Merge branch 'main' into feat/team-search-highlight

Author: JinHai-CN

.agents/skills/go-naming/SKILL.md

@@ -3,4 +3,4 @@ name: go-naming
 description: Go naming conventions and best practices. Use this skill when working with Go code and need to name packages, files, directories, structs, interfaces, functions, variables, or constants. Provides comprehensive naming guidelines following Go community standards.
 ---
 
-Strictly follow the naming conventions in [rules/named.md](rules/named.md)
+Strictly follow the naming conventions in [rules/named.md](../../rules/named.md)

.dockerignore

@@ -27,22 +27,18 @@ docker/oceanbase/
 docker/seekdb/
 
 # ── Go and C++ build outputs ────────────────────────────────────────────────
-internal/cpp/build/
-internal/cpp/cmake-build-release/
-internal/cpp/cmake-build-debug/
+internal/binding/cpp/build/
+internal/binding/cpp/cmake-build-release/
+internal/binding/cpp/cmake-build-debug/
 target/
 
-# ── Downloaded dependency artifacts (mounted from infiniflow/ragflow_deps) ──
-chrome-linux64-*
-chromedriver-linux64-*
-tika-server-standard-*.jar
-tika-server-standard-*.jar.md5
-cl100k_base.tiktoken
-libssl*.deb
-uv-*.tar.gz
-huggingface.co/
-nltk_data/
-9b5ad71b2ce5302211f9c61530b329a4922fc6a4
+# ── ragflow_deps build context (built as a separate image, mounted ──
+# ── from infiniflow/ragflow_deps:latest by the main Dockerfile)     ──
+# Excluding the entire directory keeps the main build context small
+# regardless of which deps files download_deps.py currently fetches.
+# The deps image is built from this directory with:
+#   cd ragflow_deps && docker build -f Dockerfile -t infiniflow/ragflow_deps .
+ragflow_deps/
 
 # ── IDE and editor config ──────────────────────────────────────────────────
 .idea/

.gitattributes

@@ -1,2 +1,9 @@
 *.sh text eol=lf
 docker/entrypoint.sh text eol=lf executable
+
+# Binary fixtures must be stored byte-for-byte. Mark them binary so git
+# never applies text/CRLF normalization, and so the pre-commit text fixers
+# (see tools/hooks/check_files.py) skip them. OLE2 .msg files in particular
+# were previously corrupted by the mixed-line-ending / end-of-file fixers.
+*.msg binary
+

.github/codeql/codeql-config.yml

@@ -0,0 +1,25 @@
+# CodeQL configuration. The default CodeQL Analysis workflow (managed by
+# GitHub) reads this file when scanning the repository. We use it to
+# exclude files that the Go analysis cannot compile — the rest of the
+# repo compiles fine, but the CGO-based office_oxide bindings require
+# a native header (`office_oxide.h`) that isn't present in the CodeQL
+# runner image. Without this exclusion the entire Go analysis aborts
+# with `fatal error: office_oxide.h: No such file or directory`, which
+# means no Go alerts can be re-evaluated and alerts on these files
+# stay open indefinitely even after their root cause is fixed.
+#
+# The excluded files are MS Office document parsers. They are also
+# excluded from `go test` and `go build` in local development when
+# the office_oxide C library is not installed, so this exclusion
+# brings CodeQL in line with the rest of the toolchain.
+paths-ignore:
+  - internal/ingestion/parser/doc_parser.go
+  - internal/ingestion/parser/docx_parser.go
+  - internal/ingestion/parser/ppt_parser.go
+  - internal/ingestion/parser/pptx_parser.go
+  - internal/ingestion/parser/xls_parser.go
+  - internal/ingestion/parser/xlsx_parser.go
+  # Generated / vendored — also break analysis without adding signal.
+  - "**/testdata/**"
+  - "**/node_modules/**"
+  - "**/*.pb.go"

.github/pull_request_template.md

@@ -1,12 +1,3 @@
-### What problem does this PR solve?
+### Summary
 
 _Briefly describe what this PR aims to solve. Include background context that will help reviewers understand the purpose of the PR._
-
-### Type of change
-
-- [ ] Bug Fix (non-breaking change which fixes an issue)
-- [ ] New Feature (non-breaking change which adds functionality)
-- [ ] Documentation Update
-- [ ] Refactoring
-- [ ] Performance Improvement
-- [ ] Other (please describe):

.github/workflows/release.yml

@@ -9,6 +9,7 @@ on:
   push:
     tags:
       - "v*.*.*"                  # normal release
+      - 'nightly'                 # mutable tag
 
 permissions:
   contents: write
@@ -22,8 +23,12 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  release:
+  prepare:
     runs-on: [ "self-hosted", "ragflow-release" ]
+    outputs:
+      release_tag: ${{ steps.release.outputs.release_tag }}
+      prerelease: ${{ steps.release.outputs.prerelease }}
+
     steps:
       - name: Ensure workspace ownership
         run: echo "chown -R ${USER} ${GITHUB_WORKSPACE}" && sudo chown -R ${USER} ${GITHUB_WORKSPACE}
@@ -36,7 +41,15 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
-      - name: Prepare release body
+      # https://github.com/actions/setup-go
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Prepare release metadata
+        id: release
         run: |
           if [[ ${GITHUB_EVENT_NAME} != "schedule" ]]; then
             RELEASE_TAG=${GITHUB_REF#refs/tags/}
@@ -53,8 +66,8 @@ jobs:
           fi
           echo "RELEASE_TAG=${RELEASE_TAG}" >> ${GITHUB_ENV}
           echo "PRERELEASE=${PRERELEASE}" >> ${GITHUB_ENV}
-          RELEASE_DATETIME=$(date --rfc-3339=seconds)
-          echo Release ${RELEASE_TAG} created from ${GITHUB_SHA} at ${RELEASE_DATETIME} > release_body.md
+          echo "release_tag=${RELEASE_TAG}" >> ${GITHUB_OUTPUT}
+          echo "prerelease=${PRERELEASE}" >> ${GITHUB_OUTPUT}
 
       - name: Move the existing mutable tag
         # https://github.com/softprops/action-gh-release/issues/171
@@ -72,15 +85,205 @@ jobs:
             fi
           fi
 
-      - name: Create or overwrite a release
-        # https://github.com/actions/upload-release-asset has been replaced by https://github.com/softprops/action-gh-release
+  build_cli:
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+            runner: ubuntu-24.04
+          - goos: linux
+            goarch: arm64
+            runner: ubuntu-24.04-arm
+          - goos: darwin
+            goarch: amd64
+            runner: macos-15-intel
+          - goos: darwin
+            goarch: arm64
+            runner: macos-14
+          - goos: windows
+            goarch: amd64
+            runner: windows-latest
+            output_ext: .exe
+          - goos: windows
+            goarch: arm64
+            runner: windows-11-arm
+            output_ext: .exe
+    runs-on: ${{ matrix.runner }}
+    env:
+      CLI_NAME: ragflow-cli
+      CLI_MAIN: ./cmd/ragflow-cli.go
+      DIST_DIR: dist/cli
+      RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
+
+    steps:
+      # https://github.com/actions/checkout/blob/v6/README.md
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      # https://github.com/actions/setup-go
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build Go CLI release binaries on non-Windows
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          mkdir -p "${DIST_DIR}"
+
+          if [[ ! -e "${CLI_MAIN}" ]]; then
+            echo "::error::Go CLI entry does not exist: ${CLI_MAIN}"
+            echo "::error::Please update CLI_MAIN in .github/workflows/release.yml"
+            exit 1
+          fi
+
+          echo "Building Go CLI release binaries"
+          echo "CLI name: ${CLI_NAME}"
+          echo "CLI main: ${CLI_MAIN}"
+          echo "Release tag: ${RELEASE_TAG}"
+          echo "Commit: ${GITHUB_SHA}"
+
+          output="${DIST_DIR}/${CLI_NAME}-${RELEASE_TAG}-${{ matrix.goos }}-${{ matrix.goarch }}"
+          echo "Building ${{ matrix.goos }}/${{ matrix.goarch }} -> ${output}"
+
+          CGO_ENABLED=0 \
+          GOOS="${{ matrix.goos }}" \
+          GOARCH="${{ matrix.goarch }}" \
+          go build \
+            -trimpath \
+            -ldflags="-s -w -X main.version=${RELEASE_TAG} -X main.commit=${GITHUB_SHA}" \
+            -o "${output}" \
+            "${CLI_MAIN}"
+
+          chmod +x "${output}"
+
+      - name: Build Go CLI release binaries on Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path $env:DIST_DIR | Out-Null
+
+          if (-not (Test-Path $env:CLI_MAIN)) {
+            Write-Error "Go CLI entry does not exist: $env:CLI_MAIN"
+            exit 1
+          }
+
+          $output = Join-Path $env:DIST_DIR "${env:CLI_NAME}-${env:RELEASE_TAG}-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.output_ext }}"
+          Write-Host "Building ${{ matrix.goos }}/${{ matrix.goarch }} -> $output"
+
+          $env:CGO_ENABLED = "0"
+          $env:GOOS = "${{ matrix.goos }}"
+          $env:GOARCH = "${{ matrix.goarch }}"
+
+          go build `
+            -trimpath `
+            -ldflags="-s -w -X main.version=$env:RELEASE_TAG -X main.commit=$env:GITHUB_SHA" `
+            -o "$output" `
+            "$env:CLI_MAIN"
+
+      - name: Upload CLI artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: dist/cli/*
+          if-no-files-found: error
+
+  publish_cli_assets:
+    needs:
+      - prepare
+      - build_cli
+    runs-on: [ "self-hosted", "ragflow-release" ]
+
+    steps:
+      - name: Ensure workspace ownership
+        run: echo "chown -R ${USER} ${GITHUB_WORKSPACE}" && sudo chown -R ${USER} ${GITHUB_WORKSPACE}
+
+      # https://github.com/actions/checkout/blob/v6/README.md
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Download CLI artifacts
+        uses: actions/download-artifact@v5
+        with:
+          pattern: cli-*
+          path: dist/cli
+          merge-multiple: true
+
+      - name: Prepare CLI release assets
+        env:
+          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
+        run: |
+          set -euo pipefail
+
+          RELEASE_DATETIME=$(date --rfc-3339=seconds)
+          echo Release ${RELEASE_TAG} created from ${GITHUB_SHA} at ${RELEASE_DATETIME} > release_body.md
+
+          cd dist/cli
+          sha256sum * > SHA256SUMS
+          cd -
+
+          echo "Generated CLI release assets:"
+          ls -lh dist/cli
+
+      - name: Upload Go CLI release assets
         uses: softprops/action-gh-release@v2
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}  # Use the secret as an environment variable
-          prerelease: ${{ env.PRERELEASE }}
-          tag_name: ${{ env.RELEASE_TAG }}
-          # The body field does not support environment variable substitution directly.
+          token: ${{ secrets.GITHUB_TOKEN }}
+          prerelease: ${{ needs.prepare.outputs.prerelease }}
+          tag_name: ${{ needs.prepare.outputs.release_tag }}
           body_path: release_body.md
+          files: |
+            dist/cli/*
+            tools/scripts/install.sh
+            tools/scripts/install.ps1
+
+  release:
+    needs:
+      - prepare
+      - publish_cli_assets
+    runs-on: [ "self-hosted", "ragflow-release" ]
+    env:
+      RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
+
+    steps:
+      - name: Ensure workspace ownership
+        run: echo "chown -R ${USER} ${GITHUB_WORKSPACE}" && sudo chown -R ${USER} ${GITHUB_WORKSPACE}
+
+      # https://github.com/actions/checkout/blob/v6/README.md
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Build server binary (with native libs / ORT)
+        # The production Dockerfile does `COPY bin bin`, so the binary must be
+        # built (and ORT statically linked from the runner image at
+        # /opt/ragflow-native-libs) before the docker build. This makes ORT's
+        # presence in the released image an explicit, visible precondition
+        # instead of relying on a pre-populated bin/ from elsewhere.
+        env:
+          CGO_ENABLED: '1'
+        run: |
+          set -euo pipefail
+          ./build.sh --cpp
+          ./build.sh --go
 
       - name: Build and push image
         run: |