Also add Python CodeQL coverage in the security workflow so repository-level script regression checks stay green when Python source exists.
Signed-off-by: dongmucat <1127093059@qq.com>
* refactor(cli): improve publish-cli script reliability
- Move version computation and pre-flight checks before build-and-test
to fail fast on conflicts (existing branch/tag) instead of wasting
minutes on lint/test/build
- Add INT/TERM signal handlers to cleanup trap so Ctrl+C during build
properly restores working tree state
- Update Makefile help text to reflect PR-based workflow
* fix(cli): use git checkout -f for robust cleanup
Address code review feedback from gemini-code-assist bot:
- Use `git checkout -f` in on-release and committed cleanup stages
to ensure reliable branch switching even when files are staged
but not committed (e.g., interrupted after `git add` but before
`git commit`)
- Remove redundant `git checkout -- <file>` in on-release stage
since `-f` already discards all local changes
This prevents cleanup failures when the script is interrupted
between staging and committing.
* fix(cli): address PR #441 review findings
- Fix ERR trap bypass: remove `if !` wrapper around `gh pr create` so
set -e triggers the trap and prints pushed-stage recovery instructions
- Fix command injection: all node -e/-p calls now use process.env
instead of interpolating shell variables into JS string literals
- Rewrite cli/RELEASE.md to document the new PR-based release flow
- Rewrite scripts/tests/publish-cli-test.sh with 10 tests covering
the new flow (stubs for bun/gh, pre-flight checks, happy path,
cleanup state machine stages)
* fix(cli): address PR #441 review findings from @dongmucat
- Bind release tag to origin/main: PR body, end-of-run hint, and
cli/RELEASE.md now use `git tag $TAG origin/main` so the tag is
always placed on the merged commit, regardless of local branch state
- Reject prerelease tags in version computation: if the latest cli-v*
tag contains non-X.Y.Z characters (e.g., -rc.1), exit with a clear
message instead of crashing in node parsing
- Add pr-scripts.yml workflow: runs publish-cli-test.sh on scripts/**
changes so the release script regression suite gates PRs
- Add Test 11 covering prerelease tag rejection
* fix(cli): compute publish baseline from origin tags only
A failed `git push origin cli-vX.Y.Z` after a successful local tag
leaves an orphan tag locally. The previous `git tag --list` baseline
would then treat it as the latest release, causing skipped versions or
publishes based on an unreleased tag.
Switch to `git ls-remote --tags --refs origin 'cli-v*' | sort -V` so
the baseline reflects only what is actually on origin. Local orphan
tags can still collide with the computed target tag, which fails fast
with a clear message as before.
Adds test 12 covering the orphan-tag scenario.
publish-npm and create-release now checkout the same ref as
build-and-test (the input tag or push ref), preventing source
mismatch between npm package and GitHub Release artifacts.
1. npm version check: three-state logic (exists/missing/error) to prevent
silent skip on network failures, registry 5xx, or auth issues.
2. workflow_dispatch: checkout the specified tag and validate SHA matches,
preventing builds from wrong ref.
3. Atomic push: use `git push --atomic` and detect unpushed tags via
`git ls-remote` instead of `--no-merged` (catches branch-pushed-but-
tag-failed state).
1. Update release-cli.yml to make create-release depend on publish-npm with proper skip_npm handling, preventing half-released state where GitHub Release exists but npm package is unavailable.
2. Rewrite publish-cli-test.sh to cover the new publish flow: main branch check, dirty tree detection, tag baseline sync, version bumping, tag conflict detection, user cancellation, and atomic push verification.
- Add release-cli.yml GitHub Actions workflow: build, test, npm publish,
and GitHub Release triggered by cli-v* tags
- Rewrite scripts/publish-cli.sh: local bump + commit + tag + push,
enforces main branch, idempotent tag checks
- Add concurrency group and release idempotency to workflow
- Add make publish-cli / publish-cli-minor / publish-cli-major targets
- Add cli/RELEASE.md documenting the full release process
* chore(workflow): align local hooks and e2e guidance
* test(e2e): expand reusable api mock helpers
* test(skill): stabilize share button e2e assertions
* chore(test): add e2e make target and tune playwright workers
* test(web): expand e2e coverage and smoke suite
* test(e2e): migrate to real API flows and add request-based data builder
* ci(e2e): add PR workflow for real-service frontend e2e
* ci(e2e): install playwright chromium in PR workflow
* test(e2e): relax timeout and force single worker in CI
* test(e2e): stabilize not-found assertions and harden CI session bootstrap
* chore(agents): align tester role with web/e2e workflow
* feat(deploy): add scanner service to release deployment
- Add skill-scanner service to compose.release.yml (enabled by default)
- Add scanner image to CI publish-images workflow matrix
- Add --scanner-image and --no-scanner flags to runtime.sh
- Add scanner config to .env.release.example
* fix(docker): add skillhub-notification module to server Dockerfile
* fix(deploy): set scanner mode to upload for container deployment
* fix(deploy): use env override instead of persisting scanner disabled state
* feat(profile): add field policy config and GET response
Add per-field edit policy configuration (editable, requiresReview) to
application.yml and expose it in the GET /api/v1/user/profile response
via a new fieldPolicies map, enabling the frontend to dynamically render
fields based on backend-driven policies.
* feat(profile): implement mixed submission in PATCH
Split profile update changes by per-field policy: fields without
requiresReview apply immediately, fields with requiresReview enter
the pending queue. Return PARTIALLY_APPLIED status with appliedFields
and pendingFields maps when both paths trigger in a single request.
* feat(web): rewrite profile page with dynamic fields
Render profile fields dynamically from backend fieldPolicies, with
whole-page read/edit mode toggle. Handle APPLIED, PENDING_REVIEW, and
PARTIALLY_APPLIED responses. Add i18n keys for review hints and
partial-apply toasts in both en and zh.
* merge: resolve deepwiki.yml conflict with package-lock.json fix
* api schema
* fix(profile): align moderation defaults and tests
* ci(deepwiki): run crawler on release publish
- Change workflow trigger from push events to release published events
- Remove automatic builds on main branch merges
- Keep manual workflow_dispatch option for flexibility
