chore: import upstream snapshot with attribution

2026-07-13 12:01:57 +08:00
commit 9dda3e2451
399 changed files with 118131 additions and 0 deletions
@@ -0,0 +1,140 @@
+# CI/CD Flows
+
+## PR Quality Gates (ci.yml)
+
+Trigger: pull_request to develop or master
+
+```
+                          ┌──────────────────┐
+                          │    PR opened      │
+                          └────────┬─────────┘
+                                   │
+                          ┌────────▼─────────┐
+                          │    fmt --all     │
+                          └────────┬─────────┘
+                                   │
+                       ┌───────────▼──────────┐
+                       │ clippy --all-targets │
+                       └───┬───┬───┬───┬───┬──┘
+                           │   │   │   │   │
+           ┌───────────────┘   │   │   │   └────────────────┐
+           │       ┌───────────┘   │   └───────────┐        │
+           ▼       ▼              ▼               ▼        ▼
+     ┌──────────┐ ┌──────────┐ ┌───────────┐ ┌─────────┐ ┌──────────┐
+     │ test     │ │ security │ │ semgrep   │ │benchmark│ │ doc      │
+     │ ubuntu   │ │ cargo    │ │ AST-aware │ │ >=80%   │ │ review   │
+     │ windows  │ │ audit    │ │ diff-only │ │ savings │ │ ai agent │
+     │ macos    │ │ patterns │ │           │ │         │ │          │
+     └────┬─────┘ └────┬─────┘ └─────┬─────┘ └────┬────┘ └────┬─────┘
+          │            │             │             │            │
+          └────────────┴─────────┬───┴─────────────┴────────────┘
+                                 │
+                      ┌──────────▼─────────┐
+                      │  All must pass     │
+                      │  to merge          │
+                      └────────────────────┘
+
+     + DCO check (independent, develop PRs only)
+     + Dependabot (weekly: Cargo deps + GitHub Actions)
+```
+
+## Merge to develop — pre-release (cd.yml)
+
+Trigger: push to develop | workflow_dispatch (not master) | Concurrency: cancel-in-progress
+
+```
+     ┌──────────────────┐
+     │ push to develop   │
+     │ OR dispatch       │
+     └────────┬─────────┘
+              │
+     ┌────────▼──────────────────┐
+     │ pre-release                │
+     │ compute next version      │
+     │ from conventional commits │
+     │ tag = v{next}-rc.{run}    │
+     └────────┬──────────────────┘
+              │
+     ┌────────▼──────────────────┐
+     │ release.yml               │
+     │ prerelease = true         │
+     └────────┬──────────────────┘
+              │
+     ┌────────▼──────────────────┐
+     │ Build                     │
+     │ 5 platforms + DEB + RPM   │
+     └────────┬──────────────────┘
+              │
+     ┌────────▼──────────────────┐
+     │ GitHub Release            │
+     │ (pre-release badge)       │
+     │                           │
+     │ Discord:  SKIPPED         │
+     │ Homebrew: SKIPPED         │
+     └──────────────────────────┘
+```
+
+## Merge to master — stable release (cd.yml)
+
+Trigger: push to master (only) | Concurrency: never cancelled
+
+```
+     ┌──────────────────┐
+     │ push to master    │
+     └────────┬─────────┘
+              │
+     ┌────────▼──────────────────┐
+     │ release-please            │
+     │ analyze conventional      │
+     │ commits                   │
+     └────────┬──────────────────┘
+              │
+         ┌────┴────────────────┐
+         │                     │
+    no release           release created
+         │                     │
+         ▼                     ▼
+  ┌──────────────┐    ┌───────────────────────┐
+  │ create/update│    │ release.yml            │
+  │ release PR   │    │ prerelease = false     │
+  └──────────────┘    └───────────┬───────────┘
+                                  │
+                     ┌────────────▼────────────┐
+                     │ Build                   │
+                     │ 5 platforms + DEB + RPM  │
+                     └────────────┬────────────┘
+                                  │
+                     ┌────────────▼────────────┐
+                     │ GitHub Release           │
+                     │ (stable, "Latest" badge) │
+                     └──┬─────────┬─────────┬──┘
+                        │         │         │
+                        ▼         ▼         ▼
+                    Discord   Homebrew   latest
+                    notify    tap update  tag
+```
+
+## Manual release (release.yml)
+
+Trigger: workflow_dispatch
+
+```
+     ┌────────────────────────┐
+     │ workflow_dispatch       │
+     │ inputs: tag, prerelease │
+     └───────────┬────────────┘
+                 │
+     ┌───────────▼────────────┐
+     │ Full build pipeline     │
+     │ 5 platforms + DEB + RPM │
+     └───────────┬────────────┘
+                 │
+          ┌──────┴──────┐
+          │             │
+   prerelease=false  prerelease=true
+          │             │
+          ▼             ▼
+     Discord        pre-release
+     Homebrew       badge only
+     latest tag
+```