scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-08-27 11:14:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
1171 commits 189 branches 21 tags 41 MiB
Commit graph

1171 commits

This branch
This branch
All branches
Author SHA1 Message Date
lhb6540
f3dbb57a80 fix(helm): 修正 CI 渲染与 PostgreSQL 管理员密码引用 
同步 Helm CI matrix 与当前 values schema 和确定性凭据策略。

- 所有 CI 渲染加载测试凭据并迁移 Ingress TLS 数组配置
- PostgreSQL 使用 postgres 用户时引用管理员密码 key
- 增加内置 Secret 和 existingSecret 的管理员用户契约测试

Signed-off-by: lhb6540 <lhb6540@gmail.com>
 2026-07-20 11:36:04 +08:00
betterlmy
f519b08a73 fix(cli): preflight canonical install targets 
Signed-off-by: betterlmy <betterlmy@icloud.com>
 2026-07-17 17:20:22 +08:00
betterlmy
8b84201516 feat: add generic user-level agent install target 
Signed-off-by: betterlmy <betterlmy@icloud.com>
 2026-07-17 11:39:29 +08:00
dongmucat
2e4a69d590
Merge pull request #529 from FenjuFu/faq/add-community-qa
Some checks failed
Deploy Docs / build (push) Has been cancelled
Details
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
docs(faq): supplement FAQ (zh & en) with community-sourced Q&A
 2026-07-17 10:35:29 +08:00
lhb6540
9978d82cb1 fix(helm): 修正 Server PVC 权限与 RWO 升级策略 
本地 PVC 会覆盖 Server 镜像内预先设置的目录所有者，导致非 root app 用户无法写入技能文件。

- 为 Server Pod 增加可覆盖的 fsGroup，默认匹配 v0.2.13 镜像的 app 组 101
- 本地 ReadWriteOnce 存储自动使用 Recreate，避免滚动升级时新旧 Pod 抢占卷
- ReadWriteMany 与 S3 部署继续使用 RollingUpdate
- 补充 values schema、配置契约测试和运维文档

Signed-off-by: lhb6540 <lhb6540@gmail.com>
 2026-07-16 20:04:35 +08:00
lhb6540
5d379dcaaf fix(helm): 修正组件启停与依赖配置并增加 values 校验 
在配置进入 Kubernetes 前完成父 Chart 校验，并补齐剩余的依赖配置契约。

- 让 Service、HPA 和 PDB 正确遵循组件启用状态
- 校验 Ingress、自动扩缩容、外部依赖和共享存储的组合配置
- 增加 values.schema.json 和 Helm 配置契约测试并接入 CI
- 统一 PostgreSQL Primary 与 Read Replica 的 max_connections 配置
- 修正 Redis Sentinel 节点、依赖等待和独立密码配置
- 允许覆盖依赖等待容器镜像，支持完整私有镜像仓库部署
- 兼容现代与旧式 IngressClass，并支持多域名 TLS 和证书 SAN
- 增加 GitOps 稳定 Secret 模式，阻止离线渲染产生随机凭据漂移
- 引用用户可控的 ConfigMap 字符串，并推导 TLS 安全 Cookie 和设备认证默认值
- 补充 Sentinel、RWX 存储、TLS Cookie、PVC 保留、私有镜像和 GitOps 文档
- 增加 Redis 数据密码与 Sentinel 密码分离的应用配置测试

已通过 Helm 严格 lint、渲染场景、配置契约测试、kubeconform、后端测试套件和 Sentinel 专项配置测试。

Signed-off-by: lhb6540 <lhb6540@gmail.com>
 2026-07-15 17:19:24 +08:00
lhb6540
3b3905be63 fix(helm): 修正 Bitnami 依赖连线并同步应用配置 
基于当前 SkillHub 运行时契约和 Bitnami 依赖命名，更新原贡献者提交的 Helm Chart 配置。

- 将 Server 正确连接到实际的 PostgreSQL 和 Redis Service 与 Secret
- 支持依赖组件的 existingSecret 名称和自定义密码 key，避免安装时 lookup
- 同步 S3、匿名下载、Scanner LLM、公开地址、设备认证和直接认证配置
- 将应用版本和 Chart 版本对齐当前发布版本
- 收紧 Chart 发布触发条件和手动版本选择逻辑
- 增加依赖 Service、Secret 和密码 key 的 CI 语义断言

已通过 Helm lint、九组渲染场景、kubeconform、工作流安全检查和后端应用测试套件。

Signed-off-by: lhb6540 <lhb6540@gmail.com>
 2026-07-15 17:19:15 +08:00
dongmucat
e32f05b375
Merge pull request #568 from iflytek/fix/admin-super-admin-role-guard
Some checks failed
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details 
fix(auth): guard SUPER_ADMIN role mutations
 2026-07-02 13:53:32 +08:00
dongmucat
3a254d7524 fix(auth): guard SUPER_ADMIN role mutations 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-07-01 16:23:45 +08:00
dongmucat
06cc523a0c
Merge pull request #557 from iflytek/fix/relative-link-nested-preview
Some checks failed
Security / Dependency Review (push) Has been cancelled
Details
Deploy Docs / build (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
fix(frontend): support nested preview links
 2026-06-30 17:29:08 +08:00
dongmucat
f7cc6e758f
Merge pull request #565 from iflytek/fix/scanner-llm-base-url 
Fix scanner local LLM base URL handling
 2026-06-30 15:25:03 +08:00
dongmucat
f43c8fcbee
Merge pull request #567 from iflytek/fix/dependabot-open-alerts-dco 
fix(frontend): patch undici dependabot alerts
 2026-06-30 14:40:42 +08:00
dongmucat
85332a2237 chore(staging): keep dependabot fix scoped 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-30 14:04:08 +08:00
dongmucat
db8aa36f89 fix(frontend): patch undici alerts and harden staging web 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-30 10:58:05 +08:00
dongmucat
bf7c71ad2c fix(scanner): backport local LLM base URL handling for #563 
Also add Python CodeQL coverage in the security workflow so repository-level script regression checks stay green when Python source exists.

Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-29 14:34:55 +08:00
dongmucat
0134da73b5 fix(frontend): support nested preview links 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-24 16:51:42 +08:00
dongmucat
8413ee3950
Merge pull request #554 from iflytek/fix/auth-password-settings
Some checks failed
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details 
fix(auth): restore password settings access
 2026-06-24 10:50:26 +08:00
dongmucat
c25f950841
Merge pull request #555 from iflytek/feature/promotion-review-optimization 
feat(promotion): improve promotion review dashboard
 2026-06-24 10:36:46 +08:00
dongmucat
e501be9cf8 feat(promotion): improve promotion review dashboard 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-24 09:28:43 +08:00
dongmucat
636f1edac2 docs(auth): align auth me example with #541 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-23 13:54:33 +08:00
dongmucat
f61ce71daa test(web): ISSUE-61 cover security settings real requests 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-22 17:22:19 +08:00
dongmucat
9f927c12b0 fix(PR): default deny security password changes 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-22 14:22:25 +08:00
dongmucat
54006e72a4 fix(web): ISSUE-62 gate security settings by capability 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-22 14:00:53 +08:00
dongmucat
665ee0499a feat(auth): add ISSUE-60 password capability field 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-22 12:40:01 +08:00
dongmucat
dc185861d4
Merge pull request #542 from iflytek/release/cli-v0.1.8
Some checks failed
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details 
chore(cli): release 0.1.8
 2026-06-18 15:56:27 +08:00
dongmucat
78b8b34ed1 chore(cli): bump version to 0.1.8 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-18 15:54:23 +08:00
dongmucat
f8ea4e67e4
feat(cli): support anonymous public search and install 
feat(cli): support anonymous public search and install
 2026-06-18 14:29:45 +08:00
moses
cb950c2d21
Merge branch 'iflytek:main' into main 2026-06-18 13:57:42 +08:00
dongmucat
ea73c305b8
Merge pull request #534 from SenLinLeo/fix/install-target-enter-selection 
fix(cli): treat highlighted install target as selected
 2026-06-18 09:43:48 +08:00
dongmucat
17daf87ab6
Merge pull request #539 from iflytek/fix/notification-sse-headers
Some checks failed
Security / CodeQL (java-kotlin) (push) Waiting to run
Details
Security / Dependency Review (push) Waiting to run
Details
Security / CodeQL (javascript-typescript) (push) Waiting to run
Details
Deploy Docs / build (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
fix(notification): preserve SSE headers for notification stream
 2026-06-17 16:20:35 +08:00
dongmucat
48a1de9640 fix(notification): preserve SSE headers for notification stream 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 15:19:07 +08:00
dongmucat
477bf08e3b
Merge pull request #537 from iflytek/fix/codeql-python-matrix 
fix(ci): remove unsupported Python CodeQL scan
 2026-06-17 14:19:25 +08:00
dongmucat
32f34fbf4c fix(ci): remove unsupported Python CodeQL scan 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 14:04:27 +08:00
dongmucat
22a76515d3
Merge pull request #538 from iflytek/chore/deps-2026-06-security 
chore(deps): patch dependabot security alerts
 2026-06-17 14:01:39 +08:00
dongmucat
47a0ef1f7f chore(deps): patch dependabot security alerts 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 13:43:43 +08:00
dongmucat
cf22f568f7 test(cli): align auth tests with bearer hardening 
Refs: 25f57a32-5f1d-4d56-b6b7-9b6b7b868799
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 11:35:17 +08:00
dongmucat
cb4bf94711 fix(cli): filter installable search before pagination 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 11:35:16 +08:00
dongmucat
5a708a5bd6 fix(domain): reject anonymous restricted resolves cleanly 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 11:35:16 +08:00
dongmucat
f5259daa94 fix(cli): require installable latest in search 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 11:35:16 +08:00
dongmucat
32cc316b30 fix(cli): align anonymous installability rules 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 11:35:16 +08:00
dongmucat
9520cf63e0 fix(cli): add token auth to search 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 11:35:16 +08:00
dongmucat
b56973fb80 fix(auth): fail closed invalid cli bearer tokens 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 11:35:16 +08:00
dongmucat
e4e1639833
Merge pull request #536 from iflytek/fix/review-super-admin-self-promotion 
fix(review): allow super admin self promotion review
 2026-06-17 11:25:09 +08:00
dongmucat
a85298f7ae
Merge pull request #508 from iflytek/fix/security-review-hardening 
fix(security): harden review findings
 2026-06-17 11:08:38 +08:00
dongmucat
a23cbd84eb
Merge pull request #530 from iflytek/fix/issue-51-profile-review-notifications 
fix: admin notifications for profile review requests
 2026-06-17 11:08:10 +08:00
dongmucat
52251fcd0e chore(docs): remove handwritten notification OpenAPI (#524) 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 10:25:34 +08:00
dongmucat
e50140272b fix(security): close review hardening gaps 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-16 17:48:15 +08:00
SenLinLeo
b44c65443d fix(cli): treat highlighted install target as selected 
Signed-off-by: SenLinLeo <1664761477@qq.com>
 2026-06-16 16:30:30 +08:00
dongmucat
a73dba5f80
Merge pull request #533 from iflytek/fix/publish-notification-owner 
fix(notification): avoid publish notice for promotion reviewers
 2026-06-16 15:16:08 +08:00
dongmucat
05e1968563
Merge pull request #526 from iflytek/feature/add-agentguard-skill 
feat(bootstrap): add agentguard builtin skill
 2026-06-16 14:27:30 +08:00