Update the bug report and question issue templates to direct users to
the Settings → System Info page and ask for the concrete "App Version"
and "UI Version" values shown there, explicitly disallowing "latest",
"main" or "master" as answers. This pairs with the new UI Version row
on the System Info page so version-mismatch bugs (e.g. SearXNG
base_url field missing on stale UI builds) can be triaged at a glance.
- Convert issue and PR templates to English only for broader reach
- Bug report: add Steps to Reproduce, Actual Behavior, WeKnora Version,
and Deployment Method as required fields; expand log guide to cover
Lite / Desktop / source builds
- Feature request: replace user-selected Priority with Impact to reduce
severity inflation
- PR template: slim down to 6 sections, add Conventional Commits hint
in the title, and require `make fmt && make lint && make test` in the
checklist
- Updated `pydantic` from 2.12.3 to 2.13.4 and `pypdfium2` from 5.0.0 to 5.8.0 in the `docreader` requirements.
- Modified the dependabot configuration to set `open-pull-requests-limit` to 0 and added an `ignore` rule for version updates across all ecosystems, allowing only security updates.
- Adjusted settings for `server-security`, `client-security`, `frontend-security`, and `miniprogram-security` groups to streamline security update handling.
This change aims to enhance dependency management and maintain security while reducing noise from version update PRs.
Earlier per-dep dependabot PRs against the existing cli/, frontend/,
and miniprogram/ ecosystems flooded the review queue with 40+ PRs at
once. Apply a noise-bounding pattern uniformly to every ecosystem the
repo declares:
* **Monthly schedule** for routine version updates. Mirrors caddy /
hashicorp-terraform-actions: explicitly chosen over weekly to keep
maintainer review-attention bounded for a contributor-driven OSS
project. Among 10 surveyed mainstream configs (daily 7 / weekly 1
/ monthly 2), monthly is the canonical "minimum-noise" choice for
the contributor cadence WeKnora actually has.
* **Two `groups` per ecosystem** so per-dep PRs never flood:
- `<scope>-deps` bundles minor + patch updates → ONE PR
per ecosystem per month.
- `<scope>-deps-major` bundles semver-major bumps the same way.
Mirrors grafana's `*-breaking` pattern:
surfaces breaking changes as a single
review-required PR rather than silently
ignoring them. (gh-cli's `ignore:
semver-major` style means majors never
surface until someone manually edits
the .yml or the dep — easier to forget
than to act on. Grouping forces them
into the review queue.)
* `open-pull-requests-limit: 3` (was default 5) as a safety net so a
stalled review queue can't pile up stale group PRs.
* `commit-message.prefix: "chore(deps)"` so dependabot PR titles
match the repo's Conventional Commits style out of the box.
npm gets `prefix-development: "chore(deps-dev)"` for devDependency
bumps.
* Note: GitHub Security Advisory CVEs open immediately regardless of
`schedule.interval` — that field governs *version* updates only,
so the monthly cadence does NOT delay CVE response.
Coverage:
- gomod: /, /cli, /client
- npm: /frontend, /miniprogram
- pip: /docreader
- github-actions: /
Realistic steady-state with this config: 1–3 grouped PRs per month
total across all 7 ecosystems (vs. 40+ before), with major bumps
appearing as their own group PR every few months when upstream cuts
breaking releases.
Tests / build: not affected (config-only change). YAML validated with
`python3 -c "import yaml; yaml.safe_load(...)"`.
Close the v0.2 RAG demo loop and ship the validation infrastructure:
- weknora api <method> <path> [--data X | --data-file F]
Raw passthrough wrapping client.Raw, gh-style. JSON envelope mode
surfaces status / headers / parsed body. Non-2xx routes through
cmdutil.ClassifyHTTPStatus (factored out of ClassifyHTTPError so
both SDK-error and direct-status paths stay aligned — reuse review).
- weknora chat <text> [--session-id S] [--no-stream]
KnowledgeQAStream consumer with two output modes:
- TTY default: token streaming + references footer
- --json / --no-stream / non-TTY: buffered single envelope
Auto-creates a session when --session-id is omitted; the id prints
to stderr at start AND on stream failure (^C scrolls past the
first announcement, so the recovery hint is re-surfaced when the
user is most likely to need it).
- cli/internal/sse/Accumulator
buffers Content / References / SessionID across SDK callbacks.
Idempotent post-Done so misbehaving servers don't corrupt state.
- doctor: ok → ok / warn / fail / skip
warn marks soft issues that don't block: server within compat range
but >=1 minor behind CLI; credential storage falling back to file
because keyring is unavailable. Envelope.ok stays true on warn,
flips false on fail (exit 1). doctor.error_network golden updated.
- cli/acceptance/e2e/ real-server RAG full loop
Build-tagged //go:build acceptance_e2e — kept out of the default
`go test ./...`. Exercises kb create → doc upload → poll ready →
search → chat → cleanup against a server pointed at by
WEKNORA_E2E_HOST / _TOKEN.
- .github/workflows/cli-e2e.yml
manual workflow_dispatch + label-gated PR trigger
("acceptance-e2e"). No-ops gracefully when the secrets aren't set
so cross-fork PRs can't accidentally fail the suite.
Add weekly Dependabot updates for the root and /client Go modules,
the frontend and miniprogram npm packages, and the docreader Python
package. Existing /cli gomod and github-actions entries are kept.
Semver-major bumps remain ignored to reduce noise.
cli/acceptance/contract/:
envelope_test.go — 16 envelope golden cases (9 commands × {success/error
variants}; 3 cases dropped with rationale: doctor.success
non-offline has unstable timing detail; auth_login.* needs
stdin/keyring scaffold deferred to v0.2; context_use.error
needs leaf-local --json deferred to follow-up)
errorcodes_test.go — single-direction AST scan of cli/cmd/ extracting first
arg of cmdutil.NewError / cmdutil.Wrapf calls;
ClassifyHTTPError dynamic-classify bridged via
cmdutil.ClassifyHTTPErrorOutputs() per spec §4.3.
testdata/envelopes/ — 16 JSON golden files
helpers_test.go (PR-6 scaffold) extended:
runCmd now wires cobra Out/Err sinks (version uses c.OutOrStdout) AND
replicates cmd.Execute()'s error-envelope path so error-case goldens are
populated. Without this, every error scenario's golden was 0 bytes.
cli/cmd/root.go: mapCobraError → MapCobraError, wantsJSONOutput → WantsJSONOutput
(exported so the contract test helper can replicate Execute()'s
envelope-printing path without calling Execute() itself).
root_test.go updated to use new exported names.
.github/dependabot.yml (新增):gomod /cli + github-actions weekly,gh-style
ignore semver-major to avoid noise. Open-source
dependency safety,independent of release cadence.
v0.1 不发布到任何分发平台 (release infra 推迟到发布窗口 milestone)。
Go 1.24 has an internal compiler race condition on Windows that causes
'package without types' errors during parallel compilation. Setting
GOFLAGS="-p=1" serializes the build and avoids triggering the bug.
- Added a new `.env.lite.example` file for the Lite version, providing a minimal configuration template.
- Updated `.env.example` to remove deprecated variables and include new Docreader settings.
- Enhanced Docker configurations to support the Lite version, including a new Dockerfile for the Docreader service.
- Introduced a Makefile target for building and running the Lite version, along with packaging capabilities.
- Created GitHub workflows for building and releasing Lite binaries, including Homebrew formula support.
- Implemented a new service file for managing the Lite version as a system service.
This update enables a streamlined, single-binary deployment of WeKnora, reducing external dependencies and simplifying setup.
- Introduced a new job in the Docker workflow to build and push a sandbox image.
- Configured steps for code checkout, Docker Buildx setup, Docker Hub login, and image metadata handling.
- Enabled multi-platform builds for the sandbox image, enhancing deployment flexibility.
wizardchen