fix: clean up and harden GitHub Actions workflows

.github/scripts/generate-changelog.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# generate-changelog.sh — Generate a path-scoped changelog between consecutive tags.
+#
+# Usage:
+#   generate-changelog.sh \
+#     --tag-prefix "cli/v" \
+#     --source-dir "src/client/acontext-cli" \
+#     --display-name "CLI" \
+#     --output "/path/to/CHANGELOG.txt" \
+#     --footer "Binary artifacts are available in this release."
+#
+# Requires GITHUB_REF (e.g. refs/tags/cli/v0.1.16) to be set.
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Argument parsing
+# ---------------------------------------------------------------------------
+TAG_PREFIX=""
+SOURCE_DIR=""
+DISPLAY_NAME=""
+OUTPUT=""
+FOOTER=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --tag-prefix)   TAG_PREFIX="$2";   shift 2 ;;
+    --source-dir)   SOURCE_DIR="$2";   shift 2 ;;
+    --display-name) DISPLAY_NAME="$2"; shift 2 ;;
+    --output)       OUTPUT="$2";       shift 2 ;;
+    --footer)       FOOTER="$2";       shift 2 ;;
+    *) echo "Unknown option: $1" >&2; exit 1 ;;
+  esac
+done
+
+if [[ -z "$TAG_PREFIX" || -z "$SOURCE_DIR" || -z "$DISPLAY_NAME" || -z "$OUTPUT" ]]; then
+  echo "Error: --tag-prefix, --source-dir, --display-name, and --output are required." >&2
+  exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# Derive version & current tag from GITHUB_REF
+# ---------------------------------------------------------------------------
+if [[ -z "${GITHUB_REF:-}" ]]; then
+  echo "Error: GITHUB_REF is not set." >&2
+  exit 1
+fi
+
+CURRENT_TAG="${GITHUB_REF#refs/tags/}"
+VERSION="${CURRENT_TAG#"$TAG_PREFIX"}"
+
+# ---------------------------------------------------------------------------
+# Find previous tag with the same prefix
+# ---------------------------------------------------------------------------
+PREV_TAG=$(git tag -l "${TAG_PREFIX}*" --sort=-v:refname \
+  | { grep -v "^${CURRENT_TAG}$" || true; } \
+  | head -1)
+
+# ---------------------------------------------------------------------------
+# Build changelog
+# ---------------------------------------------------------------------------
+{
+  echo "# ${DISPLAY_NAME} v${VERSION}"
+  echo ""
+
+  if [[ -z "$PREV_TAG" ]]; then
+    echo "Initial release."
+  else
+    # Get path-scoped commits between the two tags
+    COMMITS=$(git log --oneline "${PREV_TAG}..${CURRENT_TAG}" -- "${SOURCE_DIR}" 2>/dev/null) || true
+
+    if [[ -n "$COMMITS" ]]; then
+      echo "## What's Changed"
+      echo ""
+
+      # Collect commits into categories
+      FEATS=""
+      FIXES=""
+      OTHER=""
+
+      while IFS= read -r line; do
+        # Strip the short SHA prefix (first word)
+        MSG="${line#* }"
+        # Strip conventional commit prefix to get the description
+        DESC="${MSG#*: }"
+        case "$MSG" in
+          feat:*|feat\(*) FEATS="${FEATS}- ${DESC}"$'\n' ;;
+          fix:*|fix\(*)   FIXES="${FIXES}- ${DESC}"$'\n' ;;
+          *)              OTHER="${OTHER}- ${MSG}"$'\n' ;;
+        esac
+      done <<< "$COMMITS"
+
+      if [[ -n "$FEATS" ]]; then
+        echo "### Features"
+        printf '%s' "$FEATS"
+        echo ""
+      fi
+
+      if [[ -n "$FIXES" ]]; then
+        echo "### Bug Fixes"
+        printf '%s' "$FIXES"
+        echo ""
+      fi
+
+      if [[ -n "$OTHER" ]]; then
+        echo "### Other"
+        printf '%s' "$OTHER"
+        echo ""
+      fi
+    else
+      echo "No path-scoped changes in this release."
+      echo ""
+    fi
+
+    echo "**Full Changelog**: https://github.com/memodb-io/Acontext/compare/${PREV_TAG}...${CURRENT_TAG}"
+  fi
+
+  if [[ -n "$FOOTER" ]]; then
+    echo ""
+    echo "---"
+    echo ""
+    echo "$FOOTER"
+  fi
+} > "$OUTPUT"
+
+echo "Changelog written to ${OUTPUT}"

.github/workflows/_reusable-docker-release.yaml

@@ -19,6 +19,10 @@ on:
         description: "Human-readable component name (e.g. Core)"
         required: true
         type: string
+      source_dir:
+        description: "Source directory for changelog scoping (e.g. src/server/core)"
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -30,32 +34,34 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          fetch-depth: 0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
         with:
           images: ghcr.io/memodb-io/${{ inputs.image_name }}
           tags: |
             type=sha
             type=semver,pattern={{version}},match=${{ inputs.tag_prefix }}(\d+\.\d+\.\d+)$
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
 
       - name: Build and Push Docker image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           platforms: linux/amd64,linux/arm64
           context: ${{ inputs.context }}
@@ -67,19 +73,16 @@ jobs:
           cache-from: type=gha,scope=${{ inputs.image_name }}
           cache-to: type=gha,mode=max,scope=${{ inputs.image_name }}
 
-      - name: Extract version from tag
-        id: version
-        run: |
-          TAG_NAME=${GITHUB_REF#refs/tags/${{ inputs.tag_prefix }}}
-          echo "version=$TAG_NAME" >> $GITHUB_OUTPUT
-
       - name: Generate Changelog
         run: |
-          echo "# ${{ inputs.display_name }} v${{ steps.version.outputs.version }}" > ${{ github.workspace }}-CHANGELOG.txt
-          echo "" >> ${{ github.workspace }}-CHANGELOG.txt
-          echo "Published to https://github.com/memodb-io/Acontext/pkgs/container/${{ inputs.image_name }}" >> ${{ github.workspace }}-CHANGELOG.txt
+          bash .github/scripts/generate-changelog.sh \
+            --tag-prefix "${{ inputs.tag_prefix }}" \
+            --source-dir "${{ inputs.source_dir }}" \
+            --display-name "${{ inputs.display_name }}" \
+            --output "${{ github.workspace }}-CHANGELOG.txt" \
+            --footer "Published to https://github.com/memodb-io/Acontext/pkgs/container/${{ inputs.image_name }}"
 
       - name: Create Release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b
         with:
           body_path: ${{ github.workspace }}-CHANGELOG.txt

.github/workflows/api-release.yaml

@@ -4,7 +4,6 @@ on:
   push:
     tags:
       - "api/v*"
-  workflow_dispatch:
 
 permissions:
   contents: write
@@ -18,3 +17,4 @@ jobs:
       context: ./src/server/api/go
       tag_prefix: "api/v"
       display_name: API
+      source_dir: src/server/api/go

.github/workflows/api-test.yaml

@@ -30,9 +30,9 @@ jobs:
         working-directory: src/server/api/go
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version-file: src/server/api/go/go.mod
           cache: true
@@ -42,7 +42,7 @@ jobs:
         run: go test -v -timeout 30m -coverprofile=coverage.out -covermode=atomic ./...
       - name: Upload coverage artifact
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: go-api-coverage
           path: src/server/api/go/coverage.out

.github/workflows/cli-release.yaml

@@ -4,7 +4,6 @@ on:
   push:
     tags:
       - 'cli/v*'
-  workflow_dispatch:
 
 permissions:
   contents: write 
@@ -16,22 +15,21 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Extract version from tag
-        id: version
-        run: |
-          TAG_NAME=${GITHUB_REF#refs/tags/cli/v}
-          echo "version=$TAG_NAME" >> $GITHUB_OUTPUT
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          fetch-depth: 0
 
       - name: Generate Changelog
         run: |
-          echo "# CLI v${{ steps.version.outputs.version }}" > ${{ github.workspace }}-CHANGELOG.txt
-          echo "" >> ${{ github.workspace }}-CHANGELOG.txt
-          echo "Binary artifacts are available in this release." >> ${{ github.workspace }}-CHANGELOG.txt
+          bash .github/scripts/generate-changelog.sh \
+            --tag-prefix "cli/v" \
+            --source-dir "src/client/acontext-cli" \
+            --display-name "CLI" \
+            --output "${{ github.workspace }}-CHANGELOG.txt" \
+            --footer "Binary artifacts are available in this release."
 
       - name: Create Release with Notes
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b
         with:
           body_path: ${{ github.workspace }}-CHANGELOG.txt
 
@@ -48,16 +46,16 @@ jobs:
             goarch: arm64
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Read Go version from go.mod
         id: go-version
         run: |
           GO_VERSION=$(grep '^go ' src/client/acontext-cli/go.mod | awk '{print $2}')
-          echo "version=$GO_VERSION" >> $GITHUB_OUTPUT
+          echo "version=$GO_VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Go Release Binaries 
-        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1
+        uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b
         with:
           goversion: ${{ steps.go-version.outputs.version }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cli-test.yaml

@@ -32,10 +32,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version-file: src/client/acontext-cli/go.mod
           cache: true
@@ -48,7 +48,7 @@ jobs:
         run: go test -v -race -coverprofile=coverage.out ./...
 
       - name: Upload coverage
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de
         with:
           file: ./coverage.out
           flags: unittests
@@ -64,10 +64,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version-file: src/client/acontext-cli/go.mod
           cache: true
@@ -80,7 +80,7 @@ jobs:
         run: go build ./...
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
         with:
           version: latest
           working-directory: src/client/acontext-cli
@@ -102,10 +102,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version-file: src/client/acontext-cli/go.mod
           cache: true
@@ -133,7 +133,7 @@ jobs:
           fi
 
       - name: Upload artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         if: ${{ !cancelled() }}
         with:
           name: acontext-cli-${{ matrix.os }}
@@ -155,10 +155,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version-file: src/client/acontext-cli/go.mod
           cache: true