scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-24 00:55:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
1380 commits 247 branches 28 tags 52 MiB
Commit graph

99 commits

Author SHA1 Message Date
XiaoSeS
d9696be9e4 merge main into feature/skill-suites 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 20:37:53 +08:00
XiaoSeS
d824a0498c
fix(skill): harden SkillHub CLI guide bootstrap (#842)
Some checks are pending
Deploy Docs / build (push) Waiting to run
Details
Deploy Docs / Deploy (push) Blocked by required conditions
Details
Security / Dependency Review (push) Waiting to run
Details
Security / CodeQL (java-kotlin) (push) Waiting to run
Details
Security / CodeQL (javascript-typescript) (push) Waiting to run
Details
Security / CodeQL (python) (push) Waiting to run
Details 
* fix(skill): harden SkillHub CLI guide bootstrap

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): support exact preview browser checks

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(skill): enforce guide safety contracts

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(skill): verify CLI package provenance

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align CLI provenance assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 20:25:50 +08:00
XiaoSeS
ce4590c50f Merge remote-tracking branch 'origin/main' into feature/skill-suites-signed-final 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 18:23:05 +08:00
XiaoSeS
acf4448c6f feat(skill): use latest CLI with registry fallback 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 17:17:26 +08:00
XiaoSeS
f5c554c9bd feat(skill): make first-party CLI own skillhub command 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 15:08:42 +08:00
XiaoSeS
a4b35b236a fix(suite): bind exact members and protect local installs 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 13:54:59 +08:00
XiaoSeS
d0e8c168fa feat(suite): require and expose entry skill 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 13:54:59 +08:00
XiaoSeS
0ae50f30d7 feat(skill): add first-party SkillHub CLI guide 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-09 09:24:21 +08:00
XiaoSeS
859987e3bb feat(suite): add first-class skill suites 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-08 19:30:57 +08:00
XiaoSeS
b9972af39f
Merge pull request #814 from iflytek/codex/issue-728-plugin-scanner-20260904 
feat(builtin-skills): add HOL Guard plugin scanner
 2026-09-04 16:32:29 +08:00
XiaoSeS
3364869b6f
Merge pull request #812 from FenjuFu/fix/issue-810-spa-cache 
fix(web): revalidate SPA entry point after upgrades
 2026-09-04 16:31:53 +08:00
XiaoSeS
bcef4fc5f0 test(builtin-skills): constrain runtime inventory 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 15:27:04 +08:00
XiaoSeS
7d9ea67169 test(builtin-skills): derive collection size from catalog 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 15:25:02 +08:00
FenjuFu
3c9eda199c fix(web): preserve LF endings in nginx assets 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-09-04 11:56:16 +08:00
FenjuFu
374525468f test(web): assert SPA cache revalidation 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-09-04 11:29:58 +08:00
XiaoSeS
7069e87e3b fix(skill): validate derived registry hosts 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 11:23:03 +08:00
XiaoSeS
b4616e60fd fix(skill): derive registry URL for default installs 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 11:23:03 +08:00
XiaoSeS
5f17e7a181 fix(skill): align helper update with CLI inventory 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 11:23:03 +08:00
XiaoSeS
613d449d38 feat(skill): complete install-for-agent workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-04 11:23:03 +08:00
XiaoSeS
15dad68740
test(promotion): cover global download after approval (#792) 
* test(promotion): cover global download after approval

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): align smoke setup with current API

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): make download smoke repeatable

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): wait for member review readiness

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(promotion): verify denied approval state

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 11:15:10 +08:00
XiaoSeS
aa4ea17c4a fix(deploy): preserve storage volume ownership 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:58:55 +08:00
XiaoSeS
e9e570133d fix(web): preserve HTTPS in sub-path redirects 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:29:42 +08:00
ShinyHero666
470e79d6d2
fix(smoke): support separate actuator target (#689) 
Signed-off-by: ShinyHero666 <160204855+ShinyHero666@users.noreply.github.com>
 2026-08-26 10:23:31 +08:00
FenjuFu
bbdc0f7a0c
fix(dev): use bash for backend launchers (#721) 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-21 09:35:52 +08:00
XiaoSeS
4efeed18c8 fix(deploy): preserve Aliyun source mode in stop command 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-07 18:20:06 +08:00
XiaoSeS
8de293b38f fix(deploy): correct Aliyun runtime stop URL 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-07 16:45:12 +08:00
XiaoSeS
9668f3cd5a fix(deploy): avoid changing runtime helper for PR 576 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-06 19:06:55 +08:00
XiaoSeS
d0b7a7c5d4 fix(deploy): backport sub-path runtime fixes to PR 576 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-06 18:59:37 +08:00
philsun
34f244e7a4 feat(web): support configurable base-path deployment 
Signed-off-by: philsun <xinyi.sun@daocloud.io>
 2026-08-05 12:50:26 +08:00
XiaoSeS
fc457a0651
test(smoke): decouple admin checks from bootstrap credentials (#686) 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-04 19:20:34 +08:00
XiaoSeS
5f7c48b7a4 feat(bootstrap): publish starter skills in runtime manifest 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-31 18:27:25 +08:00
wowo-zZ
7f934e63ab feat(bootstrap): verify built-in skill artifacts 
Signed-off-by: wowo-zZ <zhenggui5228@126.com>
 2026-07-31 11:14:42 +08:00
wowo-zZ
0bf822290b feat(builtin-skills): add reviewed starter collection 
Signed-off-by: wowo-zZ <zhenggui5228@126.com>
 2026-07-30 15:54:09 +08:00
XiaoSeS
6817d98007
Merge pull request #367 from xring/fix/postgres-lostfound
Some checks are pending
Deploy Docs / build (push) Waiting to run
Details
Deploy Docs / Deploy (push) Blocked by required conditions
Details
Security / Dependency Review (push) Waiting to run
Details
Security / CodeQL (java-kotlin) (push) Waiting to run
Details
Security / CodeQL (javascript-typescript) (push) Waiting to run
Details
Security / CodeQL (python) (push) Waiting to run
Details 
fix(deploy): isolate PostgreSQL data from volume root
 2026-07-30 09:56:00 +08:00
XiaoSeS
3db3c9685f feat(redis): complete cluster connection support 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 17:36:06 +08:00
XiaoSeS
dad3c15f92 chore(redis): merge current main for cluster support 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 16:11:31 +08:00
XiaoSeS
87cb05a096 test(ci): cover Helm workflows in security checks 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 15:22:36 +08:00
XiaoSeS
bec701e962 test(deploy): wait for final PostgreSQL process 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-29 04:21:27 +08:00
XiaoSeS
0dd600ce13 fix(deploy): preserve PostgreSQL PVC data layout 2026-07-29 01:41:20 +08:00
XiaoSeS
e4fb26d4ba fix(nginx): trust forwarded proto only when configured 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-07-28 20:03:50 +08:00
dongmucat
bf7c71ad2c fix(scanner): backport local LLM base URL handling for #563 
Also add Python CodeQL coverage in the security workflow so repository-level script regression checks stay green when Python source exists.

Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-29 14:34:55 +08:00
moses
cb950c2d21
Merge branch 'iflytek:main' into main 2026-06-18 13:57:42 +08:00
dongmucat
32f34fbf4c fix(ci): remove unsupported Python CodeQL scan 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-17 14:04:27 +08:00
dongmucat
e50140272b fix(security): close review hardening gaps 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-16 17:48:15 +08:00
dongmucat
7d0402e937 fix(security): address review blockers 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-16 14:19:39 +08:00
dongmucat
40d7de8462 fix(security): harden review findings 
Signed-off-by: dongmucat <1127093059@qq.com>
 2026-06-12 14:40:30 +08:00
yuchangfu
92e7bd3def feat(redis): add standalone and cluster mode support with backward compatibility 2026-06-11 11:52:25 +08:00
Cheney
0b1c366f8d
refactor(cli): improve publish-cli script reliability (#441) 
* refactor(cli): improve publish-cli script reliability

- Move version computation and pre-flight checks before build-and-test
  to fail fast on conflicts (existing branch/tag) instead of wasting
  minutes on lint/test/build
- Add INT/TERM signal handlers to cleanup trap so Ctrl+C during build
  properly restores working tree state
- Update Makefile help text to reflect PR-based workflow

* fix(cli): use git checkout -f for robust cleanup

Address code review feedback from gemini-code-assist bot:

- Use `git checkout -f` in on-release and committed cleanup stages
  to ensure reliable branch switching even when files are staged
  but not committed (e.g., interrupted after `git add` but before
  `git commit`)
- Remove redundant `git checkout -- <file>` in on-release stage
  since `-f` already discards all local changes

This prevents cleanup failures when the script is interrupted
between staging and committing.

* fix(cli): address PR #441 review findings

- Fix ERR trap bypass: remove `if !` wrapper around `gh pr create` so
  set -e triggers the trap and prints pushed-stage recovery instructions
- Fix command injection: all node -e/-p calls now use process.env
  instead of interpolating shell variables into JS string literals
- Rewrite cli/RELEASE.md to document the new PR-based release flow
- Rewrite scripts/tests/publish-cli-test.sh with 10 tests covering
  the new flow (stubs for bun/gh, pre-flight checks, happy path,
  cleanup state machine stages)

* fix(cli): address PR #441 review findings from @dongmucat

- Bind release tag to origin/main: PR body, end-of-run hint, and
  cli/RELEASE.md now use `git tag $TAG origin/main` so the tag is
  always placed on the merged commit, regardless of local branch state
- Reject prerelease tags in version computation: if the latest cli-v*
  tag contains non-X.Y.Z characters (e.g., -rc.1), exit with a clear
  message instead of crashing in node parsing
- Add pr-scripts.yml workflow: runs publish-cli-test.sh on scripts/**
  changes so the release script regression suite gates PRs
- Add Test 11 covering prerelease tag rejection

* fix(cli): compute publish baseline from origin tags only

A failed `git push origin cli-vX.Y.Z` after a successful local tag
leaves an orphan tag locally. The previous `git tag --list` baseline
would then treat it as the latest release, causing skipped versions or
publishes based on an unreleased tag.

Switch to `git ls-remote --tags --refs origin 'cli-v*' | sort -V` so
the baseline reflects only what is actually on origin. Local orphan
tags can still collide with the computed target tag, which fails fast
with a clear message as before.

Adds test 12 covering the orphan-tag scenario.
 2026-06-02 14:30:39 +08:00
Cheney
48174c9ad2 fix(cli): match 'push' anywhere in git args, not just $1 
The script calls `git -C /path push ...` so the first arg is `-C`,
not `push`. Use glob match on full args instead.
 2026-05-13 09:27:44 +08:00
Cheney
dad06b465d fix(cli): fix exit code capture in tests using git wrappers 
The `status="$(env ... printf | bash ... && echo 0 || echo $?)"` pattern
doesn't correctly capture the script's exit code because the command
substitution and pipe interact poorly. Use direct assignment with
`|| status=$?` instead.
 2026-05-13 09:26:33 +08:00