Use Go 1.26.10 locally without automatic toolchain switching, verify downloaded modules, and build with read-only module metadata and trimmed source/VCS paths. Pin Go, Node, and Debian multi-platform manifests while retaining the compatible CGO/FFmpeg runtime and existing architecture selection. Align Go CI and document pin-refresh and ARMv6 limitations.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Exclude local secrets and mutable data from image builds, restore Go checksum verification, remove runtime capability tooling and setuid/setgid permissions, and preserve non-root media and demo startup behavior. Add native image smoke checks and document runtime constraints.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Reduce the build job's contents permission to read and remove DockerHub authentication, since pull request builds only need to build the image locally.
- Updated QueueCursor to manage context cancellation more effectively in ReadPacketContext.
- Added tests to ensure ReadPacketContext does not allocate when packets are available.
- Simplified ImageToBytes function by removing unnecessary buffer writer.
- Enhanced ImageCanvas component to handle image updates and editor data changes more efficiently.
- Implemented websocket client ID generation for consistent identification across components.
- Improved Settings component to manage live view subscriptions based on tab visibility.
- Added unit tests for new and modified functionalities across various components and utilities.
Replace 'secrets: inherit' with an explicit secrets mapping in the PR description workflow. This exposes TOKEN and the Azure/OpenAI-related secrets (AZURE_OPENAI_API_KEY, OPENAI_MODEL, AZURE_OPENAI_ENDPOINT, AZURE_OPENAI_VERSION) to the job so it can authenticate against the OpenAI/Azure services when generating or updating PR descriptions.
Replace the inline OpenAI-based PR description job with a reusable workflow call (uug-ai/workflows/.github/workflows/pr-description.yml@main). Removed unused env vars and the checkout/action steps, and pass pr_number and overwrite_description inputs while inheriting repository secrets. This centralizes PR description logic and simplifies the workflow file.
Add --provenance=false to docker build invocations in .github/workflows/release-create.yml (both default and arm64 steps) to suppress Docker provenance metadata during CI builds.
Pass VERSION from CI into Docker builds and embed it into the Go binary via ldflags. Updated .github workflow to supply --build-arg VERSION for both architectures. Added ARG VERSION and logic in Dockerfile and Dockerfile.arm64 to derive the version from git (git describe --tags) or fall back to the provided build-arg, then set it with -X during go build. Changed VERSION in machinery/src/utils/main.go from a const to a var defaulting to "0.0.0" and documented that it is overridden at build time. This ensures released images contain the correct agent version while local/dev builds keep a sensible default.
