* docs: simplify runtime script usage
Unify to use runtime.sh for all deployment commands, removing the
distinction between "official images" and "Aliyun mirror". The --aliyun
parameter is preserved for users in China to specify the mirror.
Changes:
- Remove runtime-github.sh references, use runtime.sh uniformly
- Default command uses GHCR images
- Add --aliyun parameter for China users
- Update README.md, README_zh.md, and docs/skillhub/ quickstart files
* docs: consolidate documentation links with clear descriptions
Merge the two documentation links into a single "Documentation" section
with clear descriptions of each:
- User Guide: skill publishing, search, CLI usage
- Developer Docs: architecture, API reference, deployment
This makes it easier for users to find the right documentation.
* docs: consolidate documentation links with clear descriptions
Merge the two documentation links into a single "Documentation" section
with clear descriptions of each:
- User Guide: skill publishing, search, CLI usage
- Developer Docs: architecture, API reference, deployment
This makes it easier for users to find the right documentation.
* fix: include --home parameter in shutdown command
When starting with a custom --home directory, the generated shutdown
command now includes the same --home parameter to ensure it can find
the correct compose files.
* docs: add VitePress bilingual documentation site
- Add VitePress-based documentation with Chinese (root) and English (/en/) locales
- Include 6 feature guides: skill-publish, skill-discovery, namespace, review, scanner, social
- Add quickstart, introduction, and FAQ pages
- Include AI-generated diagrams and screenshots
- Add GitHub Pages deployment workflow
- Add Makefile targets: docs-dev, docs-build, docs-preview
* docs: rename docs/claude to docs/skillhub
- Rename documentation directory from docs/claude to docs/skillhub
- Update Makefile paths for docs-dev, docs-build, docs-preview
- Update GitHub workflow paths for deploy-docs.yml
* fix: add enablement parameter to auto-enable GitHub Pages
* Revert "fix: add enablement parameter to auto-enable GitHub Pages"
This reverts commit 11096b1a9b.
* docs: add documentation link to README
Add link to GitHub Pages documentation (https://iflytek.github.io/skillhub/)
under Quick Start section in both English and Chinese README files.
* fix: add --public-url parameter for docker deployment
- Add --public-url parameter to runtime.sh for configuring public access URL
- Create skill.md.template for dynamic URL substitution at container startup
- Update getBaseUrl() to fallback to window.location.host when appBaseUrl is localhost
- Update landing-quick-start.tsx to dynamically generate agent command URL
- Add commandTemplate to i18n files for URL placeholder support
- Update README.md and README_zh.md with deployment parameter documentation
Fixes: Docker deployment shows localhost in install commands and skill.md
* feat(deploy): add scanner service to release deployment
- Add skill-scanner service to compose.release.yml (enabled by default)
- Add scanner image to CI publish-images workflow matrix
- Add --scanner-image and --no-scanner flags to runtime.sh
- Add scanner config to .env.release.example
* fix(docker): add skillhub-notification module to server Dockerfile
* fix(deploy): set scanner mode to upload for container deployment
* fix(deploy): use env override instead of persisting scanner disabled state
Implements 6 high-priority improvements from code review:
Backend:
- Make label business limits configurable via application.yml (max-definitions, max-per-skill)
Frontend:
- Split use-skill-queries.ts into domain-specific modules (label/namespace/user/skill)
- Enable @typescript/no-explicit-any as warning and clean up 10 any types
- Unify API error handling by removing unwrap() in favor of fetchJson()
Testing:
- Add label system scenarios to smoke test script
- Add 6 new tests for label management UI (validation, rendering)
All tests passing: 301 backend, 129 frontend
* feat(security): extend scanner config with full analyzer options
Integrate skill-scanner's 8 analysis engines and policy configuration
into SkillHub's config system. Operators can now control behavioral,
LLM, Meta, AI Defense, VirusTotal, and trigger analyzers via
application.yml or environment variables.
Changes:
- Add Analyzers and Policy nested classes to SkillScannerProperties
- Create ScanOptions record to encapsulate analyzer flags
- Update SkillScannerService to pass options in /scan body and /scan-upload query params
- Wire ScanOptions through SkillScannerConfig and SkillScannerAdapter
- Extend application.yml with full scanner config block and env var overrides
- Update all tests to verify new configuration flow
All tests pass.
* feat(security): add domain model and integrate scan into publish flow
Add SCANNING/SCAN_FAILED status to SkillVersionStatus. Introduce
SecurityScanService, SecurityScanner port, ScanTask, SecurityAudit
and related domain types. Wire scan trigger into SkillPublishService
so non-auto-publish versions enter scanning when scanner is enabled,
falling back to review task creation when disabled.
* feat(security): add infra layer for scanner HTTP client and adapters
Add WebClient-based HttpClient abstraction with WebClientHttpClient
implementation. Add SkillScannerApiResponse record, SecurityScanException,
and SecurityAuditJpaRepository. Add webflux and test dependencies to
infra module.
* feat(security): add Redis stream consumers, audit API, and DB migration
Add AbstractStreamConsumer base class, ScanTaskConsumer for processing
scan results from Redis stream, and RedisScanTaskProducer. Add
RedisStreamConfig for stream/group initialization. Add SecurityAudit
REST controller and DTO. Add V35 Flyway migration for security_audits
table.
* feat(security): add scanner config to application profiles
Add scanner enabled flag to application-local.yml and
application-test.yml. Enable behavioral analyzer by default
in application.yml.
* feat(deploy): add skill-scanner to docker-compose and k8s manifests
Add skill-scanner service to docker-compose.yml with health check.
Add scanner k8s deployment, service, and configmap entries. Wire
scanner env vars into Makefile dev-all flow. Add verify-scanner.sh
script for post-deploy validation.
* docs(security): add scanner documentation suite
Add scanner docs: configuration guide, failure impact analysis,
monitoring guide, improvement recommendations, custom rules guide,
and skill-vetter rules conversion example. Update deployment docs
with scanner section. Add security-scanning overview and PRD.
* feat(security): add skill-vetter custom rule examples
Add example Regex and YARA rules derived from skill-vetter RED FLAGS
in scanner/examples/vetter-rules/. Includes 7 Regex rules
(signatures-append.yaml) and 3 YARA rules (skillhub_vetter.yara)
covering agent memory theft, IP-based exfiltration, and browser
data theft detection.
* feat(security): add scanner Docker build context
Add Dockerfile for cisco-ai-skill-scanner container and
.env.example with LLM configuration placeholders.
* fix(security): align Finding mapping with scanner API response schema
SkillScannerApiResponse.Finding used incorrect field names (message,
location.file, location.line, code_snippet) that did not match the
scanner's actual JSON output (description, file_path, line_number,
snippet), causing all four fields to deserialize as null.
Flatten Finding to match scanner API: remove nested Location, rename
fields to description/file_path/line_number/snippet. Add skill_name
and timestamp to SkillScannerApiResponse. Extend SecurityFinding with
remediation, analyzer, and metadata fields to capture LLM analyzer
output. Retain 8-arg compact constructor for backward compatibility.
* chore(security): add debug logging to scanner response mapping
Log raw scanner API response and mapped SecurityFinding fields
side-by-side to help verify data consistency between scanner
output and database records.
* feat(security): add multi-scanner support and soft delete for security audits
- Add ScannerType enum for type-safe scanner identification
- Update V35 migration to support multiple scanners and soft delete
- Remove CASCADE delete, use code-level soft delete (deleted_at)
- Add repository methods for querying latest audit by scanner type
- Update SecurityScanService to handle scanner type parameter
- Integrate soft delete in SkillHardDeleteService
- Update all tests to use ScannerType enum
This enables multiple scanner integrations (skill-scanner, future LLM/compliance scanners)
and preserves complete audit history through soft deletion.
* feat(security): add security audit UI to review detail and skill detail pages
Display security scan results on the review detail page (full audit
section with collapsible findings) and the skill detail sidebar (compact
summary with dialog for details). Handles empty/404 gracefully by
returning null, avoids loading shimmer flicker, and separates lifecycle
action buttons with a visual divider.
* docs(security): add security audit UI PRD
* fix(security): replace LocalDateTime with Instant in security audit and align controller test with list API
SecurityAudit and SecurityScanService used LocalDateTime.now() which
violated the project time guardrail. Replaced with Instant and
Clock.systemUTC() to match existing conventions.
Also fixed SecurityAuditControllerTest to mock the correct repository
method (findLatestActiveByVersionId) and assert against the list
response shape.
* test(security): add useQuery mock for security audit components in frontend tests
The SecurityAuditSummary and SecurityAuditSection components use
useQuery via useSecurityAudits hook, which was missing from the
@tanstack/react-query mocks in skill-detail and review-detail tests.
Add infrastructure for running Claude and Codex agents in parallel
without conflicts, using isolated git worktrees and shared Docker
dependencies.
Changes:
- Add agent-worktrees and agent-sync Makefile targets
- Pin Docker Compose project names to enable worktree isolation
- Add setup-agent-worktrees.sh script for creating parallel worktrees
- Add sync-agent-integration.sh script for merging agent branches
- Document parallel workflow in 13-agent-parallel-workflow.md
- Update dev-workflow.md with worktree usage guide
Benefits:
- Prevents agents from overwriting each other's work
- Shares dependency containers across worktrees (Postgres/Redis/MinIO)
- Reserves localhost:3000 for integration verification only
- Provides clear merge and recovery procedures
- Add sticky header with LanguageSwitcher and UserMenu to landing page
- Update token dialog and i18n translations
- Fix dev process script and compose release config
- Remove stale skillhub submodule reference
