Merge branch 'headroomlabs-ai:main' into main

Author: nangsontay

.github/pr-images/issue-1696-error-protection-fix.svg

@@ -21,7 +21,8 @@ permissions:
   contents: read
 
 jobs:
-  validate:
+  validate-mkdocs:
+    name: Validate mkdocs build
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -46,7 +47,31 @@ jobs:
       - name: Build docs
         run: mkdocs build
 
-  deploy:
+  validate-nextjs:
+    name: Validate Next.js build
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: docs
+
+      - name: Build docs
+        run: npm run build
+        working-directory: docs
+
+  deploy-github-pages:
+    name: Deploy GitHub Pages
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     permissions:
@@ -73,3 +98,33 @@ jobs:
 
       - name: Build and deploy
         run: mkdocs gh-deploy --force
+
+  deploy-vercel:
+    name: Deploy Vercel Docs
+    if: >-
+      github.event_name != 'pull_request'
+      && github.ref == 'refs/heads/main'
+      && github.repository_owner == 'headroomlabs-ai'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: docs
+
+      - name: Deploy to Vercel
+        run: npx vercel deploy --prod --token=${{ secrets.VERCEL_TOKEN }}
+        working-directory: docs
+        env:
+          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
+          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}

.github/workflows/docs.yml

@@ -50,6 +50,8 @@ on:
       - "pyproject.toml"
       - "scripts/verify-versions.py"
       - "scripts/version-sync.py"
+      - "scripts/build_npm_release_assets.mjs"
+      - "scripts/verify_npm_release_assets.mjs"
       - "Cargo.toml"
       - "Cargo.lock"
   workflow_dispatch:
@@ -187,20 +189,7 @@ jobs:
 
       - name: Build npm release packages
         run: |
-          mkdir -p release-assets
-
-          cd sdk/typescript
-          npm install
-          npm run build
-          npm version ${{ needs.detect-version.outputs.npm_version }} --no-git-tag-version --allow-same-version
-          npm pack --pack-destination ../../release-assets
-
-          cd ../../plugins/openclaw
-          npm install ../../release-assets/headroom-ai-${{ needs.detect-version.outputs.npm_version }}.tgz
-          npm install
-          npm run build
-          npm version ${{ needs.detect-version.outputs.npm_version }} --no-git-tag-version --allow-same-version
-          npm pack --pack-destination ../../release-assets
+          node scripts/build_npm_release_assets.mjs "${{ needs.detect-version.outputs.npm_version }}" release-assets
 
       - name: Upload release assets artifact
         uses: actions/upload-artifact@v7
@@ -833,10 +822,11 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
+          version="${{ needs.detect-version.outputs.npm_version }}"
           cd sdk/typescript
-          npm install
+          npm ci
           npm run build
-          npm version ${{ needs.detect-version.outputs.npm_version }} --no-git-tag-version --allow-same-version
+          npm version "$version" --no-git-tag-version --allow-same-version
           npm publish --access public
         continue-on-error: true
 
@@ -845,10 +835,19 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
+          version="${{ needs.detect-version.outputs.npm_version }}"
           cd plugins/openclaw
-          npm install
+          npm ci
           npm run build
-          npm version ${{ needs.detect-version.outputs.npm_version }} --no-git-tag-version --allow-same-version
+          npm version "$version" --no-git-tag-version --allow-same-version
+          HEADROOM_NPM_VERSION="$version" node <<'EOF'
+          const fs = require("fs");
+          const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+          pkg.dependencies = pkg.dependencies || {};
+          pkg.dependencies["headroom-ai"] = `^${process.env.HEADROOM_NPM_VERSION}`;
+          fs.writeFileSync("package.json", `${JSON.stringify(pkg, null, 2)}\n`);
+          EOF
+          node prepare-dist.mjs
           npm publish --access public
         continue-on-error: true
 

.github/workflows/release.yml

@@ -54,6 +54,19 @@ jobs:
           components: rustfmt, clippy
       - name: Cache cargo registry + build
         uses: Swatinem/rust-cache@v2
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+      - name: Provide ONNX Runtime dylib
+        # headroom-core is built with `ort-load-dynamic` (see its
+        # Cargo.toml): the ONNX Runtime shared library is dlopen'd at
+        # runtime instead of statically linked, so the magika/detection
+        # tests need a real libonnxruntime.so and ORT_DYLIB_PATH pointing
+        # at it — same contract `headroom/_ort.py` fulfills for Python
+        # users via the pip `onnxruntime` package.
+        run: |
+          pip install 'onnxruntime>=1.16.0'
+          echo "ORT_DYLIB_PATH=$(python -c "import onnxruntime, pathlib; p = pathlib.Path(onnxruntime.__file__).parent / 'capi'; print(next(iter(sorted(p.glob('libonnxruntime.so*')))))")" >> "$GITHUB_ENV"
       - name: cargo fmt --check
         run: cargo fmt --all -- --check
       - name: cargo clippy

.github/workflows/rust.yml

@@ -18,6 +18,11 @@ scripts/*
 !scripts/changelog-gen.py
 !scripts/verify-versions.py
 !scripts/pr-governance.py
+!scripts/bootstrap-windows-dev.ps1
+!scripts/build_npm_release_assets.mjs
+!scripts/build_python_release_smoke.py
+!scripts/release_smoke_all.py
+!scripts/verify_npm_release_assets.mjs
 !scripts/tests/
 !scripts/README.md
 !scripts/repro_codex_replay.py
@@ -121,6 +126,9 @@ venv.bak/
 # Node.js dependencies (never commit vendored deps)
 node_modules/
 
+# Local release smoke outputs
+release-assets-local/
+
 # Secrets and API keys - NEVER commit these
 *.pem
 *.key

.gitignore

@@ -1,3 +1,3 @@
 {
-  ".": "0.31.0"
+  ".": "0.32.0"
 }