docs: document CI/CD pipelines, release flow, and v2.66.0 changelog

- CLAUDE.md: add CI/CD & Releases section with workflow table, tag patterns, Docker variants, beta/desktop release commands - CONTRIBUTING.md: expand Releases section with standard (auto), beta (manual tag), and desktop release workflows - docs/17-changelog.md: add v2.66.0 entry covering IDOR fix, BytePlus provider, per-agent grants, beta pipeline, and CI fixes
2026-09-09 02:17:17 +00:00 · 2026-04-05 11:22:30 +07:00
parent 56155ce53e
commit 1dd5635f2b
3 changed files with 113 additions and 2 deletions
@@ -85,6 +85,53 @@ make desktop-build VERSION=0.1.0             # Build .app (macOS) or .exe (Windo
 make desktop-dmg VERSION=0.1.0               # Create .dmg installer (macOS only)
 ```

+## CI/CD & Releases
+
+### Workflows
+
+| Workflow | Trigger | Purpose |
+|----------|---------|---------|
+| `ci.yaml` | push main, PR→main/dev | Go build+test+vet, Web build |
+| `release.yaml` | push main | semantic-release → binaries + Docker (4 variants + web) + Discord |
+| `release-beta.yaml` | tag `v*-beta*` / `v*-rc*` | Beta binaries + Docker + GitHub prerelease |
+| `release-desktop.yaml` | tag `lite-v*` | Desktop app (macOS+Windows), auto prerelease for `-beta`/`-rc` tags |
+
+### Creating Releases
+
+**Standard release** — merge `dev` → `main`. `go-semantic-release` auto-creates version from conventional commits.
+
+**Beta release** (from dev):
+```bash
+git tag v2.67.0-beta.1 && git push origin v2.67.0-beta.1   # standard beta
+git tag lite-v1.2.0-beta.1 && git push origin lite-v1.2.0-beta.1  # lite beta
+```
+
+**Desktop release:**
+```bash
+git tag lite-v1.1.0 && git push origin lite-v1.1.0   # stable
+git tag lite-v1.1.0-beta.1 && git push origin lite-v1.1.0-beta.1  # beta (prerelease)
+```
+
+### Docker Images
+
+Published to GHCR (`ghcr.io/nextlevelbuilder/goclaw`) and Docker Hub (`digitop/goclaw`).
+
+| Variant | Tag | Contents |
+|---------|-----|----------|
+| latest | `:latest`, `:vX.Y.Z` | Backend + web UI + Python |
+| base | `:base`, `:vX.Y.Z-base` | Backend only, no UI/runtimes |
+| full | `:full`, `:vX.Y.Z-full` | All runtimes + skills pre-installed |
+| otel | `:otel`, `:vX.Y.Z-otel` | Latest + OpenTelemetry tracing |
+| web | `-web:latest` | Standalone web UI (Nginx) |
+| beta | `:beta`, `:vX.Y.Z-beta.N` | Beta builds from dev |
+
+### Tag Pattern Safety
+
+- `release.yaml`: branch-triggered (push main) → `go-semantic-release` creates clean `vX.Y.Z` tags
+- `release-beta.yaml`: tag-triggered (`v*-beta*`, `v*-rc*`) — never matches clean semver
+- `release-desktop.yaml`: tag-triggered (`lite-v*`) — `lite-` prefix prevents overlap
+- No workflow triggers overlap — each tag pattern is distinct
+
 ## Desktop Edition (Lite)

 - **Build tag:** `//go:build sqliteonly` — desktop binary includes only SQLite, no PostgreSQL
@@ -78,6 +78,44 @@ Developer                    Reviewer                 Owner
    │                            │                      ├─ merge to dev
    │                            │                      │
    │                            │        (when stable) ├─ PR dev → main
-    │                            │                      ├─ merge → release
-    │                            │                      ├─ tag → CD triggers
+    │                            │                      ├─ merge → auto release
+    │                            │                      │  (semantic-release)
 ```
+
+## Releases
+
+### Standard (automatic)
+
+Merge `dev` → `main`. `go-semantic-release` analyzes commit messages and auto-creates:
+- GitHub Release with version tag (`vX.Y.Z`)
+- Cross-platform binaries (linux/darwin × amd64/arm64)
+- Docker images (4 variants: latest, base, full, otel + web)
+- SHA256 checksums
+- Discord notification
+
+### Beta (manual tag)
+
+Push a beta tag from `dev` to create a prerelease:
+
+```bash
+# Standard beta — builds Docker + Linux binaries
+git tag v2.67.0-beta.1
+git push origin v2.67.0-beta.1
+
+# Desktop beta — builds macOS .dmg + Windows .exe
+git tag lite-v1.2.0-beta.1
+git push origin lite-v1.2.0-beta.1
+```
+
+Beta releases are marked as **prerelease** on GitHub and use `:beta` rolling Docker tag.
+
+### Desktop / Lite
+
+Push a `lite-v*` tag to build desktop apps:
+
+```bash
+git tag lite-v1.1.0
+git push origin lite-v1.1.0
+```
+
+Tags with `-beta` or `-rc` suffix automatically create prereleases.
@@ -4,6 +4,32 @@ All notable changes to GoClaw Gateway are documented here. Format follows [Keep

 ---

+## [v2.66.0] — 2026-04-05
+
+### Security
+- **Session IDOR fix**: All 5 chat.* WS methods (send, history, inject, abort, session.status) now verify session ownership. Non-admin users cannot read, write, or disrupt other users' sessions
+- **`requireSessionOwner` helper**: Extracted shared ownership check to `access.go` (DRY — pattern was repeated 9x in sessions.go)
+
+### Added
+- **BytePlus ModelArk provider**: Seedream image generation + Seedance video generation via BytePlus/Volcengine API
+- **Per-agent CLI grants**: Secure CLI binaries can now be granted/denied per agent with setting overrides
+- **Beta release pipeline**: `release-beta.yaml` — push `v*-beta*` tag from dev to create prerelease with Docker images + binaries
+
+### Fixed
+- **Scheduler test hang**: Defer ordering fix prevents CI timeout when test fails before unblocking goroutines
+- **Semantic-release branch**: `--no-ci` flag bypasses default branch check (repo default is dev, releases cut from main)
+- **OpenAI compat**: Together/Mistral reasoning, streaming, and vision gating; Mistral tool call ID normalization
+
+### Changed
+- **Docker builds**: Removed redundant `docker-publish.yaml` — `release.yaml` handles all Docker builds on release
+- **Desktop prerelease**: `release-desktop.yaml` auto-detects beta/rc tags and marks as prerelease
+
+### Refactored
+- **Web UI**: React-arch audit — RHF+Zod forms, Zustand persist, adapter layer, component modularization
+- **Desktop UI**: React-arch audit — schemas, RHF forms, file splits, services, store cleanup
+
+---
+
 ## [Unreleased]

 ### Added