feat(agent): expose DynamoDB/ES/Mongo DBA capabilities to the agent (… #528
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: distributions release | |
| on: | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check-version: | |
| name: Check Version Bump | |
| runs-on: ubuntu-latest | |
| outputs: | |
| is_new_version: ${{ steps.check.outputs.is_new_version }} | |
| version: ${{ steps.check.outputs.version }} | |
| steps: | |
| - name: Github checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check if version is new | |
| id: check | |
| run: | | |
| VERSION=$(node -p "require('./package.json').version") | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| if git tag --list | grep -q "^v${VERSION}$"; then | |
| echo "Tag v${VERSION} already exists, skipping release" | |
| echo "is_new_version=false" >> $GITHUB_OUTPUT | |
| else | |
| echo "Tag v${VERSION} not found, proceeding with release" | |
| echo "is_new_version=true" >> $GITHUB_OUTPUT | |
| fi | |
| prepare: | |
| name: Prepare Release | |
| needs: check-version | |
| if: needs.check-version.outputs.is_new_version == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| outputs: | |
| release_body: ${{ steps.release_notes.outputs.release_body }} | |
| release_id: ${{ steps.create-release.outputs.result }} | |
| steps: | |
| - name: Github checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Build Release Notes | |
| id: release_notes | |
| run: | | |
| bash scripts/build-release-notes.sh | |
| { | |
| echo 'release_body<<EOF' | |
| cat release-notes.md | |
| echo EOF | |
| } >> $GITHUB_OUTPUT | |
| - name: Create draft release | |
| id: create-release | |
| uses: actions/github-script@v7 | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| VERSION: ${{ needs.check-version.outputs.version }} | |
| RELEASE_BODY: ${{ steps.release_notes.outputs.release_body }} | |
| with: | |
| script: | | |
| const { data } = await github.rest.repos.createRelease({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| tag_name: `v${process.env.VERSION}`, | |
| name: `v${process.env.VERSION}`, | |
| body: process.env.RELEASE_BODY || '', | |
| draft: true, | |
| prerelease: false | |
| }) | |
| return data.id | |
| lint-audit: | |
| name: Lint & Audit | |
| needs: [check-version] | |
| if: needs.check-version.outputs.is_new_version == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - run: npm ci | |
| - name: Lint & audit | |
| shell: bash | |
| run: | | |
| set +e | |
| npm run lint:check & pid1=$! | |
| npm audit --audit-level=critical & pid2=$! | |
| wait $pid1; rc1=$? | |
| wait $pid2; rc2=$? | |
| echo "LINT=$rc1" >> $GITHUB_ENV | |
| echo "AUDIT=$rc2" >> $GITHUB_ENV | |
| - name: Report failures | |
| if: env.LINT != '0' || env.AUDIT != '0' | |
| run: | | |
| [ "$LINT" = "0" ] || echo "::error::lint failed (exit $LINT)" | |
| [ "$AUDIT" = "0" ] || echo "::error::audit failed (exit $AUDIT)" | |
| exit 1 | |
| release: | |
| name: ${{ matrix.name }} | |
| needs: [check-version, prepare, lint-audit] | |
| if: needs.check-version.outputs.is_new_version == 'true' | |
| permissions: | |
| contents: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: macOS | |
| platform: macos-latest | |
| args: --target universal-apple-darwin | |
| target: aarch64-apple-darwin,x86_64-apple-darwin | |
| - name: Windows | |
| platform: windows-latest | |
| args: --target x86_64-pc-windows-msvc | |
| target: x86_64-pc-windows-msvc | |
| - name: Linux | |
| platform: ubuntu-latest | |
| args: --target x86_64-unknown-linux-gnu | |
| target: x86_64-unknown-linux-gnu | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Github checkout | |
| uses: actions/checkout@v5 | |
| - name: Install Rust stable | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: ${{ matrix.target }} | |
| - name: Use Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - name: Windows LLD linker + stdlib DLL PATH | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $sysroot = & rustc --print sysroot | |
| Add-Content -Path $env:GITHUB_PATH -Value "$sysroot\bin" | |
| $libdir = & rustc --print target-libdir | |
| Add-Content -Path $env:GITHUB_PATH -Value $libdir | |
| - name: Install Linux dependencies | |
| if: runner.os == 'Linux' | |
| run: | | |
| echo "deb http://gb.archive.ubuntu.com/ubuntu jammy main" | sudo tee -a /etc/apt/sources.list | |
| sudo apt-get update | |
| sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf pkg-config libssl-dev | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| # ── Tests (JS + Rust in parallel per OS) ──────────── | |
| - name: Tests (JS) | |
| shell: bash | |
| run: | | |
| set +e | |
| npm run test:ci; JS_EXIT=$? | |
| echo "JS_TEST=$JS_EXIT" >> "$GITHUB_ENV" | |
| - name: Tests (Rust) | |
| shell: bash | |
| run: | | |
| set +e | |
| export PATH="$HOME/.cargo/bin:$PATH" | |
| cd src-tauri | |
| if [ "$RUNNER_OS" = "Windows" ]; then | |
| echo "=== cargo check --lib (Windows: tests skipped) ===" | |
| cargo check --lib; RUST_TEST=$? | |
| else | |
| echo "=== cargo test --lib ===" | |
| cargo test --lib; RUST_TEST=$? | |
| fi | |
| echo "RUST_TEST=$RUST_TEST" >> "$GITHUB_ENV" | |
| - name: Report test failures | |
| if: env.JS_TEST != '0' || env.RUST_TEST != '0' | |
| shell: bash | |
| run: | | |
| [ "$JS_TEST" = "0" ] || echo "::error::JS tests failed (exit $JS_TEST)" | |
| [ "$RUST_TEST" = "0" ] || echo "::error::Rust tests failed (exit $RUST_TEST)" | |
| exit 1 | |
| # ── Coverage (Ubuntu only) ────────────────────────── | |
| - name: Install cargo-llvm-cov | |
| if: runner.os == 'Linux' | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-llvm-cov | |
| - name: Rust coverage | |
| if: runner.os == 'Linux' | |
| run: | | |
| cd src-tauri | |
| mkdir -p coverage | |
| cargo llvm-cov --lcov --output-path coverage/lcov.info | |
| sed -i 's|^SF:src/|SF:src-tauri/src/|' coverage/lcov.info | |
| sed -i 's|^SF:tests/|SF:src-tauri/tests/|' coverage/lcov.info | |
| - name: Upload coverage to Codecov | |
| if: runner.os == 'Linux' | |
| uses: codecov/codecov-action@v5 | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: ./coverage/lcov.info,./src-tauri/coverage/lcov.info | |
| fail_ci_if_error: false | |
| # ── Build ─────────────────────────────────────────── | |
| - run: npm run build | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=4096 | |
| - name: Import Apple Developer Certificate | |
| if: runner.os == 'macOS' | |
| env: | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | |
| run: | | |
| echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12 | |
| security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security default-keychain -s build.keychain | |
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain | |
| security set-keychain-settings -t 3600 -u build.keychain | |
| security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign | |
| security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain | |
| security find-identity -v -p codesigning build.keychain | |
| - name: Extract Signing Identity | |
| if: runner.os == 'macOS' | |
| run: | | |
| CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application") | |
| CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}') | |
| echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV | |
| echo "Certificate imported." | |
| - name: Build and Upload Artifacts | |
| uses: tauri-apps/tauri-action@v0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| APPLE_ID: ${{ secrets.APPLE_ID }} | |
| APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} | |
| APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }} | |
| APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} | |
| APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} | |
| APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }} | |
| TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} | |
| TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} | |
| NODE_OPTIONS: --max-old-space-size=4096 | |
| with: | |
| releaseId: ${{ needs.prepare.outputs.release_id }} | |
| includeUpdaterJson: true | |
| args: ${{ matrix.args }} | |
| publish: | |
| name: Publish Release | |
| needs: [check-version, prepare, release] | |
| if: needs.check-version.outputs.is_new_version == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Publish draft release | |
| uses: actions/github-script@v7 | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| release_id: ${{ needs.prepare.outputs.release_id }} | |
| with: | |
| script: | | |
| github.rest.repos.updateRelease({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| release_id: Number(process.env.release_id), | |
| draft: false, | |
| prerelease: false | |
| }) |