Fix security deps 20260609

.github/README_DOCS.md

@@ -0,0 +1,78 @@
+# GitHub Pages 文档部署指南
+
+## 快速开始
+
+### 1. 启用 GitHub Pages
+
+1. 访问：https://github.com/upbeat-backbone-bose/als/settings/pages
+2. **Source** 选择：**GitHub Actions**
+3. 保存设置
+
+### 2. 推送文档
+
+```bash
+cd /workspace
+
+# 添加文档
+git add docs/ .github/workflows/docs.yml
+
+# 提交
+git commit -m "docs: 添加项目文档"
+
+# 推送（自动部署）
+git push origin master
+```
+
+### 3. 查看部署
+
+1. Actions → **Deploy Docs to GitHub Pages**
+2. 等待完成（1-2 分钟）
+3. 访问：`https://upbeat-backbone-bose.github.io/als/`
+
+## 目录结构
+
+```
+als/
+├── docs/                          # 文档目录（提交到 git）
+│   ├── README.md                  # 文档首页
+│   ├── ARCHITECTURE.md            # 系统架构
+│   ├── INTERFACES.md              # 接口文档
+│   ├── DEVELOPER_GUIDE.md         # 开发者指南
+│   ├── mkdocs.yml                 # MkDocs 配置（可选）
+│   ├── 专有概念/
+│   └── 模块/
+└── .github/workflows/
+    └── docs.yml                   # 自动部署工作流
+```
+
+## 更新文档
+
+```bash
+# 编辑文档
+vim docs/ARCHITECTURE.md
+
+# 提交并推送
+git add docs/
+git commit -m "docs: 更新文档"
+git push origin master
+```
+
+## 说明
+
+- **自动部署**: 推送到 master 且修改 `docs/` 时自动触发
+- **部署地址**: `https://upbeat-backbone-bose.github.io/als/`
+- **文档格式**: Markdown 或 MkDocs（推荐）
+
+## 本地预览（可选）
+
+```bash
+cd docs
+pip install mkdocs mkdocs-material
+mkdocs serve
+```
+
+访问：http://127.0.0.1:8000
+
+---
+
+详细指南：[docs/DEPLOYMENT_GUIDE.md](docs/DEPLOYMENT_GUIDE.md)

.github/dependabot.yml

@@ -11,3 +11,15 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+  - package-ecosystem: "gomod"
+    directory: "./backend" # Location of package manifests
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/ui"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  build-ui:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6.0.2
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v6.4.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: 'ui/package-lock.json'
+      - name: Install dependencies
+        run: npm ci
+        working-directory: ./ui
+      - name: Build UI
+        run: npm run build
+        working-directory: ./ui
+      - name: Upload UI artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: ui-dist
+          path: ui/dist
+          retention-days: 5
+
+  backend:
+    runs-on: ubuntu-latest
+    needs: build-ui
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+      - name: Setup Go
+        uses: actions/setup-go@v6.4.0
+        with:
+          go-version-file: "backend/go.mod"
+          cache-dependency-path: "backend/go.sum"
+      - name: Download UI artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: ui-dist
+          path: backend/embed/ui
+      - name: Verify UI files exist
+        run: test -d backend/embed/ui && test -f backend/embed/ui/index.html
+      - name: Test backend
+        run: go test ./...
+        working-directory: ./backend
+      - name: Build backend
+        run: go build -v ./...
+        working-directory: ./backend

.github/workflows/docker-image.yml

@@ -1,40 +1,91 @@
 name: 'docker image build'
 
 on:
-  schedule:
-  - cron: "0 0 */7 * *"
+  release:
+    types: [published]
   workflow_dispatch:
-  push:
-    tags:
-      - '*'
+    inputs:
+      docker_tags:
+        description: 'Docker 镜像标签（多个用逗号分隔）'
+        required: false
+        default: 'test'
+        type: string
+      push_image:
+        description: '是否推送到远程仓库'
+        required: false
+        default: 'false'
+        type: boolean
 
+permissions:
+  contents: read
+  attestations: write
+  id-token: write
 
 jobs:
+  build-ui:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6.0.2
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v6.4.0
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: 'ui/package-lock.json'
+      - name: Install dependencies
+        run: npm ci
+        working-directory: ./ui
+      - name: Build UI
+        run: npm run build
+        working-directory: ./ui
+      - name: Upload UI artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: ui-dist
+          path: ui/dist
+          retention-days: 5
+
   docker:
     runs-on: ubuntu-latest
+    needs: build-ui
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v3
-      - name: Checkout submodules
-        run: git submodule update --init --recursive
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      -
-        name: Login to DockerHub
-        uses: docker/login-action@v2
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          submodules: recursive
+      - name: Download UI artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: ui-dist
+          path: backend/embed/ui
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4.1.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.1.0
+      - name: Login to DockerHub
+        uses: docker/login-action@v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v3
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ryachueng/looking-glass-server
+          tags: |
+            type=semver,pattern={{version}},enable=${{ github.event_name == 'release' }}
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+            type=raw,value=test,enable=${{ github.event.inputs.docker_tags == 'test' }}
+      - name: Build and push
+        uses: docker/build-push-action@v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64/v8
-          push: true
-          tags: wikihostinc/looking-glass-server:latest
+          push: ${{ github.event_name == 'release' || github.event.inputs.push_image == 'true' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          sbom: true
+          provenance: true

.github/workflows/docs.yml

@@ -0,0 +1,62 @@
+name: Deploy Docs to GitHub Pages
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'requirements-dev.txt'
+      - '.github/workflows/docs.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install docs dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Build docs site
+        env:
+          NO_MKDOCS_2_WARNING: "1"
+        run: mkdocs build
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v6
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5