chore(deps): bump actions/attest-build-provenance from 2 to 4 - #22
Open
dependabot[bot] wants to merge 88 commits into
Open
chore(deps): bump actions/attest-build-provenance from 2 to 4#22dependabot[bot] wants to merge 88 commits into
dependabot[bot] wants to merge 88 commits into
Conversation
Added the GNU General Public License version 3 to the project.
Add a frontend MDX engine that renders documentation with the full
Mintlify component set (callouts, Card/CardGroup/Columns, Tabs, Steps,
Accordion/Expandable, CodeGroup, Frame, Tooltip, Badge, fields, Tree,
Mermaid, ...). Markdown entries are compiled at request time via
next-mdx-remote/rsc with a matching component library and theme-aware
styles.
Plumb raw markdown end-to-end as `content_md`:
docsctl DocumentRecord -> documents.jsonl -> deploy -> store.Page ->
getPage -> doc page, which renders it through the MDX engine (falling
back to content_html/content_text). Embedded seed docs showcase every
component.
Note: next-mdx-remote v6 defaults blockJS:true, which strips JSX
expression props (cols={3}); the engine sets blockJS:false +
blockDangerousJS:true so Mintlify expression props work while
eval/Function/require/process stay blocked.
Also bundles in-progress admin/UI and infra changes from prior work.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add ?page=&limit=&keyword= server-side pagination to the six admin list
endpoints (users, teams, doc sources, releases, search logs, MCP logs).
Endpoints return a {items,total,page,limit} envelope when paginated and
stay backward-compatible (plain array without ?page=), so dropdowns, the
homepage module list, and user-identity derivation that need full lists
keep working.
Keyword filtering now happens on the backend over the same fields the UI
used to filter client-side (incl. module key/repo and team members).
Frontend: a shared usePaged hook replaces the load-all-then-slice pattern
in all six pages; keyword changes reset to page 1 and refetch.
Also fix backend Dockerfile GOPROXY default to goproxy.cn (matches the
other Dockerfiles) so `go mod download` doesn't hang on slow networks.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Releases, search logs and MCP logs rendered the Pagination component inside the "has rows" branch, so the footer disappeared when a list was empty — making it look like those pages had no pagination, unlike users/teams/modules which always show the bar. Move Pagination outside the empty/loading conditional so the "共 N 条" footer is always present. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…l pagination Address four LLM integration issues across the four supported API formats: - max_tokens: Anthropic no longer hardcodes 1024 (truncated long answers). Add configurable AskMaxTokens (default 4096); applied to Anthropic where it is required, others keep the model default. - temperature: make it consistent — configurable AskTemperature (default 0.2) now sent by all four protocols (chat/responses/anthropic/gemini), not just openai-chat. Nil pointer preserves an explicit 0. - Gemini: pass the API key via the x-goog-api-key header instead of a ?key= query param so it doesn't leak into proxy/gateway logs (both generateContent and the models listing). - Anthropic models listing: follow has_more / last_id pagination so all models are returned, not just the first page. Settings UI gains "最大回复 Tokens" and "采样温度" inputs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Introduce a team-scoped admin tier alongside super admins: Backend (data-layer enforcement): - accessibleCategoryIDs(user): a user's teams (leader or member) → owned categories (Category.ResponsibleTeam) + descendants. Super admin = all. - hasConsoleAccess/isTeamAdmin/requireConsole helpers; store.TeamKeysForUser and AllCategories. - /api/auth/me now returns is_team_admin. - Scope reads by accessible categories: categories tree (?scope=managed), admin module list, releases, search logs (via clicked doc→module), MCP logs (best-effort via input_json doc_id/module_key). These four list endpoints now require console access (previously ungated). - Doc sources must be filed under ≥1 category (create + update reject empty); team admins may only pick categories they own. Root category creation stays super-admin only. Frontend: - Reusable components/ui/user-select.tsx: search + group-by-department multi-select user picker; used in the team edit modal (replaces the per-row inline member add/remove). - Admin menu gated by role: team admins see only 分类管理/文档源管理/ 发布记录/搜索日志/MCP日志; super admins see all 9. Console entry in the user dropdown now shows for team admins too. - Categories page uses the managed (scoped) tree and hides root-category creation for non-super-admins; teams list load is tolerant of 403. - Module form sources categories from the scoped tree and requires one. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ory rows Team edit: leader and members are now both chosen with the reusable user picker, opened from "选择负责人" / "添加成员" buttons in a popup (search icon sits inside the input). Leader is a required single-select (≥1); the team list shows a member count instead of every name. UserSelect gains a `single` mode. Doc source form: framework / mount options split into title + subtitle (subtitle via Combobox hint); the selected chip shows only the title. Aligned the two fields (field-row align-items:start + matching hints). Categories: each row now shows only icon, name and responsible team — dropped the key tag and description for a cleaner tree. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Team.Leader (single) becomes Team.Leaders []string. A team requires at least one leader and may have several; every leader is kept in Members. Leader/membership permission checks, the team keyword filter, seed data, and Create/Update/SetTeamLeader handle the slice. The team edit modal picks leaders with the same multi-select user picker (required ≥1), the list shows all leader badges, and user-identity derivation reads the leader list. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Frontend PostHog init (analytics-init.tsx), pageview/event tracking in analytics.ts, docs/category/admin pages, and user-menu opt-out. - Backend PostHog proxy + capture endpoints (posthog.go), auth config and server wiring; add server security test coverage. - next.config / tsconfig adjustments for the analytics client. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Diagram-as-code via Kroki (kroki.tsx): Pre routes plantuml/graphviz/c4/ ditaa/d2/vega/… fences to a configurable Kroki server (NEXT_PUBLIC_KROKI_URL, default kroki.io). Optional self-hosted `kroki` compose profile. - Math: remark-math + rehype-katex ($..$, $$..$$), katex CSS. - GitHub-style alerts: > [!NOTE|TIP|IMPORTANT|WARNING|CAUTION] → callouts. - Auto table-of-contents: [[toc]] / [toc] → nav of h2–h4 (rehypeToc). - Footnote styling (remark-gfm). Plugins extracted to remark-plugins.ts. - Seed demo doc showcases all of the above. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Next 16 requires React 19; the tree pinned React 18.3.1, which made next-mdx-remote/rsc throw "A React Element from an older version of React was rendered" on every docs page (dev and prod prerender). Bump react, react-dom and @types to ^19; fix useRef() now requiring an initial arg. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a curated, admin-managed plugin registry for the doc engine. Admins toggle/configure built-in capabilities (no third-party code); state is global, super-admin managed, and applied to rendering immediately. Backend: - store/plugins.go: catalog (kroki, mermaid, math, github_alerts, toc, footnotes, snippets, openapi) + per-plugin overrides in Settings; merge, save (filters unknown keys/fields), and effective-config helpers. - GET/PUT /api/admin/plugins (super-admin); effective enabled+config exposed un-gated on /api/config for the renderer. Unit + auth-gate tests. Frontend: - MdxConfigProvider context carries effective config to client MDX components. - mdx-content.tsx conditionally includes math/alerts/toc plugins by config (falls back to all-enabled on fetch failure); Kroki/Mermaid routing and Kroki base_url now honor config. - Admin "插件管理" page + nav entry; getPlugins/savePlugins API client. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds an admin-managed snippet library and global variables. Docs reference
partials as <Snippet name="key"/> and values as {{key}}; both are expanded in
a pre-compile pass before compileMDX, gated by the `snippets` plugin.
Backend:
- store/snippets.go: Snippet + Variables in Settings; SnippetData /
SaveSnippetData (trim, drop blank keys, de-dup last-wins). Unit test.
- GET/PUT /api/admin/snippets (super-admin); read-only /api/docs/snippets
for the renderer.
Frontend:
- snippets.ts expandSnippets: recursive snippet splice (depth-capped) +
variable substitution; wired into mdx-content.tsx.
- <Snippet> fallback renders nothing for unknown names / disabled plugin.
- Admin "复用片段" page + nav entry; getSnippets/saveSnippets/getDocsSnippets.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Closes the last big Mintlify gap, gated by the `openapi` plugin. - <ApiPlayground method url baseUrl headers body>: editable request console with a client-side Send showing status, latency and pretty-printed response. - <RequestExample>/<ResponseExample>: passive Mintlify-compat sample containers. - <OpenApi spec operation>: fetches+caches a JSON OpenAPI spec, renders the operation's summary/parameters/responses and embeds a prefilled playground; spec falls back to the plugin's default_spec_url. (JSON specs; shallow $ref.) - Registered in the component map; seed doc showcases the playground. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lets users install the MCP server without public npm. Backend serves the
zero-dep npx package (mcp/npx) from MCP_DIST_DIR:
- GET /api/mcp/dist (listing), /api/mcp/dist/{file}, and
/api/mcp/dist/modex-docs-mcp.tgz (npm-style tarball built on the fly).
- compose bind-mounts ../mcp/npx → /app/mcp-dist (read-only).
- me/mcp page gains an offline/intranet install card: `npx -y <tarball-url>`
with the user's token prefilled, plus direct file download links.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Admins can import third-party plugins (JSX/React source) from 插件管理; once enabled they render in docs with no rebuild. Imported code runs inside an isolated iframe (sandbox="allow-scripts" WITHOUT allow-same-origin → opaque origin, no access to modex cookies/DOM/session), with React/ReactDOM/Babel self-hosted under /plugin-runtime. Code + props are base64-embedded, so there is no <script> injection surface (security-reviewed). Backend: - store/uploaded_plugins.go: UploadedPlugin model (component/fence kinds) + validated upsert/delete; merged into PluginStates (default disabled) and the shared enable/override path. Unit tests. - POST/DELETE /api/admin/plugins/import (super-admin); GET /api/docs/plugins serves enabled plugins' source to the renderer. Frontend: - components/mdx/sandboxed-plugin.tsx: iframe runtime (Babel-transpiles JSX, renders a Plugin component, auto-resizes via postMessage). - mdx-content.tsx registers component-kind as dynamic MDX tags and passes fence-kind via context; code.tsx routes uploaded fenced languages. - Admin 插件管理: 已导入插件 list (toggle/delete), 导入 modal, 开发方法 guide panel. - Vendored React 18 + ReactDOM + Babel standalone under public/plugin-runtime. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Search hits rendered raw Markdown (**, #, [text](url), code fences, tables) in titles/snippets. Add a display-only plainText() pass so results read as clean prose; keyword scoring and embeddings still use the raw content. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Expose a built-in default RAG system prompt (store.DefaultAskSystemPrompt) via the settings API so the admin UI pre-fills the editor instead of a blank box, and add a "reset to default" action. Empty still falls back to the built-in. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Every setting (source, output, module, version, deploy-url, token, metadata, entry/build overrides) now has a CLI flag, with the matching DOCS_* env var as fallback so existing pipelines keep working. Adds usage/help text. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- DOCS_DEPLOY_MAX_BYTES default raised to 512MB for image-heavy doc sites. - Pass MINIO_ROOT_USER/PASSWORD/BUCKET to the backend so site-file uploads stop failing with Access Denied. - Regroup and trim .env.example comments. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Site-builder docs (VitePress/VuePress/Fumadocs) open full-width; the Modex topbar auto-hides and reveals on top-edge hover (ImmersiveChrome). - Preserve per-page routes as ?p= deep links on ingest so search hits open the matched page instead of the entry root; the viewer maps it to the built file. - Single static-site category redirects to the full-width viewer. - Use the public API base for the embedded iframe (never backend: internal host). - Avoid cloning site files on ingest to cut peak memory and prevent OOM. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Split queries into ASCII and Han runs so mixed input like "EventBus怎么用" matches (whitespace splitting collapsed it to one token that matched nothing). - In hybrid mode, when the embedding provider is mock, rank by keyword only — the pseudo-random vectors otherwise buried strong keyword hits. Explicit semantic mode still uses the vectors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Fall back to CommonMark (format md) + rehype-raw when MDX compile fails, so imported plain Markdown (Pascal braces, <generics>, raw HTML) renders instead of being dumped as raw text or silently dropped. - Restore list markers (global reset stripped list-style) and add blockquote vertical spacing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Right rail shows the current page's own heading tree (本页目录) instead of the module entry list; drop the auto-generated description lead that duplicated garbage at the top of each doc. - A single-doc category redirects to the full doc viewer rather than embedding it in an iframe (which nested a second Modex chrome); guard null modules so a parent category with only sub-categories no longer 500s. - Topbar: wider search box, smaller Ask-AI button, more spacing between items. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bumps node from 20-alpine to 26-alpine. --- updated-dependencies: - dependency-name: node dependency-version: 26-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…6-alpine chore(deps): bump node from 20-alpine to 26-alpine in /frontend
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2 to 4. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@v2...v4) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/attest-build-provenance from 2 to 4.
Release notes
Sourced from actions/attest-build-provenance's releases.
... (truncated)
Commits
0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)a2bbfa2bump actions/attest from 4.0.0 to 4.1.0 (#838)0856891update RELEASE.md docs (#836)e4d4f7cprepare v4 release (#835)02a49bdBump github/codeql-action in the actions-minor group (#824)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)