Merge remote-tracking branch 'wavelet/feat/cordis-alignment' into cordis

# Conflicts: # .agents/skills/cache-framework/SKILL.md # .agents/skills/clickhouse-batchwriter/SKILL.md # .agents/skills/database-migration/SKILL.md # .agents/skills/file-upload/SKILL.md # .agents/skills/logstore/SKILL.md # .agents/skills/new-api/SKILL.md # .agents/skills/new-api/references/handler_example.go # .agents/skills/new-api/references/logics_example.go # .agents/skills/new-api/references/service_example.go # .agents/skills/new-async-task/SKILL.md # .agents/skills/new-async-task/references/CODE-EXAMPLES.md # .agents/skills/new-setting/SKILL.md # .agents/skills/push-notification/SKILL.md # .agents/skills/release-guide/SKILL.md # .auto/checks.sh # .auto/ideas.md # .auto/log.jsonl # .auto/measure.sh # .auto/prompt.md # .dockerignore # .env.example # .github/copilot-instructions.md # .github/workflows/build-release.yml # .gitignore # .golangci.yml # AGENTS.md # Makefile # README.md # backend/cmd/app.go # backend/cmd/app_test.go # backend/cmd/banner.go # backend/cmd/banner_test.go # backend/docs/docs.go # backend/docs/swagger.json # backend/docs/swagger.yaml # backend/go.mod # backend/go.sum # backend/main.go # config.example.yaml # docker/Dockerfile # docker/Dockerfile.backend # docker/Dockerfile.cross # scripts/swagger.sh # scripts/update_go_license.sh
2026-10-01 06:36:38 +08:00 · 2026-08-30 14:30:56 +08:00
parent 4fb47e65f4 56c650c5b5
commit c68038ad06
48 changed files with 11116 additions and 0 deletions
@@ -0,0 +1,270 @@
+name: Build Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image version/tag to publish (e.g. v1.0.0-beta). Leave empty to publish as canary."
+        required: false
+        type: string
+  push:
+    tags: ["v*"]
+    branches: ["canary"]
+
+# One active run per ref (e.g. canary); newer runs cancel older in-progress builds.
+concurrency:
+  group: build-image-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+  id-token: write
+
+env:
+  IMAGE_NAME: wavelet
+  DOCKERFILE: docker/Dockerfile
+
+jobs:
+  # Resolve version / registries once. No checkout: triggers alone determine the tag.
+  prepare:
+    name: Prepare metadata
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.prep.outputs.version }}
+      build_date: ${{ steps.prep.outputs.build_date }}
+      image: ${{ steps.prep.outputs.image }}
+      image_names: ${{ steps.prep.outputs.image_names }}
+      images: ${{ steps.prep.outputs.images }}
+      push_dockerhub: ${{ steps.prep.outputs.push_dockerhub }}
+      is_stable: ${{ steps.prep.outputs.is_stable }}
+      is_prerelease: ${{ steps.prep.outputs.is_prerelease }}
+    steps:
+      - name: Resolve version and images
+        id: prep
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          DOCKERHUB_NAMESPACE: ${{ secrets.DOCKERHUB_NAMESPACE }}
+        run: |
+          set -euo pipefail
+          INPUT_VERSION="${INPUT_VERSION//[[:space:]]/}"
+          OWNER="${GITHUB_REPOSITORY_OWNER,,}"
+          BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+
+          if [[ "${GITHUB_REF}" == refs/heads/canary ]]; then
+            VERSION="canary"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME}"
+          elif [[ -n "$INPUT_VERSION" ]]; then
+            VERSION="$INPUT_VERSION"
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            VERSION="canary"
+          else
+            echo "unable to determine image version/tag" >&2
+            exit 1
+          fi
+
+          if [[ "$VERSION" == "canary" ]]; then
+            IS_STABLE="false"
+            IS_PRERELEASE="false"
+          elif [[ "$VERSION" =~ (alpha|beta|rc) ]]; then
+            IS_STABLE="false"
+            IS_PRERELEASE="true"
+          else
+            IS_STABLE="true"
+            IS_PRERELEASE="false"
+          fi
+
+          IMAGE="ghcr.io/${OWNER}/${IMAGE_NAME}"
+          IMAGE_NAMES="${IMAGE}"
+          # Newline-separated list for docker/metadata-action
+          IMAGES="${IMAGE}"
+
+          DOCKERHUB_USERNAME="${DOCKERHUB_USERNAME//[[:space:]]/}"
+          DOCKERHUB_TOKEN="${DOCKERHUB_TOKEN//[[:space:]]/}"
+          DOCKERHUB_NAMESPACE="${DOCKERHUB_NAMESPACE//[[:space:]]/}"
+          PUSH_DOCKERHUB="false"
+          if [[ -n "$DOCKERHUB_USERNAME" && -n "$DOCKERHUB_TOKEN" ]]; then
+            HUB_NS="${DOCKERHUB_NAMESPACE:-$DOCKERHUB_USERNAME}"
+            HUB_NS="${HUB_NS,,}"
+            IMAGE_DOCKERHUB="${HUB_NS}/${IMAGE_NAME}"
+            IMAGE_NAMES="${IMAGE_NAMES},${IMAGE_DOCKERHUB}"
+            IMAGES="${IMAGES}"$'\n'"${IMAGE_DOCKERHUB}"
+            PUSH_DOCKERHUB="true"
+            echo "Docker Hub publish enabled: ${IMAGE_DOCKERHUB}"
+          else
+            echo "Docker Hub secrets not set; publishing to GHCR only."
+          fi
+
+          {
+            echo "version=${VERSION}"
+            echo "build_date=${BUILD_DATE}"
+            echo "image=${IMAGE}"
+            echo "image_names=${IMAGE_NAMES}"
+            echo "push_dockerhub=${PUSH_DOCKERHUB}"
+            echo "is_stable=${IS_STABLE}"
+            echo "is_prerelease=${IS_PRERELEASE}"
+            echo "images<<EOF"
+            printf '%s\n' "${IMAGES}"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+          echo "Resolved version=${VERSION} build_date=${BUILD_DATE} stable=${IS_STABLE} prerelease=${IS_PRERELEASE}"
+
+  build:
+    name: Build (${{ matrix.arch }})
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            platform: linux/arm64
+            # No ubuntu-latest-arm alias from GitHub; 24.04-arm is the current stable arm64 image.
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log into GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log into Docker Hub
+        if: needs.prepare.outputs.push_dockerhub == 'true'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ${{ env.DOCKERFILE }}
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,"name=${{ needs.prepare.outputs.image_names }}",push-by-digest=true,name-canonical=true,push=true
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            BUILD_DATE=${{ needs.prepare.outputs.build_date }}
+          cache-from: type=gha,scope=docker-${{ env.IMAGE_NAME }}-${{ matrix.arch }}
+          cache-to: type=gha,mode=max,ignore-error=true,timeout=20m,scope=docker-${{ env.IMAGE_NAME }}-${{ matrix.arch }}
+
+      - name: Export digest
+        shell: bash
+        run: |
+          mkdir -p "/tmp/${{ env.IMAGE_NAME }}-digests"
+          touch "/tmp/${{ env.IMAGE_NAME }}-digests/${DIGEST#sha256:}"
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.IMAGE_NAME }}-digests-${{ matrix.arch }}
+          path: /tmp/${{ env.IMAGE_NAME }}-digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ needs.prepare.outputs.image }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+
+  merge:
+    name: Merge multi-arch manifest
+    runs-on: ubuntu-latest
+    needs: [prepare, build]
+    steps:
+      # No repo checkout: tags come from prepare + metadata-action.
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ needs.prepare.outputs.images }}
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=${{ needs.prepare.outputs.version }}
+            type=raw,value=latest,enable=${{ needs.prepare.outputs.is_stable == 'true' }}
+            type=raw,value=beta,enable=${{ needs.prepare.outputs.is_prerelease == 'true' }}
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/${{ env.IMAGE_NAME }}-digests
+          pattern: ${{ env.IMAGE_NAME }}-digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log into GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log into Docker Hub
+        if: needs.prepare.outputs.push_dockerhub == 'true'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Create and push manifest list
+        working-directory: /tmp/${{ env.IMAGE_NAME }}-digests
+        shell: bash
+        env:
+          IMAGE: ${{ needs.prepare.outputs.image }}
+          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          references=()
+          for digest in *; do
+            references+=("${IMAGE}@sha256:${digest}")
+          done
+
+          if [ ${#references[@]} -eq 0 ]; then
+            echo "No digests found in /tmp/${{ env.IMAGE_NAME }}-digests" >&2
+            exit 1
+          fi
+
+          # shellcheck disable=SC2046
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            "${references[@]}"
+
+      - name: Inspect image
+        run: docker buildx imagetools inspect "${{ needs.prepare.outputs.image }}:${{ needs.prepare.outputs.version }}"
+
+      - name: Trigger webhook
+        env:
+          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
+        run: |
+          if [ -n "$WEBHOOK_URL" ]; then
+            curl -fsSL "$WEBHOOK_URL"
+          else
+            echo "Webhook URL is not set, skipping."
+          fi