dependabot[bot]
cc8dfe3dd8
chore(deps): bump the minor-and-patch group with 2 updates ( #43 )
...
Bumps the minor-and-patch group with 2 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e )
Updates `github/codeql-action/upload-sarif` from 4.37.7 to 4.37.8
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 )
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.8
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-25 15:36:01 +08:00
dependabot[bot]
73f0c15790
chore(deps): bump github/codeql-action/upload-sarif
...
Bumps the minor-and-patch group with 1 update: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ).
Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd )
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-08-17 14:05:19 +08:00
Zyy and Codex
5970efbb7c
fix(container): refresh runtime packages before scans
...
Co-authored-by: Codex <noreply@openai.com >
2026-08-15 18:34:41 +08:00
dependabot[bot] and Zyy
d7b80a2066
chore(deps): bump the minor-and-patch group with 5 updates ( #36 )
...
Bumps the minor-and-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) | `4.37.4` | `4.37.6` |
| [Swatinem/rust-cache](https://github.com/swatinem/rust-cache ) | `2.9.1` | `2.9.2` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup ) | `6.0.9` | `6.0.10` |
| [dorny/paths-filter](https://github.com/dorny/paths-filter ) | `4.0.2` | `4.0.3` |
| [actions/attest](https://github.com/actions/attest ) | `4.2.1` | `4.2.2` |
Updates `github/codeql-action/upload-sarif` from 4.37.4 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...5595ccaf912efad79be6eef63a5619ff05969be3 )
Updates `Swatinem/rust-cache` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/swatinem/rust-cache/releases )
- [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md )
- [Commits](https://github.com/swatinem/rust-cache/compare/c19371144df3bb44fab255c43d04cbc2ab54d1c4...6323deb102c322ba6fcbdcafc7e3dddab59af2b6 )
Updates `pnpm/action-setup` from 6.0.9 to 6.0.10
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86 )
Updates `dorny/paths-filter` from 4.0.2 to 4.0.3
- [Release notes](https://github.com/dorny/paths-filter/releases )
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md )
- [Commits](https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d )
Updates `actions/attest` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/actions/attest/releases )
- [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest/compare/508db95dd578ae2727ebd6217d5ba78e4fbda05d...1e69f48acb82d1966a394da916b4c1698aa569d6 )
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: Swatinem/rust-cache
dependency-version: 2.9.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: pnpm/action-setup
dependency-version: 6.0.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: dorny/paths-filter
dependency-version: 4.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: actions/attest
dependency-version: 4.2.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Zyy <39424122+zyycn@users.noreply.github.com >
2026-08-10 12:01:38 +08:00
dependabot[bot]
a3d098a87c
chore(deps): bump the minor-and-patch group with 3 updates ( #31 )
...
Bumps the minor-and-patch group with 3 updates: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ), [actions/attest](https://github.com/actions/attest ) and [docker/login-action](https://github.com/docker/login-action ).
Updates `github/codeql-action/upload-sarif` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38 )
Updates `actions/attest` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/actions/attest/releases )
- [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest/compare/f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6...508db95dd578ae2727ebd6217d5ba78e4fbda05d )
Updates `docker/login-action` from 4.5.1 to 4.6.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7...dbcb813823bdd20940b903addbd779551569679f )
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: actions/attest
dependency-version: 4.2.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: docker/login-action
dependency-version: 4.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:37:12 +08:00
Zyy and Codex
fdfb77c4a2
ci(release): reuse caches across versions
...
Dispatch releases from the long-lived publishing branch so Cargo caches are shared across version tags. Store prebuilt image caches in per-architecture GHCR refs and include toolchain and workspace manifests in Cargo cache invalidation.
Co-authored-by: Codex <noreply@openai.com >
2026-08-02 04:27:49 +08:00
zyycn and Codex
7a9715ed41
chore(db): fold schema updates into initial migration
...
Collapse the completed response ID, service tier, and quota cooldown changes into the fresh-database baseline. Refresh the migration contract and state consistently that cross-major online upgrades are unsupported.
Co-authored-by: Codex <noreply@openai.com >
2026-07-30 21:42:57 +08:00
dependabot[bot]
b296c795ac
chore(deps): Bump the minor-and-patch group across 1 directory with 3 updates ( #22 )
...
Bumps the minor-and-patch group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout ), [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) and [docker/login-action](https://github.com/docker/login-action ).
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1 )
Updates `github/codeql-action/upload-sarif` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/7188fc363630916deb702c7fdcf4e481b751f97a...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 )
Updates `docker/login-action` from 4.4.0 to 4.5.1
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: docker/login-action
dependency-version: 4.5.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 11:41:57 +08:00
zyycn and Claude
885369f19f
chore(release): drop Windows target, extend stop grace, document single-replica
...
The Windows release shipped a zip that self-update cannot extract, so
remove the Windows platform, matrix leg, and its dead archive handling
rather than add zip support. Raise the compose stop grace period above the
serial drain plus worker-shutdown budget so Docker does not SIGKILL mid
shutdown. Record that the deployment is single-replica and why, since the
worker leader lease and self-update swap are per-replica.
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-27 02:26:25 +08:00
zyycn and Claude
cc0303c65e
ci: drop the dead Dockerfile stage and sanitize the build-metadata image tag
...
Remove the release-asset build stages that nothing references. Strip the
+build semver metadata from the derived container tag, which is not a legal
tag character, while keeping the full version string where a tag is not
required.
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-27 01:51:51 +08:00
zyycn and Claude
c6444b2bf1
ci: assert the migration freeze manifest is append-only vs the PR base
...
Follow-up to 720eb0c2 : the manifest was self-attested — editing a released
migration and regenerating its sha256 line in the same PR passed the
checksum and membership checks, and the next release then bricked every
deployment on the startup checksum mismatch the guard exists to prevent.
On pull requests, fetch the base commit and require every line in the base
manifest to survive verbatim, so a changed hash (edit) or a dropped line
(delete) fails CI; genuinely new migrations only add lines and still pass.
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-27 00:12:44 +08:00
zyycn and Claude
55e87c3b16
docs: phrase the clean-break warning per major, not 2.x/3.x
...
The release body ships on every future release, so a hardcoded "from
2.x" would be stale by 4.0. State the invariant instead: schema and
configuration are compatible within a major only, and self-update refuses
cross-major targets from 3.0 on.
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-26 23:43:14 +08:00
zyycn and Claude
0c4da6c838
docs: warn 2.x deployments that 3.x is a clean break
...
The runtime cross-major gate only exists in 3.x binaries; a 2.x admin UI
happily offers the one-click update that produces a non-starting service.
State the clean break in the three places a 2.x operator actually sees
before upgrading: the top of every 3.x GitHub Release body, the README
operations section, and the deploy README upgrade section, each with the
fresh-deployment path (new .runtime/, re-import or re-authorize accounts
and client keys).
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-26 23:41:50 +08:00
zyycn and Claude
720eb0c227
ci: freeze applied migrations behind a sha256 manifest
...
sqlx re-validates applied-migration checksums on every startup, so any byte
change to a released migration file locks existing deployments out of
starting with no automatic recovery. Record the released migrations in
backend/migrations/.frozen-sha256 and fail CI when a frozen file changes or
a new migration lands without being enrolled. Document the freeze rule and
the local test-database environment in backend/migrations/README.md. The
migration files themselves stay byte-identical: adding even a header
comment would trip the same startup validation this guard protects.
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-26 23:20:38 +08:00
zyycn and Codex
997e4ed296
fix(ci): configure Redis test auth in service container
...
Use the Redis client shipped with the service image so the quality workflow does not depend on a runner package.
Co-authored-by: Codex <noreply@openai.com >
2026-07-25 02:00:34 +08:00
zyycn and Codex
a6bac4601e
chore(release): prepare v3.0.0
...
Refresh verified dependencies, harden CI test credentials, and align release builders with the current supported image.
Co-authored-by: Codex <noreply@openai.com >
2026-07-25 01:54:18 +08:00
Zyy and Codex
9e57f78bab
ci: speed up validation pipelines
...
Run affected CI checks in parallel and skip unrelated backend or frontend work while retaining workflow lint.
Start release binary builds after release metadata is available, while keeping image assembly, packaging, and publication gated by quality checks.
Co-authored-by: Codex <noreply@openai.com >
2026-07-16 16:07:55 +08:00
dependabot[bot] and Codex
81c58b1cdc
chore(deps): bump setup-node to 7.0.0
...
Update the pinned setup-node action to 7.0.0 across quality and security workflows.
Co-authored-by: Codex <noreply@openai.com >
2026-07-16 01:51:31 +08:00
dependabot[bot]
25081de913
chore(deps): bump action-gh-release to 3.0.2
...
Update the pinned GitHub Release action from 3.0.1 to 3.0.2.\n\nCo-authored-by: Codex <noreply@openai.com >
2026-07-16 01:23:07 +08:00
zyycn and Codex
37a368de32
fix(ci): avoid duplicate pull request checks
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-15 11:33:11 +08:00
zyycn and Codex
3f7d473bea
fix(ci): allow database bind initialization
...
Prepare ephemeral CI bind roots as sticky hand-off directories so image-specific database users can initialize storage on user-namespaced runners.
Keep PostgreSQL data permissions image-managed and verify PostgreSQL and Redis persistence across container recreation.
Co-authored-by: Codex <noreply@openai.com >
2026-07-14 01:27:14 +08:00
zyycn and Codex
99cf39c76d
refactor: consolidate runtime configuration
...
Use deploy/config.yaml as the structured source for application settings and service credentials, with strict validation and runtime-relative paths.
Consolidate Compose assets under deploy, remove obsolete environment and smoke files, keep terminal logs readable while retaining JSON file output, and refresh the Codex Desktop fingerprint.
Co-authored-by: Codex <noreply@openai.com >
2026-07-14 00:46:57 +08:00
zyycn and Codex
a8f5c5a54e
fix: standardize Docker timezone
...
Set the runtime image and PostgreSQL service to Asia/Shanghai while preserving UTC timestamptz storage semantics.
Verify the application and PostgreSQL timezone contracts in the container workflow and document the display behavior.
Co-authored-by: Codex <noreply@openai.com >
2026-07-12 21:38:14 +08:00
zyycn and Codex
1e99c5037d
refactor: migrate backend to Rust 1.97 and edition 2024
...
Unify the local, CI, release, and container toolchains on Rust 1.97.
Move update configuration, release caching, and event delivery into service-owned state, apply Edition 2024 idioms, and refresh repository ignore rules and documentation.
Co-authored-by: Codex <noreply@openai.com >
2026-07-12 19:10:56 +08:00
zyycn and Codex
f30652e113
fix: scan release images for target platform
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-12 13:34:51 +08:00
zyycn and Codex
f867f13ce7
fix: upgrade GitHub Actions runtimes
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-12 12:59:49 +08:00
zyycn and Codex
d7bb5e4ab2
fix: configure redis memory overcommit in container CI
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-12 12:52:01 +08:00
zyycn and Codex
203fc1b03e
fix: harden persistence and runtime boundaries
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-12 10:07:21 +08:00
zyycn and Codex
4dcd9dc31d
feat: harden deployment and CI pipeline
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-11 17:18:17 +08:00
zyycn and Codex
fe5494a614
refactor: align implementation with authoritative architecture
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-10 22:53:27 +08:00
Zyy and Codex
45e4b36225
refactor: complete postgresql redis migration
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-10 19:00:14 +08:00
zyycn and Codex
96bcb65e6e
ci: optimize release workflow
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-04 13:25:40 +08:00
zyycn and Codex
0179d02c80
chore: prepare release cleanup
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-03 23:37:27 +08:00
Zyy and Codex
112bd76f66
refactor: address audit findings
...
Co-authored-by: Codex <noreply@openai.com >
Signed-off-by: Zyy <No Email>
2026-07-03 18:20:05 +08:00
Zyy and Codex
71279877df
ci: refine release workflow
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-03 10:25:44 +08:00
Zyy and Codex
00fa8505ea
ci: centralize release metadata
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-02 18:20:29 +08:00
Zyy and Codex
ee1194d618
ci: add desktop release assets
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-02 13:13:47 +08:00
Zyy and Codex
269fde863b
ci: polish release notes headings
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-02 13:03:39 +08:00
Zyy and Codex
49a47ea8f9
ci: update release cache action
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-02 13:00:52 +08:00
Zyy and Codex
2485d776ff
ci: optimize release pipeline
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-02 12:51:40 +08:00
Zyy and Codex
9092740c9a
ci: complete release pipeline
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-02 12:09:22 +08:00
Zyy and Codex
1dd74b454e
ci: align release image architecture
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-01 17:49:46 +08:00
Zyy and Codex
0aaef984a0
ci: pin pnpm for release workflow
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-01 17:21:37 +08:00
Zyy and Codex
9b0e874379
refactor: restructure project layout
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-01 17:13:00 +08:00
Zyy and Codex
6c7dace082
feat: align online update flow
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-01 15:54:43 +08:00
Zyy and Codex
ea0f3af9d7
feat: add docker online update flow
...
Co-authored-by: Codex <noreply@openai.com >
2026-07-01 12:21:47 +08:00