Dev #62
Open
Dev #62
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 9 commits
June 27, 2024 09:43
…n server case, need to discuss more
added 9 commits
December 25, 2025 22:46
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+14
to
+79
| name: Build binaries (Linux/macOS) | ||
| env: | ||
| SQLX_OFFLINE: true | ||
| strategy: | ||
| matrix: | ||
| include: | ||
| - os: ubuntu-latest | ||
| target: x86_64-unknown-linux-gnu | ||
| artifact_name: stacker-linux-x86_64 | ||
| - os: macos-latest | ||
| target: x86_64-apple-darwin | ||
| artifact_name: stacker-macos-x86_64 | ||
| - os: macos-latest | ||
| target: aarch64-apple-darwin | ||
| artifact_name: stacker-macos-aarch64 | ||
| runs-on: ${{ matrix.os }} | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Build | ||
| run: cargo build --verbose | ||
| - name: Run tests | ||
| run: cargo test --verbose | ||
| - uses: actions/checkout@v4 | ||
| - name: Verify .sqlx cache exists | ||
| run: | | ||
| ls -lh .sqlx/ || echo ".sqlx directory not found" | ||
| find .sqlx -type f 2>/dev/null | wc -l | ||
| - name: Install Rust toolchain | ||
| uses: actions-rs/toolchain@v1 | ||
| with: | ||
| toolchain: stable | ||
| target: ${{ matrix.target }} | ||
| override: true | ||
| - name: Cache cargo registry | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: ~/.cargo/registry | ||
| key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-cargo-registry- | ||
| - name: Cache cargo index | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: ~/.cargo/git | ||
| key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-cargo-index- | ||
| - name: Cache target directory | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: target | ||
| key: ${{ runner.os }}-target-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-target-${{ matrix.target }}- | ||
| - name: Build server (release) | ||
| run: cargo build --release --target ${{ matrix.target }} --bin server --verbose | ||
|
|
||
| - name: Build console (release with features) | ||
| run: cargo build --release --target ${{ matrix.target }} --bin console --features explain --verbose | ||
| - name: Prepare binaries | ||
| run: | | ||
| mkdir -p artifacts | ||
| cp target/${{ matrix.target }}/release/server artifacts/server | ||
| cp target/${{ matrix.target }}/release/console artifacts/console | ||
| tar -czf ${{ matrix.artifact_name }}.tar.gz -C artifacts . | ||
| - name: Upload binaries | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: ${{ matrix.artifact_name }} | ||
| path: ${{ matrix.artifact_name }}.tar.gz | ||
| retention-days: 7 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 days ago
To fix the issue, we should explicitly declare the permissions for the GITHUB_TOKEN used by this workflow and restrict them to the minimum required. This workflow only needs to read repository contents to build and upload artifacts, so contents: read is sufficient. We can set permissions at the workflow root so it applies to all jobs (currently only build), or directly under the build job. Root-level is cleaner and recommended.
Concretely, in .github/workflows/rust.yml, add a permissions: block near the top, after name: Rust and before on:. Set it to:
permissions:
contents: readNo additional imports or dependencies are required, and this does not alter any existing build behavior. It only constrains what the automatically provided GITHUB_TOKEN can do.
Suggested changeset
1
.github/workflows/rust.yml
| @@ -1,5 +1,8 @@ | ||
| name: Rust | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ dev, main ] |
Copilot is powered by AI and may make mistakes. Always verify output.
added 17 commits
December 26, 2025 15:36
- Add MCP protocol types with JSON-RPC 2.0 support - Implement WebSocket handler with heartbeat mechanism - Create tool registry with pluggable handler architecture - Add session management for conversation context - Register /mcp WebSocket endpoint with OAuth auth - Add Casbin rules for group_user and group_admin access - Include comprehensive unit tests for protocol layer Components: - src/mcp/protocol.rs: JSON-RPC 2.0 + MCP types - src/mcp/websocket.rs: Actix WebSocket actor - src/mcp/registry.rs: Tool handler infrastructure - src/mcp/session.rs: Session state management - migrations/20251227140000: Casbin authorization rules Dependencies: - actix 0.13.5 (WebSocket actor framework) - actix-web-actors 4.3.1 (Actix-web WS integration) - async-trait 0.1.77 (Tool handler trait) Supports: - initialize, tools/list, tools/call methods - OAuth bearer token authentication - Casbin role-based authorization - Structured logging with tracing - Graceful connection handling
| "{}/api/1.0/stacks?where={{\"user_id\":\"{}\"}}", | ||
| self.base_url, user_id | ||
| ); | ||
| let mut req = self.http_client.get(&url); |
Check failure
Code scanning / CodeQL
Cleartext transmission of sensitive information High
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.