From cc0c6cd61496d525cd8710601c59d13a1b306219 Mon Sep 17 00:00:00 2001
From: im10furry <xiaoliuwj.china@gmail.com>
Date: Mon, 6 Jul 2026 00:02:20 -0500
Subject: [PATCH] ci: auto-publish releases after CI

---
 .github/workflows/ci.yml        |   3 +
 .github/workflows/release.yml   | 117 +++++++++++++++++++++++++++++---
 internal/bundle/manifest.json   |  10 +--
 internal/bundle/registry.zip    | Bin 720620 -> 720833 bytes
 registry/database/README.md     |   4 ++
 registry/database/src/go/go.mod |   2 +-
 6 files changed, 119 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 55ee651..2889937 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,6 +61,7 @@ jobs:
             middleware
             auth
             crud
+            database
             rbac
             ratelimit
             validation
@@ -100,6 +101,7 @@ jobs:
             middleware
             auth
             crud
+            database
             rbac
             ratelimit
             validation
@@ -147,6 +149,7 @@ jobs:
             middleware
             auth
             crud
+            database
             rbac
             ratelimit
             validation
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 99c0129..9a15542 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,10 @@ on:
   push:
     tags:
       - "v*.*.*"
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+    branches: [master]
   workflow_dispatch:
     inputs:
       tag:
@@ -15,34 +19,45 @@ permissions:
   contents: write
 
 concurrency:
-  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref_name }}
   cancel-in-progress: false
 
 jobs:
   release:
     name: Build and publish release
     runs-on: ubuntu-latest
+    if: github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'master')
     steps:
-      - name: Resolve tag
+      - name: Resolve release source
         id: release
         shell: bash
         run: |
           set -euo pipefail
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             tag="${{ inputs.tag }}"
+            ref="$tag"
+            automatic="false"
+          elif [ "${{ github.event_name }}" = "workflow_run" ]; then
+            tag=""
+            ref="${{ github.event.workflow_run.head_sha }}"
+            automatic="true"
           else
             tag="${{ github.ref_name }}"
+            ref="$tag"
+            automatic="false"
           fi
-          if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if [ -n "$tag" ] && [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "::error::Release tag must match vMAJOR.MINOR.PATCH, got: $tag"
             exit 1
           fi
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+          echo "automatic=$automatic" >> "$GITHUB_OUTPUT"
 
-      - name: Checkout tag
+      - name: Checkout release source
         uses: actions/checkout@v4
         with:
-          ref: ${{ steps.release.outputs.tag }}
+          ref: ${{ steps.release.outputs.ref }}
           fetch-depth: 0
 
       - name: Setup Go
@@ -50,13 +65,59 @@ jobs:
         with:
           go-version: "1.22"
 
+      - name: Resolve automatic tag
+        id: auto
+        if: steps.release.outputs.automatic == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          sha="${{ github.event.workflow_run.head_sha }}"
+          existing="$(git tag --points-at "$sha" --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1 || true)"
+          create_tag="false"
+
+          if [ -n "$existing" ]; then
+            tag="$existing"
+          else
+            latest="$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1 || true)"
+            if [ -z "$latest" ]; then
+              latest="v0.0.0"
+            fi
+
+            version="${latest#v}"
+            IFS=. read -r major minor patch <<< "$version"
+            tag="v${major}.${minor}.$((patch + 1))"
+            create_tag="true"
+          fi
+
+          should_publish="true"
+          if gh release view "$tag" >/dev/null 2>&1; then
+            should_publish="false"
+          fi
+
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "create_tag=$create_tag" >> "$GITHUB_OUTPUT"
+          echo "should_publish=$should_publish" >> "$GITHUB_OUTPUT"
+
+      - name: Create automatic tag
+        if: steps.release.outputs.automatic == 'true' && steps.auto.outputs.create_tag == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="${{ steps.auto.outputs.tag }}"
+          sha="${{ github.event.workflow_run.head_sha }}"
+          git tag "$tag" "$sha"
+          git push origin "refs/tags/$tag"
+
       - name: Resolve release commit
         id: commit
         shell: bash
         run: |
           set -euo pipefail
-          tag="${{ steps.release.outputs.tag }}"
+          tag="${{ steps.auto.outputs.tag || steps.release.outputs.tag }}"
           sha="$(git rev-list -n 1 "$tag")"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
           echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Ensure release does not already exist
@@ -65,13 +126,18 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          tag="${{ steps.release.outputs.tag }}"
+          tag="${{ steps.commit.outputs.tag }}"
           if gh release view "$tag" >/dev/null 2>&1; then
+            if [ "${{ steps.release.outputs.automatic }}" = "true" ] && [ "${{ steps.auto.outputs.should_publish }}" = "false" ]; then
+              echo "Release already exists for automatic tag: $tag"
+              exit 0
+            fi
             echo "::error::Release already exists: $tag"
             exit 1
           fi
 
       - name: Run release gates
+        if: steps.release.outputs.automatic != 'true' || steps.auto.outputs.should_publish == 'true'
         shell: bash
         run: |
           set -euo pipefail
@@ -83,6 +149,31 @@ jobs:
           go vet ./cmd/... ./internal/...
           echo "::endgroup::"
 
+          modules=(
+            middleware
+            auth
+            crud
+            database
+            rbac
+            ratelimit
+            validation
+            file-upload
+            health
+            cache
+            pagination
+            mail
+          )
+
+          for mod in "${modules[@]}"; do
+            echo "::group::module test: $mod"
+            (cd "registry/$mod/src/go" && go test -count=1 -timeout 10m ./...)
+            echo "::endgroup::"
+
+            echo "::group::module vet: $mod"
+            (cd "registry/$mod/src/go" && go vet ./...)
+            echo "::endgroup::"
+          done
+
           echo "::group::doctor strict"
           go run ./cmd/scion doctor --strict
           echo "::endgroup::"
@@ -93,10 +184,11 @@ jobs:
           echo "::endgroup::"
 
       - name: Build release assets
+        if: steps.release.outputs.automatic != 'true' || steps.auto.outputs.should_publish == 'true'
         shell: bash
         run: |
           set -euo pipefail
-          tag="${{ steps.release.outputs.tag }}"
+          tag="${{ steps.commit.outputs.tag }}"
           sha="${{ steps.commit.outputs.sha }}"
           ldflags="-s -w -X github.com/DarkInno/scion/internal/version.Version=$tag -X github.com/DarkInno/scion/internal/version.Commit=$sha"
 
@@ -140,20 +232,22 @@ jobs:
           (cd dist && sha256sum scion_*.tar.gz scion_*.zip > SHA256SUMS)
 
       - name: Verify built binary version
+        if: steps.release.outputs.automatic != 'true' || steps.auto.outputs.should_publish == 'true'
         shell: bash
         run: |
           set -euo pipefail
-          tag="${{ steps.release.outputs.tag }}"
+          tag="${{ steps.commit.outputs.tag }}"
           version="$(./dist/scion_${tag}_linux_amd64/scion version)"
           echo "$version"
           grep -q "scion $tag" <<< "$version"
           grep -q "commit: ${{ steps.commit.outputs.sha }}" <<< "$version"
 
       - name: Write release notes
+        if: steps.release.outputs.automatic != 'true' || steps.auto.outputs.should_publish == 'true'
         shell: bash
         run: |
           set -euo pipefail
-          tag="${{ steps.release.outputs.tag }}"
+          tag="${{ steps.commit.outputs.tag }}"
           cat > release-notes.md <<EOF
           ## Install
 
@@ -180,12 +274,13 @@ jobs:
           EOF
 
       - name: Publish GitHub Release
+        if: steps.release.outputs.automatic != 'true' || steps.auto.outputs.should_publish == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
         shell: bash
         run: |
           set -euo pipefail
-          tag="${{ steps.release.outputs.tag }}"
+          tag="${{ steps.commit.outputs.tag }}"
           gh release create "$tag" \
             dist/*.tar.gz \
             dist/*.zip \
diff --git a/internal/bundle/manifest.json b/internal/bundle/manifest.json
index 0d13152..2a981eb 100644
--- a/internal/bundle/manifest.json
+++ b/internal/bundle/manifest.json
@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "registryVersion": "0.2.0",
-  "bundleHash": "a02b457e62e7e559ecef0dff6c0aeb47e901c0092099f1e83085aeb9ddc8c3a6",
+  "bundleHash": "bea9fed999eeaac57df1837e148a9a8a5ddf11b55dac47740d1aacacb32d1d8d",
   "modules": [
     {
       "id": "auth",
@@ -370,8 +370,8 @@
       "path": "registry/database/README.md",
       "module": "database",
       "moduleVersion": "0.1.0",
-      "sha256": "5ed6a2fe853d535b0f742b8ba0f9cb34b1ac06344946b3177e555757edcdeb81",
-      "size": 3005
+      "sha256": "b965f9107f529fda5d732b5afc051357c13d38f6c3d50eb7f460cef0c3e6af72",
+      "size": 3212
     },
     {
       "path": "registry/database/__llms__.md",
@@ -405,8 +405,8 @@
       "path": "registry/database/src/go/go.mod",
       "module": "database",
       "moduleVersion": "0.1.0",
-      "sha256": "c5e7df7c136894507b1fe57e2e2f172c279d43bf0e1dc85187192b11034c3214",
-      "size": 25
+      "sha256": "585b325189217d789ecf2891cb221f0d65c2d88f216a2f67cbe6f42e5dc8295b",
+      "size": 31
     },
     {
       "path": "registry/database/src/go/open.go",
diff --git a/internal/bundle/registry.zip b/internal/bundle/registry.zip
index e5f3887ee3a162a0b051492245316404af8197fe..42de8e36862a2e13a278088f05ba2c1cd3cdbcee 100644
GIT binary patch
delta 2616
zcmYk83rv((7RTYvi#eTL9->ll@Z+JTAfQ(8K@kVnYFmrN+NfQtGs1{dVFqEQ)~p-c
zq-mvAtJ}t7)3l_ek91dz+D%+-u*I&AT0u}jM1`RuAW9V!A1Juz&iR-^a`W;3o&UY}
z+<VWxaC0D`>Pf=pcLM(-*1JoVthFn}ZksdLmhW=f6>FX=slb(MRXoM^V#P|odh*GT
z<8V0>b8T+hYFn}0syLj*Zo4g4ajk(N%O63vOR>G>a^xyGuKavQuEUw9Y;d^OD)U_v
zi`A)$auf3%tBY(!8?zLvzb7~f3SC8R#a(2#D=w$9(BbsFtrU5jPJ2;tk|HxLwB@X`
z<=GXdt-!7n*$Zrx$*>WU(B&2x5SwnYd|(O)_`rl!`*qJ?Wv?*eidqOiIOrCZ8G2q0
zW>kn#@aM4o_r?VT1dI##C_2Sw4S8>Og`lRPrlqE%rl)407DUZ>aCZe{#tfgO?F_6I
zr5@a02jOy}+2Z5|DI#(51`&qI-4KEoYhjGIvXgO09azNiau&`ym^k*2JY+6L%7}ly
z`bSlTv@H>-d)ZFeh2R?}X~@j8G^FPM<Bew_LtHq_qRA5&fj`xdXFz%ik2BtW4h)!f
z4pK!!ou6ci+9np==O9h2yThWoSB&Bz)}4nj+8v+?K-&mi1a1!1n6TnJq-w{74P$0D
zPpYT+O3k>x0Y>AhdU#IkiD3aTns6+vrJNe2XK$RuQRr*{J^p@OXX0&|)<Cg6)BQ0^
z;62>e0L#Rz+04q)H6wWWFI^z(=Qck!;G#NhD5p^&WAl!2>{N<ScO$rw@RL5qABJiT
z_(~(BYU0DRnB4$oB&0fP$f-$=RC&-vn5~IURMnb`FjwQ5qQ%O|+E_eu5#lw5R4pz_
z(T?W@PHCcP9!*EvWq2BoG|{FPG|{HN|C*m<ijO~I5qXLB=<6yLx+?8xUce`pXov|X
z7}s2anPR6;D42W!#^SuoFeb1Qt(ReiC}?0;b^TECPbey0`4dK7fd!hQ@j8TfU9?Oz
z1n~-m{*{d1Ux6%<Hw8nybWW~jIs>JdQv5m1Pb{K3gGEAyE*Mu<Q}51Z>OE}^<H#0B
z7u#NDabqEshOgp2X(7+M*^E!OKxSYY279T1-`y&i8N1%ssi#!#C2R6mY~5C_3&*4u
znx$XjlY1E_w!&Po`vCS_g;BVrl{Ty6AdAbbbkS}dlERELf1~n$^#}|64gMmYIxR&M
z7XGSJ?@Q!W8rON=kF~h`DpmYDU6RBOE5dqd{3rmk+d#p;bweDcv=LbvD#`2OYMA`S
zVOE%4T}ZDC&lxH4I83|-GsJ%rSVSf0NASLUca1!mFG_62Z(g9TzDulWC%kqE<LBC8
zj)=6eD6#6*Z9gnM+f}@%gX*cjoenGA!$u;R;{1m!_DON$kQzBe(+r-YJ)PP~L!?zR
zE<3GP@AgiKovn<$9r_?_^6E|4+zIhwQ>Pz4jdQLOX&+?rhRI;We_p4X^U!2Ki^-76
zOAPIzOH&r>LuP!b3#Mz{oT#cZ6AWSO`X9N3B>}x%w3o|f%5NN6Z_r7UWJwW)Kiq&>
z!eC{QzsfL@JI=aE9oKKfowukIYTl;td?meI;%k3r{L@V;iX$abn9<x#<+8k#MdcQQ
zdbi5DsYCfz#*NYwTF%1r<&fv~-^sJ-XU5*62K6KkNPJ7hN!13xvZX;LF5A#s6gyST
zT__gGS$ibbot1dGh-jDJSPZ@mX`0Q!LHNZM!&r3OhD^=)R8^h2O^?lwvsE>*hw8uG
zf<1R&B!2lT#9(<34Y>7rCLQyF)K~R^#Jd(qJQgSSQWbb!WwE0d=8LMOEPiRG5)HpY
z-l@x&EWATSH{(se0CXNQs)b!Ijmu8R*h(=o2D9&iRir1&Z#?cz8nO-ECEKQFB{rjX
zsxgFjWN9Da9aQoX@93i&Iz9{Q`e>-{{)$uXL5}!w74EtR3q@%z*5(-F`1y>uFDG4t
zmWT8<73LcaSZOz!aOHg}!LR~9R^OXnq}x=;`0;&uDT{p~0vA1?qb=PoBR)ZYXSNMx
zeEI?Ps@x-E(ZkMg{6oU}!xFC$8;@|;#!6a{@3LNy;S<LgKh;kQT6|K9(YWt~QO##-
zKY70QV)i4d(h#qas<fXHUw@5BO`B0Yu#`t+T-+h?a`8-${L){OM|2PVeOC%I2H!QR
zb+_O#d87ImdmqE_y8Bkf@&eH^C^!Ex%oCr|os;5;o)+$Vl=BD3(=bWJ1E9l<Nnqkd
i9j91e3$_l>xh$S5Ei1&d68W8g#|9x<4@ZIi8Tmg`q4@Lw

delta 2435
zcmY+G2~bo=5Qf=#d$w{c5D;WV@Q9*8qyjMtvS?zI2*Eosk;9WjjaU(5l?7_FJg{O=
zOWIo^R;&_HsUlHSqKJwbO+-Y+gG)d;L=F{1j`X~Fth!aRZ~w1*rf0fm=50>bkh+c`
ztJkSA+0tbg<taJh?gFsI^`4Te!D^G=g6tkvR@vK!uQ#DNPi=kjL>!A4;XXHdS@i7a
zpXLE9Skia6x34dRf2q^Q>^_(1Vr6CJg2T-k(}wV4jG9DEO-(~hOHD^jPt9;L{1`-f
zf+a=|%(@A)+397tG#?x>D~>thzB^!t)AGTUy<X1o3}&;HKRxh3E`9a9MV6L>ob<+y
zROXB)a>35cG7p-IyOn{y#plqPrlZ35^$fi&p11{GEIM6~#mAT(ZYiX2&IL4RN`}B;
z1rWs8X(4RRuwHTmyv2R?ToTy&7So~KZSZHRd<#(=H{T}5H$?*L9xx*=&Z8KQIZkd8
z*tHPM(iww<Ni-_{TnNEZh*43~?Ikx6Qgw&AWV$66fis>pN%pv;oCccC>0J+*mhj?H
z#=KZjKLUMlV+DAk;V$>^m%+6g@FD)dfk%K0d;%po4|bT#>AXOhcHD(Pb~UQ|w+>69
zC8L<dFZakT_M&WBbxG=lK80Y!%6s6V^1`lr@SQZxs76&0^v8wvYNb<Z5x7b-U1e^<
zM@2ANnmF{W(&O0sFp8!4;OhGj#(e$o=6wiP4MdLzFhlxtsv0x)sZF@^0R&3t_R7jj
zq|yE%4Se&wjQU_{PItf`IiGY{=DqOSJhigO3!I<r=3hMm9d<qhf5{<VaV0cH+F7Wm
zqoml%p4jjR#!JrzYp}#i<010CsF?Cl=#3kTAxzrlqrpjLjT1gEh5)I4<Xfc``*dLm
z#cdrec(PfeOedS;$RHUH7AtZnC3I?{j7%6>3ZtZqaAiD~P8ft&xr6Nj4XR=^gV3f7
zyrhgoS-Ii4%^D@+E6T`gW~$OLt&B3>oUW)h$22aYm_y2G5xE)ISPo7&s~iHD{YfEQ
zPHB|GS4ci8S8OPUSu7!&TL)s?V=9;bKU|pbKQ49^ScC?>D~KGg79_hyV~_juX{#Qo
zplE-0$#}<gtvIU)l|+BB!{8bkE6J#Jz=((BJfE=22G>+V6kF&hTa&9`Bzx@D{acN*
zswmFl38L%D5Uo+fxmQIaZl5Bs@d=pOxF{iFpTMUqOA%L|&?b*rCM?V2w90{<_>_8g
zZ4uZysT-$r?35+2xf(QB`;-p+{OcBCX1hwcaL3MS(BknjZBJ3s+-mB2_=&|9tTLjx
zhSJ%;CmQQ$)$Uzd1CFxRDYdJrA^&Thimet#upI-1SYAt0UgX6^e=Mq{_-jXS5y_5(
z@@F4Rs-qnFMp}d#>+2{<dskpi1J$^))S%oObDmKUyLf?}6Ld<ovpB9!;MgRt565~U
z>oy7!S`WeO-$WtO>uJLT926oXRi_km*mLS|_=3Ql?UauVoVex+a{f6L<mGjX06f=0
zH+e_{`S|2>+z&T3(9*_MauLDOY|x{TmKg5GpC&xe2%}j|phf7DgY-(~1~k#8q2xBf
zWcJtR7~BLO;Ms9{N6c=bOEKpQK_bWLwRmH^-UUs~gi|KJkF7ClO80=<nrT*b)8BEp
z+Dr+aHRB!9_XXu-&iC(=9%5BTUQqwFm*27dmPc{<OA6s7+2(rS)+u^79P<)BV=>-B
z#0@jJ3!eh+bJ$nl9<Qj9XC?@7CB)z)d=g)gPk1N>hZ#P`Ev<AL*S-Q5c6%l#gV4K$
zdeubW!WNjwGUs4c3th2m=b^_NdXMyNr41Fh$RczY-%9SEED<Cq)?kaJt(2tw3i%_}
z;D8BNX!_$`Q`pR3h2z;R2Ictt&hgVUfg6s}B<1&A8^^=5ELf@f*KLFkWeZ%=MyD#N
zjY{8i(L&5DK97rUSaAuiX@74IXTG7{dn*KfyN98jaC{ZV{cu7%jW@M{iwJh78Oz#X
zI-Br<YZIoZ05Gb9UI5#y04J>iH;#Ja%?`R%FKZPvx{<Ek;7+<wRYMhI`w^vCUf3Sa
pA?PjFpvg=|xx{VU7(Yff4#0pe3KW?jD}PMu0z0i=4$wc7{{i*ho<;xw

diff --git a/registry/database/README.md b/registry/database/README.md
index 23067c3..d8c0545 100644
--- a/registry/database/README.md
+++ b/registry/database/README.md
@@ -106,6 +106,10 @@ old argument references.
 
 ## Tests
 
+The standalone `go.mod` uses `module scion-database` instead of
+`module database` to avoid colliding with Go's standard-library `database`
+import tree on Linux runners. The package name remains `database`.
+
 ```bash
 cd registry/database/src/go
 go test -v ./...
diff --git a/registry/database/src/go/go.mod b/registry/database/src/go/go.mod
index c83f728..d2cf6ee 100644
--- a/registry/database/src/go/go.mod
+++ b/registry/database/src/go/go.mod
@@ -1,3 +1,3 @@
-module database
+module scion-database
 
 go 1.22