chore: import upstream snapshot with attribution

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: usememos

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,162 @@
+name: Bug Report
+description: Report reproducible behavior that is broken in the current version
+type: Bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Please help maintainers reproduce it on current code.
+
+        Before submitting:
+        - Search [existing issues](https://github.com/usememos/memos/issues) to avoid duplicates.
+        - Upgrade and retest with the [latest release](https://github.com/usememos/memos/releases/latest), current `main`, or the [demo site](https://demo.usememos.com/).
+        - Use [Discussions](https://github.com/usememos/memos/discussions) for questions, setup help, or configuration troubleshooting.
+
+        Maintainers normally fix bugs in current code and future releases, not older released versions.
+
+  - type: checkboxes
+    id: pre-check
+    attributes:
+      label: Pre-submission Checklist
+      options:
+        - label: I have searched existing issues and confirmed this has not already been reported
+          required: true
+        - label: I have reproduced this bug on the latest Memos release, current `main`, or the demo site, or this report is specifically about upgrading to the latest release
+          required: true
+        - label: This is a bug report, not a question or configuration request
+          required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected Area
+      description: Choose the main area where the bug appears.
+      multiple: true
+      options:
+        - Web UI
+        - API
+        - Authentication / SSO
+        - Database / migration
+        - Resources / attachments
+        - Search / filters
+        - Markdown / editor
+        - Deployment / startup
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: reproduced-on
+    attributes:
+      label: Reproduced On
+      description: Where did you confirm the issue still happens?
+      options:
+        - Latest release
+        - Current main branch
+        - Demo site
+        - Upgrade to latest release
+        - I cannot test the latest version
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Memos Version Tested
+      description: Report the exact version where you reproduced the bug. Use the version shown in **Settings > System**, the container image tag, the release binary version, or `memos --version`. Please do not write `latest` only.
+      placeholder: "v0.29.x, ghcr.io/usememos/memos:v0.29.x, main@abcdef, or demo site"
+    validations:
+      required: true
+
+  - type: input
+    id: previous-version
+    attributes:
+      label: Previous Version
+      description: If this happened after an upgrade, enter the version you upgraded from. Leave blank if not applicable.
+      placeholder: "v0.28.x, unknown, or not applicable"
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment Details
+      description: Include the deployment, database, client, and network details that apply.
+      placeholder: |
+        - Deployment: Docker / binary / source / demo site
+        - Database: SQLite / PostgreSQL / MySQL
+        - Browser: Firefox 126 on macOS 15
+        - Server OS: Ubuntu 24.04
+        - Reverse proxy: nginx / Caddy / Traefik / none
+        - Related settings: SSO / SMTP / storage / webhooks / none
+    validations:
+      required: true
+
+  - type: dropdown
+    id: frequency
+    attributes:
+      label: Reproduction Frequency
+      description: How reliably can you reproduce this?
+      options:
+        - Always
+        - Often
+        - Sometimes
+        - Once
+        - Unknown
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction-steps
+    attributes:
+      label: Steps to Reproduce
+      description: Provide minimal, numbered steps that start from a clean page/session when possible.
+      placeholder: |
+        1. Open ...
+        2. Click ...
+        3. Enter ...
+        4. Wait for ...
+        5. See ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: current-behavior
+    attributes:
+      label: Current Behavior
+      description: What happened? Include exact error messages, status codes, or visible UI state if available.
+      placeholder: The application ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected-behavior
+    attributes:
+      label: Expected Behavior
+      description: What did you expect to happen instead?
+      placeholder: I expected...
+    validations:
+      required: true
+
+  - type: textarea
+    id: regression
+    attributes:
+      label: Regression Information
+      description: If this worked before, describe when it last worked and what changed before it broke.
+      placeholder: |
+        This last worked in ...
+        It started after ...
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Paste relevant server logs, browser console output, or network errors. Remove secrets before submitting.
+      render: shell
+      placeholder: |
+        Paste logs here.
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Attach screenshots, screen recordings, sample data, exports, or links to related issues.
+      placeholder: Drag and drop files here or add any extra context.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions & Support
+    url: https://github.com/usememos/memos/discussions
+    about: Ask questions or get help in GitHub Discussions — please don't open issues for questions
+  - name: Documentation
+    url: https://www.usememos.com/docs
+    about: Check the documentation before opening an issue

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,109 @@
+name: Feature Request
+description: Propose a product improvement with a clear use case
+type: Feature
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting an improvement. Please describe the problem and workflow first so maintainers can evaluate the request.
+
+        Before submitting:
+        - Search [existing feature requests](https://github.com/usememos/memos/issues?q=label%3Aenhancement) to avoid duplicates.
+        - Use [Discussions](https://github.com/usememos/memos/discussions) for broad ideas, setup help, or questions.
+        - Keep one feature request focused on one user problem.
+
+  - type: checkboxes
+    id: pre-check
+    attributes:
+      label: Pre-submission Checklist
+      options:
+        - label: I have searched existing issues and confirmed this has not already been requested
+          required: true
+        - label: This is a feature request, not a bug report or support question
+          required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      description: Choose the main area this request affects.
+      multiple: true
+      options:
+        - Web UI
+        - Mobile / responsive experience
+        - API
+        - Authentication / SSO
+        - Administration
+        - Memo editor
+        - Search / filters
+        - Tags / organization
+        - Resources / attachments
+        - Import / export
+        - Deployment / operations
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or Use Case
+      description: What problem does this solve? Describe the user need, not just the proposed UI or API.
+      placeholder: |
+        I often need to ...
+        Today, this is difficult because ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: users
+    attributes:
+      label: Who Would Use This?
+      description: Describe the user, role, team, or workflow that would benefit.
+      placeholder: |
+        This helps ...
+        They currently ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Describe the behavior you would like Memos to support. Include UI, API, or configuration details if relevant.
+      placeholder: |
+        Memos should ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Existing workarounds, related tools, or simpler alternatives you considered.
+      placeholder: |
+        I tried ...
+        It does not work well because ...
+
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility and Migration
+      description: Note any expected impact on existing users, APIs, storage, permissions, or deployments.
+      placeholder: |
+        This should not affect existing memos because ...
+        Existing API clients may need ...
+
+  - type: textarea
+    id: examples
+    attributes:
+      label: Examples
+      description: Link to screenshots, mockups, API sketches, related apps, or existing issues that show the desired behavior.
+      placeholder: Drag and drop files here or add links/examples.
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Add any extra context that does not fit above.
+      placeholder: Any other details.

.github/workflows/backend-tests.yml

@@ -0,0 +1,91 @@
+name: Backend Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    paths:
+      - "go.mod"
+      - "go.sum"
+      - "**.go"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  GO_VERSION: "1.26.2"
+
+jobs:
+  static-checks:
+    name: Static Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Verify go.mod is tidy
+        run: |
+          go mod tidy -go=${{ env.GO_VERSION }}
+          git diff --exit-code
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.11.3
+          args: --timeout=3m
+
+  tests:
+    name: Tests (${{ matrix.test-group }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        test-group: [store, server, internal, other]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+          cache-dependency-path: go.sum
+
+      - name: Run tests
+        run: |
+          case "${{ matrix.test-group }}" in
+            store)
+              # Run store tests for all drivers (sqlite, mysql, postgres)
+              go test -v -coverprofile=coverage.out -covermode=atomic ./store/...
+              ;;
+            server)
+              go test -v -race -coverprofile=coverage.out -covermode=atomic ./server/...
+              ;;
+            internal)
+              go test -v -race -coverprofile=coverage.out -covermode=atomic ./internal/...
+              ;;
+            other)
+              go test -v -race -coverprofile=coverage.out -covermode=atomic \
+                ./cmd/... ./internal/... ./proto/...
+              ;;
+          esac
+        env:
+          DRIVER: ${{ matrix.test-group == 'store' && '' || 'sqlite' }}
+
+      - name: Upload coverage
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage.out
+          flags: ${{ matrix.test-group }}
+          fail_ci_if_error: false

.github/workflows/build-canary-image.yml

@@ -0,0 +1,180 @@
+name: Build Canary Image
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: pnpm/action-setup@v4.2.0
+        with:
+          version: 11.0.1
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: pnpm
+          cache-dependency-path: "web/pnpm-lock.yaml"
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+      - name: Setup pnpm cache
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('web/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-pnpm-store-
+      - run: pnpm install --frozen-lockfile
+        working-directory: web
+      - name: Run frontend build
+        run: pnpm release
+        working-directory: web
+
+      - name: Upload frontend artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: frontend-dist
+          path: server/router/frontend/dist
+          retention-days: 1
+
+  build-push:
+    needs: build-frontend
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Resolve version from latest tag
+        id: version
+        run: |
+          version="$(git describe --tags --abbrev=0 2>/dev/null || echo dev)"
+          echo "version=${version#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Download frontend artifacts
+        uses: actions/download-artifact@v7
+        with:
+          name: frontend-dist
+          path: server/router/frontend/dist
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./scripts/Dockerfile
+          platforms: ${{ matrix.platform }}
+          build-args: |
+            VERSION=${{ steps.version.outputs.version }}
+            COMMIT=${{ github.sha }}
+          cache-from: type=gha,scope=build-${{ matrix.platform }}
+          cache-to: type=gha,mode=max,scope=build-${{ matrix.platform }}
+          outputs: type=image,name=neosmemo/memos,push-by-digest=true,name-canonical=true,push=true
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v6
+        with:
+          name: digests-${{ strategy.job-index }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    needs: build-push
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v7
+        with:
+          pattern: digests-*
+          merge-multiple: true
+          path: /tmp/digests
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            neosmemo/memos
+            ghcr.io/usememos/memos
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=canary
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf 'neosmemo/memos@sha256:%s ' *)
+        env:
+          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
+
+      - name: Inspect images
+        run: |
+          docker buildx imagetools inspect neosmemo/memos:canary
+          docker buildx imagetools inspect ghcr.io/usememos/memos:canary

.github/workflows/demo-deploy.yml

@@ -0,0 +1,17 @@
+name: Demo Deploy
+
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy-demo:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Render Deploy
+        run: |
+          curl -X POST "${{ secrets.RENDER_DEPLOY_HOOK }}" \
+            -H "Content-Type: application/json" \
+            -d '{"trigger": "github_action"}'
+
+      - name: Deployment Status
+        run: echo "Demo deployment triggered successfully on Render"

.github/workflows/frontend-tests.yml

@@ -0,0 +1,76 @@
+name: Frontend Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    paths:
+      - "web/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: "24"
+  PNPM_VERSION: "11.0.1"
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: web
+        run: pnpm install --frozen-lockfile
+
+      - name: Run lint
+        working-directory: web
+        run: pnpm lint
+
+      - name: Run unit tests
+        working-directory: web
+        run: pnpm test
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: web
+        run: pnpm install --frozen-lockfile
+
+      - name: Build frontend
+        working-directory: web
+        run: pnpm build

.github/workflows/proto-linter.yml

@@ -0,0 +1,40 @@
+name: Proto Linter
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    paths:
+      - "proto/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint Protos
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup buf
+        uses: bufbuild/buf-setup-action@v1
+        with:
+          github_token: ${{ github.token }}
+
+      - name: Run buf lint
+        uses: bufbuild/buf-lint-action@v1
+        with:
+          input: proto
+
+      - name: Check buf format
+        run: |
+          if [[ $(buf format -d) ]]; then
+            echo "❌ Proto files are not formatted. Run 'buf format -w' to fix."
+            exit 1
+          fi

.github/workflows/release-please.yml

@@ -0,0 +1,37 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check release token
+        env:
+          RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+        run: |
+          if [ -z "$RELEASE_PLEASE_TOKEN" ]; then
+            echo "RELEASE_PLEASE_TOKEN must be set to a fine-grained PAT so release-please tags can trigger release.yml." >&2
+            exit 1
+          fi
+
+      - name: Run release-please
+        uses: googleapis/release-please-action@v4
+        with:
+          # Use a fine-grained PAT so generated tags trigger release.yml.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.github/workflows/release.yml

@@ -0,0 +1,384 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: "1.26.2"
+  NODE_VERSION: "24"
+  PNPM_VERSION: "11.0.1"
+  ARTIFACT_RETENTION_DAYS: 60
+  ARTIFACT_PREFIX: memos
+
+jobs:
+  prepare:
+    name: Extract Version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      tag: ${{ steps.version.outputs.tag }}
+      major_minor: ${{ steps.version.outputs.major_minor }}
+      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
+    steps:
+      - name: Extract version
+        id: version
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "tag=" >> "$GITHUB_OUTPUT"
+            echo "version=manual-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+            echo "major_minor=" >> "$GITHUB_OUTPUT"
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ ! "$REF_NAME" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)(-rc\.[0-9]+)?$ ]]; then
+            echo "Unsupported release tag format: $REF_NAME" >&2
+            exit 1
+          fi
+
+          version="${BASH_REMATCH[1]}${BASH_REMATCH[2]}"
+          major_minor="${BASH_REMATCH[1]%.*}"
+          is_prerelease=false
+          if [ -n "${BASH_REMATCH[2]}" ]; then
+            is_prerelease=true
+          fi
+
+          echo "tag=${REF_NAME}" >> "$GITHUB_OUTPUT"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "major_minor=${major_minor}" >> "$GITHUB_OUTPUT"
+          echo "is_prerelease=${is_prerelease}" >> "$GITHUB_OUTPUT"
+
+  build-frontend:
+    name: Build Frontend
+    needs: prepare
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4.2.0
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: echo "STORE_PATH=$(pnpm store path)" >> "$GITHUB_OUTPUT"
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('web/pnpm-lock.yaml') }}
+          restore-keys: ${{ runner.os }}-pnpm-store-
+
+      - name: Install dependencies
+        working-directory: web
+        run: pnpm install --frozen-lockfile
+
+      - name: Build frontend release assets
+        working-directory: web
+        run: pnpm release
+
+      - name: Upload frontend artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-dist
+          path: server/router/frontend/dist
+          retention-days: 1
+
+  build-binaries:
+    name: Build ${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.goarm && format('v{0}', matrix.goarm) || '' }}
+    needs: [prepare, build-frontend]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: linux
+            goarch: arm
+            goarm: "7"
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+          - goos: windows
+            goarch: amd64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+
+      - name: Download frontend artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: frontend-dist
+          path: server/router/frontend/dist
+
+      - name: Build binary
+        env:
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          GOARM: ${{ matrix.goarm }}
+          CGO_ENABLED: "0"
+        run: |
+          output_name="memos"
+          if [ "$GOOS" = "windows" ]; then
+            output_name="memos.exe"
+          fi
+
+          mkdir -p build
+
+          go build \
+            -trimpath \
+            -ldflags="-s -w -X github.com/usememos/memos/internal/version.Version=${{ needs.prepare.outputs.version }} -X github.com/usememos/memos/internal/version.Commit=${{ github.sha }} -extldflags '-static'" \
+            -tags netgo,osusergo \
+            -o "build/${output_name}" \
+            ./cmd/memos
+
+      - name: Package binary
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+          GOARM: ${{ matrix.goarm }}
+        run: |
+          cd build
+
+          package_name="${ARTIFACT_PREFIX}_${VERSION}_${GOOS}_${GOARCH}"
+          if [ -n "$GOARM" ]; then
+            package_name="${package_name}v${GOARM}"
+          fi
+
+          if [ "$GOOS" = "windows" ]; then
+            artifact_name="${package_name}.zip"
+            zip -q "${artifact_name}" memos.exe
+          else
+            artifact_name="${package_name}.tar.gz"
+            tar czf "${artifact_name}" memos
+          fi
+
+          echo "artifact_name=${artifact_name}" >> "$GITHUB_ENV"
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.artifact_name }}
+          path: build/${{ env.artifact_name }}
+          retention-days: ${{ env.ARTIFACT_RETENTION_DAYS }}
+
+  checksums:
+    name: Generate Checksums
+    needs: [prepare, build-binaries]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download binary artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          pattern: ${{ env.ARTIFACT_PREFIX }}_*
+          merge-multiple: true
+
+      - name: Generate checksums
+        working-directory: artifacts
+        run: sha256sum * > checksums.txt
+
+      - name: Upload checksum artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: checksums
+          path: artifacts/checksums.txt
+          retention-days: ${{ env.ARTIFACT_RETENTION_DAYS }}
+
+  release:
+    name: Publish GitHub Release
+    needs: [prepare, build-binaries, checksums]
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download binary artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          pattern: ${{ env.ARTIFACT_PREFIX }}_*
+          merge-multiple: true
+
+      - name: Download checksum artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: checksums
+          path: artifacts
+
+      - name: Publish release assets
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.prepare.outputs.tag }}
+          name: ${{ needs.prepare.outputs.tag }}
+          prerelease: ${{ needs.prepare.outputs.is_prerelease == 'true' }}
+          files: artifacts/*
+
+  build-push:
+    name: Build Image ${{ matrix.platform }}
+    needs: [prepare, build-frontend]
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm/v7
+          - linux/arm64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Download frontend artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: frontend-dist
+          path: server/router/frontend/dist
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./scripts/Dockerfile
+          platforms: ${{ matrix.platform }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            COMMIT=${{ github.sha }}
+          cache-from: type=gha,scope=release-${{ matrix.platform }}
+          cache-to: type=gha,mode=max,scope=release-${{ matrix.platform }}
+          outputs: type=image,name=neosmemo/memos,push-by-digest=true,name-canonical=true,push=true
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ strategy.job-index }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge-images:
+    name: Publish Release Image Tags
+    needs: [prepare, build-push]
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          pattern: digests-*
+          merge-multiple: true
+          path: /tmp/digests
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          version="${{ needs.prepare.outputs.version }}"
+          if [ "${{ needs.prepare.outputs.is_prerelease }}" = "true" ]; then
+            docker buildx imagetools create \
+              -t "neosmemo/memos:${version}" \
+              -t "ghcr.io/usememos/memos:${version}" \
+              $(printf 'neosmemo/memos@sha256:%s ' *)
+            exit 0
+          fi
+
+          docker buildx imagetools create \
+            -t "neosmemo/memos:${version}" \
+            -t "neosmemo/memos:${{ needs.prepare.outputs.major_minor }}" \
+            -t "neosmemo/memos:stable" \
+            -t "ghcr.io/usememos/memos:${version}" \
+            -t "ghcr.io/usememos/memos:${{ needs.prepare.outputs.major_minor }}" \
+            -t "ghcr.io/usememos/memos:stable" \
+            $(printf 'neosmemo/memos@sha256:%s ' *)
+
+      - name: Inspect images
+        run: |
+          docker buildx imagetools inspect neosmemo/memos:${{ needs.prepare.outputs.version }}
+          if [ "${{ needs.prepare.outputs.is_prerelease }}" = "true" ]; then
+            exit 0
+          fi
+
+          docker buildx imagetools inspect neosmemo/memos:stable

.github/workflows/stale.yml

@@ -0,0 +1,24 @@
+name: Close Stale
+
+on:
+  schedule:
+    - cron: "0 */8 * * *" # Every 8 hours
+
+jobs:
+  close-stale:
+    name: Close Stale Issues and PRs
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Mark and close stale issues and PRs
+        uses: actions/stale@v10.1.1
+        with:
+          # Issues: mark stale after 14 days of inactivity, close after 3 more days
+          days-before-issue-stale: 14
+          days-before-issue-close: 3
+
+          # Pull requests: mark stale after 14 days of inactivity, close after 3 more days
+          days-before-pr-stale: 14
+          days-before-pr-close: 3