Declare compatible Artalk ranges and npm repository metadata for the pending plugin versions.
Correct ESM and CommonJS declaration exports, trim plugin-kit package contents, and validate package types in CI.
Replace the long-lived npm token with GitHub OIDC credentials, verify the release version, and retain pnpm packaging so the published tarball still includes the repository license.
Pass the resolved release commit into Docker builds, verify every checkout against it, and derive image version metadata and sha tags from the packaged source instead of the workflow invocation commit.
Resolve automatic releases from the merged release PR commit and require an explicit immutable commit when recovering a missing tag. Reuse existing tags idempotently, restore annotated release tags, and reject duplicate release preparation or inconsistent version files.
Create lightweight release refs directly at the checked-out commit so the v* linear-history rule evaluates the commit instead of an annotated tag object. Resolve existing tags through the remote API, verify their exact target without overwriting them, and accept an explicit version for safe manual release retries.
Keep the movable nightly tag while replacing the release, verify its exact commit through the Git refs API, and pass the build SHA as the release target. This avoids the tag visibility race caused by deleting and immediately recreating the tag before --verify-tag.
Protect checksum globs and quote test artifact paths for ShellCheck. Pass release versions to Perl through the environment instead of interpolating shell variables into the program text.
Inject the requested release version and commit hash through Go linker variables so Docker images report the version they were built for, and make release preparation update the linkable version variable.\n\nAssert the version in release image smoke tests and trim unused files from Docker build contexts while preserving both prebuilt-UI and full frontend build paths.
Run Go tests natively on Linux AMD64, Linux ARM64, and macOS; reduce the frontend matrix while keeping Node 22, Node 24, and Windows coverage; and make type-entry validation blocking.\n\nAdd the Playwright browser UAT flow to CI, pin test tools, isolate architecture-specific caches and artifacts, and cancel superseded pull-request runs.
Pin every third-party action to an immutable commit, enforce least-privilege tokens, avoid persisted checkout credentials, and validate all user-controlled values before they reach scripts.\n\nKeep dry-run GoReleaser jobs tokenless, publish npm provenance, generate tags through authenticated GitHub API calls, disable shared caches for release artifacts, and continuously audit workflow syntax and security policy.
Run AMD64 and ARM64 Docker builds on native GitHub-hosted Linux runners, reuse architecture-scoped BuildKit caches, and merge validated image digests after both builds succeed.\n\nMake manual dry runs build, smoke-test, and upload artifacts without exposing DockerHub credentials or replacing the nightly tag and release.
Build Docker images once per native AMD64 and ARM64 runner, merge immutable digests into the release manifest, and reuse a single UI artifact across architectures.\n\nKeep dry runs local by separating the source ref from the release version, avoid remote tags and package publication, scope reusable-workflow secrets, and smoke-test each image before publication.
Pass the event ref through the environment instead of interpolating expression data into the shell, validate the derived semantic version, and quote Git refs and environment files.
Use rev-parse for an exact tag existence check before creating and pushing the release tag.
Update checkout, setup, cache, artifact, Docker, CodeQL, Codecov, repository-dispatch, and supporting GitHub Actions to their current major releases.
Move the builder and runtime images to Go 1.26.5 on Alpine 3.24 while preserving workflow inputs and release artifact layout.
- Implemented `eslint-plugin-artalk` to enforce Artalk's development conventions.
- Added setup script for UI development environment.
- Created test cases for Artalk plugin rules.
- Configured TypeScript and build settings for the plugin.
- Updated documentation with installation and configuration instructions.
BREAKING CHANGE: The original Go module name was `github.com/ArtalkJS/Artalk`, which has now been modified to `github.com/artalkjs/artalk/v2` (all lowercase). This change may affect the CI pipeline or other areas if you are compiling the Artalk server and have specified the fixed Go module name. Regarding the original `-ldflags -X github.com/ArtalkJS/Artalk/internal/config.Version` and `CommitHash` definitions, please remove them, as they are now obsolete. The `Version` has been hardcoded into the Go code, and the `CommitHash` is now read from the Go build info via runtime/debug’s vcs.revision value. This change only affects the server developers and does not impact the frontend UI client.
qwqcode