scriptoriumadmin/skillhub
1
0
Fork 0
mirror of https://github.com/iflytek/skillhub.git synced 2026-09-06 08:15:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
1289 commits 212 branches 25 tags 42 MiB
Commit graph

464 commits

Author SHA1 Message Date
XiaoSeS
e02c22e678 fix(i18n): align scanner failure reason keys 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
8b09c23dc4 fix(scanner): make terminal failures recoverable 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 19:32:37 +08:00
XiaoSeS
d6afc43364
Merge pull request #807 from iflytek/codex/refactor/issue-622-notification-polling 
refactor(notification): replace SSE with HTTP polling
 2026-09-03 13:48:57 +08:00
XiaoSeS
47f3d33c65
Merge pull request #806 from iflytek/codex/docs/issue-795-clawhub-compat 
docs(compat): clarify supported ClawHub workflows
 2026-09-03 13:48:33 +08:00
XiaoSeS
4d71a16ddd fix(notification): complete polling migration 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 11:38:02 +08:00
XiaoSeS
efa3c1ae65 refactor(notification): replace SSE with HTTP polling 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 11:38:02 +08:00
XiaoSeS
20d20c16d0 docs(compat): separate ClawHub and SkillHub authentication 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 10:44:15 +08:00
XiaoSeS
923c1df4e1 docs(compat): remove unsupported publish guidance 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 10:40:35 +08:00
XiaoSeS
5045901c9e fix(web): retain dashboard pagination on detail return 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 10:27:51 +08:00
XiaoSeS
b62a487037 fix(web): preserve dashboard return path from skill details 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-03 09:42:00 +08:00
XiaoSeS
fc7c59534a
fix(platform): harden sessions, scanner recovery, and CLI guidance (#801) 
* fix(auth): recover from unreadable sessions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): defer unavailable scan tasks safely

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(web): prefer the SkillHub CLI install command

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(auth): decode session cookies during recovery

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(runtime): address scanner and session review findings

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): defer all server-side outages

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* docs(scanner): clarify deferred failure semantics

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(scanner): cover recovery boundaries

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(scanner): register startup hook on router

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(e2e): align install defaults and reuse auth session

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 20:15:42 +08:00
XiaoSeS
45d341f144
feat(review): add skill comments and user feedback (#793) 
* feat(review): add skill review domain model

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* feat(review): expose skill reviews in API and UI

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve moderation under concurrent edits

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): scope concurrent write conflicts

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): restore web build compatibility

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): keep author cleanup available

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): preserve author cleanup access

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): require review score contract

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): strengthen failure and concurrency coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): tighten persistence assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): disambiguate repository ports

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enable request validation

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(review): align validation and postgres coverage

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(namespace): verify invalid batch has no side effects

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(web): align accessibility and plural assertions

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(i18n): require complete plural references

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap editor actions on mobile

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): wrap long mobile labels

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): disable edits for archived skills

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* fix(review): enforce archived mutation guard

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-02 11:15:52 +08:00
XiaoSeS
ea1ebb99d7 test(web): stabilize theme and review browser flows 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
2e11705ebd fix(theme): harden responsive switch semantics 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
0d48945fd2 fix(theme): polish dark header and toggle 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
83599f9317 fix(review): prevent progress offset overflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
39861bc6d8 test(review): strengthen exact-sha coverage 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:42 +08:00
XiaoSeS
918ef9d265 test(review): filter known CSP browser warning 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
a568d22526 fix(review): restrict version history to reviewers 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
3e77365a5d fix(review): complete progress history workflow 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
b8b0fba3d4 fix(theme): polish dark notification states 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
7995c00683 feat(review): add author review progress and attempt history 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
ebac94a043 feat(theme): add browser-local light and dark mode 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-09-01 17:53:41 +08:00
XiaoSeS
8361ea3fcd
Merge pull request #774 from FenjuFu/fix/promotion-pagination 
fix(promotion): paginate review queues
 2026-08-31 15:22:21 +08:00
XiaoSeS
fe8a0cb21f fix(promotion): clamp emptied queue pages 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-31 14:00:45 +08:00
XiaoSeS
e9e570133d fix(web): preserve HTTPS in sub-path redirects 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 15:29:42 +08:00
XiaoSeS
2babc0935b fix(cli): add namespace sync manifest endpoint 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-29 14:06:34 +08:00
FenjuFu
817426c50f fix(promotion): paginate review queues 
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-28 23:29:58 +08:00
XiaoSeS
c32bced109
Merge pull request #748 from myml/fix/security-csp-policy 
fix(security): harden CSP policy and hide nginx server tokens
 2026-08-28 10:22:14 +08:00
XiaoSeS
c825d896a4
Merge pull request #762 from FenjuFu/fix/code-scanning-alerts-2026-08 
fix(security): resolve CodeQL findings
 2026-08-28 10:22:04 +08:00
wurongjie
f43c047a6b feat(skill-card): show author and update time in skill card 
Add ownerId and ownerDisplayName fields to SkillSummaryResponse,
and render author and last update time at the bottom of each skill card.

在技能卡片底部新增作者和最近更新时间显示，搜索结果接口新增
ownerId 和 ownerDisplayName 字段。

Log: 技能卡片新增作者和更新时间
Influence: 搜索结果页技能卡片底部显示作者和更新时间信息，接口新增 ownerId/ownerDisplayName 字段。
Signed-off-by: wurongjie <wurongjie@uniontech.com>
 2026-08-27 17:21:15 +08:00
FenjuFu
36967794d1 fix(security): resolve CodeQL findings 
Use a bounded safe YAML constructor, remove the polynomial placeholder regex, keep public label access GET-only with CSRF protection, validate CLI callbacks as loopback URL objects, and use cryptographic UUIDs for E2E identities.

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-27 15:16:54 +08:00
XiaoSeS
7e37935da8
fix(i18n): keep Russian locale keys in sync 
Merge validated locale parity fix.
 2026-08-27 14:51:22 +08:00
qwn3213
412514b299
fix(web) 添加oidc的logo文件，配置oidc登录后图裂无logo太丑了 (#734) 
* fix(web) 添加oidc的logo文件，配置oidc登录后图裂无logo太丑了

Signed-off-by: qwn3213 <qwn3213@gmail.com>

* fix(web) rename loge.svg to logo.svg

Signed-off-by: qwn3213 <qwn3213@gmail.com>

---------

Signed-off-by: qwn3213 <qwn3213@gmail.com>
 2026-08-26 19:45:08 +08:00
Michael
16306dd4f4
feat(i18n): add Russian locale for web UI and server messages (#700) 
Signed-off-by: Mikhail Neradkov <michael.neradkov@gmail.com>
 2026-08-26 19:43:07 +08:00
FenjuFu
3b5d4381a9
feat(publish): allow uploading a skill folder directly 
Fix E2E ZIP picker selector after adding folder upload input.
 2026-08-26 17:37:21 +08:00
XiaoSeS
243e9b68f4 fix(auth): prevent login page redirect loop 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-26 15:46:20 +08:00
wrj97
d7e8c51775
fix(dashboard): remove encoding from slug params (#747) 
The router handles parameter encoding automatically. Explicitly encoding
the slug results in double-encoded characters in the URL.

Signed-off-by: wurongjie <wurongjie@uniontech.com>
 2026-08-26 10:23:43 +08:00
XiaoSeS
7599dd0ca9
fix(web): keep select poppers in collision bounds (#755) 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-25 20:07:58 +08:00
FenjuFu
907d8eff90
fix(web): keep select menus within viewport (#754) 
Cap shared Radix select content to the available viewport height and enable vertical scrolling so long option lists remain usable near page and dialog edges. Add a shared component regression test for the viewport and overflow classes.\n\nCloses #714

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
 2026-08-25 16:56:58 +08:00
FenjuFu
91d0ae1504
feat(api): return skill labels from the skill listing endpoints on request (#730) 
* feat(api): return skill labels from the skill listing endpoints on request

Skill labels were reachable only one skill at a time, through
/api/{v1,web}/skills/{namespace}/{slug}/labels, so a client rendering a list had
to issue a follow-up request per row.

Add includeLabels=true to GET /api/v1/skills and GET /api/web/skills. The labels
array is populated only when the parameter is set and left out of the payload
otherwise, so existing responses are byte-identical.

Labels for the whole page are resolved by SkillLabelProjectionService in three
queries — assignments, definitions, translations — rather than three per skill.

Closes #710

Signed-off-by: FenjuFu <fufenjupku@gmail.com>

* fix(api): use include parameter for skill labels

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

* test(api): reject unsupported include before search

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: FenjuFu <fufenjupku@gmail.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-25 13:49:24 +08:00
FenjuFu
1c3e9be9e9
fix(web): self-host Inter and JetBrains Mono fonts (#753) 
* fix(web): self-host Inter and JetBrains Mono fonts

web/index.html loaded Inter + JetBrains Mono from fonts.googleapis.com at
runtime. On networks where Google Fonts is slow or unreachable (e.g. CN),
that stylesheet blocks first paint for tens of seconds (#716).

Vendor the same woff2 (from the @fontsource distribution) under
web/public/fonts and declare them in fonts.css with latin/latin-ext
unicode-range splits and font-display: swap, then point index.html at the
local stylesheet and drop the fonts.googleapis.com / fonts.gstatic.com hosts
from the page CSP. Only Inter and JetBrains Mono were ever fetched from the
CDN, so families and weights are unchanged; no external font requests remain.

Closes #716

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* docs(web): record vendored font licenses

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-25 13:49:08 +08:00
wurongjie
b807fb3ee1 fix(security): harden CSP policy and hide nginx server tokens 
- Remove 'unsafe-inline' and 'unsafe-eval' from script-src directive
- Restrict connect-src to 'self' only
- Disable nginx server_tokens to hide version information

Signed-off-by: wurongjie <wurongjie@uniontech.com>
 2026-08-24 17:02:42 +08:00
FenjuFu
f846da230c
feat: add initial RISC-V image support (#725)
Some checks failed
Security / Dependency Review (push) Waiting to run
Details
Security / CodeQL (java-kotlin) (push) Waiting to run
Details
Security / CodeQL (javascript-typescript) (push) Waiting to run
Details
Security / CodeQL (python) (push) Waiting to run
Details
Deploy Docs / build (push) Has been cancelled
Details
Deploy Docs / Deploy (push) Has been cancelled
Details 
* feat: add initial RISC-V image support

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* chore(ci): tighten riscv64 image guardrails

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>

---------

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
Co-authored-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-24 16:37:34 +08:00
XiaoSeS
1b7a6d5544
chore(deps): resolve dependabot npm alerts 
Resolve open npm Dependabot alerts for the web app and docs site by refreshing dependency overrides and lockfiles.

Also sets the staging web forwarded-proto default so `make staging` can render the shared Nginx template when using the bare nginx image.

Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-24 16:08:07 +08:00
XiaoSeS
d2403bb591
feat(namespace): add admin namespace management
Some checks failed
Security / Dependency Review (push) Has been cancelled
Details
Security / CodeQL (java-kotlin) (push) Has been cancelled
Details
Security / CodeQL (javascript-typescript) (push) Has been cancelled
Details
Security / CodeQL (python) (push) Has been cancelled
Details 
Closes #580
 2026-08-12 12:39:24 +08:00
XiaoSeS
2fe7514a4e
feat(review): show compliance declaration diffs (#703) 2026-08-11 10:44:11 +08:00
XiaoSeS
1dfe3756a9 feat(search): refine compliance discovery interactions 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-10 10:42:19 +08:00
XiaoSeS
00f55c2db3 feat(search): surface compliance mappings in discovery 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-07 16:37:07 +08:00
XiaoSeS
a7b25b072b feat(metadata): expose compliance snapshots in version views 
Signed-off-by: XiaoSeS <87064762+XiaoSeS@users.noreply.github.com>
 2026-08-07 15:46:06 +08:00