From f7a4cb64ab0e6f2b194ef194beb209c43a7e050e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Tue, 1 Sep 2026 01:05:22 -0400 Subject: [PATCH] Return the forge to GitHub: releases, self-update, links, CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The GitHub account is restored, so github.com/ZacharyZhang-NY/Kigi-CLI is the canonical repo again. Reverse the 2026-08 Gitea migration: - .github/workflows/{release,warm-cache}.yml: restore the GitHub-hosted pipeline dropped in 3e1652c, unchanged — hosted runners, rust-cache, softprops release with every asset attached atomically. - .gitea/workflows/release.yml: retire the Gitea edition (the runners are being deregistered; git.zacharyzhang.com keeps the v0.1.12/v0.1.13 releases for old clients). - kigi-env: update_base_url now defaults to the GitHub Releases API. The updater already speaks GitHub wire format and sends a User-Agent; v0.1.14 is published to BOTH forges with identical assets so pre-0.1.14 installs polling Gitea self-update onto the GitHub channel. - install.sh / install.ps1: resolve releases from api.github.com. - feedback, /docs, SECURITY.md, frontend worker + site: repo, issues and raw-file links point at github.com / raw.githubusercontent.com. - docs/RELEASE.md: GitHub edition of the checklist; Gitea runner sections retired. - version: 0.1.13 -> 0.1.14 (the cross-forge transition release). Claude-Session: https://claude.ai/code/session_01A6RcwHhhsFYYrNdQB4ASuP --- .gitea/workflows/release.yml | 375 ------------------ .github/workflows/release.yml | 147 +++++++ .github/workflows/warm-cache.yml | 85 ++++ Cargo.lock | 124 +++--- Cargo.toml | 2 +- SECURITY.md | 2 +- crates/codegen/kigi-env/src/lib.rs | 2 +- .../kigi-shell/src/agent/feedback_client.rs | 2 +- .../kigi-tui/src/slash/commands/docs.rs | 2 +- .../kigi-tui/src/slash/commands/feedback.rs | 2 +- crates/codegen/kigi-update/src/auto_update.rs | 4 +- crates/codegen/kigi-update/src/version.rs | 2 +- docs/RELEASE.md | 158 ++------ frontend/dist/assets/index-Bf_hNuMB.js | 2 +- frontend/worker/index.ts | 6 +- install.ps1 | 5 +- install.sh | 5 +- 17 files changed, 336 insertions(+), 589 deletions(-) delete mode 100644 .gitea/workflows/release.yml create mode 100644 .github/workflows/release.yml create mode 100644 .github/workflows/warm-cache.yml diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml deleted file mode 100644 index 9fd593f..0000000 --- a/.gitea/workflows/release.yml +++ /dev/null @@ -1,375 +0,0 @@ -name: Release - -# PRD F8, Gitea edition. On a v* tag push, build the single-file kigi binary -# for the five supported targets, package kigi--. -# {tar.gz|zip} (binary + LICENSE + NOTICE + THIRD-PARTY-NOTICES), and publish -# them as a Gitea Release alongside SHA256SUMS. install.sh, install.ps1 and -# auto_update::release_asset_name() all resolve these exact names — keep the -# naming in lockstep with them. -# -# RUNNERS. Gitea has no hosted runners; every label below must be a runner you -# registered yourself (docs/RELEASE.md has the register commands): -# -# ubuntu-latest Linux x86_64, container mode — the label the Dokploy box's -# runner already advertises. Builds both Linux targets; -# aarch64 is a cross-compile, so this leg installs the -# aarch64 GNU toolchain. Because the image is a bare -# runner-image, the Linux legs provision their own apt -# packages and rustup (see the provision steps below). -# Registering a dedicated `linux-x86_64:docker://...` runner -# instead is fine — swap the three labels back if you do. -# macos-arm64 Apple Silicon Mac, host mode. Builds both Darwin targets; -# x86_64 is a cross-compile against the same SDK. macOS -# CANNOT be built anywhere else — Apple's SDK licence -# restricts it to Apple hardware. -# windows-x86_64 Windows x86_64, host mode, with VS 2022 Build Tools -# (C++ workload). Needed because the tree links ring, -# mimalloc, zstd-sys and libz-sys against a static MSVC CRT -# (-C target-feature=+crt-static). -# -# SHELLS. Every step names its shell explicitly and the Windows leg never uses -# bash. On a normal Windows box `bash` resolves to WSL (not Git Bash), and -# `pwsh` (PowerShell 7) is usually absent — so Windows steps use `powershell`, -# which is the built-in 5.1. Keep those steps 5.1-compatible: no `&&`, no -# ternary, no null-coalescing. -# -# Note: because this file exists, Gitea ignores .github/workflows entirely. -# -# PUBLISH ORDER. The release is created as a draft and only made public once -# SHA256SUMS is attached, so `releases/latest` never hands the installer a -# release whose checksum manifest is still missing. - -on: - push: - tags: ["v*"] - -permissions: - contents: write - -env: - CARGO_TERM_COLOR: always - # Matches the version pinned by the dotslash launcher in bin/protoc. That - # launcher is not used here: it has no Windows entry and needs a `cargo - # install dotslash` first, so every platform fetches protoc directly. - PROTOC_VERSION: "29.3" - -jobs: - prepare: - name: prepare draft release - runs-on: ubuntu-latest - outputs: - release_id: ${{ steps.draft.outputs.release_id }} - steps: - - uses: actions/checkout@v4 - - - name: Check tag matches workspace version - shell: bash - run: | - tag_version="${GITHUB_REF_NAME#v}" - cargo_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)" - if [ "$tag_version" != "$cargo_version" ]; then - echo "Tag $GITHUB_REF_NAME does not match workspace version $cargo_version" >&2 - exit 1 - fi - - - name: Create or reuse draft release - id: draft - shell: bash - env: - TOKEN: ${{ secrets.GITEA_TOKEN }} - API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }} - run: | - set -eu - # The runner-image is bare; jq and curl are both used below. - if ! command -v jq >/dev/null || ! command -v curl >/dev/null; then - SUDO=""; command -v sudo >/dev/null && SUDO=sudo - export DEBIAN_FRONTEND=noninteractive - $SUDO apt-get update -qq - $SUDO apt-get install -y -qq --no-install-recommends jq curl ca-certificates - fi - - # Idempotent so a re-run of a failed tag build reuses the same draft - # instead of erroring on a duplicate tag_name. - existing="$(curl -sS -H "Authorization: token $TOKEN" \ - "$API/releases/tags/$GITHUB_REF_NAME")" - release_id="$(printf '%s' "$existing" | jq -r '.id // empty')" - - if [ -z "$release_id" ]; then - prerelease=false - case "$GITHUB_REF_NAME" in *-*) prerelease=true ;; esac - created="$(curl -fsS -X POST \ - -H "Authorization: token $TOKEN" \ - -H "Content-Type: application/json" \ - -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\",\"draft\":true,\"prerelease\":$prerelease}" \ - "$API/releases")" - release_id="$(printf '%s' "$created" | jq -r '.id')" - echo "Created draft release $release_id (prerelease=$prerelease)" - else - echo "Reusing release $release_id for $GITHUB_REF_NAME" - fi - - echo "release_id=$release_id" >> "$GITHUB_OUTPUT" - - build: - name: build (${{ matrix.target }}) - needs: prepare - strategy: - fail-fast: false - matrix: - include: - - target: x86_64-unknown-linux-gnu - runner: ubuntu-latest - protoc: linux-x86_64 - ext: tar.gz - linux: true - - target: aarch64-unknown-linux-gnu - runner: ubuntu-latest - protoc: linux-x86_64 - ext: tar.gz - linux: true - cross_gnu: true - - target: aarch64-apple-darwin - runner: macos-arm64 - protoc: osx-aarch_64 - ext: tar.gz - - target: x86_64-apple-darwin - runner: macos-arm64 - protoc: osx-aarch_64 - ext: tar.gz - - target: x86_64-pc-windows-msvc - runner: windows-x86_64 - protoc: win64 - ext: zip - runs-on: ${{ matrix.runner }} - steps: - - uses: actions/checkout@v4 - - # ── linux container provisioning ────────────────────────────────────── - # The Linux legs run in a bare gitea runner-image, which ships git and - # node for the JavaScript actions but no compiler, no unzip (protoc) and - # no rustup. Host-mode macOS and Windows already have their toolchains - # installed, so this step is Linux-only. - - name: Provision Linux build deps - if: matrix.linux - shell: bash - run: | - set -eu - SUDO=""; command -v sudo >/dev/null && SUDO=sudo - export DEBIAN_FRONTEND=noninteractive - $SUDO apt-get update -qq - $SUDO apt-get install -y -qq --no-install-recommends \ - build-essential pkg-config ca-certificates curl unzip tar jq - - # ── protoc ──────────────────────────────────────────────────────────── - - name: Install protoc (unix) - if: matrix.ext == 'tar.gz' - shell: bash - run: | - set -eu - url="https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-${{ matrix.protoc }}.zip" - curl -fsSL -o protoc.zip "$url" - rm -rf "$HOME/protoc" - unzip -q -o protoc.zip -d "$HOME/protoc" - chmod +x "$HOME/protoc/bin/protoc" - echo "$HOME/protoc/bin" >> "$GITHUB_PATH" - - - name: Install protoc (windows) - if: matrix.ext == 'zip' - shell: powershell - run: | - $ErrorActionPreference = "Stop" - $url = "https://github.com/protocolbuffers/protobuf/releases/download/v$env:PROTOC_VERSION/protoc-$env:PROTOC_VERSION-${{ matrix.protoc }}.zip" - Invoke-WebRequest -Uri $url -OutFile protoc.zip - $dest = Join-Path $env:USERPROFILE "protoc" - if (Test-Path $dest) { Remove-Item $dest -Recurse -Force } - Expand-Archive protoc.zip -DestinationPath $dest -Force - Add-Content -Path $env:GITHUB_PATH -Value (Join-Path $dest "bin") - - # ── toolchain ───────────────────────────────────────────────────────── - # rust-toolchain.toml pins the channel (1.97.0) and preinstalls both - # Linux targets; `rustup show` materialises exactly that. - - name: Install toolchain (unix) - if: matrix.ext == 'tar.gz' - shell: bash - run: | - set -eu - # No-op on the macOS host runner, which has rustup installed already. - # `--default-toolchain none` leaves the channel choice to - # rust-toolchain.toml, which `rustup show` then materialises. - if ! command -v rustup >/dev/null; then - curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \ - | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none - echo "$HOME/.cargo/bin" >> "$GITHUB_PATH" - export PATH="$HOME/.cargo/bin:$PATH" - fi - rustup show - rustup target add ${{ matrix.target }} - - - name: Install toolchain (windows) - if: matrix.ext == 'zip' - shell: powershell - run: | - $ErrorActionPreference = "Stop" - rustup show - rustup target add ${{ matrix.target }} - - # ring, mimalloc, zstd-sys and libz-sys are all cc-rs builds, so the - # cross target needs its own C toolchain — cc-rs picks these up from the - # target-suffixed vars. - - name: Install aarch64 cross toolchain - if: matrix.cross_gnu - shell: bash - run: | - set -eu - SUDO=""; command -v sudo >/dev/null && SUDO=sudo - $SUDO apt-get update -qq - $SUDO apt-get install -y -qq gcc-aarch64-linux-gnu g++-aarch64-linux-gnu - { - echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" - echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc" - echo "CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++" - echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar" - } >> "$GITHUB_ENV" - - # ── build ───────────────────────────────────────────────────────────── - - name: Build kigi (unix) - if: matrix.ext == 'tar.gz' - shell: bash - run: cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }} - - - name: Build kigi (windows) - if: matrix.ext == 'zip' - shell: powershell - run: | - $ErrorActionPreference = "Stop" - cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }} - if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } - - # ── package, upload, checksum ───────────────────────────────────────── - # Archives go straight to the release rather than through the artifact - # store: they are large, and the release is the only place install.sh - # can read them from anyway. Only the checksum line travels as an - # artifact, for the publish job to concatenate. - - name: Package and upload (unix) - if: matrix.ext == 'tar.gz' - shell: bash - env: - TOKEN: ${{ secrets.GITEA_TOKEN }} - API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }} - RELEASE_ID: ${{ needs.prepare.outputs.release_id }} - run: | - set -eu - version="${GITHUB_REF_NAME#v}" - archive="kigi-${version}-${{ matrix.target }}.tar.gz" - staging="$(mktemp -d)" - cp "target/${{ matrix.target }}/release-dist/kigi" "$staging/kigi" - cp LICENSE "$staging/" - [ -f NOTICE ] && cp NOTICE "$staging/" - for f in THIRD-PARTY-NOTICES THIRD-PARTY-NOTICES.md; do - [ -f "$f" ] && cp "$f" "$staging/" - done - tar -C "$staging" -czf "$archive" . - - curl -fsS -X POST \ - -H "Authorization: token $TOKEN" \ - -F "attachment=@${archive}" \ - "$API/releases/$RELEASE_ID/assets?name=${archive}" > /dev/null - echo "Uploaded $archive" - - if command -v sha256sum >/dev/null; then - sha256sum "$archive" > "checksum-${{ matrix.target }}.txt" - else - shasum -a 256 "$archive" > "checksum-${{ matrix.target }}.txt" - fi - cat "checksum-${{ matrix.target }}.txt" - - - name: Package and upload (windows) - if: matrix.ext == 'zip' - shell: powershell - env: - TOKEN: ${{ secrets.GITEA_TOKEN }} - API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }} - RELEASE_ID: ${{ needs.prepare.outputs.release_id }} - run: | - $ErrorActionPreference = "Stop" - $version = $env:GITHUB_REF_NAME.TrimStart("v") - $archive = "kigi-$version-${{ matrix.target }}.zip" - $staging = Join-Path $env:RUNNER_TEMP "staging" - if (Test-Path $staging) { Remove-Item $staging -Recurse -Force } - New-Item -ItemType Directory -Force -Path $staging | Out-Null - Copy-Item "target/${{ matrix.target }}/release-dist/kigi.exe" (Join-Path $staging "kigi.exe") - Copy-Item LICENSE $staging - if (Test-Path NOTICE) { Copy-Item NOTICE $staging } - foreach ($f in @("THIRD-PARTY-NOTICES", "THIRD-PARTY-NOTICES.md")) { - if (Test-Path $f) { Copy-Item $f $staging } - } - Compress-Archive -Path (Join-Path $staging "*") -DestinationPath $archive -Force - - # System32\curl.exe, not PowerShell's `curl` alias for - # Invoke-WebRequest, which cannot do multipart uploads. - $api = "$env:API/releases/$env:RELEASE_ID/assets?name=$archive" - & "$env:SystemRoot\System32\curl.exe" -fsS -X POST ` - -H "Authorization: token $env:TOKEN" ` - -F "attachment=@$archive" $api - if ($LASTEXITCODE -ne 0) { throw "asset upload failed ($LASTEXITCODE)" } - Write-Host "Uploaded $archive" - - # sha256sum's exact format, so the publish job can just concatenate. - # ASCII keeps the BOM out — a BOM would corrupt the first hash. - $hash = (Get-FileHash -Algorithm SHA256 -Path $archive).Hash.ToLowerInvariant() - "$hash $archive" | Out-File -FilePath "checksum-${{ matrix.target }}.txt" -Encoding ascii - Get-Content "checksum-${{ matrix.target }}.txt" - - - uses: actions/upload-artifact@v3 - with: - name: checksum-${{ matrix.target }} - path: checksum-${{ matrix.target }}.txt - if-no-files-found: error - - publish: - name: publish release - needs: [prepare, build] - runs-on: ubuntu-latest - steps: - - uses: actions/download-artifact@v3 - with: - path: checksums - - - name: Assemble SHA256SUMS - shell: bash - run: | - set -eu - # download-artifact v3 nests each artifact in its own directory. The - # Windows line arrives CRLF-terminated; strip CR so every line is LF - # for install.sh's `read -r hash name`. - find checksums -name 'checksum-*.txt' -exec cat {} + \ - | tr -d '\r' | grep -v '^$' | sort -k2 > SHA256SUMS - lines="$(wc -l < SHA256SUMS)" - if [ "$lines" -ne 5 ]; then - echo "expected 5 checksum lines, got $lines" >&2 - cat SHA256SUMS >&2 - exit 1 - fi - cat SHA256SUMS - - - name: Attach SHA256SUMS and publish - shell: bash - env: - TOKEN: ${{ secrets.GITEA_TOKEN }} - API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }} - RELEASE_ID: ${{ needs.prepare.outputs.release_id }} - run: | - set -eu - curl -fsS -X POST \ - -H "Authorization: token $TOKEN" \ - -F "attachment=@SHA256SUMS" \ - "$API/releases/$RELEASE_ID/assets?name=SHA256SUMS" > /dev/null - - # Flip the draft public only now that every asset install.sh looks - # for is attached. - curl -fsS -X PATCH \ - -H "Authorization: token $TOKEN" \ - -H "Content-Type: application/json" \ - -d '{"draft":false}' \ - "$API/releases/$RELEASE_ID" > /dev/null - echo "Published $GITHUB_REF_NAME" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..7febfd5 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,147 @@ +name: Release + +# PRD F8: on tag push v*, build the single-file kigi binary for the five +# supported targets, package per-target archives named +# kigi--.{tar.gz|zip} (binary + LICENSE + NOTICE + +# THIRD-PARTY-NOTICES), generate SHA256SUMS, and publish everything as a +# GitHub Release. install.sh / install.ps1 and the in-app self-updater +# (kigi-update) both resolve these exact asset names — keep the naming in +# lockstep with auto_update::release_asset_name(). + +on: + push: + tags: ["v*"] + +permissions: + contents: write + +env: + CARGO_TERM_COLOR: always + +jobs: + build: + name: build (${{ matrix.target }}) + strategy: + fail-fast: false + matrix: + include: + - target: aarch64-apple-darwin + os: macos-14 + # macos-14 runners are arm64; the x86_64 slice is a cross-compile + # against the same SDK (macos-13 Intel runners are deprecated). + - target: x86_64-apple-darwin + os: macos-14 + - target: x86_64-unknown-linux-gnu + os: ubuntu-24.04 + - target: aarch64-unknown-linux-gnu + os: ubuntu-24.04-arm + - target: x86_64-pc-windows-msvc + os: windows-2022 + runs-on: ${{ matrix.os }} + steps: + - uses: actions/checkout@v4 + + - name: Check tag matches workspace version + shell: bash + run: | + tag_version="${GITHUB_REF_NAME#v}" + cargo_version="$(sed -n 's/^version = "\(.*\)"$/\1/p' Cargo.toml | head -n 1)" + if [ "$tag_version" != "$cargo_version" ]; then + echo "Tag $GITHUB_REF_NAME does not match workspace version $cargo_version" >&2 + exit 1 + fi + + - name: Install toolchain (rust-toolchain.toml) + run: rustup show + + - name: Add build target + run: rustup target add ${{ matrix.target }} + + - name: Install dotslash (protoc launcher) + run: cargo install dotslash --locked + + # Windows cannot exec the dotslash launcher directly (no shebang + # support → os error 193), and the build script's documented fallback + # is a protoc on PATH — install the same version the dotslash file + # pins (v29.3). + - name: Install protoc (Windows PATH fallback) + if: runner.os == 'Windows' + shell: pwsh + run: | + $url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protoc-29.3-win64.zip" + Invoke-WebRequest -Uri $url -OutFile protoc.zip + Expand-Archive protoc.zip -DestinationPath "$env:USERPROFILE\protoc" + Add-Content $env:GITHUB_PATH "$env:USERPROFILE\protoc\bin" + + - uses: Swatinem/rust-cache@v2 + with: + key: ${{ matrix.target }} + + - name: Build kigi (release-dist) + run: cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }} + + - name: Package archive (tar.gz) + if: runner.os != 'Windows' + shell: bash + run: | + version="${GITHUB_REF_NAME#v}" + archive="kigi-${version}-${{ matrix.target }}.tar.gz" + staging="$(mktemp -d)" + cp "target/${{ matrix.target }}/release-dist/kigi" "$staging/kigi" + cp LICENSE "$staging/" + [ -f NOTICE ] && cp NOTICE "$staging/" + for f in THIRD-PARTY-NOTICES THIRD-PARTY-NOTICES.md; do + [ -f "$f" ] && cp "$f" "$staging/" + done + tar -C "$staging" -czf "$archive" . + shasum -a 256 "$archive" || sha256sum "$archive" + echo "ARCHIVE=$archive" >> "$GITHUB_ENV" + + - name: Package archive (zip) + if: runner.os == 'Windows' + shell: pwsh + run: | + $version = $env:GITHUB_REF_NAME.TrimStart("v") + $archive = "kigi-$version-${{ matrix.target }}.zip" + $staging = New-Item -ItemType Directory -Path (Join-Path $env:RUNNER_TEMP "staging") + Copy-Item "target/${{ matrix.target }}/release-dist/kigi.exe" (Join-Path $staging "kigi.exe") + Copy-Item LICENSE $staging + if (Test-Path NOTICE) { Copy-Item NOTICE $staging } + foreach ($f in @("THIRD-PARTY-NOTICES", "THIRD-PARTY-NOTICES.md")) { + if (Test-Path $f) { Copy-Item $f $staging } + } + Compress-Archive -Path (Join-Path $staging "*") -DestinationPath $archive + Get-FileHash -Algorithm SHA256 $archive + Add-Content -Path $env:GITHUB_ENV -Value "ARCHIVE=$archive" + + - name: Upload artifact + uses: actions/upload-artifact@v4 + with: + name: ${{ env.ARCHIVE }} + path: ${{ env.ARCHIVE }} + if-no-files-found: error + + release: + name: publish GitHub Release + needs: build + runs-on: ubuntu-24.04 + steps: + - uses: actions/download-artifact@v4 + with: + path: dist + merge-multiple: true + + - name: Generate SHA256SUMS + working-directory: dist + run: | + ls -l + sha256sum kigi-* > SHA256SUMS + cat SHA256SUMS + + - name: Create GitHub Release + uses: softprops/action-gh-release@v2 + with: + files: dist/* + prerelease: ${{ contains(github.ref_name, '-') }} + generate_release_notes: true + fail_on_unmatched_files: true diff --git a/.github/workflows/warm-cache.yml b/.github/workflows/warm-cache.yml new file mode 100644 index 0000000..35f1809 --- /dev/null +++ b/.github/workflows/warm-cache.yml @@ -0,0 +1,85 @@ +name: Warm build cache + +# Release builds run on TAG refs, and GitHub Actions cache isolation only +# lets a run restore caches created on its OWN ref or the DEFAULT branch. +# No workflow ran on `main`, so every release compiled the whole workspace +# cold on all five targets (~50 min wall clock, gated by Windows). This +# workflow builds the same `release-dist` profile on `main` so tag builds +# restore a warm default-branch cache. +# +# Triggers: dependency-affecting pushes to main (each release's version-bump +# commit warms the cache for the NEXT release), a weekly refresh so the +# cache never hits GitHub's 7-day unused-eviction, and manual dispatch. +# +# The setup steps mirror release.yml's build job (toolchain, target, +# dotslash/protoc, rust-cache key) — keep them in lockstep, or the cache +# key won't match and releases go back to cold builds. + +on: + push: + branches: ["main"] + paths: + - "Cargo.lock" + - "Cargo.toml" + - "rust-toolchain.toml" + - ".github/workflows/warm-cache.yml" + schedule: + - cron: "17 5 * * 1" + workflow_dispatch: + +permissions: + contents: read + +env: + CARGO_TERM_COLOR: always + +concurrency: + group: warm-cache + cancel-in-progress: true + +jobs: + warm: + name: warm (${{ matrix.target }}) + strategy: + fail-fast: false + matrix: + include: + - target: aarch64-apple-darwin + os: macos-14 + - target: x86_64-apple-darwin + os: macos-14 + - target: x86_64-unknown-linux-gnu + os: ubuntu-24.04 + - target: aarch64-unknown-linux-gnu + os: ubuntu-24.04-arm + - target: x86_64-pc-windows-msvc + os: windows-2022 + runs-on: ${{ matrix.os }} + steps: + - uses: actions/checkout@v4 + + - name: Install toolchain (rust-toolchain.toml) + run: rustup show + + - name: Add build target + run: rustup target add ${{ matrix.target }} + + - name: Install dotslash (protoc launcher) + run: cargo install dotslash --locked + + - name: Install protoc (Windows PATH fallback) + if: runner.os == 'Windows' + shell: pwsh + run: | + $url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.3/protoc-29.3-win64.zip" + Invoke-WebRequest -Uri $url -OutFile protoc.zip + Expand-Archive protoc.zip -DestinationPath "$env:USERPROFILE\protoc" + Add-Content $env:GITHUB_PATH "$env:USERPROFILE\protoc\bin" + + # Same key as release.yml so tag builds restore this cache verbatim. + - uses: Swatinem/rust-cache@v2 + with: + key: ${{ matrix.target }} + + - name: Build kigi (release-dist) + run: cargo build --profile release-dist -p kigi-bin --locked --target ${{ matrix.target }} diff --git a/Cargo.lock b/Cargo.lock index 6eab357..0aa1ef2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5442,7 +5442,7 @@ dependencies = [ [[package]] name = "kigi-acp-lib" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "async-trait", @@ -5456,7 +5456,7 @@ dependencies = [ [[package]] name = "kigi-agent" -version = "0.1.13" +version = "0.1.14" dependencies = [ "chrono", "dirs 6.0.0", @@ -5486,7 +5486,7 @@ dependencies = [ [[package]] name = "kigi-agent-lifecycle" -version = "0.1.13" +version = "0.1.14" dependencies = [ "async-trait", "tokio", @@ -5495,7 +5495,7 @@ dependencies = [ [[package]] name = "kigi-auth" -version = "0.1.13" +version = "0.1.14" dependencies = [ "async-trait", "http 1.4.2", @@ -5508,7 +5508,7 @@ dependencies = [ [[package]] name = "kigi-bin" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "clap", @@ -5543,7 +5543,7 @@ dependencies = [ [[package]] name = "kigi-chat-state" -version = "0.1.13" +version = "0.1.14" dependencies = [ "indexmap", "kigi-compaction", @@ -5560,7 +5560,7 @@ dependencies = [ [[package]] name = "kigi-codebase-graph" -version = "0.1.13" +version = "0.1.14" dependencies = [ "ahash", "clap", @@ -5596,7 +5596,7 @@ dependencies = [ [[package]] name = "kigi-compaction" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "async-trait", @@ -5609,7 +5609,7 @@ dependencies = [ [[package]] name = "kigi-config" -version = "0.1.13" +version = "0.1.14" dependencies = [ "base64", "blake3", @@ -5632,7 +5632,7 @@ dependencies = [ [[package]] name = "kigi-config-types" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "indexmap", @@ -5646,7 +5646,7 @@ dependencies = [ [[package]] name = "kigi-crash-handler" -version = "0.1.13" +version = "0.1.14" dependencies = [ "backtrace", "libc", @@ -5657,7 +5657,7 @@ dependencies = [ [[package]] name = "kigi-env" -version = "0.1.13" +version = "0.1.14" dependencies = [ "tracing", "url", @@ -5665,7 +5665,7 @@ dependencies = [ [[package]] name = "kigi-fast-worktree" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "bytes", @@ -5697,7 +5697,7 @@ dependencies = [ [[package]] name = "kigi-file-utils" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "aws-config", @@ -5721,7 +5721,7 @@ dependencies = [ [[package]] name = "kigi-fsnotify" -version = "0.1.13" +version = "0.1.14" dependencies = [ "criterion", "dunce", @@ -5742,7 +5742,7 @@ dependencies = [ [[package]] name = "kigi-gix-status" -version = "0.1.13" +version = "0.1.14" dependencies = [ "gix", "kigi-test-utils", @@ -5752,7 +5752,7 @@ dependencies = [ [[package]] name = "kigi-hooks" -version = "0.1.13" +version = "0.1.14" dependencies = [ "fastrand", "kigi-config", @@ -5771,7 +5771,7 @@ dependencies = [ [[package]] name = "kigi-hooks-plugins-types" -version = "0.1.13" +version = "0.1.14" dependencies = [ "serde", "serde_json", @@ -5779,7 +5779,7 @@ dependencies = [ [[package]] name = "kigi-http" -version = "0.1.13" +version = "0.1.14" dependencies = [ "kigi-auth", "kigi-log", @@ -5794,7 +5794,7 @@ dependencies = [ [[package]] name = "kigi-hunk-tracker" -version = "0.1.13" +version = "0.1.14" dependencies = [ "chrono", "dunce", @@ -5815,14 +5815,14 @@ dependencies = [ [[package]] name = "kigi-interjection-core" -version = "0.1.13" +version = "0.1.14" dependencies = [ "serde", ] [[package]] name = "kigi-log" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "chrono", @@ -5840,7 +5840,7 @@ dependencies = [ [[package]] name = "kigi-markdown" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anstyle", "anstyle-lossy", @@ -5864,14 +5864,14 @@ dependencies = [ [[package]] name = "kigi-markdown-core" -version = "0.1.13" +version = "0.1.14" dependencies = [ "pulldown-cmark", ] [[package]] name = "kigi-mcp" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "async-trait", @@ -5908,7 +5908,7 @@ dependencies = [ [[package]] name = "kigi-memory" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "arc-swap", @@ -5942,7 +5942,7 @@ dependencies = [ [[package]] name = "kigi-mermaid" -version = "0.1.13" +version = "0.1.14" dependencies = [ "fontdb", "image", @@ -5960,7 +5960,7 @@ dependencies = [ [[package]] name = "kigi-models" -version = "0.1.13" +version = "0.1.14" dependencies = [ "kigi-env", "serde", @@ -5970,7 +5970,7 @@ dependencies = [ [[package]] name = "kigi-pager-minimal" -version = "0.1.13" +version = "0.1.14" dependencies = [ "chrono", "crossterm", @@ -5987,7 +5987,7 @@ dependencies = [ [[package]] name = "kigi-pager-pty-harness" -version = "0.1.13" +version = "0.1.14" dependencies = [ "alacritty_terminal", "anyhow", @@ -6012,7 +6012,7 @@ dependencies = [ [[package]] name = "kigi-pager-render" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "anstyle", @@ -6064,7 +6064,7 @@ dependencies = [ [[package]] name = "kigi-paths" -version = "0.1.13" +version = "0.1.14" dependencies = [ "camino", "serde", @@ -6074,7 +6074,7 @@ dependencies = [ [[package]] name = "kigi-prompt-queue" -version = "0.1.13" +version = "0.1.14" dependencies = [ "serde", "serde_json", @@ -6082,7 +6082,7 @@ dependencies = [ [[package]] name = "kigi-proto-build" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "pbjson-build", @@ -6093,7 +6093,7 @@ dependencies = [ [[package]] name = "kigi-ratatui-inline" -version = "0.1.13" +version = "0.1.14" dependencies = [ "ansi-width", "anstyle-parse 0.2.7", @@ -6110,7 +6110,7 @@ dependencies = [ [[package]] name = "kigi-ratatui-textarea" -version = "0.1.13" +version = "0.1.14" dependencies = [ "arboard", "chrono", @@ -6131,7 +6131,7 @@ dependencies = [ [[package]] name = "kigi-sampler" -version = "0.1.13" +version = "0.1.14" dependencies = [ "async-openai", "async-stream", @@ -6154,7 +6154,7 @@ dependencies = [ [[package]] name = "kigi-sampling-types" -version = "0.1.13" +version = "0.1.14" dependencies = [ "assert_matches", "async-openai", @@ -6171,7 +6171,7 @@ dependencies = [ [[package]] name = "kigi-sandbox" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "chrono", @@ -6192,7 +6192,7 @@ dependencies = [ [[package]] name = "kigi-secrets" -version = "0.1.13" +version = "0.1.14" dependencies = [ "regex", "serde_json", @@ -6230,7 +6230,7 @@ dependencies = [ [[package]] name = "kigi-shell" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "anyhow", @@ -6367,7 +6367,7 @@ dependencies = [ [[package]] name = "kigi-shell-base" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "chrono", @@ -6392,7 +6392,7 @@ dependencies = [ [[package]] name = "kigi-sqlite-journal" -version = "0.1.13" +version = "0.1.14" dependencies = [ "libc", "rusqlite", @@ -6403,7 +6403,7 @@ dependencies = [ [[package]] name = "kigi-subagent-resolution" -version = "0.1.13" +version = "0.1.14" dependencies = [ "kigi-sampling-types", "kigi-tool-types", @@ -6418,7 +6418,7 @@ dependencies = [ [[package]] name = "kigi-system-power" -version = "0.1.13" +version = "0.1.14" dependencies = [ "windows-sys 0.59.0", "zbus", @@ -6426,7 +6426,7 @@ dependencies = [ [[package]] name = "kigi-test-support" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "anyhow", @@ -6448,7 +6448,7 @@ dependencies = [ [[package]] name = "kigi-test-utils" -version = "0.1.13" +version = "0.1.14" dependencies = [ "runfiles", "tracing", @@ -6457,11 +6457,11 @@ dependencies = [ [[package]] name = "kigi-token-estimation" -version = "0.1.13" +version = "0.1.14" [[package]] name = "kigi-tool-protocol" -version = "0.1.13" +version = "0.1.14" dependencies = [ "kigi-tool-types", "serde", @@ -6472,7 +6472,7 @@ dependencies = [ [[package]] name = "kigi-tool-runtime" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "async-trait", @@ -6490,7 +6490,7 @@ dependencies = [ [[package]] name = "kigi-tool-types" -version = "0.1.13" +version = "0.1.14" dependencies = [ "minijinja", "schemars 1.2.1", @@ -6500,7 +6500,7 @@ dependencies = [ [[package]] name = "kigi-tools" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "arc-swap", @@ -6577,7 +6577,7 @@ dependencies = [ [[package]] name = "kigi-tools-api" -version = "0.1.13" +version = "0.1.14" dependencies = [ "kigi-proto-build", "kigi-tool-protocol", @@ -6590,11 +6590,11 @@ dependencies = [ [[package]] name = "kigi-tracing-macros" -version = "0.1.13" +version = "0.1.14" [[package]] name = "kigi-tty-utils" -version = "0.1.13" +version = "0.1.14" dependencies = [ "libc", "nix 0.30.1", @@ -6604,7 +6604,7 @@ dependencies = [ [[package]] name = "kigi-tui" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "ansi-to-tui", @@ -6691,7 +6691,7 @@ dependencies = [ [[package]] name = "kigi-update" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "dunce", @@ -6720,14 +6720,14 @@ dependencies = [ [[package]] name = "kigi-version" -version = "0.1.13" +version = "0.1.14" dependencies = [ "semver", ] [[package]] name = "kigi-workspace" -version = "0.1.13" +version = "0.1.14" dependencies = [ "agent-client-protocol", "anyhow", @@ -6806,7 +6806,7 @@ dependencies = [ [[package]] name = "kigi-workspace-types" -version = "0.1.13" +version = "0.1.14" dependencies = [ "base64", "chrono", @@ -8840,7 +8840,7 @@ dependencies = [ [[package]] name = "ptyctl" -version = "0.1.13" +version = "0.1.14" dependencies = [ "alacritty_terminal", "anyhow", @@ -8858,7 +8858,7 @@ dependencies = [ [[package]] name = "ptyctl-cli" -version = "0.1.13" +version = "0.1.14" dependencies = [ "anyhow", "axum", diff --git a/Cargo.toml b/Cargo.toml index 6693b2b..8c58906 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -76,7 +76,7 @@ members = [ ] [workspace.package] -version = "0.1.13" +version = "0.1.14" edition = "2024" license = "Apache-2.0" diff --git a/SECURITY.md b/SECURITY.md index 978e13f..2192c5d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,7 +1,7 @@ # Security Policy Kigi is a community build; report vulnerabilities on the -[Kigi issue tracker](https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues). +[Kigi issue tracker](https://github.com/ZacharyZhang-NY/Kigi-CLI/issues). Issues there are public, so please leave out any detail that would make a report directly exploitable — open with the affected area and impact, and a maintainer will follow up for the rest. diff --git a/crates/codegen/kigi-env/src/lib.rs b/crates/codegen/kigi-env/src/lib.rs index 8a9ed24..e39bf16 100644 --- a/crates/codegen/kigi-env/src/lib.rs +++ b/crates/codegen/kigi-env/src/lib.rs @@ -21,7 +21,7 @@ pub struct KigiEndpoints { pub const PRODUCTION_ENDPOINTS: KigiEndpoints = KigiEndpoints { coding_api_base_url: "https://api.kimi.com/coding/v1", oauth_host: "https://auth.kimi.com", - update_base_url: "https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases", + update_base_url: "https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases", upgrade_page_url: "https://www.kimi.com/code/", }; diff --git a/crates/codegen/kigi-shell/src/agent/feedback_client.rs b/crates/codegen/kigi-shell/src/agent/feedback_client.rs index 8791dbb..cb8d1cb 100644 --- a/crates/codegen/kigi-shell/src/agent/feedback_client.rs +++ b/crates/codegen/kigi-shell/src/agent/feedback_client.rs @@ -13,7 +13,7 @@ use serde::Serialize; /// Where non-subscription users (no OAuth session) submit feedback instead. pub const FEEDBACK_ISSUES_URL: &str = - "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues"; + "https://github.com/ZacharyZhang-NY/Kigi-CLI/issues"; /// HTTP error from the feedback endpoint with a preserved status code, so /// callers can distinguish auth failures (401) without string matching. diff --git a/crates/codegen/kigi-tui/src/slash/commands/docs.rs b/crates/codegen/kigi-tui/src/slash/commands/docs.rs index df0724f..61a1f21 100644 --- a/crates/codegen/kigi-tui/src/slash/commands/docs.rs +++ b/crates/codegen/kigi-tui/src/slash/commands/docs.rs @@ -11,7 +11,7 @@ use crate::slash::command::{AppCtx, ArgItem, CommandExecCtx, CommandResult, Slas /// Online docs landing page (hardcoded like other TUI deep-links; the /// project README is the docs entry point for the repo-hosted docs). pub const BUILD_DOCS_URL: &str = - "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/src/branch/main/README.md"; + "https://github.com/ZacharyZhang-NY/Kigi-CLI/blob/main/README.md"; /// Open How-to Guides or online Build docs. pub struct DocsCommand; diff --git a/crates/codegen/kigi-tui/src/slash/commands/feedback.rs b/crates/codegen/kigi-tui/src/slash/commands/feedback.rs index 5fddb83..aeb907d 100644 --- a/crates/codegen/kigi-tui/src/slash/commands/feedback.rs +++ b/crates/codegen/kigi-tui/src/slash/commands/feedback.rs @@ -7,7 +7,7 @@ use crate::slash::command::{CommandExecCtx, CommandResult, SlashCommand}; /// build, so its feedback belongs on its own repo — mirroring the official /// kimi-cli, whose `/feedback` opens its repo's issues page. pub const FEEDBACK_ISSUES_URL: &str = - "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/issues"; + "https://github.com/ZacharyZhang-NY/Kigi-CLI/issues"; /// Open the Kigi issue tracker in the browser. pub struct FeedbackCommand; diff --git a/crates/codegen/kigi-update/src/auto_update.rs b/crates/codegen/kigi-update/src/auto_update.rs index 0dc9ece..f26e1d7 100644 --- a/crates/codegen/kigi-update/src/auto_update.rs +++ b/crates/codegen/kigi-update/src/auto_update.rs @@ -695,7 +695,7 @@ pub(crate) fn detect_platform() -> Result<(&'static str, &'static str)> { /// Rust target triple for this build — the key that maps a platform to its /// release-asset name. Must stay in lockstep with the five targets built by -/// `.gitea/workflows/release.yml` and the tables in install.sh/install.ps1. +/// `.github/workflows/release.yml` and the tables in install.sh/install.ps1. pub(crate) fn target_triple() -> Result<&'static str> { let triple = if cfg!(all(target_os = "macos", target_arch = "aarch64")) { "aarch64-apple-darwin" @@ -2653,7 +2653,7 @@ mod tests { #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] #[test] fn test_release_asset_name_matches_release_workflow_naming() { - // Must stay in lockstep with .gitea/workflows/release.yml, which + // Must stay in lockstep with .github/workflows/release.yml, which // publishes kigi--.{tar.gz|zip}. let triple = target_triple().unwrap(); assert!( diff --git a/crates/codegen/kigi-update/src/version.rs b/crates/codegen/kigi-update/src/version.rs index 90618e11..7e8f8a8 100644 --- a/crates/codegen/kigi-update/src/version.rs +++ b/crates/codegen/kigi-update/src/version.rs @@ -10,7 +10,7 @@ const TTL_SECONDS_BEFORE_AUTO_UPDATE: Duration = Duration::from_secs(60 * 30); /// Release channel: this repo's Releases (PRD F8). The API base is resolved /// through [`kigi_env::update_base_url`] — production default -/// `https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases`, +/// `https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases`, /// overridable via `KIGI_UPDATE_BASE_URL` for mirrors and tests. pub(crate) fn update_base_url() -> String { kigi_env::update_base_url() diff --git a/docs/RELEASE.md b/docs/RELEASE.md index e771474..242579e 100644 --- a/docs/RELEASE.md +++ b/docs/RELEASE.md @@ -1,17 +1,14 @@ # Release checklist (PRD F8) Kigi ships as a single-file binary for five targets, published on this -repo's Gitea Releases by `.gitea/workflows/release.yml`. Users install via +repo's GitHub Releases by `.github/workflows/release.yml`. Users install via `install.sh` / `install.ps1` and stay current through the in-app self-updater (`kigi-update`), which resolves the same Releases API. -`.github/workflows/release.yml` is the retired GitHub pipeline. Gitea ignores -`.github/workflows` entirely whenever `.gitea/workflows` is non-empty, so it -does not run — it is kept only as a reference for the GitHub-hosted layout. - ## Cutting a release -1. Bump `[workspace.package] version` in `Cargo.toml`; land the change on +1. Bump `[workspace.package] version` in `Cargo.toml` (and refresh + `Cargo.lock` with `cargo update --workspace`); land the change on `main` with green CI. 2. Regenerate the third-party notices (not enforced by CI — this is the step that keeps `THIRD-PARTY-NOTICES.md` fresh): @@ -34,15 +31,10 @@ does not run — it is kept only as a reference for the GitHub-hosted layout. `release-dist` profile, packages `kigi--.{tar.gz|zip}` archives (binary + LICENSE + NOTICE + THIRD-PARTY-NOTICES), generates `SHA256SUMS`, and - publishes the Gitea Release. Tags containing `-` (e.g. - `v0.2.0-alpha.1`) publish as pre-releases, which only the `alpha` - update channel picks up. - - The release is created as a **draft** and only flipped public once - `SHA256SUMS` is attached, so `releases/latest` never hands the installer - a release whose checksum manifest is still missing. A failed run leaves - the draft in place; re-pushing the tag reuses it rather than erroring on - a duplicate `tag_name`. + publishes the GitHub Release with every asset attached in one step, so + `releases/latest` never serves a release whose checksum manifest is + missing. Tags containing `-` (e.g. `v0.2.0-alpha.1`) publish as + pre-releases, which only the `alpha` update channel picks up. 5. Smoke-test an installed artifact: ```sh @@ -52,127 +44,27 @@ does not run — it is kept only as a reference for the GitHub-hosted layout. ## Build runners -Gitea has no hosted runners, so all three `runs-on` labels below are machines -we register ourselves with `gitea-runner` (the binary formerly called -`act_runner`). Labels are declared in the runner's `config.yaml` as -`