fix: migration 010 — clean up group_members RLS policies to minimal set #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🚀 Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - 'v*.*.*' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| release: | |
| name: Create or Update GitHub Release | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: release-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| steps: | |
| - name: ⬇️ Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: 🏷️ Get tag info | |
| id: tag | |
| run: | | |
| set -euo pipefail | |
| if [ "${GITHUB_REF_TYPE}" = "tag" ]; then | |
| TAG="${GITHUB_REF_NAME}" | |
| VERSION="${TAG#v}" | |
| else | |
| VERSION="$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' package.json | head -1)" | |
| TAG="v${VERSION}" | |
| fi | |
| if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9.-]+)?$'; then | |
| echo "❌ Invalid package version: $VERSION" | |
| exit 1 | |
| fi | |
| echo "tag=${TAG}" >> "$GITHUB_OUTPUT" | |
| echo "version=${VERSION}" >> "$GITHUB_OUTPUT" | |
| - name: 🟢 Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - name: ✅ Release syntax checks | |
| run: | | |
| set -euo pipefail | |
| node --check server.mjs | |
| node --check server/backup-manager.mjs | |
| node --check public/sync/backup-normalizer.js | |
| node --check public/sync/local-data-adapter.js | |
| node --check scripts/validate-backup-files.mjs | |
| node --check scripts/repair-user-backup.mjs | |
| node --check scripts/prove-new-browser-restore.mjs | |
| node --check scripts/validate-storage-cleanup.mjs | |
| node --check scripts/verify-supabase-security.mjs | |
| node --check scripts/compare-remote-assets.mjs | |
| npm run docs:validate | |
| - name: 📋 Extract changelog section | |
| id: changelog | |
| run: | | |
| VERSION="${{ steps.tag.outputs.version }}" | |
| # Extract section for this version from CHANGELOG.md | |
| NOTES=$(awk "/^## \[$VERSION\]/{found=1; next} found && /^## /{exit} found{print}" CHANGELOG.md) | |
| if [ -z "$NOTES" ]; then | |
| NOTES="See [CHANGELOG.md](./CHANGELOG.md) for details." | |
| fi | |
| # Write to a file to avoid multi-line/special-char issues in GITHUB_OUTPUT | |
| echo "$NOTES" > /tmp/changelog_notes.txt | |
| { | |
| echo "notes<<CHANGELOG_EOF" | |
| cat /tmp/changelog_notes.txt | |
| echo "CHANGELOG_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: 🤖 Enhance release notes with AI | |
| id: ai_notes | |
| continue-on-error: true | |
| env: | |
| YEPAPI_KEY: ${{ secrets.YEPAPI_KEY }} | |
| run: | | |
| if [ -z "$YEPAPI_KEY" ]; then | |
| echo "No YEPAPI_KEY — using raw changelog notes" | |
| { | |
| echo "notes<<CHANGELOG_EOF" | |
| cat /tmp/changelog_notes.txt | |
| echo "CHANGELOG_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| VERSION="${{ steps.tag.outputs.version }}" | |
| # Write excerpt to a file — avoids shell injection via changelog content | |
| head -50 /tmp/changelog_notes.txt > /tmp/changelog_excerpt.txt | |
| # Build JSON payload using node to handle escaping safely | |
| node -e " | |
| const fs = require('fs'); | |
| const excerpt = fs.readFileSync('/tmp/changelog_excerpt.txt', 'utf8').trim(); | |
| const payload = { | |
| model: 'gpt-4o-mini', | |
| messages: [{ | |
| role: 'user', | |
| content: 'Polish these GitHub release notes for IsotopeAI v${VERSION} into a clean, friendly, emoji-enhanced format for students. Keep it concise (max 300 words). Original:\n' + excerpt | |
| }] | |
| }; | |
| fs.writeFileSync('/tmp/ai_payload.json', JSON.stringify(payload)); | |
| " | |
| RESPONSE=$(curl -s -X POST "https://api.yepapi.com/v1/ai/chat" \ | |
| -H "x-api-key: $YEPAPI_KEY" \ | |
| -H "Content-Type: application/json" \ | |
| -d @/tmp/ai_payload.json) | |
| AI_NOTES=$(echo "$RESPONSE" | node -e " | |
| let d=''; | |
| process.stdin.on('data', c => d += c); | |
| process.stdin.on('end', () => { | |
| try { | |
| const p = JSON.parse(d); | |
| console.log(p.data?.message?.content || ''); | |
| } catch { | |
| console.log(''); | |
| } | |
| }); | |
| ") | |
| if [ -n "$AI_NOTES" ]; then | |
| echo "$AI_NOTES" > /tmp/ai_notes.txt | |
| { | |
| echo "notes<<CHANGELOG_EOF" | |
| cat /tmp/ai_notes.txt | |
| echo "CHANGELOG_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| else | |
| echo "AI returned empty — falling back to raw changelog" | |
| { | |
| echo "notes<<CHANGELOG_EOF" | |
| cat /tmp/changelog_notes.txt | |
| echo "CHANGELOG_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: 📦 Package release archive | |
| run: | | |
| VERSION="${{ steps.tag.outputs.version }}" | |
| zip -qr "isotope-v${VERSION}.zip" . \ | |
| --exclude ".git/*" \ | |
| --exclude "node_modules/*" \ | |
| --exclude ".env" \ | |
| --exclude ".isotope/*" \ | |
| --exclude "artifacts/*" \ | |
| --exclude "*.log" \ | |
| --exclude ".github/*" \ | |
| --exclude "screenshots/*" | |
| echo "Archive: $(wc -c < isotope-v${VERSION}.zip) bytes" | |
| - name: 🔎 Verify release archive | |
| run: | | |
| set -euo pipefail | |
| VERSION="${{ steps.tag.outputs.version }}" | |
| TMPDIR="$(mktemp -d)" | |
| unzip -q "isotope-v${VERSION}.zip" -d "$TMPDIR" | |
| required=( | |
| server.mjs | |
| package.json | |
| public/sync/backup-normalizer.js | |
| public/sync/local-data-adapter.js | |
| server/backup-manager.mjs | |
| scripts/prove-new-browser-restore.mjs | |
| scripts/repair-user-backup.mjs | |
| scripts/validate-backup-files.mjs | |
| scripts/validate-storage-cleanup.mjs | |
| scripts/verify-supabase-security.mjs | |
| scripts/compare-remote-assets.mjs | |
| sql/backup_manifests.sql | |
| sql/006_security_policy_cleanup.sql | |
| docs/sync-system.md | |
| docs/storage-backup-system.md | |
| docs/supabase-connection-map.md | |
| docs/index.html | |
| docs/install.html | |
| docs/sync.html | |
| docs/admin.html | |
| docs/gallery.html | |
| docs/motion.html | |
| docs/assets/site.css | |
| docs/assets/site.js | |
| docs/logo.svg | |
| README.md | |
| ADMIN.md | |
| .env.example | |
| ) | |
| for f in "${required[@]}"; do | |
| test -f "$TMPDIR/$f" || { echo "❌ Missing from release: $f"; exit 1; } | |
| echo "✅ $f" | |
| done | |
| if [ -f "$TMPDIR/.env" ]; then | |
| echo "❌ .env included in release" | |
| exit 1 | |
| fi | |
| if find "$TMPDIR" -maxdepth 1 -name '.env.*' ! -name '.env.example' | grep -q .; then | |
| echo "❌ private .env.* included in release" | |
| exit 1 | |
| fi | |
| PORT=3099 \ | |
| SUPABASE_URL=https://placeholder.supabase.co \ | |
| SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoiYW5vbiJ9.signature \ | |
| SESSION_SECRET=release_smoke_test_secret_not_real \ | |
| node "$TMPDIR/server.mjs" & | |
| PID=$! | |
| trap 'kill "$PID" 2>/dev/null || true; rm -rf "$TMPDIR"' EXIT | |
| for i in $(seq 1 30); do | |
| STATUS="$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3099/__isotope/ping 2>/dev/null || echo 000)" | |
| if [ "$STATUS" = "200" ]; then | |
| echo "Release smoke HTTP $STATUS" | |
| exit 0 | |
| fi | |
| sleep 0.5 | |
| done | |
| echo "❌ Release archive server ping did not return 200 (got: $STATUS)" | |
| exit 1 | |
| - name: 📝 Build release notes | |
| run: | | |
| cat > /tmp/release_notes.md <<'EOF' | |
| ## IsotopeAI ${{ steps.tag.outputs.tag }} | |
| ${{ steps.ai_notes.outputs.notes || steps.changelog.outputs.notes }} | |
| --- | |
| ### 📥 Quick Install | |
| ```bash | |
| git clone https://github.com/Suydev/isotope-code.git | |
| cd isotope-code | |
| bash setup.sh | |
| ``` | |
| ### 📋 What's Changed | |
| See [CHANGELOG.md](https://github.com/Suydev/isotope-code/blob/main/CHANGELOG.md) for the full history. | |
| ### ❤️ Support | |
| UPI: `9699393886@fam` · [isotopeai.in](https://isotopeai.in) | |
| EOF | |
| - name: 🏷️ Ensure release tag points to this commit | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ steps.tag.outputs.tag }}" | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git tag -f "$TAG" "$GITHUB_SHA" | |
| git push --force origin "refs/tags/$TAG" | |
| - name: 🎉 Create or update GitHub Release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| TAG="${{ steps.tag.outputs.tag }}" | |
| VERSION="${{ steps.tag.outputs.version }}" | |
| ARCHIVE="isotope-v${VERSION}.zip" | |
| PRERELEASE_FLAG=() | |
| if printf '%s' "$TAG" | grep -Eq -- '(-beta|-rc)'; then | |
| PRERELEASE_FLAG=(--prerelease) | |
| fi | |
| if gh release view "$TAG" >/dev/null 2>&1; then | |
| gh release edit "$TAG" \ | |
| --title "IsotopeAI ${TAG} 🧪" \ | |
| --notes-file /tmp/release_notes.md \ | |
| "${PRERELEASE_FLAG[@]}" | |
| else | |
| gh release create "$TAG" \ | |
| --target "$GITHUB_SHA" \ | |
| --title "IsotopeAI ${TAG} 🧪" \ | |
| --notes-file /tmp/release_notes.md \ | |
| "${PRERELEASE_FLAG[@]}" | |
| fi | |
| gh release upload "$TAG" "$ARCHIVE" --clobber | |
| echo "✅ Release ${TAG} published with ${ARCHIVE}" |