feat: detect and reconcile docs created outside the API

.github/release.yml

@@ -0,0 +1,27 @@
+changelog:
+  template: |
+    ## Downloads
+    - **macOS**: Download `.dmg` and double-click to install.
+    - **Windows**: Download `.msi` or `.exe`.
+
+    ## 更新日志
+    $CHANGES
+
+    ## Contributors
+    $CONTRIBUTORS
+  categories:
+    - title: Features
+      labels:
+        - feature
+        - enhancement
+    - title: Bug Fixes
+      labels:
+        - bug
+        - fix
+    - title: Documentation
+      labels:
+        - docs
+        - documentation
+    - title: Other Changes
+      labels:
+        - "*"

.github/workflows/ci.yml

@@ -43,7 +43,10 @@ jobs:
           cd crates/opencontext-node
           npm ci
           npm run build:debug
-
+
+      - name: Use local native build for tests
+        run: npm uninstall @aicontextlab/core-native
+
       - name: Run JS tests
         run: npm test
 

.github/workflows/cli-smoke.yml

@@ -0,0 +1,28 @@
+name: CLI smoke test (no publish)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  linux-cli-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Install CLI from repo (no publish)
+        run: npm install -g .
+
+      - name: CLI help
+        run: oc --help
+
+      - name: CLI init (expected to pass; if it fails, we capture logs)
+        run: oc init

.github/workflows/desktop-build.yml

@@ -37,21 +37,29 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Version: $VERSION"
 
+      - name: Ensure tag exists (workflow_dispatch)
+        if: github.event_name == 'workflow_dispatch' && !startsWith(github.ref, 'refs/tags/desktop-v')
+        run: |
+          if [ "${{ steps.get_version.outputs.version }}" = "0.0.0-dev" ]; then
+            echo "Missing version for workflow_dispatch. Provide an input version." >&2
+            exit 1
+          fi
+          TAG="desktop-v${{ steps.get_version.outputs.version }}"
+          git fetch --tags
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists."
+            exit 0
+          fi
+          git tag "$TAG"
+          git push origin "$TAG"
+
       - name: Create Release
         id: create_release
         uses: softprops/action-gh-release@v1
         with:
           tag_name: desktop-v${{ steps.get_version.outputs.version }}
           name: OpenContext Desktop v${{ steps.get_version.outputs.version }}
-          body: |
-            ## OpenContext Desktop v${{ steps.get_version.outputs.version }}
-
-            ### 下载
-            - **macOS**: 下载 `.dmg` 文件，双击安装
-            - **Windows**: 下载 `.msi` 或 `.exe` 文件安装
-
-            ### 更新日志
-            请查看 [CHANGELOG](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md)
+          generate_release_notes: true
           draft: true
           prerelease: false
 
@@ -67,6 +75,9 @@ jobs:
           - platform: windows-latest
             target: x86_64-pc-windows-msvc
             artifact_name: windows
+          - platform: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            artifact_name: linux
 
     runs-on: ${{ matrix.platform }}
 
@@ -97,8 +108,49 @@ jobs:
         if: matrix.platform == 'windows-latest'
         run: choco install protoc -y
 
+      - name: Install Linux dependencies
+        if: matrix.platform == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            protobuf-compiler
+
       - name: Install npm dependencies
-        run: npm ci
+        run: npm ci --include=optional
+
+      - name: Import Apple signing certificate
+        if: matrix.platform == 'macos-latest'
+        env:
+          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          CERT_PATH="$RUNNER_TEMP/apple_cert.p12"
+          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
+          echo "$APPLE_CERTIFICATE_P12" | base64 -D > "$CERT_PATH"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychains -d user -s "$KEYCHAIN_PATH"
+          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> $GITHUB_ENV
+
+      - name: Resolve signing identity
+        if: matrix.platform == 'macos-latest'
+        run: |
+          SIGNING_IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | awk -F\" '/Developer ID Application/ {print $2; exit}')
+          if [ -z "$SIGNING_IDENTITY" ]; then
+            echo "No Developer ID Application identity found in keychain." >&2
+            security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true
+            exit 1
+          fi
+          echo "APPLE_SIGNING_IDENTITY=$SIGNING_IDENTITY" >> $GITHUB_ENV
 
       - name: Update version in tauri.conf.json
         run: |
@@ -111,17 +163,69 @@ jobs:
 
       - name: Build Tauri app (macOS)
         if: matrix.platform == 'macos-latest'
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
         run: npm run tauri build -- --target universal-apple-darwin
 
+      - name: Notarize and staple DMG (macOS)
+        if: matrix.platform == 'macos-latest'
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          DMG_PATH=$(ls src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg | head -n 1)
+          if [ -z "$DMG_PATH" ]; then
+            echo "No DMG found to notarize." >&2
+            exit 1
+          fi
+          xcrun notarytool submit "$DMG_PATH" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" --wait
+          xcrun stapler staple "$DMG_PATH"
+
+      - name: Verify notarized DMG (macOS)
+        if: matrix.platform == 'macos-latest'
+        run: |
+          DMG_PATH=$(ls src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg | head -n 1)
+          if [ -z "$DMG_PATH" ]; then
+            echo "No DMG found to verify." >&2
+            exit 1
+          fi
+          xcrun stapler validate "$DMG_PATH"
+          MOUNT_DIR=$(mktemp -d)
+          cleanup() {
+            if mount | grep -q "$MOUNT_DIR"; then
+              hdiutil detach "$MOUNT_DIR" -quiet || true
+            fi
+            rm -rf "$MOUNT_DIR"
+          }
+          trap cleanup EXIT
+          hdiutil attach "$DMG_PATH" -nobrowse -quiet -mountpoint "$MOUNT_DIR"
+          APP_PATH=$(find "$MOUNT_DIR" -maxdepth 1 -type d -name "*.app" | head -n 1)
+          if [ -z "$APP_PATH" ]; then
+            echo "No .app found inside DMG." >&2
+            exit 1
+          fi
+          spctl -a -vv --type execute "$APP_PATH"
+
       - name: Build Tauri app (Windows)
         if: matrix.platform == 'windows-latest'
         run: npm run tauri build
 
+      - name: Build Tauri app (Linux)
+        if: matrix.platform == 'ubuntu-22.04'
+        run: npm run tauri build -- --bundles appimage
+
       - name: Upload to Release (macOS)
         if: matrix.platform == 'macos-latest'
         uses: softprops/action-gh-release@v1
         with:
           tag_name: desktop-v${{ needs.create-release.outputs.version }}
+          name: OpenContext Desktop v${{ needs.create-release.outputs.version }}
+          generate_release_notes: true
+          draft: true
           files: |
             src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg
 
@@ -130,10 +234,22 @@ jobs:
         uses: softprops/action-gh-release@v1
         with:
           tag_name: desktop-v${{ needs.create-release.outputs.version }}
+          name: OpenContext Desktop v${{ needs.create-release.outputs.version }}
+          generate_release_notes: true
+          draft: true
           files: |
             src-tauri/target/release/bundle/msi/*.msi
             src-tauri/target/release/bundle/nsis/*.exe
 
+      - name: Upload to Release (Linux)
+        if: matrix.platform == 'ubuntu-22.04'
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: desktop-v${{ needs.create-release.outputs.version }}
+          draft: true
+          files: |
+            src-tauri/target/release/bundle/appimage/*.AppImage
+
   publish-release:
     needs: [create-release, build]
     runs-on: ubuntu-latest
@@ -142,4 +258,6 @@ jobs:
         uses: softprops/action-gh-release@v1
         with:
           tag_name: desktop-v${{ needs.create-release.outputs.version }}
+          name: OpenContext Desktop v${{ needs.create-release.outputs.version }}
+          generate_release_notes: true
           draft: false