chore: import upstream snapshot with attribution

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,39 @@
+name: 漏洞反馈
+description: 【供中文用户】报错或漏洞请使用这个模板创建，不使用此模板创建的异常、漏洞相关issue将被直接关闭。由于自己操作不当/不甚了解所用技术栈引起的网络连接问题恕无法解决，请勿提 issue。容器间网络连接问题，参考文档 https://link.langbot.app/zh/docs/network  
+title: "[Bug]: "
+labels: ["bug?"]
+body:
+  - type: input
+    attributes:
+      label: 运行环境
+      description: LangBot 版本、操作系统、系统架构、**Python版本**、**主机地理位置**
+      placeholder: 例如：v3.3.0、CentOS x64 Python 3.10.3、Docker
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: 部署版本
+      description: 请选择您使用的 LangBot 部署版本。
+      options:
+        - 社区版
+        - 云服务
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: 异常情况
+      description: 完整描述异常情况，什么时候发生的、发生了什么。**请附带日志信息。** 
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: 复现步骤
+      description: 提供越多信息，我们会越快解决问题，建议多提供配置截图；**如果涉及 Dify、n8n、Langflow 等外部平台，请提供应用的导出文件（如 Dify 应用的 DSL），我们将更快回复您。**
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: 启用的插件
+      description: 有些情况可能和插件功能有关，建议提供插件启用情况。
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/bug-report_en.yml

@@ -0,0 +1,39 @@
+name: Bug report
+description: Report bugs or vulnerabilities using this template. For container network connection issues, refer to the documentation https://link.langbot.app/en/docs/network
+title: "[Bug]: "
+labels: ["bug?"]
+body:
+  - type: input
+    attributes:
+      label: Runtime environment
+      description: LangBot version, operating system, system architecture, **Python version**, **host location**
+      placeholder: "For example: v3.3.0, CentOS x64 Python 3.10.3, Docker"
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: Deployment version
+      description: Please select the LangBot deployment version you are using.
+      options:
+        - Community Edition
+        - Cloud Service
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Exception
+      description: Describe the exception in detail, what happened and when it happened. **Please include log information.** 
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reproduction steps
+      description: How to reproduce this problem, the more detailed the better; the more information you provide, the faster we will solve the problem.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Enabled plugins
+      description: Some cases may be related to plugin functionality, so please provide the plugin enablement status.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -0,0 +1,21 @@
+name: 需求建议
+title: "[Feature]: "
+labels: []
+description: "【供中文用户】新功能或现有功能优化请使用这个模板；不符合类别的issue将被直接关闭"
+body:
+  - type: dropdown
+    attributes:
+      label: 这是一个？
+      description: 新功能建议还是现有功能优化
+      options:
+        - 新功能
+        - 现有功能优化
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: 详细描述
+      description: 详细描述，越详细越好
+    validations:
+      required: true
+      

.github/ISSUE_TEMPLATE/feature-request_en.yml

@@ -0,0 +1,21 @@
+name: Feature request
+title: "[Feature]: "
+labels: []
+description: "New features or existing feature improvements should use this template; issues that do not match will be closed directly"
+body:
+  - type: dropdown
+    attributes:
+      label: This is a?
+      description: New feature request or existing feature improvement
+      options:
+        - New feature
+        - Existing feature improvement
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Detailed description
+      description: Detailed description, the more detailed the better
+    validations:
+      required: true
+      

.github/ISSUE_TEMPLATE/submit-plugin.yml

@@ -0,0 +1,24 @@
+name: 提交新插件
+title: "[Plugin]: 请求登记新插件"
+labels: ["独立插件"]
+description: "【供中文用户】本模板供且仅供提交新插件使用"
+body:
+  - type: input
+    attributes:
+      label: 插件名称
+      description: 填写插件的名称
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: 插件代码库地址
+      description: 仅支持 Github
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: 插件简介
+      description: 插件的简介
+    validations:
+      required: true
+      

.github/ISSUE_TEMPLATE/submit-plugin_en.yml

@@ -0,0 +1,24 @@
+name: Submit a new plugin
+title: "[Plugin]: Request to register a new plugin"
+labels: ["Independent Plugin"]
+description: "This template is only for submitting new plugins"
+body:
+  - type: input
+    attributes:
+      label: Plugin name
+      description: Fill in the name of the plugin
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Plugin code repository address
+      description: Only support Github
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Plugin description
+      description: The description of the plugin
+    validations:
+      required: true
+      

.github/dependabot.yml

@@ -0,0 +1,13 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "pip" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"
+    allow:
+      - dependency-name: "openai"

.github/pull_request_template.md

@@ -0,0 +1,33 @@
+## 概述 / Overview
+
+> 请在此部分填写你实现/解决/优化的内容:  
+> Summary of what you implemented/solved/optimized:
+> 
+
+### 更改前后对比截图 / Screenshots
+
+> 请在此部分粘贴更改前后对比截图（可以是界面截图、控制台输出、对话截图等）:  
+> Please paste the screenshots of changes before and after here (can be interface screenshots, console output, conversation screenshots, etc.):
+> 
+> 修改前 / Before:
+> 
+> 修改后 / After:
+> 
+
+## 检查清单 / Checklist
+
+### PR 作者完成 / For PR author
+
+*请在方括号间写`x`以打勾 / Please tick the box with `x`*
+
+- [ ] 阅读仓库[贡献指引](https://github.com/langbot-app/LangBot/blob/master/CONTRIBUTING.md)了吗？ / Have you read the [contribution guide](https://github.com/langbot-app/LangBot/blob/master/CONTRIBUTING.md)?
+- [ ] 我已签署或将在机器人提示后签署 [CLA](https://github.com/langbot-app/LangBot/blob/master/CLA.md)。 / I have signed, or will sign when prompted by the bot, the [CLA](https://github.com/langbot-app/LangBot/blob/master/CLA.md).
+- [ ] 与项目所有者沟通过了吗？ / Have you communicated with the project maintainer?
+- [ ] 我确定已自行测试所作的更改，确保功能符合预期。 / I have tested the changes and ensured they work as expected.
+
+### 项目维护者完成 / For project maintainer
+
+- [ ] 相关 issues 链接了吗？ / Have you linked the related issues?
+- [ ] 配置项写好了吗？迁移写好了吗？生效了吗？ / Have you written the configuration items? Have you written the migration? Has it taken effect?
+- [ ] 依赖加到 pyproject.toml 和 core/bootutils/deps.py 了吗 / Have you added the dependencies to pyproject.toml and core/bootutils/deps.py?
+- [ ] 文档编写了吗？ / Have you written the documentation?

.github/workflows/build-dev-image.yaml

@@ -0,0 +1,29 @@
+name: Build Dev Image
+
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  build-dev-image:
+    runs-on: ubuntu-latest
+    # 如果是tag则跳过
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: Generate Tag
+        id: generate_tag
+        run: |
+          # 获取分支名称，把/替换为-
+          echo ${{ github.ref }} | sed 's/refs\/heads\///g' | sed 's/\//-/g'
+          echo ::set-output name=tag::$(echo ${{ github.ref }} | sed 's/refs\/heads\///g' | sed 's/\//-/g')
+      - name: Login to Registry
+        run: docker login --username=${{ secrets.DOCKER_USERNAME }} --password ${{ secrets.DOCKER_PASSWORD }}
+      - name: Build Docker Image
+        run: |
+          docker buildx create --name mybuilder --use
+          docker build -t rockchin/langbot:${{ steps.generate_tag.outputs.tag }} . --push

.github/workflows/build-docker-image.yml

@@ -0,0 +1,47 @@
+name: Build Docker Image
+on:
+  ## 发布release的时候会自动构建
+  release:
+    types: [published]
+jobs:
+  publish-docker-image:
+    runs-on: ubuntu-latest
+    name: Build image
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: judge has env GITHUB_REF  # 如果没有GITHUB_REF环境变量，则把github.ref变量赋值给GITHUB_REF
+        run: |
+          if [ -z "$GITHUB_REF" ]; then
+            export GITHUB_REF=${{ github.ref }}
+            echo $GITHUB_REF
+          fi
+      - name: Check version
+        id: check_version
+        run: |
+          echo $GITHUB_REF
+          # 如果是tag，则去掉refs/tags/前缀
+          if [[ $GITHUB_REF == refs/tags/* ]]; then
+            echo "It's a tag"
+            echo $GITHUB_REF
+            echo $GITHUB_REF | awk -F '/' '{print $3}'
+            echo ::set-output name=version::$(echo $GITHUB_REF | awk -F '/' '{print $3}')
+          else
+            echo "It's not a tag"
+            echo $GITHUB_REF
+            echo ::set-output name=version::${GITHUB_REF}
+          fi
+      - name: Login to Registry
+        run: docker login --username=${{ secrets.DOCKER_USERNAME }} --password ${{ secrets.DOCKER_PASSWORD }}
+      - name: Create Buildx
+        run: docker buildx create --name mybuilder --use
+      - name: Build for Release # only relase, exlude pre-release
+        if: ${{ github.event.release.prerelease == false }}
+        run: docker buildx build --platform linux/arm64,linux/amd64 -t rockchin/langbot:${{ steps.check_version.outputs.version }} -t rockchin/langbot:latest . --push
+      - name: Build for Pre-release # no update for latest tag
+        if: ${{ github.event.release.prerelease == true }}
+        run: docker buildx build --platform linux/arm64,linux/amd64 -t rockchin/langbot:${{ steps.check_version.outputs.version }} . --push

.github/workflows/build-release-artifacts.yaml

@@ -0,0 +1,62 @@
+name: Build Release Artifacts
+
+on:
+  workflow_dispatch:
+  ## 发布release的时候会自动构建
+  release:
+    types: [published]
+
+jobs:
+  build-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          persist-credentials: false
+
+      - name: Check version
+        id: check_version
+        run: |
+          echo $GITHUB_REF
+          # 如果是tag，则去掉refs/tags/前缀
+          if [[ $GITHUB_REF == refs/tags/* ]]; then
+            echo "It's a tag"
+            echo $GITHUB_REF
+            echo $GITHUB_REF | awk -F '/' '{print $3}'
+            echo ::set-output name=version::$(echo $GITHUB_REF | awk -F '/' '{print $3}')
+          else
+            echo "It's not a tag"
+            echo $GITHUB_REF
+            echo ::set-output name=version::${GITHUB_REF}
+          fi
+
+      - name: Make Temp Directory
+        run: |
+          mkdir -p /tmp/langbot_build_web
+          cp -r . /tmp/langbot_build_web
+      - name: Setup Node
+        uses: actions/setup-node@v2
+        with:
+          node-version: '22'
+      - name: Build Web
+        run: |
+          cd /tmp/langbot_build_web/web
+          npm install
+          npx vite build
+      - name: Package Output
+        run: |
+          cp -r /tmp/langbot_build_web/web/dist ./web
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: langbot-${{ steps.check_version.outputs.version }}-all
+          path: .
+
+      - name: Upload To Release
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_UPLOAD_GITHUB_TOKEN }}
+        run: |
+          # 本目录下所有文件打包成zip
+          zip -r langbot-${{ steps.check_version.outputs.version }}-all.zip .
+          gh release upload ${{ github.event.release.tag_name }} langbot-${{ steps.check_version.outputs.version }}-all.zip

.github/workflows/check-i18n.yml

@@ -0,0 +1,25 @@
+name: Check i18n Keys
+
+on:
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  check-i18n:
+    name: Check i18n Key Consistency
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Check i18n keys against en-US reference
+        run: node web/scripts/check-i18n.mjs

.github/workflows/cla.yml

@@ -0,0 +1,41 @@
+name: "CLA Assistant"
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize, reopened]
+
+permissions:
+  actions: write          # re-run the failed CLA check after signing
+  contents: read          # signatures are stored in the remote langbot-app/cla repo
+  pull-requests: write    # post guidance comments, lock PR after merge
+  statuses: write         # set the commit status
+
+jobs:
+  CLAAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "CLA Assistant"
+        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+        # Upstream repo was archived in 2026-03; pin to the v2.6.1 commit SHA.
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # repo-scope PAT with write access to langbot-app/cla
+          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_PAT }}
+        with:
+          path-to-document: 'https://github.com/langbot-app/LangBot/blob/master/CLA.md'
+          remote-organization-name: 'langbot-app'
+          remote-repository-name: 'cla'
+          path-to-signatures: 'signatures/version1/cla.json'
+          branch: 'main'
+          allowlist: 'dependabot[bot],github-actions[bot],devin-ai-integration[bot],Copilot,renovate[bot],bot*'
+          custom-notsigned-prcomment: |
+            Thank you for your contribution! :heart: Before we can merge this pull request, we need you to sign the [LangBot Contributor License Agreement (CLA)](https://github.com/langbot-app/LangBot/blob/master/CLA.md). You keep full copyright of your code — the CLA grants us a license to use and distribute your contribution. Signing takes 10 seconds and covers all repositories in this organization, permanently.
+
+            感谢您的贡献！合并前请阅读并签署[贡献者许可协议（CLA）](https://github.com/langbot-app/LangBot/blob/master/CLA.md)。您保留代码的全部版权，签署仅需回复下方指定内容，一次签署对本组织全部仓库永久有效。
+          custom-allsigned-prcomment: 'All contributors have signed the CLA. :white_check_mark: 所有贡献者均已签署 CLA。'
+          lock-pullrequest-aftermerge: true
+        # SECURITY: this workflow runs on pull_request_target (it holds secrets and has
+        # write access to the base repository). NEVER add an actions/checkout step that
+        # checks out the PR's code here.

.github/workflows/frontend-tests.yml

@@ -0,0 +1,46 @@
+name: Frontend Tests
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - 'web/**'
+      - '.github/workflows/frontend-tests.yml'
+  push:
+    branches:
+      - master
+      - develop
+    paths:
+      - 'web/**'
+      - '.github/workflows/frontend-tests.yml'
+
+jobs:
+  playwright-smoke:
+    name: Playwright Smoke
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '25'
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 8.9.2
+
+      - name: Install dependencies
+        working-directory: web
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Playwright browsers
+        working-directory: web
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Run Playwright smoke tests
+        working-directory: web
+        run: pnpm test:e2e

.github/workflows/lint.yml

@@ -0,0 +1,60 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - main
+      - master
+      - dev
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+jobs:
+  ruff:
+    name: Ruff Lint & Format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run ruff check
+        run: uv run ruff check src/langbot/ tests/ --output-format=concise
+
+      - name: Run ruff format
+        run: uv run ruff format src --check
+
+  frontend:
+    name: Frontend Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '25'
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install dependencies
+        working-directory: web
+        run: pnpm install
+
+      - name: Run lint
+        working-directory: web
+        run: pnpm lint

.github/workflows/publish-to-pypi.yml

@@ -0,0 +1,46 @@
+name: Build and Publish to PyPI
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # Required for trusted publishing to PyPI
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Build frontend
+        run: |
+          cd web
+          npm install -g pnpm
+          pnpm install
+          pnpm build
+          mkdir -p ../src/langbot/web/dist
+          cp -r dist ../src/langbot/web/
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: "latest"
+
+      - name: Build package
+        run: |
+          uv build
+
+      - name: Publish to PyPI
+        run: |
+          uv publish --token ${{ secrets.PYPI_TOKEN }}

.github/workflows/run-tests.yml

@@ -0,0 +1,193 @@
+name: Unit Tests
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, synchronize]
+    paths:
+      - 'src/langbot/**'
+      - 'tests/**'
+      - '.github/workflows/run-tests.yml'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - 'run_tests.sh'
+      - 'scripts/test-*.sh'
+  push:
+    branches:
+      - master
+      - develop
+      - 'feat/**'
+    # No path filter on push: every push to the branches above runs the
+    # full unit-test suite. feat/** branches in particular must be tested
+    # on every push (they accumulate large changes before a PR exists).
+
+jobs:
+  test:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.11', '3.12', '3.13']
+      fail-fast: false
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run unit + smoke tests
+        run: uv run pytest tests/unit_tests/ tests/smoke/ -q --tb=short
+
+      - name: Test Summary
+        if: always()
+        run: |
+          echo "## Unit Tests Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Python Version: ${{ matrix.python-version }}" >> $GITHUB_STEP_SUMMARY
+          echo "Test Status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+
+  integration:
+    name: Fast Integration Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run fast integration tests
+        run: uv run pytest tests/integration/ -m "not slow" -q --tb=short
+
+      - name: Integration Test Summary
+        if: always()
+        run: |
+          echo "## Integration Tests Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Test Status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+
+  e2e:
+    name: E2E Startup Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run E2E startup tests
+        run: uv run pytest tests/e2e -q --tb=short
+
+      - name: E2E Test Summary
+        if: always()
+        run: |
+          echo "## E2E Startup Test Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Test Status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+
+  box-integration:
+    name: Box Integration Tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Check Docker runtime
+        run: docker info
+
+      - name: Run Box integration tests
+        run: uv run pytest tests/integration_tests -q --tb=short
+
+      - name: Box Integration Test Summary
+        if: always()
+        run: |
+          echo "## Box Integration Test Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Test Status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+
+  coverage:
+    name: Coverage Gate
+    runs-on: ubuntu-latest
+    needs: [test, integration]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run coverage (unit + smoke)
+        run: |
+          uv run pytest tests/unit_tests/ tests/smoke/ \
+            --cov=langbot \
+            --cov-report=xml \
+            --cov-report=term-missing \
+            --cov-fail-under=18 \
+            -q --tb=short
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage.xml
+          flags: unit-tests
+          name: coverage-report
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+      - name: Coverage Summary
+        if: always()
+        run: |
+          echo "## Coverage Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Threshold: 18%" >> $GITHUB_STEP_SUMMARY
+          echo "Status: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/test-dev-image.yaml

@@ -0,0 +1,108 @@
+name: Test Dev Image
+
+on:
+  workflow_run:
+    workflows: ["Build Dev Image"]
+    types:
+      - completed
+    branches:
+      - master
+
+jobs:
+  test-dev-image:
+    runs-on: ubuntu-latest
+    # Only run if the build workflow succeeded
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    
+    permissions:
+      contents: read
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Update Docker Compose to use master tag
+        working-directory: ./docker
+        run: |
+          # Replace 'latest' with 'master' tag for testing the dev image
+          sed -i 's/rockchin\/langbot:latest/rockchin\/langbot:master/g' docker-compose.yaml
+          echo "Updated docker-compose.yaml to use master tag:"
+          cat docker-compose.yaml
+
+      - name: Start Docker Compose
+        working-directory: ./docker
+        run: docker compose up -d
+
+      - name: Wait and Test API
+        run: |
+          # Function to test API endpoint
+          test_api() {
+            echo "Testing API endpoint..."
+            response=$(curl -s --connect-timeout 10 --max-time 30 -w "\n%{http_code}" http://localhost:5300/api/v1/system/info 2>&1)
+            curl_exit_code=$?
+            
+            if [ $curl_exit_code -ne 0 ]; then
+              echo "Curl failed with exit code: $curl_exit_code"
+              echo "Error: $response"
+              return 1
+            fi
+            
+            http_code=$(echo "$response" | tail -n 1)
+            response_body=$(echo "$response" | head -n -1)
+            
+            if [ "$http_code" = "200" ]; then
+              echo "API is healthy! Response code: $http_code"
+              echo "Response: $response_body"
+              return 0
+            else
+              echo "API returned non-200 response: $http_code"
+              echo "Response body: $response_body"
+              return 1
+            fi
+          }
+
+          # Wait 30 seconds before first attempt
+          echo "Waiting 30 seconds for services to start..."
+          sleep 30
+
+          # Try up to 3 times with 30-second intervals
+          max_attempts=3
+          attempt=1
+
+          while [ $attempt -le $max_attempts ]; do
+            echo "Attempt $attempt of $max_attempts"
+            
+            if test_api; then
+              echo "Success! API is responding correctly."
+              exit 0
+            fi
+            
+            if [ $attempt -lt $max_attempts ]; then
+              echo "Retrying in 30 seconds..."
+              sleep 30
+            fi
+            
+            attempt=$((attempt + 1))
+          done
+
+          # All attempts failed
+          echo "Failed to get healthy response after $max_attempts attempts"
+          exit 1
+
+      - name: Show Container Logs on Failure
+        if: failure()
+        working-directory: ./docker
+        run: |
+          echo "=== Docker Compose Status ==="
+          docker compose ps
+          echo ""
+          echo "=== LangBot Logs ==="
+          docker compose logs langbot
+          echo ""
+          echo "=== Plugin Runtime Logs ==="
+          docker compose logs langbot_plugin_runtime
+
+      - name: Cleanup
+        if: always()
+        working-directory: ./docker
+        run: docker compose down

.github/workflows/test-migrations.yml

@@ -0,0 +1,78 @@
+name: Test Migrations
+
+on:
+  push:
+    branches:
+      - main
+      - master
+      - dev
+    paths:
+      - 'src/langbot/pkg/persistence/**'
+      - 'src/langbot/pkg/entity/persistence/**'
+      - 'tests/integration/persistence/**'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - 'src/langbot/pkg/persistence/**'
+      - 'src/langbot/pkg/entity/persistence/**'
+      - 'tests/integration/persistence/**'
+
+jobs:
+  test-migrations-sqlite:
+    name: Migrations (SQLite)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run SQLite migration tests
+        run: uv run pytest tests/integration/persistence/test_migrations.py -q --tb=short
+
+  test-migrations-postgres:
+    name: Migrations (PostgreSQL)
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: langbot
+          POSTGRES_PASSWORD: langbot
+          POSTGRES_DB: langbot_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U langbot"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run PostgreSQL migration tests
+        env:
+          TEST_POSTGRES_URL: postgresql+asyncpg://langbot:langbot@localhost:5432/langbot_test
+        run: uv run pytest tests/integration/persistence/test_migrations_postgres.py -q --tb=short