ci: run CI on push to dev and main, widen coverage, and fix the release skill for this fork

[JOY (JOY)]

What this does

Two independent process fixes. Neither changes application behaviour.

1. CI actually runs on dev

deploy-beta.yml triggers on push: branches: [dev] and publishes ghcr.io/dos/crove-desk:beta. ci.yml triggered on pull_request only. A direct push to dev therefore built and shipped an image that no test had ever seen.

This happened in practice: commits e66b1043 (a Critical security fix), 99355186, 2f369422, 1e7c8327 and c69bc397 all produced a successful Build & Deploy Beta run and zero CI runs. The gap is recorded as PROC-01 in docs/CROVE_DESK_AUDIT.html.

The push trigger uses the same paths-ignore list as pull_request, so documentation-only pushes still skip.

2. The jobs cover what already exists

Adding a trigger to a job that misses half the test files is half a fix. Every addition below was run locally on this tree and passed:

Step	Why
go vet -tags dev ./...	Never ran in CI.
./internal/builders/... ./internal/bootstrap/... ./internal/handlers/... added to the Go test command	All three contain test files that CI never executed. internal/builders alone has six _test.go files.
node --test "**/*.test.mjs"	68 tests across 13 suites, including the i18n and SDK suites. Nothing was running them.
pnpm lint with continue-on-error: true	The tree carries six pre-existing react-hooks errors (PROC-16). Making lint blocking before those are fixed would turn every unrelated PR red, so this reports without gating.

-tags dev is required for the vet and test steps: without it the //go:embed all:out directive in web/embed.go fails on a checkout that has no web/out.

Known limitation, not fixed here: CI and deploy-beta.yml still run independently, so a push to dev can publish a beta image while CI is still red. Making the image build wait on CI needs workflow_run chaining in deploy-beta.yml, which is a larger change to a pipeline that currently works.

3. .codex/skills/release-version rewritten for the fork

The skill was inherited from upstream and no longer described this repository:

• It required a bare ^v\d+\.\d+\.\d+$ tag and rejected anything else. Bare tags allocate from the upstream namespace, and sync-upstream.yml:79-88 skips the entire sync when this fork already holds a tag matching upstream's target tag. v1.7.0 here would silently disable a future upstream v1.7.0 sync.
• It wrote bilingual changelogs to docs/zh/docs/changelog.md and docs/en/docs/changelog.md. The docs submodule was removed in upstream PR chore: remove docs submodule pointing to a private repository huabeitech/agent-desk#35; those paths do not exist. The fork's changelog is the root CHANGELOG.md, English only, Keep a Changelog format.
• It published Release pages to Gitee and to huabeitech/agent-desk. There is no Gitee mirror and the release repo is DOS/Crove-Desk.
• It had no step for reconciling dev with main. That omission is not theoretical: the web/pnpm-workspace.yaml fix and the 28 dependency overrides that took Dependabot from 162 alerts to 34 existed only on main, so tagging dev without merging main in first would have regressed them. The skill now covers the reconciliation, including resolving a pnpm-lock.yaml conflict by running pnpm install --frozen-lockfile rather than reasoning about it.
• It did not mention that neither deploy workflow deploys anything. Both only build and push an OCI image; the operator still pulls on the host.

references/changelog-style.md keeps the useful Keep / Drop-or-Compress / Before-Finalizing guidance, drops the bilingual sections, and adds a rule for partial fixes: state what a fix does not cover, because marking a half-fixed issue as fixed removes it from tracking without removing it from the product.

scripts/collect_release_context.py now validates a release target against ^v\d+\.\d+\.\d+-crove\.\d+$ while still parsing inherited upstream tags (v1.6.3, v20260622) permissively enough to select a baseline from them. Both paths verified:

$ python .codex/skills/release-version/scripts/collect_release_context.py --repo . --tag v1.7.1-crove.1
  "previous_tag": "v1.7.0-crove.1", "previous_tag_source": "semver", ...

$ python .codex/skills/release-version/scripts/collect_release_context.py --repo . --tag v1.7.1
  {"error": "invalid release tag format: v1.7.1", "expected": "vx.y.z-crove.n", ...}   exit 1

agents/openai.yaml no longer promises to "push docs".

Verification

• ci.yml parsed with js-yaml: three triggers (push, pull_request, workflow_dispatch), push.branches = ["main","dev"], backend steps Checkout | Set up Go | Run Go Vet | Run Go Tests, frontend steps ... | Run Typecheck | Run Node Tests | Run Lint [non-blocking].
• Every command added to CI was executed locally on this tree first: go vet -tags dev ./... clean, go test -count=1 -tags dev over all eight package roots ok, node --test "**/*.test.mjs" 68/68 pass.
• collect_release_context.py exercised in both directions, output above.
• This pull request is itself the first run of the new configuration.

Not included

Recording the branch-and-pull-request rule in AGENTS.md was attempted and blocked by tooling policy, which requires an explicit owner request to edit that file. The rule is therefore demonstrated by this PR rather than written down. Proposed text, if the owner wants it added under §1 Scope and Priorities:

• Land work through a feature branch and a pull request into dev. Do not commit directly to dev or main: deploy-beta.yml publishes an OCI image on every push to dev, and a PR is the only path where the change is reviewed and where ci.yml gates it before it lands.
• Never run git add -A or git add .. Stage explicit paths only. Other agent sessions regularly hold uncommitted work in this same working tree.
• Do not switch branches, rebase, stash, or add a worktree while another session may hold uncommitted changes. When a commit has to be built without moving HEAD, build it with plumbing: a temporary GIT_INDEX_FILE, read-tree, add, write-tree, commit-tree, then git branch <name> <commit>.

---

Note

Low Risk
Changes are limited to CI triggers, test coverage, and release documentation/tooling; no production app logic is modified.

Overview
CI now runs on direct pushes to dev and main, closing the gap where deploy-beta.yml could ship a :beta image without any workflow having tested the commit. The workflow adds go vet -tags dev, expands Go tests to internal/builders, bootstrap, and handlers, runs node --test "**/*.test.mjs", and reports pnpm lint with continue-on-error (PROC-16).

The release-version Codex skill is rewritten for this fork: vX.Y.Z-crove.N tags (bare vX.Y.Z rejected because of sync-upstream.yml), root CHANGELOG.md instead of removed bilingual docs submodule, dev/main reconciliation before tagging, pre-tag verification commands, GitHub Release on DOS/Crove-Desk only (no Gitee). collect_release_context.py enforces fork tag format while still parsing upstream tags for baselines; changelog-style.md and agents/openai.yaml match the new process.

No application runtime behavior changes—process and automation only.

^{Reviewed by Cursor Bugbot for commit 8a3979e. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_100ea553-aece-47ef-b607-19bc390ce680)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 6b52a748-f7c9-46b0-bf6b-0600aaa55896

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the release-version skill documentation, configuration, and helper script to adapt to a fork-specific release process. This includes using vX.Y.Z-crove.N tags, maintaining a single English CHANGELOG.md at the repository root, and targeting the DOS/Crove-Desk repository. Feedback was provided on the verification commands in SKILL.md, suggesting the use of subshells for sequential cd web commands to prevent directory resolution errors in persistent shell sessions.

[gemini-code-assist]

If these commands are executed sequentially in a single persistent shell session (which is common for AI agents or developers running scripts), the second and third cd web commands will fail because the shell is already inside the web directory.

Using subshells (cd web && ...) ensures that the working directory of the parent shell remains at the repository root, making the sequence robust and preventing directory resolution errors.

Suggested change

	cd web && pnpm install --frozen-lockfile
	cd web && pnpm typecheck
	cd web && node --test "**/*.test.mjs"
	(cd web && pnpm install --frozen-lockfile)
	(cd web && pnpm typecheck)
	(cd web && node --test "**/*.test.mjs")