Skip to content

refactor(knowledge): extract generic CUE compiler core and projection… #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ljahier merged 20 commits into from
Jul 19, 2026
Merged

refactor(knowledge): extract generic CUE compiler core and projection… #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
faaba01
refactor(knowledge): extract generic CUE compiler core and projection…
ljahier Jul 16, 2026
5219ad1
feat(knowledge): add optional CUE metadata contract with explicit and…
ljahier Jul 16, 2026
1c22269
feat(runtime): add transport-independent knowledge runtime and route …
ljahier Jul 16, 2026
73285eb
feat(catalog): expose schema-aware domains, relations, and evaluation…
ljahier Jul 16, 2026
d946b63
feat(query): add bounded catalog-validated query API for agent-safe d…
ljahier Jul 16, 2026
3149780
chore(license): add MPL-2.0 headers to knowledge package source files
ljahier Jul 16, 2026
97e6fde
feat(eval): execute named CUE evaluations with validated JSON input o…
ljahier Jul 16, 2026
7ca9dd2
feat(knowledge): expose catalog/domains/query/eval runtime over HTTP …
ljahier Jul 18, 2026
16172a0
ci(backend): add GitHub Actions workflow for gofmt, build, and tests
ljahier Jul 19, 2026
88d6093
fix(knowledge): reject package selectors escaping the module root in …
ljahier Jul 19, 2026
bacd953
feat(examples): add service-catalog demo CUE module
ljahier Jul 19, 2026
84f1a1c
feat(assets): embed cue schema, demo module, and web UI; pin CI to so…
ljahier Jul 19, 2026
a4e2502
feat(server): extract shared HTTP serving loop with graceful shutdown
ljahier Jul 19, 2026
8e4a563
feat(projects): add Seed to create a project from an embedded module …
ljahier Jul 19, 2026
47bd8ba
feat(session): resolve the current project server-side via /session e…
ljahier Jul 19, 2026
4d62048
feat(cli): add serve, projects, and use commands with home-based modu…
ljahier Jul 19, 2026
64939c0
feat(frontend): bootstrap current project from server session instead…
ljahier Jul 19, 2026
278c536
ci: build cueto release binaries
ljahier Jul 19, 2026
53af16b
docs: rewrite README around cueto serve and drop the Makefile
ljahier Jul 19, 2026
a1a7ef7
feat(home): add cueto home root with config and project selection state
ljahier Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions .github/workflows/backend-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
name: backend-ci

# cue/** and examples/** are included because backend tests pin the embedded
# schema and demo assets byte-for-byte to those directories.
on:
push:
branches: [main]
paths:
- backend/**
- cue/**
- examples/**
- .github/workflows/backend-ci.yml
pull_request:
paths:
- backend/**
- cue/**
- examples/**
- .github/workflows/backend-ci.yml

jobs:
test:
Comment thread
mendral-app[bot] marked this conversation as resolved.
Comment on lines +20 to +21

@mendral-app mendral-app Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (P3): No explicit permissions: block; the workflow inherits the repository default token scope. Adding a least-privilege block limits blast radius if a dependency or step is compromised.

Suggested change
Suggested change
jobs:
test:
jobs:
test:
runs-on: ubuntu-latest
permissions:
contents: read
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/backend-ci.yml, line 20:

<issue>
No explicit `permissions:` block; the workflow inherits the repository default token scope. Adding a least-privilege block limits blast radius if a dependency or step is compromised.
</issue>

runs-on: ubuntu-latest
Comment thread
mendral-app[bot] marked this conversation as resolved.
Comment on lines +21 to +22

@mendral-app mendral-app Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (P3): Adding an explicit permissions block limits the GITHUB_TOKEN scope, reducing blast radius if a step is compromised.

Suggested change
Suggested change
test:
runs-on: ubuntu-latest
test:
runs-on: ubuntu-latest
permissions:
contents: read
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/backend-ci.yml, line 15:

<issue>
Adding an explicit `permissions` block limits the GITHUB_TOKEN scope, reducing blast radius if a step is compromised.
</issue>

defaults:
run:
working-directory: backend
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: backend/go.mod
cache-dependency-path: backend/go.sum

- name: gofmt check
run: |
unformatted="$(gofmt -l .)"
if [ -n "$unformatted" ]; then
echo "gofmt needed on:"
echo "$unformatted"
exit 1
fi

- name: build
run: go build ./...

- name: install gotestsum
run: go install gotest.tools/gotestsum@v1.13.0

- name: test
run: gotestsum --junitfile junit.xml --format testname -- ./...

- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: junit
path: backend/junit.xml
58 changes: 58 additions & 0 deletions .github/workflows/binaries.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
name: binaries

# Self-contained cueto binaries: the web UI is built once with an empty
# VITE_API_URL (same-origin), copied over the placeholder embed dir, and the CLI
# is cross-compiled for each release target. Pure-Go dependencies make
# CGO_ENABLED=0 cross-compilation from one runner safe; backend tests verified
# separately in backend-ci.

on:
push:
branches: [main]
tags: ["v*"]
pull_request:
paths:
- backend/**
- frontend/**
- .github/workflows/binaries.yml
workflow_dispatch:

jobs:
build:
Comment on lines +20 to +21

@mendral-app mendral-app Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (P3): No explicit permissions: block on the build job. Restricting to contents: read follows least-privilege for a build-and-upload workflow.

Suggested change
Suggested change
jobs:
build:
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/binaries.yml, line 20:

<issue>
No explicit `permissions:` block on the build job. Restricting to `contents: read` follows least-privilege for a build-and-upload workflow.
</issue>

runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: install pnpm
run: npm install -g pnpm@11

@mendral-app mendral-app Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maintainability (P3): pnpm is installed with a floating major-version tag (@11). A patch-level pin (e.g. pnpm@11.11.0) prevents silent behavior changes between runs.

Suggested change
Suggested change
run: npm install -g pnpm@11
run: npm install -g pnpm@11.11.0
Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/binaries.yml, line 27:

<issue>
pnpm is installed with a floating major-version tag (`@11`). A patch-level pin (e.g. `pnpm@11.11.0`) prevents silent behavior changes between runs.
</issue>


- name: build web UI (same-origin API)
working-directory: frontend
run: |
pnpm install --frozen-lockfile
pnpm run build

- name: embed web UI
run: |
rm -rf backend/internal/assets/webui
cp -R frontend/dist backend/internal/assets/webui

- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: backend/go.mod
cache-dependency-path: backend/go.sum

- name: build binaries
working-directory: backend
env:
CGO_ENABLED: "0"
run: |
mkdir -p dist
GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o dist/cueto-linux-amd64 ./cmd/cueto
GOOS=linux GOARCH=arm64 go build -trimpath -ldflags="-s -w" -o dist/cueto-linux-arm64 ./cmd/cueto
GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags="-s -w" -o dist/cueto-darwin-arm64 ./cmd/cueto

- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: cueto-binaries
path: backend/dist/cueto-*
9 changes: 9 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,12 @@

# Project store: registry and per-project versions (runtime data, default DATA_DIR).
/data/

# go build output for the CLI binary (e.g. `go build ./cmd/cueto`).
/cueto

# Local reproduction of the binaries workflow (backend/dist/cueto-*).
/backend/dist/

# gotestsum JUnit report (backend-ci.yml).
/backend/junit.xml
9 changes: 0 additions & 9 deletions Makefile
View file
Open in desktop

This file was deleted.

Loading
Loading