scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-24 00:55:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
1360 commits 247 branches 28 tags 52 MiB
Commit graph

562 commits

Author SHA1 Message Date
XiaoSeS
d824a0498c
fix(skill): harden SkillHub CLI guide bootstrap (#842)
Some checks are pending
Deploy Docs / build (push) Waiting to run
Details
Deploy Docs / Deploy (push) Blocked by required conditions
Details
Security / Dependency Review (push) Waiting to run
Details
Security / CodeQL (java-kotlin) (push) Waiting to run
Details
Security / CodeQL (javascript-typescript) (push) Waiting to run
Details
Security / CodeQL (python) (push) Waiting to run
Details 
* fix(skill): harden SkillHub CLI guide bootstrap

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): support exact preview browser checks

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(skill): enforce guide safety contracts

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(skill): verify CLI package provenance

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align CLI provenance assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 20:25:50 +08:00
XiaoSeS
beecc34b88
feat(web): unify landing, dashboard, and paginated lists (#825) 
* feat(web): unify landing and dashboard experience

Closes #824

Made-with: Proma
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): clamp skill card summaries

Keep skill grids compact by reserving a stable three-line summary region while exposing the full description via the title attribute.

Made-with: Proma
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align e2e with redesigned experience

Update real-service E2E assertions for the current landing and dashboard flows, and make settings card headings distinct from their page headings.

Made-with: Proma

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* Revert "test(web): align e2e with redesigned experience"

This reverts commit 3f78115277.

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): align dashboard layout footer spacing

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): restore footer access links

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): link footer API to Swagger UI

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): refine footer resource links

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): link landing CTA to open source resources

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(frontend): restore responsive navigation contracts

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): wrap narrow search controls

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): derive landing guide origin

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): remove landing statistics strip

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align landing guide assertion

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): address follow-up review feedback

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): update landing CLI version

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 18:31:18 +08:00
XiaoSeS
acf4448c6f feat(skill): use latest CLI with registry fallback 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 17:17:26 +08:00
XiaoSeS
f5c554c9bd feat(skill): make first-party CLI own skillhub command 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 15:08:42 +08:00
XiaoSeS
0ce9b8e35a chore(skill): register skillhub cli builtin package 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 09:24:21 +08:00
XiaoSeS
25e18e047c
Merge pull request #829 from iflytek/codex/feat/issue-819-hidden-skill-restore-20260908 
fix(governance): restore hidden skill management
 2026-09-08 14:35:22 +08:00
XiaoSeS
a6aa073627 fix(validation): preserve wrapper expression boundaries 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 12:25:29 +08:00
XiaoSeS
52969c997c fix(validation): classify bare secrets by file context 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 12:17:03 +08:00
XiaoSeS
8f9db2ada7 fix(validation): scan all sensitive assignments 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 12:03:56 +08:00
XiaoSeS
9d0431f7d3 fix(validation): preserve credential literal boundaries 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 11:45:48 +08:00
XiaoSeS
7c62aa218a fix(validation): avoid regex stack overflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 11:34:51 +08:00
XiaoSeS
702a1cc34f perf(governance): batch hidden skill summaries 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 11:32:20 +08:00
XiaoSeS
4efd6c6366 refactor(governance): page hidden skill queries 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 11:27:36 +08:00
XiaoSeS
927780db46 fix(governance): exclude hidden skills from owner list 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 11:19:06 +08:00
XiaoSeS
824a992afc fix(validation): ignore credential expressions 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 11:17:22 +08:00
XiaoSeS
5c5634dd22 fix(governance): restore hidden skill management 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 11:15:04 +08:00
XiaoSeS
1ea1c0867f test(builtin-skills): avoid manifest size coupling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 15:56:00 +08:00
XiaoSeS
9761205e77 feat(builtin-skills): publish plugin scanner artifact 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 15:51:31 +08:00
XiaoSeS
7d9ea67169 test(builtin-skills): derive collection size from catalog 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 15:25:02 +08:00
XiaoSeS
1b7e679d45 fix(security): include csrf token in scan retry 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:46:13 +08:00
XiaoSeS
fd932cc160 fix(security): require explicit retry locking 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:45:44 +08:00
XiaoSeS
6770be22c5 test(security): verify retry row locking 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:45:44 +08:00
XiaoSeS
697bb952a4 fix(security): harden scan retry lifecycle 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:45:44 +08:00
XiaoSeS
680a5d1b94 feat(security): retry failed scans 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:45:16 +08:00
XiaoSeS
ccc13291b2 fix(scanner): keep failure details private 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
8b09c23dc4 fix(scanner): make terminal failures recoverable 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
4bfb5e2692 fix(scanner): expire unavailable pending tasks 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
2e697d1581 test(scanner): reproduce unbounded unavailable task 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
4d71a16ddd fix(notification): complete polling migration 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 11:38:02 +08:00
XiaoSeS
efa3c1ae65 refactor(notification): replace SSE with HTTP polling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 11:38:02 +08:00
XiaoSeS
fc7c59534a
fix(platform): harden sessions, scanner recovery, and CLI guidance (#801) 
* fix(auth): recover from unreadable sessions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): defer unavailable scan tasks safely

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): prefer the SkillHub CLI install command

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(auth): decode session cookies during recovery

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(runtime): address scanner and session review findings

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): defer all server-side outages

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* docs(scanner): clarify deferred failure semantics

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(scanner): cover recovery boundaries

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): register startup hook on router

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(e2e): align install defaults and reuse auth session

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 20:15:42 +08:00
XiaoSeS
45d341f144
feat(review): add skill comments and user feedback (#793) 
* feat(review): add skill review domain model

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* feat(review): expose skill reviews in API and UI

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve moderation under concurrent edits

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): scope concurrent write conflicts

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): restore web build compatibility

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): keep author cleanup available

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve author cleanup access

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): require review score contract

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): strengthen failure and concurrency coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): tighten persistence assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): disambiguate repository ports

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enable request validation

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): align validation and postgres coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(namespace): verify invalid batch has no side effects

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align accessibility and plural assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(i18n): require complete plural references

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap editor actions on mobile

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap long mobile labels

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): disable edits for archived skills

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enforce archived mutation guard

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 11:15:52 +08:00
XiaoSeS
fa13dd54ee test(review): validate progress query on postgres 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
83599f9317 fix(review): prevent progress offset overflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
39861bc6d8 test(review): strengthen exact-sha coverage 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
a568d22526 fix(review): restrict version history to reviewers 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
3e77365a5d fix(review): complete progress history workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
7995c00683 feat(review): add author review progress and attempt history 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
ac42c2346c
Merge pull request #786 from iflytek/fix/issue-613-oauth-concurrency-20260831 
fix(auth): converge concurrent identity binding
 2026-08-31 18:49:41 +08:00
XiaoSeS
bdb42b1be9
Merge pull request #787 from iflytek/fix/issue-615-audit-atomicity-20260831 
fix(governance): make mutations and audit atomic
 2026-08-31 18:48:30 +08:00
XiaoSeS
a73997c672
Merge pull request #784 from iflytek/fix/concurrent-publish-coordinate-race 
fix(publish): return deterministic conflict on concurrent coordinate race
 2026-08-31 18:47:19 +08:00
XiaoSeS
3a29f6d750 fix(auth): converge concurrent identity binding 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
b22b92fcbc fix(governance): make mutations and audit atomic 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
182f7bacef fix(publish): flush concurrent coordinate writes 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 16:30:33 +08:00
XiaoSeS
13510609a0
Merge pull request #783 from iflytek/fix/auth-stale-session-public-routes 
fix(auth): allow public routes after session expiry
 2026-08-31 15:25:01 +08:00
XiaoSeS
d1cd3d2afe
Merge pull request #782 from FenjuFu/fix/audit-detail-json 
fix(audit): render audit detail JSON with Jackson instead of string concatenation
 2026-08-31 15:24:06 +08:00
XiaoSeS
49ef09d989
Merge pull request #773 from FenjuFu/fix/publish-case-insensitive-whitelist 
fix(publish): match allowed filenames case-insensitively
 2026-08-31 15:19:52 +08:00
FenjuFu
d224c5a8ba fix(publish): return deterministic conflict on concurrent coordinate race 
Concurrent publishes for the same (namespace_id, slug, owner_id) or
(skill_id, version) coordinate both pass the check-then-create reads and
race on the database unique constraints. The losing request surfaced an
unhandled DataIntegrityViolationException as HTTP 500.

Translate the constraint violation at both insert points into a
deterministic DomainBadRequestException (error.skill.publish.concurrentConflict),
matching the existing idiom in LabelDefinitionService/ReviewService/
PromotionService. No same-transaction re-read is attempted, so the losing
publish rolls back cleanly and returns a retryable conflict instead of a 500.

Add the i18n key (en/zh) and two unit tests covering the skill-insert and
version-insert races.

Closes #617

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-31 14:27:45 +08:00
XiaoSeS
346acbcfa3 fix(auth): preserve protected invalid-session handling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
9f3b10d27a test(publish): cover case-insensitive whitelist variants 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00