From a347c3360856f4204c567440c77a4477052783b4 Mon Sep 17 00:00:00 2001 From: ryan Date: Sun, 30 Aug 2026 15:00:44 +0800 Subject: [PATCH] chore(cordis): persist merge.ours and isolate wavelet extras Add a repo .gitconfig so merge=ours in .gitattributes can actually run. Disable the Wavelet canary image workflow and keep docker-compose.yaml as the OpenFlare default so a merge cannot ship the wrong product. --- .gitattributes | 3 + .gitconfig | 10 ++ .github/workflows/build-image.yml | 274 ++---------------------------- CONTRIBUTING.md | 10 ++ README.md | 12 ++ README.zh-CN.md | 12 ++ backend/OpenFlare/README.md | 3 + docker-compose.wavelet.yml | 2 + docker-compose.yaml | 2 + docker-compose.yml | 6 + docs/changelog/index.md | 1 + 11 files changed, 74 insertions(+), 261 deletions(-) create mode 100644 .gitconfig create mode 100644 docker-compose.yml diff --git a/.gitattributes b/.gitattributes index ae85146a..2e55f92b 100644 --- a/.gitattributes +++ b/.gitattributes @@ -3,3 +3,6 @@ backend/OpenFlare/** merge=ours frontend/** merge=ours docs/changelog/** merge=ours docs/superpowers/** merge=ours +.github/workflows/build-image.yml merge=ours +docker-compose.yml merge=ours +.gitconfig merge=ours diff --git a/.gitconfig b/.gitconfig new file mode 100644 index 00000000..b5d615c3 --- /dev/null +++ b/.gitconfig @@ -0,0 +1,10 @@ +# Repo-local Git settings. Git does not load this file automatically. +# From the clone (or worktree) root: +# git config include.path ../.gitconfig +# Worktree-safe: +# git config include.path "$(git rev-parse --show-toplevel)/.gitconfig" +# Relative include.path is resolved against .git/config, so ../.gitconfig +# is the repo root when .git is a directory (non-worktree clone). + +[merge "ours"] + driver = true diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index 16adf69d..eb118760 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -1,270 +1,22 @@ -name: Build Image +name: Build Image (Wavelet upstream — isolated) +# Isolated: OpenFlare publishes images via build-image-openflare.yml +# (IMAGE_NAME: openflare). This Wavelet workflow is kept under the same +# path so `git merge wavelet/main` cannot restore a canary wavelet image. on: workflow_dispatch: inputs: - version: - description: "Image version/tag to publish (e.g. v1.0.0-beta). Leave empty to publish as canary." - required: false - type: string - push: - tags: ["v*"] - branches: ["canary"] - -# One active run per ref (e.g. canary); newer runs cancel older in-progress builds. -concurrency: - group: build-image-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - packages: write - attestations: write - id-token: write - -env: - IMAGE_NAME: wavelet - DOCKERFILE: docker/Dockerfile + confirm: + description: "Disabled on OpenFlare. Use build-image-openflare.yml." + required: true jobs: - # Resolve version / registries once. No checkout: triggers alone determine the tag. - prepare: - name: Prepare metadata + isolated: + name: Isolated runs-on: ubuntu-latest - outputs: - version: ${{ steps.prep.outputs.version }} - build_date: ${{ steps.prep.outputs.build_date }} - image: ${{ steps.prep.outputs.image }} - image_names: ${{ steps.prep.outputs.image_names }} - images: ${{ steps.prep.outputs.images }} - push_dockerhub: ${{ steps.prep.outputs.push_dockerhub }} - is_stable: ${{ steps.prep.outputs.is_stable }} - is_prerelease: ${{ steps.prep.outputs.is_prerelease }} steps: - - name: Resolve version and images - id: prep - env: - INPUT_VERSION: ${{ github.event.inputs.version }} - DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} - DOCKERHUB_NAMESPACE: ${{ secrets.DOCKERHUB_NAMESPACE }} + - name: Refuse Wavelet image publish run: | - set -euo pipefail - INPUT_VERSION="${INPUT_VERSION//[[:space:]]/}" - OWNER="${GITHUB_REPOSITORY_OWNER,,}" - BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')" - - if [[ "${GITHUB_REF}" == refs/heads/canary ]]; then - VERSION="canary" - elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then - VERSION="${GITHUB_REF_NAME}" - elif [[ -n "$INPUT_VERSION" ]]; then - VERSION="$INPUT_VERSION" - elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then - VERSION="canary" - else - echo "unable to determine image version/tag" >&2 - exit 1 - fi - - if [[ "$VERSION" == "canary" ]]; then - IS_STABLE="false" - IS_PRERELEASE="false" - elif [[ "$VERSION" =~ (alpha|beta|rc) ]]; then - IS_STABLE="false" - IS_PRERELEASE="true" - else - IS_STABLE="true" - IS_PRERELEASE="false" - fi - - IMAGE="ghcr.io/${OWNER}/${IMAGE_NAME}" - IMAGE_NAMES="${IMAGE}" - # Newline-separated list for docker/metadata-action - IMAGES="${IMAGE}" - - DOCKERHUB_USERNAME="${DOCKERHUB_USERNAME//[[:space:]]/}" - DOCKERHUB_TOKEN="${DOCKERHUB_TOKEN//[[:space:]]/}" - DOCKERHUB_NAMESPACE="${DOCKERHUB_NAMESPACE//[[:space:]]/}" - PUSH_DOCKERHUB="false" - if [[ -n "$DOCKERHUB_USERNAME" && -n "$DOCKERHUB_TOKEN" ]]; then - HUB_NS="${DOCKERHUB_NAMESPACE:-$DOCKERHUB_USERNAME}" - HUB_NS="${HUB_NS,,}" - IMAGE_DOCKERHUB="${HUB_NS}/${IMAGE_NAME}" - IMAGE_NAMES="${IMAGE_NAMES},${IMAGE_DOCKERHUB}" - IMAGES="${IMAGES}"$'\n'"${IMAGE_DOCKERHUB}" - PUSH_DOCKERHUB="true" - echo "Docker Hub publish enabled: ${IMAGE_DOCKERHUB}" - else - echo "Docker Hub secrets not set; publishing to GHCR only." - fi - - { - echo "version=${VERSION}" - echo "build_date=${BUILD_DATE}" - echo "image=${IMAGE}" - echo "image_names=${IMAGE_NAMES}" - echo "push_dockerhub=${PUSH_DOCKERHUB}" - echo "is_stable=${IS_STABLE}" - echo "is_prerelease=${IS_PRERELEASE}" - echo "images<> "$GITHUB_OUTPUT" - - echo "Resolved version=${VERSION} build_date=${BUILD_DATE} stable=${IS_STABLE} prerelease=${IS_PRERELEASE}" - - build: - name: Build (${{ matrix.arch }}) - needs: prepare - strategy: - fail-fast: false - matrix: - include: - - arch: amd64 - platform: linux/amd64 - runner: ubuntu-latest - - arch: arm64 - platform: linux/arm64 - # No ubuntu-latest-arm alias from GitHub; 24.04-arm is the current stable arm64 image. - runner: ubuntu-24.04-arm - runs-on: ${{ matrix.runner }} - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - fetch-depth: 1 - persist-credentials: false - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - - name: Log into GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Log into Docker Hub - if: needs.prepare.outputs.push_dockerhub == 'true' - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Build and push - id: build - uses: docker/build-push-action@v7 - with: - context: . - file: ${{ env.DOCKERFILE }} - platforms: ${{ matrix.platform }} - outputs: type=image,"name=${{ needs.prepare.outputs.image_names }}",push-by-digest=true,name-canonical=true,push=true - build-args: | - VERSION=${{ needs.prepare.outputs.version }} - BUILD_DATE=${{ needs.prepare.outputs.build_date }} - cache-from: type=gha,scope=docker-${{ env.IMAGE_NAME }}-${{ matrix.arch }} - cache-to: type=gha,mode=max,ignore-error=true,timeout=20m,scope=docker-${{ env.IMAGE_NAME }}-${{ matrix.arch }} - - - name: Export digest - shell: bash - run: | - mkdir -p "/tmp/${{ env.IMAGE_NAME }}-digests" - touch "/tmp/${{ env.IMAGE_NAME }}-digests/${DIGEST#sha256:}" - env: - DIGEST: ${{ steps.build.outputs.digest }} - - - name: Upload digest - uses: actions/upload-artifact@v4 - with: - name: ${{ env.IMAGE_NAME }}-digests-${{ matrix.arch }} - path: /tmp/${{ env.IMAGE_NAME }}-digests/* - if-no-files-found: error - retention-days: 1 - - - name: Generate artifact attestation - uses: actions/attest-build-provenance@v3 - with: - subject-name: ${{ needs.prepare.outputs.image }} - subject-digest: ${{ steps.build.outputs.digest }} - push-to-registry: true - - merge: - name: Merge multi-arch manifest - runs-on: ubuntu-latest - needs: [prepare, build] - steps: - # No repo checkout: tags come from prepare + metadata-action. - - name: Docker meta - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ needs.prepare.outputs.images }} - flavor: | - latest=false - tags: | - type=raw,value=${{ needs.prepare.outputs.version }} - type=raw,value=latest,enable=${{ needs.prepare.outputs.is_stable == 'true' }} - type=raw,value=beta,enable=${{ needs.prepare.outputs.is_prerelease == 'true' }} - - - name: Download digests - uses: actions/download-artifact@v4 - with: - path: /tmp/${{ env.IMAGE_NAME }}-digests - pattern: ${{ env.IMAGE_NAME }}-digests-* - merge-multiple: true - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - - name: Log into GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Log into Docker Hub - if: needs.prepare.outputs.push_dockerhub == 'true' - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Create and push manifest list - working-directory: /tmp/${{ env.IMAGE_NAME }}-digests - shell: bash - env: - IMAGE: ${{ needs.prepare.outputs.image }} - DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }} - run: | - set -euo pipefail - shopt -s nullglob - references=() - for digest in *; do - references+=("${IMAGE}@sha256:${digest}") - done - - if [ ${#references[@]} -eq 0 ]; then - echo "No digests found in /tmp/${{ env.IMAGE_NAME }}-digests" >&2 - exit 1 - fi - - # shellcheck disable=SC2046 - docker buildx imagetools create \ - $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ - "${references[@]}" - - - name: Inspect image - run: docker buildx imagetools inspect "${{ needs.prepare.outputs.image }}:${{ needs.prepare.outputs.version }}" - - - name: Trigger webhook - env: - WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }} - run: | - if [ -n "$WEBHOOK_URL" ]; then - curl -fsSL "$WEBHOOK_URL" - else - echo "Webhook URL is not set, skipping." - fi + echo "This Wavelet image workflow is isolated on OpenFlare." + echo "Use .github/workflows/build-image-openflare.yml" + exit 1 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index edcb6683..8eeec7c8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,6 +20,16 @@ 为提高协作效率，我们建议您在提交 PR 前，先通过 Issue 简要说明动机与背景。 +## 合并上游 + +`.gitattributes` 对 `backend/OpenFlare/`、`frontend/` 等路径使用 `merge=ours`。该驱动不会自动生效，请在仓库根目录执行一次： + +```bash +git config include.path ../.gitconfig +# worktree 安全写法： +git config include.path "$(git rev-parse --show-toplevel)/.gitconfig" +``` + ## 贡献步骤 1. **Fork 本仓库** 并创建您的分支（建议使用有意义的分支名）。 diff --git a/README.md b/README.md index 1647adcf..f540b77c 100644 --- a/README.md +++ b/README.md @@ -165,6 +165,18 @@ docker run -d --name openflare-agent --restart unless-stopped \ ghcr.io/rain-kl/openflare-agent:latest ``` +## Cordis / Wavelet upstream + +OpenFlare is built on Wavelet Cordis. After cloning, enable `merge=ours` from `.gitattributes` so `git merge wavelet/main` keeps OpenFlare-owned paths: + +```bash +git config include.path ../.gitconfig +# worktree-safe: +git config include.path "$(git rev-parse --show-toplevel)/.gitconfig" +``` + +`docker compose` uses `docker-compose.yaml`. `docker-compose.wavelet.yml` is the upstream Wavelet stack and is not the product default. Image publishes go through `.github/workflows/build-image-openflare*.yml`; the Wavelet `build-image.yml` is isolated. + ## Open Source License This project is licensed under the [Apache License 2.0](./LICENSE). diff --git a/README.zh-CN.md b/README.zh-CN.md index 365dca96..d9207664 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -165,6 +165,18 @@ docker run -d --name openflare-agent --restart unless-stopped \ ghcr.io/rain-kl/openflare-agent:latest ``` +## Cordis / Wavelet 上游 + +OpenFlare 构建在 Wavelet Cordis 之上。克隆后请启用 `.gitattributes` 中的 `merge=ours`，这样 `git merge wavelet/main` 会保留 OpenFlare 自有路径： + +```bash +git config include.path ../.gitconfig +# worktree 安全写法： +git config include.path "$(git rev-parse --show-toplevel)/.gitconfig" +``` + +`docker compose` 使用 `docker-compose.yaml`。`docker-compose.wavelet.yml` 是上游 Wavelet 编排，不是本产品的默认栈。镜像发布走 `.github/workflows/build-image-openflare*.yml`；Wavelet 的 `build-image.yml` 已隔离。 + ## 开源协议 本项目采用 [Apache License 2.0](./LICENSE) 开源。 diff --git a/backend/OpenFlare/README.md b/backend/OpenFlare/README.md index 28e046ec..80f13be5 100644 --- a/backend/OpenFlare/README.md +++ b/backend/OpenFlare/README.md @@ -5,6 +5,9 @@ （`backend/{core,pkg,plugins}`）通过 `git fetch wavelet && git merge wavelet/main` 吸收（第一次接线已 merge `wavelet/feat/cordis-alignment`，待该分支合入上游 main 后改走 `wavelet/main`）。本目录、`frontend/` 与 `backend/cmd` 由本仓库持有。 +合并前请 `git config include.path ../.gitconfig`（或 worktree 安全写法 +`git config include.path "$(git rev-parse --show-toplevel)/.gitconfig"`）， +以启用 `.gitattributes` 的 `merge=ours`。 ``` backend/OpenFlare/ diff --git a/docker-compose.wavelet.yml b/docker-compose.wavelet.yml index fae282c5..9d4adf58 100644 --- a/docker-compose.wavelet.yml +++ b/docker-compose.wavelet.yml @@ -1,3 +1,5 @@ +# Upstream Wavelet stack. Not the OpenFlare default. +# Use docker-compose.yaml (or `docker compose up`) for the product. services: wavelet: build: diff --git a/docker-compose.yaml b/docker-compose.yaml index 59c1fcc1..88a7300e 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -1,3 +1,5 @@ +# OpenFlare default compose file (`docker compose` / `docker-compose.yaml`). +# The Wavelet upstream stack is in docker-compose.wavelet.yml and is not used here. services: openflare: build: diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 00000000..c1c322e4 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,6 @@ +# Isolated Wavelet compose filename. +# OpenFlare's default stack is docker-compose.yaml (`docker compose` prefers +# that name over this one). This stub is kept so `git merge wavelet/main` +# cannot restore a wavelet product stack under the default compose name. +include: + - path: docker-compose.yaml diff --git a/docs/changelog/index.md b/docs/changelog/index.md index feac0144..eb63027b 100644 --- a/docs/changelog/index.md +++ b/docs/changelog/index.md @@ -12,6 +12,7 @@ sidebar: false ### 💄 其他/体验 +- 内嵌前端拷贝目标改为 `backend/plugins/drivers/driver_http/dist`，与上游 `//go:embed all:dist` 对齐；发布工作流改为读取 `backend/go.mod`。仓库内 `.gitconfig` 提供 `merge.ours` 驱动，合并上游时保留 OpenFlare 自有路径；Wavelet 的 `build-image.yml` 与 `docker-compose.yml` 已隔离，避免 canary 发布成 wavelet 镜像。 - 后端代码整体迁入 `backend/`，与上游 Wavelet 的仓库布局对齐（Cordis 插件化改造第一阶段），模块名保持 `Wavelet` 以保证上游包路径逐字一致。构建、测试、镜像与发布链路已同步调整，`make build-all` / `make dev` / `make swagger` 等本地命令用法不变；HTTP 接口与控制台行为均无变化。 - 引入上游 Cordis 微内核与平台插件到 `backend/{core,pkg,plugins}`（与上游逐字一致，可用 `scripts/sync-upstream.sh` 重复同步），并新增 `backend/OpenFlare/share/` 承载多插件共享资源（控制消息协议、GeoIP、边缘日志）。此阶段仅落位结构与共享层，尚未改变运行时行为。 - 下游代码按功能职责拆为 `server`/`agent`/`relay`/`flared` 四个插件与 `backend/OpenFlare/share` 共享层；三个边缘守护进程改由 Cordis 内核装配启动（profile `agent`/`relay`/`flared`），`-config` 旗标、默认配置路径、退出码与启动日志保持原样。