security: add rate limiting and hash share link passwords

.dockerignore

@@ -1,5 +1,5 @@
 # All node_modules directories
-node_modules
+**/node_modules
 **/dist
 **/.next
 
@@ -45,8 +45,10 @@ tmp
 
 # other
 **/db
+!packages/v2/adapter-repository-postgres/src/db
+!packages/v2/adapter-repository-postgres/src/db/**
 **/.assets
 **/.temporary
 **.DS_Store
 docs
-**/*.md
+**/*.md

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,36 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ""
+labels: ""
+assignees: ""
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+** Client (please complete the following information):**
+
+- OS: [e.g. iOS]
+- Browser [e.g. chrome, safari]
+- Version [e.g. 22]
+
+**Platform (Please tell us which deployment version you are using)**
+[eg. teable.ai, docker-standalone, docker-swarm, docker-cluster]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ""
+labels: ""
+assignees: ""
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/actions/pnpm-install/action.yml

@@ -36,7 +36,7 @@ runs:
       id: pnpm-config
       shell: bash
       run: |
-        echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+        echo "STORE_PATH=$(pnpm store path | tr -d '\n')" >> $GITHUB_OUTPUT
 
     - name: ⚙️ Cache rotation keys
       id: cache-rotation

.github/workflows/docker-push.yml

@@ -1,24 +1,40 @@
 name: Build and Push to Docker Registry
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches:
       - develop
+    tags:
+      - 'v*'
+    paths:
+      - 'apps/nestjs-backend/**'
+      - 'apps/nextjs-app/**'
+      - 'packages/**'
+      - '.github/**'
+      - 'scripts/**'
 
 jobs:
   build-push:
-    runs-on: ubuntu-latest
-
     strategy:
       matrix:
         target: [app, db-migrate]
+        arch: [amd64, arm64]
         include:
           - target: app
             file: Dockerfile
-            image: teable
+            image: teable-community
           - target: db-migrate
             file: Dockerfile.db-migrate
-            image: teable-db-migrate
+            image: teable-db-migrate-community
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
 
     steps:
       - name: Checkout code
@@ -31,6 +47,12 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.PACKAGES_KEY }}
 
+      - name: Login to Docker Hub registry
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_NAME }}
+          password: ${{ secrets.DOCKER_HUB_AK }}
+
       - name: Login to Ali container registry
         uses: docker/login-action@v3
         with:
@@ -40,7 +62,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20.9.0
+          node-version: 22.18.0
       - name: ⚙️ Install zx
         run: npm install -g zx
 
@@ -51,21 +73,63 @@ jobs:
           images: |
             registry.cn-shenzhen.aliyuncs.com/teable/${{ matrix.image }}
             ghcr.io/teableio/${{ matrix.image }}
+            docker.io/teableio/${{ matrix.image }}
           tags: |
-            type=ref,event=branch
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=sha
-            # set latest tag for default branch
-            type=raw,value=latest,enable={{is_default_branch}}
-      - name: ⚙️ Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: ⚙️ Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+            type=sha,format=long
+            type=raw,value=latest
+
       - name: 📦 Build and push
         run: |
           zx scripts/build-image.mjs --file=dockers/teable/${{ matrix.file }} \
-              --cache-from=type=registry,ref=ghcr.io/teableio/${{ matrix.image }}:buildcache \
-              --cache-to=type=registry,ref=ghcr.io/teableio/${{ matrix.image }}:buildcache,mode=max \
+              --build-arg="ENABLE_CSP=false" \
               --tag="${{ steps.meta.outputs.tags }}" \
+              --platform="linux/${{ matrix.arch }}" \
               --push
+
+  create-manifest:
+    needs: build-push
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        target: [app, db-migrate]
+        include:
+          - target: app
+            image: teable-community
+          - target: db-migrate
+            image: teable-db-migrate-community
+
+    steps:
+      - name: Login to GitHub container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.PACKAGES_KEY }}
+
+      - name: Login to Docker Hub registry
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_NAME }}
+          password: ${{ secrets.DOCKER_HUB_AK }}
+
+      - name: Login to Ali container registry
+        uses: docker/login-action@v3
+        with:
+          registry: registry.cn-shenzhen.aliyuncs.com
+          username: ${{ secrets.ALI_DOCKER_USERNAME }}
+          password: ${{ secrets.ALI_DOCKER_PASSWORD }}
+
+      - name: Create and push manifest
+        run: |
+          REGISTRIES=("registry.cn-shenzhen.aliyuncs.com/teable" "ghcr.io/teableio" "docker.io/teableio")
+          TAGS=("latest" "sha-${{ github.sha }}")
+
+          for REGISTRY in "${REGISTRIES[@]}"; do
+            for TAG in "${TAGS[@]}"; do
+              docker manifest create $REGISTRY/${{ matrix.image }}:$TAG \
+                $REGISTRY/${{ matrix.image }}:${TAG}-amd64 \
+                $REGISTRY/${{ matrix.image }}:${TAG}-arm64
+
+              docker manifest push $REGISTRY/${{ matrix.image }}:$TAG
+            done
+          done

.github/workflows/integration-tests.yml

@@ -1,22 +1,44 @@
 name: Integration Tests
 
 on:
+  push:
+    branches:
+      - develop
   pull_request:
     branches:
       - develop
     paths:
       - 'apps/nestjs-backend/**'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  build:
+  test:
     runs-on: ubuntu-latest
-    name: Integration Tests
+    name: Integration Tests - ${{ matrix.e2e.database-type }} ${{ matrix.e2e.shard }} ${{ matrix.runtime.mode }}
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20.x]
-        database-type: [postgres, sqlite]
+        node-version: [22.18.0]
+        runtime:
+          - mode: v1
+            force-v2-all: ''
+            computed-update-mode: ''
+          - mode: v2
+            force-v2-all: 'true'
+            computed-update-mode: 'sync'
+        e2e:
+          - database-type: postgres
+            shard: 1/4
+          - database-type: postgres
+            shard: 2/4
+          - database-type: postgres
+            shard: 3/4
+          - database-type: postgres
+            shard: 4/4
     env:
       CI: 1
 
@@ -34,7 +56,30 @@ jobs:
       - name: 🧪 Run Tests
         env:
           CI: 1
+          FORCE_V2_ALL: ${{ matrix.runtime.force-v2-all }}
+          V2_COMPUTED_UPDATE_MODE: ${{ matrix.runtime.computed-update-mode }}
           VITEST_MAX_THREADS: 2
           VITEST_MIN_THREADS: 1
+          VITEST_SHARD: ${{ matrix.e2e.shard }}
+          VITEST_REPORTER: blob
         run: |
-          make ${{ matrix.database-type }}.integration.test
+          make ${{ matrix.e2e.database-type }}.integration.test
+          pnpm -F "@teable/backend" test-unit-cover
+          pnpm -F "@teable/backend" merge-cover
+          pnpm -F "@teable/backend" generate-cover
+
+      - name: Coveralls Parallel
+        uses: coverallsapp/github-action@v2
+        with:
+          flag-name: run-${{ join(matrix.*, '-') }}
+          file: apps/nestjs-backend/coverage/nestjs-backend/clover.xml
+          parallel: true
+
+  finish:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Coveralls Finished
+        uses: coverallsapp/github-action@v2
+        with:
+          parallel-finished: true

.github/workflows/linting.yml

@@ -8,14 +8,17 @@ on:
       - 'apps/**'
       - 'packages/**'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   build:
     runs-on: ubuntu-latest
     name: Linting and Types
 
     strategy:
       matrix:
-        node-version: [20.x]
+        node-version: [22.18.0]
 
     steps:
       - uses: actions/checkout@v4