From 1dd5635f2b115bcc5a2e5e3d1ec85dbb45ab2eff Mon Sep 17 00:00:00 2001 From: viettranx Date: Sun, 5 Apr 2026 11:22:30 +0700 Subject: [PATCH] docs: document CI/CD pipelines, release flow, and v2.66.0 changelog - CLAUDE.md: add CI/CD & Releases section with workflow table, tag patterns, Docker variants, beta/desktop release commands - CONTRIBUTING.md: expand Releases section with standard (auto), beta (manual tag), and desktop release workflows - docs/17-changelog.md: add v2.66.0 entry covering IDOR fix, BytePlus provider, per-agent grants, beta pipeline, and CI fixes --- CLAUDE.md | 47 ++++++++++++++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 42 +++++++++++++++++++++++++++++++++++++-- docs/17-changelog.md | 26 ++++++++++++++++++++++++ 3 files changed, 113 insertions(+), 2 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index cbfbc30a..ef32f38e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -85,6 +85,53 @@ make desktop-build VERSION=0.1.0 # Build .app (macOS) or .exe (Windo make desktop-dmg VERSION=0.1.0 # Create .dmg installer (macOS only) ``` +## CI/CD & Releases + +### Workflows + +| Workflow | Trigger | Purpose | +|----------|---------|---------| +| `ci.yaml` | push main, PR→main/dev | Go build+test+vet, Web build | +| `release.yaml` | push main | semantic-release → binaries + Docker (4 variants + web) + Discord | +| `release-beta.yaml` | tag `v*-beta*` / `v*-rc*` | Beta binaries + Docker + GitHub prerelease | +| `release-desktop.yaml` | tag `lite-v*` | Desktop app (macOS+Windows), auto prerelease for `-beta`/`-rc` tags | + +### Creating Releases + +**Standard release** — merge `dev` → `main`. `go-semantic-release` auto-creates version from conventional commits. + +**Beta release** (from dev): +```bash +git tag v2.67.0-beta.1 && git push origin v2.67.0-beta.1 # standard beta +git tag lite-v1.2.0-beta.1 && git push origin lite-v1.2.0-beta.1 # lite beta +``` + +**Desktop release:** +```bash +git tag lite-v1.1.0 && git push origin lite-v1.1.0 # stable +git tag lite-v1.1.0-beta.1 && git push origin lite-v1.1.0-beta.1 # beta (prerelease) +``` + +### Docker Images + +Published to GHCR (`ghcr.io/nextlevelbuilder/goclaw`) and Docker Hub (`digitop/goclaw`). + +| Variant | Tag | Contents | +|---------|-----|----------| +| latest | `:latest`, `:vX.Y.Z` | Backend + web UI + Python | +| base | `:base`, `:vX.Y.Z-base` | Backend only, no UI/runtimes | +| full | `:full`, `:vX.Y.Z-full` | All runtimes + skills pre-installed | +| otel | `:otel`, `:vX.Y.Z-otel` | Latest + OpenTelemetry tracing | +| web | `-web:latest` | Standalone web UI (Nginx) | +| beta | `:beta`, `:vX.Y.Z-beta.N` | Beta builds from dev | + +### Tag Pattern Safety + +- `release.yaml`: branch-triggered (push main) → `go-semantic-release` creates clean `vX.Y.Z` tags +- `release-beta.yaml`: tag-triggered (`v*-beta*`, `v*-rc*`) — never matches clean semver +- `release-desktop.yaml`: tag-triggered (`lite-v*`) — `lite-` prefix prevents overlap +- No workflow triggers overlap — each tag pattern is distinct + ## Desktop Edition (Lite) - **Build tag:** `//go:build sqliteonly` — desktop binary includes only SQLite, no PostgreSQL diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8ae455b7..e1dd3ce9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -78,6 +78,44 @@ Developer Reviewer Owner │ │ ├─ merge to dev │ │ │ │ │ (when stable) ├─ PR dev → main - │ │ ├─ merge → release - │ │ ├─ tag → CD triggers + │ │ ├─ merge → auto release + │ │ │ (semantic-release) ``` + +## Releases + +### Standard (automatic) + +Merge `dev` → `main`. `go-semantic-release` analyzes commit messages and auto-creates: +- GitHub Release with version tag (`vX.Y.Z`) +- Cross-platform binaries (linux/darwin × amd64/arm64) +- Docker images (4 variants: latest, base, full, otel + web) +- SHA256 checksums +- Discord notification + +### Beta (manual tag) + +Push a beta tag from `dev` to create a prerelease: + +```bash +# Standard beta — builds Docker + Linux binaries +git tag v2.67.0-beta.1 +git push origin v2.67.0-beta.1 + +# Desktop beta — builds macOS .dmg + Windows .exe +git tag lite-v1.2.0-beta.1 +git push origin lite-v1.2.0-beta.1 +``` + +Beta releases are marked as **prerelease** on GitHub and use `:beta` rolling Docker tag. + +### Desktop / Lite + +Push a `lite-v*` tag to build desktop apps: + +```bash +git tag lite-v1.1.0 +git push origin lite-v1.1.0 +``` + +Tags with `-beta` or `-rc` suffix automatically create prereleases. diff --git a/docs/17-changelog.md b/docs/17-changelog.md index f1f71290..6ae4e2da 100644 --- a/docs/17-changelog.md +++ b/docs/17-changelog.md @@ -4,6 +4,32 @@ All notable changes to GoClaw Gateway are documented here. Format follows [Keep --- +## [v2.66.0] — 2026-04-05 + +### Security +- **Session IDOR fix**: All 5 chat.* WS methods (send, history, inject, abort, session.status) now verify session ownership. Non-admin users cannot read, write, or disrupt other users' sessions +- **`requireSessionOwner` helper**: Extracted shared ownership check to `access.go` (DRY — pattern was repeated 9x in sessions.go) + +### Added +- **BytePlus ModelArk provider**: Seedream image generation + Seedance video generation via BytePlus/Volcengine API +- **Per-agent CLI grants**: Secure CLI binaries can now be granted/denied per agent with setting overrides +- **Beta release pipeline**: `release-beta.yaml` — push `v*-beta*` tag from dev to create prerelease with Docker images + binaries + +### Fixed +- **Scheduler test hang**: Defer ordering fix prevents CI timeout when test fails before unblocking goroutines +- **Semantic-release branch**: `--no-ci` flag bypasses default branch check (repo default is dev, releases cut from main) +- **OpenAI compat**: Together/Mistral reasoning, streaming, and vision gating; Mistral tool call ID normalization + +### Changed +- **Docker builds**: Removed redundant `docker-publish.yaml` — `release.yaml` handles all Docker builds on release +- **Desktop prerelease**: `release-desktop.yaml` auto-detects beta/rc tags and marks as prerelease + +### Refactored +- **Web UI**: React-arch audit — RHF+Zod forms, Zustand persist, adapter layer, component modularization +- **Desktop UI**: React-arch audit — schemas, RHF forms, file splits, services, store cleanup + +--- + ## [Unreleased] ### Added