| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix(release): download clobber/skip, named-asset strictness, streaming upload, view/delete polish download: an existing file was silently overwritten (temp+rename with no existence check), and a mistyped asset name exited 0 with "No assets to download" — scripts could not tell a typo from an empty release. Existing files now refuse by default with --clobber to overwrite and --skip-existing to skip (mutually exclusive, gh-aligned). Named downloads are strict: any miss is an error listing the available asset names, and the named set bypasses the source-archive filter — naming an archive explicitly is intent and must download it even without --all. upload: the whole file was buffered in memory (io.ReadAll then a []byte PUT — double the asset size, OOM territory for large binaries); UploadToURL and UploadReleaseAssetByTag now take an io.Reader with an explicit ContentLength (presigned URLs reject chunked PUTs) and uploadFile streams from the file handle with a 512-byte sniff-and-rewind for content type. The platform's overwrite behavior for duplicate asset names is undefined, so a GetRelease precheck refuses the whole batch (zero PUTs) when any name collides, pointing at delete-asset or a rename. A mid-batch failure now names what already landed. The --label example that errors when copied is gone (the flag stays, with its explicit rejection). delete: the confirmation prompt showed the release Name but expected the tag — when they differ, typing what the screen says was rejected. confirmTitle shows "Name (tag: tag)" so the expected input is always visible; Expected stays the tag (the API key). view: gained its first run-level tests (web/TTY/non-TTY browser fallback via an injected opener matching the pr create seam, JSON, human render, not-found wrapping). list: the body-first-line truncate was byte-based and corrupted CJK text at the 60-byte boundary; a shared rune-aware output.Truncate now serves release list, issue templates (same latent bug), and the plugin list (which had its own correct copy). COMMANDS.md documents the new download/upload semantics and fixes the extension-name wording for source archives (detection is by URL, not extension). Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 | |
fix: unblock secret scan install and Windows baseline tests GitHub 镜像 run 34840279268 两个失败： 1. Secret Scan Install gitleaks：GitHub runner 镜像默认 GOTOOLCHAIN=local， go 1.22 无法按需切换到 gitleaks v8.30.1 要求的 go >= 1.24.11。 修复：install 步骤显式 GOTOOLCHAIN=auto（两个工作流统一）。 2. Test (windows-latest)：plugin list/view 测试硬编码 /tmp/ 路径 （list_test.go:270 / view_test.go:174），Windows 无该目录，属 main 基线问题，阻塞所有 PR 的 Windows CI。修复：改用 t.TempDir()。 | 1 个月前 | |
feat(actions): add plugin list/view commands for Actions plugin directory Add gc actions plugin list and gc actions plugin view commands to query the official GitCode Actions plugin directory and usage docs on the web-api.gitcode.com host. - api/client.go: add RawRESTToHost with host whitelist (SSRF-safe) - api/queries_actions_plugins.go: ListActionsPlugins, ViewActionsPlugin with flexible list parsing (plain array or paginated wrapper) - pkg/cmd/actions/plugin/{list,view}: commands with --json, pagination, -R/--repo, auto-paginate default - docs/COMMANDS.md: document both commands The web-api.gitcode.com host is whitelisted in allowedGitCodeHosts so SSRF protection for arbitrary hosts is preserved. Token is injected via standard Bearer header, never exposed in the URL. Closes #551 | 2 个月前 |