Dev > Main for Release v3.0.0

.github/workflows/agora-token-service.yml

@@ -0,0 +1,26 @@
+name: Build agora-token-service docker image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev
+      - main
+    paths:
+      - 'deploy/docker/agora-token-service/**'
+      - '.github/workflows/agora-token-service.yml'
+      - '.github/workflows/build-service-image.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    uses: ./.github/workflows/build-service-image.yml
+    # Publishes the image used by the `agora-token-service` service
+    # in deploy/docker/docker-compose-multi.yaml
+    with:
+      context: ./deploy/docker/agora-token-service
+      dockerfile: ./deploy/docker/agora-token-service/Dockerfile
+      image_name: lowcoderorg/lowcoder-agora-token-service
+    secrets: inherit

.github/workflows/build-service-image.yml

@@ -0,0 +1,74 @@
+name: Build service docker image
+
+on:
+  workflow_call:
+    inputs:
+      context:
+        type: string
+        description: 'Docker build context, relative to the repository root'
+        required: true
+      dockerfile:
+        type: string
+        description: 'Path to the Dockerfile'
+        required: true
+      image_name:
+        type: string
+        description: 'Docker Hub image name without tag'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set environment variables
+        shell: bash
+        env:
+          BRANCH_NAME: ${{ github.ref_name }}
+          IMAGE_NAME: ${{ inputs.image_name }}
+        run: |
+          # Map branch to docker image tag: dev -> dev, main -> latest
+          case "${BRANCH_NAME}" in
+            dev)
+              IMAGE_TAG=dev
+              ;;
+            main)
+              IMAGE_TAG=latest
+              ;;
+            *)
+              echo "::error::Unsupported branch '${BRANCH_NAME}': images are only built from 'dev' or 'main'"
+              exit 1
+              ;;
+          esac
+
+          echo "IMAGE_TAG=${IMAGE_TAG}" >> "${GITHUB_ENV}"
+          echo "IMAGE_NAMES=${IMAGE_NAME}:${IMAGE_TAG}" >> "${GITHUB_ENV}"
+
+      - name: Checkout lowcoder source
+        uses: actions/checkout@v4
+
+      - name: Log into Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_LOGIN }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Setup Docker Buildx with cloud driver
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: "lab:latest"
+          driver: cloud
+          endpoint: "lowcoderorg/lowcoder-cloud-builder"
+
+      - name: Build and push the image
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ inputs.context }}
+          file: ${{ inputs.dockerfile }}
+          platforms: |
+            linux/amd64
+            linux/arm64
+          push: true
+          tags: ${{ env.IMAGE_NAMES }}

.github/workflows/client.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [ 20.x ]
+        node-version: [ 22.x ]
     steps:
       - uses: actions/checkout@v3
         with:

.github/workflows/deploy-lowcoder-sdk-webpack-netlify.yml

@@ -0,0 +1,55 @@
+# Builds client/packages/lowcoder-sdk-webpack-bundle and deploys its dist/ folder to Netlify.
+#
+# Deploy uses --no-build so Netlify CLI does not run the site UI "build command" (e.g. expo).
+# The webpack bundle is built in the prior CI step.
+#
+# Repository secrets (Netlify: Site settings → General → Site details → Site ID;
+# User settings → Applications → Personal access tokens):
+#   NETLIFY_AUTH_TOKEN  — Netlify personal access token
+#   NETLIFY_SITE_ID     — Site API ID for the Netlify site
+
+name: Deploy SDK Webpack Bundle to Netlify
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-sdk-webpack-netlify-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Use Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20.x
+          cache: yarn
+          cache-dependency-path: client/yarn.lock
+
+      - name: Install dependencies
+        uses: borales/actions-yarn@v4.2.0
+        with:
+          cmd: install
+          dir: client
+
+      - name: Build lowcoder-sdk-webpack-bundle
+        uses: borales/actions-yarn@v4.2.0
+        with:
+          cmd: workspace lowcoder-sdk-webpack-bundle build
+          dir: client
+
+      - name: Deploy dist to Netlify
+        working-directory: client/packages/lowcoder-sdk-webpack-bundle
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SDK_SITE_ID }}
+        run: npx --yes netlify-cli deploy --prod --dir=dist --no-build

.github/workflows/hocuspocus.yml

@@ -0,0 +1,27 @@
+name: Build lowcoder-hocuspocus docker image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev
+      - main
+    paths:
+      - 'client/packages/lowcoder/hocuspocus-server.js'
+      - 'deploy/docker/hocuspocus/**'
+      - '.github/workflows/hocuspocus.yml'
+      - '.github/workflows/build-service-image.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    uses: ./.github/workflows/build-service-image.yml
+    # Publishes the image used by the `hocuspocus` service
+    # in deploy/docker/docker-compose-multi.yaml
+    with:
+      context: ./client/packages/lowcoder
+      dockerfile: ./deploy/docker/hocuspocus/Dockerfile
+      image_name: lowcoderorg/lowcoder-hocuspocus
+    secrets: inherit

.github/workflows/node-service.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [ 20.x ]
+        node-version: [ 22.x ]
     steps:
       - uses: actions/checkout@v3
         with:

.github/workflows/proxy-service.yml

@@ -0,0 +1,26 @@
+name: Build lowcoder-proxy-service docker image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - dev
+      - main
+    paths:
+      - 'server/proxy-service/**'
+      - '.github/workflows/proxy-service.yml'
+      - '.github/workflows/build-service-image.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    uses: ./.github/workflows/build-service-image.yml
+    # Publishes the image used by the `lowcoder-proxy-service` service
+    # in deploy/docker/docker-compose-multi.yaml
+    with:
+      context: ./server/proxy-service
+      dockerfile: ./server/proxy-service/Dockerfile
+      image_name: lowcoderorg/lowcoder-proxy-service
+    secrets: inherit

.github/workflows/publish-lowcoder-comps.yml

@@ -1,19 +1,27 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+# Build and publish changed Comps versions to npm from dev.
 
 name: Publish Lowcoder Comps
 
 on:
   push:
     branches: [ "dev" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-lowcoder-comps
+  cancel-in-progress: false
 
 jobs:
   publish-package:
-    if: ${{ github.repositoryUrl == 'git://github.com/lowcoder-org/lowcoder.git'}}
+    if: github.repository == 'lowcoder-org/lowcoder' && github.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Check version changes
         uses: EndBug/version-check@v1
@@ -30,23 +38,37 @@ jobs:
 
       - name: Set up Node.js for NPM
         if: steps.check.outputs.changed == 'true'
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
-          node-version: 16
-          registry-url: https://registry.npmjs.org/
+          node-version: 22
+          package-manager-cache: false
+
+      - name: Verify GitHub OIDC availability
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          if [[ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" || -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]]; then
+            echo "::error::GitHub OIDC is unavailable. This publishing job requires id-token: write."
+            exit 1
+          fi
 
       - name: Install dependencies
         if: steps.check.outputs.changed == 'true'
-        uses: borales/actions-yarn@v4.2.0
-        with:
-          cmd: install
-          dir: client/packages/lowcoder-comps
+        run: node .yarn/releases/yarn-3.6.4.cjs install --immutable
+        working-directory: client
 
-      - name: Publish
+      - name: Build package
         if: steps.check.outputs.changed == 'true'
-        uses: borales/actions-yarn@v4.2.0
-        with:
-          cmd: build_publish
-          dir: client/packages/lowcoder-comps
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.LOWCODERNPMBOT }}
+        run: node .yarn/releases/yarn-3.6.4.cjs workspace lowcoder-comps build_only
+        working-directory: client
+
+      - name: Set up npm for trusted publishing
+        if: steps.check.outputs.changed == 'true'
+        # OIDC requires npm >=11.5.1. Pin npm 11 to avoid npm 12 install-policy changes.
+        run: npm install --global npm@11.21.0 --registry=https://registry.npmjs.org/
+
+      - name: Publish package to npm with OIDC
+        if: steps.check.outputs.changed == 'true'
+        run: npm publish --access public --registry=https://registry.npmjs.org/
+        # lowcoder-cli writes the compiled package here; publishing the source
+        # workspace would omit the generated component entry point.
+        working-directory: client/packages/lowcoder-cli/.out

.github/workflows/publish-lowcoder-sdk.yml

@@ -1,19 +1,27 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+# Build and publish changed SDK versions to npm from dev.
 
 name: Publish Lowcoder SDK
 
 on:
   push:
     branches: [ "dev" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-lowcoder-sdk
+  cancel-in-progress: false
 
 jobs:
   publish-package:
-    if: ${{ github.repositoryUrl == 'git://github.com/lowcoder-org/lowcoder.git'}}
+    if: github.repository == 'lowcoder-org/lowcoder' && github.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Check version changes
         uses: EndBug/version-check@v1
@@ -30,28 +38,35 @@ jobs:
 
       - name: Set up Node.js for NPM
         if: steps.check.outputs.changed == 'true'
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
-          node-version: 16
-          registry-url: https://registry.npmjs.org/
+          node-version: 22
+          package-manager-cache: false
+
+      - name: Verify GitHub OIDC availability
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          if [[ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" || -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]]; then
+            echo "::error::GitHub OIDC is unavailable. This publishing job requires id-token: write."
+            exit 1
+          fi
 
       - name: Install dependencies
         if: steps.check.outputs.changed == 'true'
-        uses: borales/actions-yarn@v4.2.0
-        with:
-          cmd: install
-          dir: client/packages/lowcoder-sdk
+        run: node .yarn/releases/yarn-3.6.4.cjs install --immutable
+        working-directory: client
 
       - name: Build Package
         if: steps.check.outputs.changed == 'true'
-        uses: borales/actions-yarn@v4.2.0
-        with:
-          cmd: build
-          dir: client/packages/lowcoder-sdk
+        run: node .yarn/releases/yarn-3.6.4.cjs workspace lowcoder-sdk build
+        working-directory: client
+
+      - name: Set up npm for trusted publishing
+        if: steps.check.outputs.changed == 'true'
+        # OIDC requires npm >=11.5.1. Pin npm 11 to avoid npm 12 install-policy changes.
+        run: npm install --global npm@11.21.0 --registry=https://registry.npmjs.org/
 
-      - name: Publish package to NPM
+      - name: Publish package to npm with OIDC
         if: steps.check.outputs.changed == 'true'
-        run: npm publish
+        run: npm publish --access public --registry=https://registry.npmjs.org/
         working-directory: client/packages/lowcoder-sdk
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.LOWCODERNPMBOT }}