zeattacker
diff --git a/‎.github/workflows/_build.yml‎
Lines changed: 14 additions & 3 deletions b/‎.github/workflows/_build.yml‎
Lines changed: 14 additions & 3 deletions
diff --git a/‎.github/workflows/api_test.yml‎
Lines changed: 14 additions & 18 deletions b/‎.github/workflows/api_test.yml‎
Lines changed: 14 additions & 18 deletions
diff --git a/‎.github/workflows/build-docker-image.yml‎
Lines changed: 100 additions & 23 deletions b/‎.github/workflows/build-docker-image.yml‎
Lines changed: 100 additions & 23 deletions
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 0 additions & 3 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 0 additions & 3 deletions
@@ -237,12 +237,17 @@ jobs:
         mkdir -p openviking/bin
         cp target/${{ matrix.arch == 'aarch64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu' }}/release/ov openviking/bin/
         chmod +x openviking/bin/ov
+
     - name: Clean workspace (force ignore dirty)
       shell: bash
       run: |
+        # Back up pre-built artifacts before cleaning
+        cp -a openviking/bin /tmp/_ov_bin || true
         git reset --hard HEAD
         git clean -fd
         rm -rf openviking/_version.py openviking.egg-info
+        # Restore pre-built artifacts
+        cp -a /tmp/_ov_bin openviking/bin || true
         # Ignore uv.lock changes to avoid dirty state in setuptools_scm
         git update-index --assume-unchanged uv.lock || true
 
@@ -257,6 +262,8 @@ jobs:
         git status --ignored
         echo "=== Check openviking/_version.py ==="
         if [ -f openviking/_version.py ]; then cat openviking/_version.py; else echo "Not found"; fi
+        echo "=== Verify pre-built artifacts survived clean ==="
+        ls -la openviking/bin/ || true
 
     - name: Build package (Wheel Only)
       run: uv build --wheel
@@ -276,11 +283,8 @@ jobs:
     - name: Repair wheels (Linux)
       run: |
         uv pip install auditwheel
-        # Repair wheels and output to a temporary directory
         uv run auditwheel repair dist/*.whl -w dist_fixed
-        # Remove original non-compliant wheels
         rm dist/*.whl
-        # Move repaired wheels back to dist
         mv dist_fixed/*.whl dist/
         rmdir dist_fixed
 
@@ -405,12 +409,17 @@ jobs:
           cp target/release/ov openviking/bin/
           chmod +x openviking/bin/ov
         fi
+
     - name: Clean workspace (force ignore dirty)
       shell: bash
       run: |
+        # Back up pre-built artifacts before cleaning
+        cp -a openviking/bin /tmp/_ov_bin || true
         git reset --hard HEAD
         git clean -fd
         rm -rf openviking/_version.py openviking.egg-info
+        # Restore pre-built artifacts
+        cp -a /tmp/_ov_bin openviking/bin || true
         # Ignore uv.lock changes to avoid dirty state in setuptools_scm
         git update-index --assume-unchanged uv.lock || true
 
@@ -425,6 +434,8 @@ jobs:
         git status --ignored
         echo "=== Check openviking/_version.py ==="
         if [ -f openviking/_version.py ]; then cat openviking/_version.py; else echo "Not found"; fi
+        echo "=== Verify pre-built artifacts survived clean ==="
+        ls -la openviking/bin/ || true
 
     - name: Build package (Wheel Only)
       run: uv build --wheel
 
@@ -1,4 +1,4 @@
-name: 03. API Integration Tests
+name: 06. API Integration Tests
 
 on:
   workflow_dispatch:
@@ -42,10 +42,12 @@ jobs:
   api-tests:
     name: API Integration Tests (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 50
     strategy:
       fail-fast: false
+      max-parallel: 2
       matrix:
-        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-14, macos-15-intel, windows-latest]
+        os: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') && fromJSON('["ubuntu-24.04", "macos-14", "windows-latest"]') || fromJSON('["ubuntu-24.04"]') }}
 
     steps:
       - uses: actions/checkout@v6
@@ -58,24 +60,17 @@ jobs:
           python-version: '3.10'
 
       - name: Cache Go modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
+        continue-on-error: true
         with:
           path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ hashFiles('third_party/agfs/**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
 
-      - name: Cache C++ extensions
-        uses: actions/cache@v4
-        with:
-          path: openviking/pyagfs
-          key: ${{ runner.os }}-cpp-${{ hashFiles('**/CMakeLists.txt', '**/*.cpp', '**/*.h') }}
-          restore-keys: |
-            ${{ runner.os }}-cpp-
-
       - name: Cache Python dependencies (Unix)
         if: runner.os != 'Windows'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt', '**/pyproject.toml') }}
@@ -84,7 +79,7 @@ jobs:
 
       - name: Cache Python dependencies (Windows)
         if: runner.os == 'Windows'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~\AppData\Local\pip\Cache
           key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt', '**/pyproject.toml') }}
@@ -94,7 +89,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version: '1.25.1'
 
       - name: Install system dependencies (Ubuntu)
         if: runner.os == 'Linux'
@@ -109,7 +104,7 @@ jobs:
       - name: Install system dependencies (Windows)
         if: runner.os == 'Windows'
         run: |
-          choco install cmake -y
+          echo "cmake is pre-installed on Windows runner and will also be installed via pip"
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
@@ -415,7 +410,8 @@ jobs:
             echo "Running basic tests only (no VLM/Embedding)"
             uv run python -m pytest . -v --html=api-test-report.html --self-contained-html \
               --ignore=retrieval/ --ignore=resources/test_pack.py --ignore=resources/test_wait_processed.py \
-              --ignore=admin/ --ignore=skills/ --ignore=system/test_system_status.py --ignore=system/test_is_healthy.py --ignore=system/test_system_wait.py -k "not test_observer"
+              --ignore=admin/ --ignore=skills/ --ignore=system/test_system_status.py --ignore=system/test_is_healthy.py --ignore=system/test_system_wait.py \
+              --ignore=scenarios/ -k "not test_observer"
           fi
         continue-on-error: true
 
@@ -433,7 +429,7 @@ jobs:
             uv run python -m pytest . -v --html=api-test-report.html --self-contained-html --ignore=filesystem/
           } else {
             Write-Host "Running basic tests only (no VLM/Embedding, Windows: skipping filesystem tests)"
-            uv run python -m pytest . -v --html=api-test-report.html --self-contained-html --ignore=retrieval/ --ignore=resources/test_pack.py --ignore=resources/test_wait_processed.py --ignore=admin/ --ignore=skills/ --ignore=system/test_system_status.py --ignore=system/test_is_healthy.py --ignore=system/test_system_wait.py --ignore=filesystem/ -k "not test_observer"
+            uv run python -m pytest . -v --html=api-test-report.html --self-contained-html --ignore=retrieval/ --ignore=resources/test_pack.py --ignore=resources/test_wait_processed.py --ignore=admin/ --ignore=skills/ --ignore=system/test_system_status.py --ignore=system/test_is_healthy.py --ignore=system/test_system_wait.py --ignore=filesystem/ --ignore=scenarios/ -k "not test_observer"
           }
         continue-on-error: true
 
 
@@ -8,6 +8,7 @@ on:
         required: true
         type: string
   push:
+    branches: [ main ]
     tags: [ "v*.*.*" ]
 
 env:
@@ -52,41 +53,79 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Extract metadata (tags, labels) for Docker
         id: meta
         uses: docker/metadata-action@v6
         with:
-          images: ${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }}
+          images: |
+            ${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }}
+            docker.io/${{ secrets.DOCKERHUB_USERNAME }}/openviking
           tags: |
             type=raw,value=${{ github.event.inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' }}
             type=ref,event=tag,enable=${{ github.ref_type == 'tag' }}
+            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
+            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Build and push Docker image
-        id: push
+      - name: Build and push Docker image to GHCR
+        id: push-ghcr
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          outputs: |
+            type=image,name=${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }},push-by-digest=true,name-canonical=true,push=true
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            # fallback to 0.0.0 if no version is provided
+            OPENVIKING_VERSION=${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.version) || (github.ref_type == 'tag' && github.ref_name) || '0.0.0' }}
+
+      - name: Build and push Docker image to Docker Hub
+        id: push-dockerhub
         uses: docker/build-push-action@v7
         with:
           context: .
           platforms: ${{ matrix.platform }}
-          outputs: type=image,name=${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }},push-by-digest=true,name-canonical=true,push=true
+          outputs: |
+            type=image,name=docker.io/${{ secrets.DOCKERHUB_USERNAME }}/openviking,push-by-digest=true,name-canonical=true,push=true
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             # fallback to 0.0.0 if no version is provided
             OPENVIKING_VERSION=${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.version) || (github.ref_type == 'tag' && github.ref_name) || '0.0.0' }}
 
-      - name: Export image digest
+      - name: Export GHCR image digest
         run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.push.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
+          mkdir -p /tmp/digests-ghcr
+          ghcr_digest="${{ steps.push-ghcr.outputs.digest }}"
+          touch "/tmp/digests-ghcr/${ghcr_digest#sha256:}"
 
-      - name: Upload image digest
+      - name: Upload GHCR image digest
         uses: actions/upload-artifact@v7
         with:
-          name: docker-digests-${{ matrix.arch }}
-          path: /tmp/digests/*
+          name: docker-digests-ghcr-${{ matrix.arch }}
+          path: /tmp/digests-ghcr/*
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Export Docker Hub image digest
+        run: |
+          mkdir -p /tmp/digests-dockerhub
+          dockerhub_digest="${{ steps.push-dockerhub.outputs.digest }}"
+          touch "/tmp/digests-dockerhub/${dockerhub_digest#sha256:}"
+
+      - name: Upload Docker Hub image digest
+        uses: actions/upload-artifact@v7
+        with:
+          name: docker-digests-dockerhub-${{ matrix.arch }}
+          path: /tmp/digests-dockerhub/*
           if-no-files-found: error
           retention-days: 1
 
@@ -117,43 +156,81 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Extract metadata (tags, labels) for Docker
         id: meta
         uses: docker/metadata-action@v6
         with:
-          images: ${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }}
+          images: |
+            ${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }}
+            docker.io/${{ secrets.DOCKERHUB_USERNAME }}/openviking
           tags: |
             type=raw,value=${{ github.event.inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' }}
             type=ref,event=tag,enable=${{ github.ref_type == 'tag' }}
+            type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
+            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Download image digests
+      - name: Download GHCR image digests
         uses: actions/download-artifact@v8
         with:
-          pattern: docker-digests-*
-          path: /tmp/digests
+          pattern: docker-digests-ghcr-*
+          path: /tmp/digests-ghcr
+          merge-multiple: true
+
+      - name: Download Docker Hub image digests
+        uses: actions/download-artifact@v8
+        with:
+          pattern: docker-digests-dockerhub-*
+          path: /tmp/digests-dockerhub
           merge-multiple: true
 
       - name: Create multi-arch manifests
         env:
           SOURCE_TAGS: ${{ steps.meta.outputs.tags }}
         run: |
-          image_refs=()
-          for digest_file in /tmp/digests/*; do
+          # Collect image references for both registries
+          ghcr_image_refs=()
+          dockerhub_image_refs=()
+          for digest_file in /tmp/digests-ghcr/*; do
+            [ -e "$digest_file" ] || continue
+            digest="sha256:$(basename "$digest_file")"
+            ghcr_image_refs+=("${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }}@${digest}")
+          done
+          for digest_file in /tmp/digests-dockerhub/*; do
             [ -e "$digest_file" ] || continue
-            image_refs+=("${{ env.REGISTRY }}/${{ steps.image-name.outputs.image }}@sha256:$(basename "$digest_file")")
+            digest="sha256:$(basename "$digest_file")"
+            dockerhub_image_refs+=("docker.io/${{ secrets.DOCKERHUB_USERNAME }}/openviking@${digest}")
           done
 
-          [ ${#image_refs[@]} -gt 0 ] || {
-            echo "No image digests found" >&2
+          [ ${#ghcr_image_refs[@]} -gt 0 ] || {
+            echo "No GHCR image digests found" >&2
+            exit 1
+          }
+          [ ${#dockerhub_image_refs[@]} -gt 0 ] || {
+            echo "No Docker Hub image digests found" >&2
             exit 1
           }
 
+          # Create manifests for all tags
           while IFS= read -r tag; do
             [ -n "$tag" ] || continue
-            docker buildx imagetools create \
-              --tag "$tag" \
-              "${image_refs[@]}"
+
+            # Determine which registry this tag belongs to
+            if [[ "$tag" == ghcr.io/* ]]; then
+              docker buildx imagetools create \
+                --tag "$tag" \
+                "${ghcr_image_refs[@]}"
+            elif [[ "$tag" == docker.io/* ]]; then
+              docker buildx imagetools create \
+                --tag "$tag" \
+                "${dockerhub_image_refs[@]}"
+            fi
           done <<< "$SOURCE_TAGS"
@@ -23,8 +23,5 @@ permissions:
   security-events: write
 
 jobs:
-  test-full:
-    uses: ./.github/workflows/_test_full.yml
-
   security-scan:
     uses: ./.github/workflows/_codeql.yml