48225a077b
fix: remove redundant checkout and pnpm steps from beta release workflow
2026-03-18 22:53:24 +05:30
167f3c3ccd
feat: add beta release and rollback workflows with cosign signing
2026-03-18 22:07:58 +05:30
a513aad161
fix: remove environment gates and add NPM_TOKEN to publish step
2026-03-18 16:09:40 +05:30
955eae5d65
fix: remove duplicate environment gate from merge-docker job
...
Move DOCKERHUB_USERNAME from vars to secrets so merge-docker can access
credentials without its own environment scope. This eliminates the
redundant double approval since build-docker already gates on
release-publish.
2026-03-18 15:58:45 +05:30
12ce802770
fix: use native ARM64 runners for Docker multi-platform builds
...
Replace QEMU emulation with parallel native builds using a matrix
strategy (ubuntu-latest for amd64, ubuntu-24.04-arm for arm64).
Each platform pushes by digest, then a merge job creates the
multi-arch manifest list before signing with cosign.
2026-03-18 15:58:45 +05:30
96732306a8
feat: mark GitHub release as latest during rollback
2026-03-18 15:58:45 +05:30
181f24cfcc
refactor: migrate to Turborepo + pnpm + Biome monorepo
...
Restructure into apps/worker, apps/cli, packages/mcp-server with
Turborepo task orchestration, pnpm workspaces, Biome linting/formatting,
and tsdown CLI bundling.
Key changes:
- src/ -> apps/worker/src/, cli/ -> apps/cli/, mcp-server/ -> packages/mcp-server/
- prompts/ and configs/ moved into apps/worker/
- npm replaced with pnpm, package-lock.json replaced with pnpm-lock.yaml
- Dockerfile updated for pnpm-based builds
- CLI logs command rewritten with chokidar for cross-platform reliability
- Router health checking added for auto-detected router mode
- Centralized path resolution via apps/worker/src/paths.ts
2026-03-18 15:58:45 +05:30
9b1abd9ec0
feat: integrate npx CLI, CI/CD, and ephemeral worker architecture
...
Bring in changes from shannon-npx: npx-distributable CLI package (cli/),
semantic-release CI/CD workflows, ephemeral per-scan worker containers,
TOML config support, setup wizard, and workspace management.
Preserves all shannon-only changes: security hardening (localhost-bound
ports, MCP env allowlist, path traversal guard), updated benchmarks
(XBEN 19/31/35/44), README assets, and prompt injection disclaimer.
Applies security hardening to cli/infra/compose.yml as well.
2026-03-18 15:57:57 +05:30
ezl-keygraph