Preserve the V44 compliance index reserved by PR #561 and renumber the unreleased identity migrations to V45-V48.
Refs #561
Refs #652
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Also add Python CodeQL coverage in the security workflow so repository-level script regression checks stay green when Python source exists.
Signed-off-by: dongmucat <1127093059@qq.com>
* refactor(cli): improve publish-cli script reliability
- Move version computation and pre-flight checks before build-and-test
to fail fast on conflicts (existing branch/tag) instead of wasting
minutes on lint/test/build
- Add INT/TERM signal handlers to cleanup trap so Ctrl+C during build
properly restores working tree state
- Update Makefile help text to reflect PR-based workflow
* fix(cli): use git checkout -f for robust cleanup
Address code review feedback from gemini-code-assist bot:
- Use `git checkout -f` in on-release and committed cleanup stages
to ensure reliable branch switching even when files are staged
but not committed (e.g., interrupted after `git add` but before
`git commit`)
- Remove redundant `git checkout -- <file>` in on-release stage
since `-f` already discards all local changes
This prevents cleanup failures when the script is interrupted
between staging and committing.
* fix(cli): address PR #441 review findings
- Fix ERR trap bypass: remove `if !` wrapper around `gh pr create` so
set -e triggers the trap and prints pushed-stage recovery instructions
- Fix command injection: all node -e/-p calls now use process.env
instead of interpolating shell variables into JS string literals
- Rewrite cli/RELEASE.md to document the new PR-based release flow
- Rewrite scripts/tests/publish-cli-test.sh with 10 tests covering
the new flow (stubs for bun/gh, pre-flight checks, happy path,
cleanup state machine stages)
* fix(cli): address PR #441 review findings from @dongmucat
- Bind release tag to origin/main: PR body, end-of-run hint, and
cli/RELEASE.md now use `git tag $TAG origin/main` so the tag is
always placed on the merged commit, regardless of local branch state
- Reject prerelease tags in version computation: if the latest cli-v*
tag contains non-X.Y.Z characters (e.g., -rc.1), exit with a clear
message instead of crashing in node parsing
- Add pr-scripts.yml workflow: runs publish-cli-test.sh on scripts/**
changes so the release script regression suite gates PRs
- Add Test 11 covering prerelease tag rejection
* fix(cli): compute publish baseline from origin tags only
A failed `git push origin cli-vX.Y.Z` after a successful local tag
leaves an orphan tag locally. The previous `git tag --list` baseline
would then treat it as the latest release, causing skipped versions or
publishes based on an unreleased tag.
Switch to `git ls-remote --tags --refs origin 'cli-v*' | sort -V` so
the baseline reflects only what is actually on origin. Local orphan
tags can still collide with the computed target tag, which fails fast
with a clear message as before.
Adds test 12 covering the orphan-tag scenario.
The `status="$(env ... printf | bash ... && echo 0 || echo $?)"` pattern
doesn't correctly capture the script's exit code because the command
substitution and pipe interact poorly. Use direct assignment with
`|| status=$?` instead.
The old approach (breaking origin URL) caused `git pull` to fail
before reaching the push step. Use a git wrapper that only fails
on `push` so the rest of the script runs normally.
Remove test 7 (remote tag race condition) — the scenario is nearly
impossible with the new baseline sync logic and too complex to
reliably simulate. Fix variable naming inconsistencies from the
renumbering.
Old test 7 used `--no-tags` config to prevent fetch from pulling the
remote tag, but that doesn't reflect any real-world scenario. With the
new baseline sync logic, a pre-existing remote tag would be synced
into the local version, eliminating the conflict path the test claimed
to cover.
Replace with a git wrapper that injects the conflicting tag into origin
right before the script's `ls-remote` check, which simulates a real
race between two developers attempting to release the same version.
Tests write stdout.log/stderr.log into the test repo root, which made
`git status --porcelain` non-empty and broke test 3 (non-main branch
abort) by tripping the dirty-tree check first.
Add a .gitignore to the test fixture repo to filter out these files.
1. npm version check: three-state logic (exists/missing/error) to prevent
silent skip on network failures, registry 5xx, or auth issues.
2. workflow_dispatch: checkout the specified tag and validate SHA matches,
preventing builds from wrong ref.
3. Atomic push: use `git push --atomic` and detect unpushed tags via
`git ls-remote` instead of `--no-merged` (catches branch-pushed-but-
tag-failed state).
Add pre-flight check in publish-cli.sh to detect unpushed commits and tags
from previous failed pushes. When detected, the script exits with clear
recovery instructions:
1. Retry push (for transient network failures)
2. Rollback and re-release (for clean restart)
This prevents the baseline sync logic from skipping failed versions when
local tags participate in version calculation after a push failure.
Addresses feedback from dongmucat in PR #422.
1. Update release-cli.yml to make create-release depend on publish-npm with proper skip_npm handling, preventing half-released state where GitHub Release exists but npm package is unavailable.
2. Rewrite publish-cli-test.sh to cover the new publish flow: main branch check, dirty tree detection, tag baseline sync, version bumping, tag conflict detection, user cancellation, and atomic push verification.
- Add release-cli.yml GitHub Actions workflow: build, test, npm publish,
and GitHub Release triggered by cli-v* tags
- Rewrite scripts/publish-cli.sh: local bump + commit + tag + push,
enforces main branch, idempotent tag checks
- Add concurrency group and release idempotency to workflow
- Add make publish-cli / publish-cli-minor / publish-cli-major targets
- Add cli/RELEASE.md documenting the full release process
Ensures npm publish uses the correct registry (registry.npmjs.org) even when
global npm config points to a mirror registry (e.g., registry.npmmirror.com).
- Add publish script with env validation, git checks, and build/test/pack preflights
- Add comprehensive test suite for publish workflow (302 lines)
- Update cli/package.json with @astron-team scope and full npm metadata
- Add README.md with user-focused documentation and registry info
- Add .env.example template for publish configuration
- Add Apache 2.0 LICENSE
- Add Makefile targets for build/test/lint/typecheck/publish workflows
- All publish targets include .env.local validation
- Update installation instructions across all documentation to use @astron-team/skillhub
- start postgres before bringing up application services
- sync the database role password from .env.release
- verify TCP auth with the synced password before startup
* docs: simplify runtime script usage
Unify to use runtime.sh for all deployment commands, removing the
distinction between "official images" and "Aliyun mirror". The --aliyun
parameter is preserved for users in China to specify the mirror.
Changes:
- Remove runtime-github.sh references, use runtime.sh uniformly
- Default command uses GHCR images
- Add --aliyun parameter for China users
- Update README.md, README_zh.md, and docs/skillhub/ quickstart files
* docs: consolidate documentation links with clear descriptions
Merge the two documentation links into a single "Documentation" section
with clear descriptions of each:
- User Guide: skill publishing, search, CLI usage
- Developer Docs: architecture, API reference, deployment
This makes it easier for users to find the right documentation.
* docs: consolidate documentation links with clear descriptions
Merge the two documentation links into a single "Documentation" section
with clear descriptions of each:
- User Guide: skill publishing, search, CLI usage
- Developer Docs: architecture, API reference, deployment
This makes it easier for users to find the right documentation.
* fix: include --home parameter in shutdown command
When starting with a custom --home directory, the generated shutdown
command now includes the same --home parameter to ensure it can find
the correct compose files.
* docs: add VitePress bilingual documentation site
- Add VitePress-based documentation with Chinese (root) and English (/en/) locales
- Include 6 feature guides: skill-publish, skill-discovery, namespace, review, scanner, social
- Add quickstart, introduction, and FAQ pages
- Include AI-generated diagrams and screenshots
- Add GitHub Pages deployment workflow
- Add Makefile targets: docs-dev, docs-build, docs-preview
* docs: rename docs/claude to docs/skillhub
- Rename documentation directory from docs/claude to docs/skillhub
- Update Makefile paths for docs-dev, docs-build, docs-preview
- Update GitHub workflow paths for deploy-docs.yml
* fix: add enablement parameter to auto-enable GitHub Pages
* Revert "fix: add enablement parameter to auto-enable GitHub Pages"
This reverts commit 11096b1a9b.
* docs: add documentation link to README
Add link to GitHub Pages documentation (https://iflytek.github.io/skillhub/)
under Quick Start section in both English and Chinese README files.
* fix: add --public-url parameter for docker deployment
- Add --public-url parameter to runtime.sh for configuring public access URL
- Create skill.md.template for dynamic URL substitution at container startup
- Update getBaseUrl() to fallback to window.location.host when appBaseUrl is localhost
- Update landing-quick-start.tsx to dynamically generate agent command URL
- Add commandTemplate to i18n files for URL placeholder support
- Update README.md and README_zh.md with deployment parameter documentation
Fixes: Docker deployment shows localhost in install commands and skill.md
* feat(deploy): add scanner service to release deployment
- Add skill-scanner service to compose.release.yml (enabled by default)
- Add scanner image to CI publish-images workflow matrix
- Add --scanner-image and --no-scanner flags to runtime.sh
- Add scanner config to .env.release.example
* fix(docker): add skillhub-notification module to server Dockerfile
* fix(deploy): set scanner mode to upload for container deployment
* fix(deploy): use env override instead of persisting scanner disabled state
Implements 6 high-priority improvements from code review:
Backend:
- Make label business limits configurable via application.yml (max-definitions, max-per-skill)
Frontend:
- Split use-skill-queries.ts into domain-specific modules (label/namespace/user/skill)
- Enable @typescript/no-explicit-any as warning and clean up 10 any types
- Unify API error handling by removing unwrap() in favor of fetchJson()
Testing:
- Add label system scenarios to smoke test script
- Add 6 new tests for label management UI (validation, rendering)
All tests passing: 301 backend, 129 frontend
