Fix GitHub Actions permissions for release creation

- Add contents: write permission for private repository
- Remove Windows zip file references
- Simplify artifact upload paths
- Fix release workflow permissions for private repos

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.claude/settings.local.json

@@ -42,7 +42,10 @@
       "WebFetch(domain:syui.ai)",
       "Bash(rustup target list:*)",
       "Bash(rustup target:*)",
-      "Bash(git add:*)"
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git push:*)",
+      "Bash(git tag:*)"
     ],
     "deny": []
   }

.github/workflows/gh-pages-fast.yml

@@ -15,18 +15,45 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     
-    - name: Get latest release
-      id: latest_release
-      run: |
-        LATEST_TAG=$(curl -s https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r .tag_name)
-        echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT
+    - name: Cache ailog binary
+      uses: actions/cache@v4
+      with:
+        path: ./bin
+        key: ailog-bin-${{ runner.os }}
+        restore-keys: |
+          ailog-bin-${{ runner.os }}
     
-    - name: Download pre-built binary from release
+    - name: Check and update ailog binary
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
-        curl -sL https://github.com/${{ github.repository }}/releases/download/${{ steps.latest_release.outputs.tag }}/ailog-linux-x86_64.tar.gz | tar -xzf -
-        chmod +x ailog
+        # Get latest release version
+        LATEST_VERSION=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
+          https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r .tag_name)
+        echo "Latest version: $LATEST_VERSION"
+        
+        # Check current binary version if exists
         mkdir -p ./bin
-        mv ailog ./bin/
+        if [ -f "./bin/ailog" ]; then
+          CURRENT_VERSION=$(./bin/ailog --version | awk '{print $2}' || echo "unknown")
+          echo "Current version: $CURRENT_VERSION"
+        else
+          CURRENT_VERSION="none"
+          echo "No binary found"
+        fi
+        
+        # Download if version is different or binary doesn't exist
+        if [ "$CURRENT_VERSION" != "${LATEST_VERSION#v}" ]; then
+          echo "Downloading ailog $LATEST_VERSION..."
+          curl -sL -H "Authorization: Bearer $GITHUB_TOKEN" \
+            https://github.com/${{ github.repository }}/releases/download/$LATEST_VERSION/ailog-linux-x86_64.tar.gz | tar -xzf -
+          mv ailog ./bin/ailog
+          chmod +x ./bin/ailog
+          echo "Updated to version: $(./bin/ailog --version)"
+        else
+          echo "Binary is up to date"
+          chmod +x ./bin/ailog
+        fi
       
     - name: Setup Hugo
       uses: peaceiris/actions-hugo@v3

.github/workflows/release.yml

@@ -11,13 +11,20 @@ on:
         required: true
         default: 'v0.1.0'
 
+permissions:
+  contents: write
+  actions: read
+
 env:
   CARGO_TERM_COLOR: always
+  OPENSSL_STATIC: true
+  OPENSSL_VENDOR: true
 
 jobs:
   build:
     name: Build ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     strategy:
       matrix:
         include:
@@ -25,10 +32,6 @@ jobs:
             os: ubuntu-latest
             artifact_name: ailog
             asset_name: ailog-linux-x86_64
-          - target: x86_64-unknown-linux-musl
-            os: ubuntu-latest
-            artifact_name: ailog
-            asset_name: ailog-linux-x86_64-musl
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-latest
             artifact_name: ailog
@@ -41,10 +44,6 @@ jobs:
             os: macos-latest
             artifact_name: ailog
             asset_name: ailog-macos-aarch64
-          - target: x86_64-pc-windows-msvc
-            os: windows-latest
-            artifact_name: ailog.exe
-            asset_name: ailog-windows-x86_64.exe
 
     steps:
     - uses: actions/checkout@v4
@@ -55,16 +54,10 @@ jobs:
         targets: ${{ matrix.target }}
 
     - name: Install cross-compilation tools (Linux)
-      if: matrix.os == 'ubuntu-latest'
+      if: matrix.os == 'ubuntu-latest' && matrix.target == 'aarch64-unknown-linux-gnu'
       run: |
         sudo apt-get update
-        sudo apt-get install -y gcc-multilib
-        if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-        fi
-        if [[ "${{ matrix.target }}" == "x86_64-unknown-linux-musl" ]]; then
-          sudo apt-get install -y musl-tools
-        fi
+        sudo apt-get install -y gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu
 
     - name: Configure cross-compilation (Linux ARM64)
       if: matrix.target == 'aarch64-unknown-linux-gnu'
@@ -93,11 +86,17 @@ jobs:
       shell: bash
       run: |
         cd target/${{ matrix.target }}/release
-        if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
-          strip ${{ matrix.artifact_name }} || true
+        
+        # Use appropriate strip command for cross-compilation
+        if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
+          aarch64-linux-gnu-strip ${{ matrix.artifact_name }} || echo "Strip failed, continuing..."
+        elif [[ "${{ matrix.os }}" == "windows-latest" ]]; then
+          strip ${{ matrix.artifact_name }} || echo "Strip failed, continuing..."
         else
-          strip ${{ matrix.artifact_name }}
+          strip ${{ matrix.artifact_name }} || echo "Strip failed, continuing..."
         fi
+        
+        # Create archive
         if [[ "${{ matrix.target }}" == *"windows"* ]]; then
           7z a ../../../${{ matrix.asset_name }}.zip ${{ matrix.artifact_name }}
         else
@@ -108,14 +107,15 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.asset_name }}
-        path: |
-          ${{ matrix.asset_name }}.tar.gz
-          ${{ matrix.asset_name }}.zip
+        path: ${{ matrix.asset_name }}.tar.gz
 
   release:
     name: Create Release
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: read
     steps:
     - uses: actions/checkout@v4
 
@@ -135,9 +135,8 @@ jobs:
         echo "- AI comment system" >> release_notes.md
         echo "" >> release_notes.md
         echo "### Platforms" >> release_notes.md
-        echo "- Linux (x86_64, aarch64, musl)" >> release_notes.md
+        echo "- Linux (x86_64, aarch64)" >> release_notes.md
         echo "- macOS (Intel, Apple Silicon)" >> release_notes.md
-        echo "- Windows (x86_64)" >> release_notes.md
         echo "" >> release_notes.md
         echo "### Installation" >> release_notes.md
         echo "\`\`\`bash" >> release_notes.md
@@ -146,8 +145,6 @@ jobs:
         echo "chmod +x ailog" >> release_notes.md
         echo "sudo mv ailog /usr/local/bin/" >> release_notes.md
         echo "" >> release_notes.md
-        echo "# Windows" >> release_notes.md
-        echo "# Extract ailog-windows-x86_64.zip and add to PATH" >> release_notes.md
         echo "\`\`\`" >> release_notes.md
 
     - name: Get tag name
@@ -167,8 +164,6 @@ jobs:
         body_path: release_notes.md
         draft: false
         prerelease: ${{ contains(steps.tag_name.outputs.tag, 'alpha') || contains(steps.tag_name.outputs.tag, 'beta') || contains(steps.tag_name.outputs.tag, 'rc') }}
-        files: |
-          artifacts/*/ailog-*.tar.gz
-          artifacts/*/ailog-*.zip
+        files: artifacts/*/ailog-*.tar.gz
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Cargo.toml

@@ -26,7 +26,7 @@ fs_extra = "1.3"
 colored = "2.1"
 serde_yaml = "0.9"
 syntect = "5.2"
-reqwest = { version = "0.12", features = ["json"] }
+reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
 rand = "0.8"
 sha2 = "0.10"
 base64 = "0.22"
@@ -43,12 +43,12 @@ cookie = "0.18"
 syn = { version = "2.0", features = ["full", "parsing", "visit"] }
 quote = "1.0"
 ignore = "0.4"
-git2 = "0.18"
+git2 = { version = "0.18", features = ["vendored-openssl", "vendored-libgit2", "ssh"], default-features = false }
 regex = "1.0"
 # ATProto and stream monitoring dependencies
-tokio-tungstenite = { version = "0.21", features = ["native-tls"] }
+tokio-tungstenite = { version = "0.21", features = ["rustls-tls-webpki-roots", "connect"], default-features = false }
 futures-util = "0.3"
-tungstenite = { version = "0.21", features = ["native-tls"] }
+tungstenite = { version = "0.21", features = ["rustls-tls-webpki-roots"], default-features = false }
 
 [dev-dependencies]
 tempfile = "3.14"

action.yml

@@ -47,17 +47,57 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - name: Setup Rust
-      uses: actions-rs/toolchain@v1
+    - name: Cache ailog binary
+      uses: actions/cache@v4
       with:
-        toolchain: stable
-        override: true
+        path: ./bin
+        key: ailog-bin-${{ runner.os }}
+        restore-keys: |
+          ailog-bin-${{ runner.os }}
     
-    - name: Install ailog
+    - name: Check and update ailog binary
       shell: bash
       run: |
-        if [ ! -f "./target/release/ailog" ]; then
+        # Get latest release version (for Gitea, adjust API endpoint if needed)
+        if command -v curl >/dev/null 2>&1; then
+          LATEST_VERSION=$(curl -s https://api.github.com/repos/syui/ailog/releases/latest | jq -r .tag_name 2>/dev/null || echo "v0.1.1")
+        else
+          LATEST_VERSION="v0.1.1"  # fallback version
+        fi
+        echo "Target version: $LATEST_VERSION"
+        
+        # Check current binary version if exists
+        mkdir -p ./bin
+        if [ -f "./bin/ailog" ]; then
+          CURRENT_VERSION=$(./bin/ailog --version | awk '{print $2}' 2>/dev/null || echo "unknown")
+          echo "Current version: $CURRENT_VERSION"
+        else
+          CURRENT_VERSION="none"
+          echo "No binary found"
+        fi
+        
+        # Download if version is different or binary doesn't exist
+        if [ "$CURRENT_VERSION" != "${LATEST_VERSION#v}" ]; then
+          echo "Downloading ailog $LATEST_VERSION..."
+          # Try GitHub first, then fallback to local build
+          if curl -sL https://github.com/syui/ailog/releases/download/$LATEST_VERSION/ailog-linux-x86_64.tar.gz | tar -xzf - 2>/dev/null; then
+            mv ailog ./bin/ailog
+            chmod +x ./bin/ailog
+            echo "Downloaded binary: $(./bin/ailog --version)"
+          else
+            echo "Download failed, building from source..."
+            if command -v cargo >/dev/null 2>&1; then
               cargo build --release
+              cp ./target/release/ailog ./bin/ailog
+              echo "Built from source: $(./bin/ailog --version)"
+            else
+              echo "Error: Neither download nor cargo build available"
+              exit 1
+            fi
+          fi
+        else
+          echo "Binary is up to date"
+          chmod +x ./bin/ailog
         fi
         
     - name: Setup Node.js for OAuth app
@@ -83,8 +123,8 @@ runs:
       run: |
         start_time=$(date +%s)
         
-        ./target/release/ailog generate \
-          --input ${{ inputs.content-dir }} \
+        ./bin/ailog build \
+          --content ${{ inputs.content-dir }} \
           --output ${{ inputs.output-dir }} \
           --templates ${{ inputs.template-dir }} \
           --static ${{ inputs.static-dir }} \