merge main

Author: wsx864321

.air.toml

@@ -0,0 +1,10 @@
+---
+name: Other
+about: Something not captured by any other template
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+- [] I acknowledge that issues using this template may be closed without further explanation at the maintainer's discretion.

.github/ISSUE_TEMPLATE/other.md

@@ -2,15 +2,20 @@ name: CI@backend
 
 on:
   push:
-    branches: ["main"]
+    branches: ["main", "release/**"]
     paths:
       - 'backend/**'
       - '.github/workflows/backend-ci.yaml'
   pull_request:
-    branches: ["main"]
+    branches: ["main", "release/**"]
     paths:
       - 'backend/**'
       - '.github/workflows/backend-ci.yaml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
   golang-lint:
@@ -33,10 +38,10 @@ jobs:
         run: |
           # Install golangci-lint
           curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.2.1
-          
+
           # Add golangci-lint to PATH
           export PATH=$PATH:$(go env GOPATH)/bin
-          
+
           # Run golangci-lint
           golangci-lint run --config ../.github/.golangci.yaml
 
@@ -70,4 +75,4 @@ jobs:
           slug: coze-dev/cozeloop
           fail_ci_if_error: false
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/backend-ci.yaml

@@ -2,38 +2,34 @@ name: CI@frontend - Main
 
 on:
   push:
-    branches: ["main"]
+    branches: ["main", "release/**"]
     paths:
       - 'frontend/**'
       - '.github/workflows/frontend-ci.yaml'
   pull_request:
-    branches: ["main"]
+    branches: ["main", "release/**"]
     paths:
       - 'frontend/**'
       - '.github/workflows/frontend-ci.yaml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   setup:
     name: Build All
     runs-on: ubuntu-latest
     env:
       NODE_VERSION: '18'
-      # should be ci trigger user
-      GIT_USER_NAME: 'mocayo'
-      GIT_USER_EMAIL: 'qihai@bytedance.com'
       BUILD_BRANCH: ${{ github.ref }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
-      - name: Config Git User
-        run: |
-          git config --local user.name ${{ env.GIT_USER_NAME }}
-          git config --local user.email ${{ env.GIT_USER_EMAIL }}
-
       - name: Setup Node
         uses: actions/setup-node@v3
         with:

.github/workflows/frontend-ci.yaml

@@ -2,37 +2,33 @@ name: CI@frontend - TS Check
 
 on:
   push:
-    branches: ["main"]
+    branches: ["main", "release/**"]
     paths:
       - 'frontend/**'
       - '.github/workflows/frontend-tsc-ci.yaml'
   pull_request:
-    branches: ["main"]
+    branches: ["main", "release/**"]
     paths:
       - 'frontend/**'
       - '.github/workflows/frontend-tsc-ci.yaml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   setup:
     name: TS Check
     runs-on: ubuntu-latest
     env:
       NODE_VERSION: '18'
-      # should be ci trigger user
-      GIT_USER_NAME: 'mocayo'
-      GIT_USER_EMAIL: 'qihai@bytedance.com'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
-      - name: Config Git User
-        run: |
-          git config --local user.name ${{ env.GIT_USER_NAME }}
-          git config --local user.email ${{ env.GIT_USER_EMAIL }}
-
       - name: Setup Node
         uses: actions/setup-node@v3
         with:

.github/workflows/frontend-tsc-ci.yaml

@@ -1,6 +1,6 @@
 name: Thrift Syntax Validation
 
-on: 
+on:
   push:
     paths:
       - 'idl/**'
@@ -10,6 +10,10 @@ on:
       - 'idl/**'
       - '.github/workflows/idl.yaml'
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   validate-thrift:
     runs-on: ubuntu-latest
@@ -32,15 +36,15 @@ jobs:
         run: |
           # Initialize error flag
           ERROR_FOUND=0
-          
+
           # Create temporary working directory
           TEMP_DIR=$(mktemp -d)
           echo "Created temporary working directory: $TEMP_DIR"
-          
+
           # Initialize go mod in temp directory
           cd "$TEMP_DIR"
           go mod init dummy
-          
+
           # Find all thrift files and validate them
           while IFS= read -r -d '' thrift_file; do
             echo "Validating $thrift_file..."
@@ -49,17 +53,17 @@ jobs:
               ERROR_FOUND=1
             fi
           done < <(find "$GITHUB_WORKSPACE/idl" -name '*.thrift' -print0)
-          
+
           # Clean up temporary directory
           cd "$GITHUB_WORKSPACE"
           rm -rf "$TEMP_DIR"
           echo "Cleaned up temporary working directory"
-          
+
           # Exit with appropriate status
           if [ $ERROR_FOUND -eq 1 ]; then
             echo "Thrift validation failed. Please check the errors above."
             exit 1
           else
             echo "All Thrift files validated successfully!"
             exit 0
-          fi
+          fi

.github/workflows/idl.yaml

@@ -4,6 +4,10 @@ on:
   issues:
     types: ['opened', 'reopened']
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   sync:
     name: Sync Issues

.github/workflows/issue-sync.yaml

@@ -2,11 +2,15 @@ name: License Check
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', "release/**"]
   pull_request:
-    branches: ['main']
+    branches: ['main', "release/**"]
   workflow_dispatch:
-    
+
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   license-check:
     name: License Check
@@ -16,11 +20,11 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: 1.23
-          
+
       - name: Install license-eye
         run: |
           go install github.com/apache/skywalking-eyes/cmd/license-eye@main
-      
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -29,7 +33,7 @@ jobs:
       - name: License Header Check
         run: |
           license-eye header check -c .github/.licenserc.yaml
-      
+
       - name: License Dependency Check
         run: |
           license-eye dependency check -c .github/.licenserc.yaml

.github/workflows/license-check.yaml

@@ -4,6 +4,10 @@ on:
   pull_request_target:
     types: ['opened', 'reopened', 'closed']
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   sync:
     name: Send Lark Message

.github/workflows/pr-sync.yaml

@@ -11,6 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   main:
     name: Check Pull Request Title