feat(skill): complete install-for-agent workflow
...
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-09-04 11:23:03 +08:00
wurongjie
b807fb3ee1
fix(security): harden CSP policy and hide nginx server tokens
...
- Remove 'unsafe-inline' and 'unsafe-eval' from script-src directive
- Restrict connect-src to 'self' only
- Disable nginx server_tokens to hide version information
Signed-off-by: wurongjie <wurongjie@uniontech.com>
2026-08-24 17:02:42 +08:00
philsun
34f244e7a4
feat(web): support configurable base-path deployment
...
Signed-off-by: philsun <xinyi.sun@daocloud.io>
2026-08-05 12:50:26 +08:00
XiaoSeS
e4fb26d4ba
fix(nginx): trust forwarded proto only when configured
...
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
2026-07-28 20:03:50 +08:00
wurongjie
42da467336
fix(nginx): use X-Forwarded-Proto header for proper protocol forwarding
...
Replace $scheme with $http_x_forwarded_proto in proxy headers to correctly
forward the original client protocol when behind a reverse proxy or load
balancer. This fixes OAuth2 authentication issues where redirects would use
the wrong protocol scheme.
2026-05-15 13:53:26 +08:00
XiaoSeS
3366d018dc
fix: increase nginx upload limit and filter Chrome DevTools logs ( #195 )
...
* fix: increase nginx upload limit and filter Chrome DevTools logs
- Add client_max_body_size 100M to nginx config to allow large skill package uploads
- Silently handle Chrome DevTools .well-known requests to reduce log noise
Fixes #193
* remove
2026-03-31 09:38:51 +08:00
vsxd
012ed35a10
Serve registry skill docs from nginx
2026-03-18 17:56:53 +08:00
vsxd
9ae9b93ca7
Refine production compose runtime config
2026-03-13 17:00:47 +08:00
