Files
MuyueWorkspace/.gitea/workflows/ci.yml
Augustin 3494f6b40d
All checks were successful
CI / build (push) Successful in 2m37s
feat: security hardening, tests, doctor command, CI update, CHANGELOG
- Add AES-256-GCM encryption for API keys (internal/secret)
- Add dangerous command detection in terminal
- Add muyue doctor command for system health checks
- Add scanner TTL cache, orchestrator history mutex, shared HTTP client
- Deduplicate MCP config generation, refactor skills YAML parser
- Add XDG-compliant config dir with legacy migration
- Add cleanup on all TUI quit paths
- Add 8 test files (config, workflow, skills, orchestrator, version,
  platform, scanner, secret)
- Update CI to actions/setup-go@v5
- Add CHANGELOG.md, update README and Makefile

🤖 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>
2026-04-20 19:56:07 +02:00

178 lines
6.9 KiB
YAML

name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Go
uses: actions/setup-go@v5
with:
go-version: '1.24.3'
- name: Cache Go modules
uses: actions/cache@v4
with:
path: |
/root/go/pkg/mod
/home/runner/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- name: Download dependencies
run: go mod download
- name: Vet
run: go vet ./...
- name: Test
run: go test ./... -v -race -timeout 60s
- name: Build
run: |
go build -o muyue ./cmd/muyue/
./muyue version
- name: Build all platforms
if: github.event_name == 'push'
run: |
mkdir -p dist
LDFLAGS="-s -w -X github.com/muyue/muyue/internal/version.Version=$(grep 'Version =' internal/version/version.go | cut -d'"' -f2)"
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="$LDFLAGS" -o dist/muyue-linux-amd64 ./cmd/muyue/
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="$LDFLAGS" -o dist/muyue-linux-arm64 ./cmd/muyue/
CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags="$LDFLAGS" -o dist/muyue-darwin-amd64 ./cmd/muyue/
CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags="$LDFLAGS" -o dist/muyue-darwin-arm64 ./cmd/muyue/
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="$LDFLAGS" -o dist/muyue-windows-amd64.exe ./cmd/muyue/
CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags="$LDFLAGS" -o dist/muyue-windows-arm64.exe ./cmd/muyue/
- name: Package archives
if: github.event_name == 'push'
run: |
cd dist
sha256sum * > checksums.txt
tar czf muyue-linux-amd64.tar.gz muyue-linux-amd64
tar czf muyue-linux-arm64.tar.gz muyue-linux-arm64
tar czf muyue-darwin-amd64.tar.gz muyue-darwin-amd64
tar czf muyue-darwin-arm64.tar.gz muyue-darwin-arm64
zip muyue-windows-amd64.zip muyue-windows-amd64.exe
zip muyue-windows-arm64.zip muyue-windows-arm64.exe
rm -f muyue-linux-amd64 muyue-linux-arm64 muyue-darwin-amd64 muyue-darwin-arm64 muyue-windows-amd64.exe muyue-windows-arm64.exe
- name: Delete old release
if: github.event_name == 'push'
env:
GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
run: |
if [ -z "$GITEA_TOKEN" ]; then
echo "Warning: GITEATOKEN not set"
exit 0
fi
API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases"
RESPONSE=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" "${API}" 2>/dev/null || echo "")
if [ -n "$RESPONSE" ]; then
echo "$RESPONSE" | grep -o '"id":[0-9]*' | while read line; do
ID=$(echo "$line" | grep -o '[0-9]*')
curl -s -X DELETE -H "Authorization: token ${GITEA_TOKEN}" "${API}/${ID}" > /dev/null 2>&1 || true
done || true
fi
curl -s -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/tags/latest" > /dev/null 2>&1 || true
- name: Create release
if: github.event_name == 'push'
env:
GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
run: |
if [ -z "$GITEA_TOKEN" ]; then
echo "Error: GITEATOKEN not set"
exit 1
fi
SHORT_SHA=$(git rev-parse --short HEAD)
API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases"
DL_URL="${{ github.server_url }}/${{ github.repository }}/releases/download/latest"
BODY=$(cat <<BODYEOF
## muyue latest (${SHORT_SHA})
| Platform | File |
|----------|------|
| Linux x86_64 | muyue-linux-amd64.tar.gz |
| Linux ARM64 | muyue-linux-arm64.tar.gz |
| macOS Intel | muyue-darwin-amd64.tar.gz |
| macOS Apple Silicon | muyue-darwin-arm64.tar.gz |
| Windows x86_64 | muyue-windows-amd64.zip |
| Windows ARM64 | muyue-windows-arm64.zip |
### Install
**Linux (x86_64)**
\`\`\`bash
curl -sL ${DL_URL}/muyue-linux-amd64.tar.gz | tar xz
chmod +x muyue-linux-amd64
sudo mv muyue-linux-amd64 /usr/local/bin/muyue
\`\`\`
**Linux (ARM64)**
\`\`\`bash
curl -sL ${DL_URL}/muyue-linux-arm64.tar.gz | tar xz
chmod +x muyue-linux-arm64
sudo mv muyue-linux-arm64 /usr/local/bin/muyue
\`\`\`
**macOS (Apple Silicon)**
\`\`\`bash
curl -sL ${DL_URL}/muyue-darwin-arm64.tar.gz | tar xz
chmod +x muyue-darwin-arm64
sudo mv muyue-darwin-arm64 /usr/local/bin/muyue
\`\`\`
**macOS (Intel)**
\`\`\`bash
curl -sL ${DL_URL}/muyue-darwin-amd64.tar.gz | tar xz
chmod +x muyue-darwin-amd64
sudo mv muyue-darwin-amd64 /usr/local/bin/muyue
\`\`\`
**Windows (x86_64)**
\`\`\`powershell
Invoke-WebRequest -Uri "${DL_URL}/muyue-windows-amd64.zip" -OutFile "muyue.zip"
Expand-Archive -Path "muyue.zip" -DestinationPath "."
Move-Item muyue-windows-amd64.exe C:\Windows\muyue.exe
\`\`\`
**Windows (ARM64)**
\`\`\`powershell
Invoke-WebRequest -Uri "${DL_URL}/muyue-windows-arm64.zip" -OutFile "muyue.zip"
Expand-Archive -Path "muyue.zip" -DestinationPath "."
Move-Item muyue-windows-arm64.exe C:\Windows\muyue.exe
\`\`\`
BODYEOF
)
RESPONSE=$(curl -s -X POST "${API}" \
-H "Authorization: token ${GITEA_TOKEN}" \
-H "Content-Type: application/json" \
-d "{\"tag_name\":\"latest\",\"target_commitish\":\"main\",\"name\":\"muyue latest (${SHORT_SHA})\",\"body\":$(echo "$BODY" | jq -Rs .),\"draft\":false,\"prerelease\":false}")
RELEASE_ID=$(echo "$RESPONSE" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
if [ -z "$RELEASE_ID" ]; then
echo "Failed to create release:"
echo "$RESPONSE"
exit 1
fi
echo "Release ID: ${RELEASE_ID}"
UPLOAD_URL="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets"
for file in dist/*.tar.gz dist/*.zip dist/checksums.txt; do
filename=$(basename "$file")
echo "Uploading ${filename}..."
curl -s -X POST "${UPLOAD_URL}" \
-H "Authorization: token ${GITEA_TOKEN}" \
-F "attachment=@${file};filename=${filename}" > /dev/null
done
echo "Release published!"