Publish ModelsDB 1.29.0

Full republication of the public catalog browser: Go backend (cmd/, internal/) with embedded web UI and seed catalog, CI and release workflows, Dependabot config, documentation (README, ARCHITECTURE, DESIGN, CONTRIBUTING, SECURITY, CHANGELOG), build script, and the update-database-manually skill. 91 files, 23133 insertions.

Author: DavidTimar1

.claude/skills/update-database-manually/SKILL.md

@@ -0,0 +1,85 @@
+# .gitattributes - stable, cross-platform line endings
+# (Windows / WSL / Git Bash / Linux / macOS).
+#
+# DEFAULT: every text file is stored LF in the repo and checked out LF on EVERY OS.
+# One LF policy keeps bash scripts and config working under Git Bash / WSL on Windows
+# (a shell script checked out with CRLF breaks), and makes each file byte-identical on
+# every machine. Git still auto-detects text vs binary, so unlisted text types are still
+# handled and binaries are never EOL-converted. The exceptions below are the few files
+# where a DIFFERENT ending is correct.
+* text=auto eol=lf
+
+# Windows-native scripts: keep CRLF. These run under cmd.exe / PowerShell, never under
+# bash, and CRLF is their native convention.
+*.bat   text eol=crlf
+*.cmd   text eol=crlf
+*.ps1   text eol=crlf
+
+# Files we author: force LF explicitly (documents intent, and pins "text" so a file is
+# never mis-detected as binary). These must stay LF to run under bash or be read by Linux tools.
+*.sh     text eol=lf
+*.bash   text eol=lf
+*.zsh    text eol=lf
+*.mjs    text eol=lf
+*.cjs    text eol=lf
+*.js     text eol=lf
+*.jsx    text eol=lf
+*.ts     text eol=lf
+*.tsx    text eol=lf
+*.py     text eol=lf
+*.rb     text eol=lf
+*.php    text eol=lf
+*.go     text eol=lf
+*.rs     text eol=lf
+*.json   text eol=lf
+*.jsonc  text eol=lf
+*.yml    text eol=lf
+*.yaml   text eol=lf
+*.toml   text eol=lf
+*.ini    text eol=lf
+*.cfg    text eol=lf
+*.conf   text eol=lf
+*.md     text eol=lf
+*.txt    text eol=lf
+*.html   text eol=lf
+*.css    text eol=lf
+*.scss   text eol=lf
+*.sql    text eol=lf
+*.xml    text eol=lf
+*.svg    text eol=lf
+
+# Binary / asset types: never apply EOL conversion or text diffs.
+*.png    binary
+*.jpg    binary
+*.jpeg   binary
+*.gif    binary
+*.bmp    binary
+*.ico    binary
+*.webp   binary
+*.pdf    binary
+*.woff   binary
+*.woff2  binary
+*.ttf    binary
+*.otf    binary
+*.eot    binary
+*.zip    binary
+*.gz     binary
+*.tar    binary
+*.7z     binary
+*.mp4    binary
+*.webm   binary
+*.mov    binary
+*.mp3    binary
+*.wav    binary
+*.exe    binary
+*.dll    binary
+*.so     binary
+*.dylib  binary
+*.wasm   binary
+*.bin    binary
+*.db     binary
+*.sqlite binary
+
+# Project-specific overrides go here (add per repo as needed). Example: a template file
+# consumed only by a Linux script must stay LF even if its extension is unusual:
+# *.template text eol=lf

.gitattributes

@@ -0,0 +1,9 @@
+# Keep the SHA-pinned GitHub Actions current: Dependabot opens a PR when a pinned
+# action has a newer release, bumping both the commit SHA and its version comment.
+# (Runs on the public/remote repo only.)
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/dependabot.yml

@@ -0,0 +1,33 @@
+# Continuous integration: build, vet, and test on every push to main and on PRs.
+# This is what powers the "CI passing" badge in the README. (The separate
+# release.yml runs only on version tags.)
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./... -cover

.github/workflows/ci.yml

@@ -0,0 +1,79 @@
+# Build and publish a GitHub Release when a version tag (v*) is pushed.
+#
+# The FIRST step is a release GATE: it refuses to release unless the pushed tag
+# matches the VERSION file, so the tag, the binary's stamped version (build.sh
+# injects VERSION via -ldflags), and VERSION itself can never drift apart.
+#
+# See README "Cutting a release" for how a maintainer triggers this.
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write # required to create the Release and upload its assets
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Verify tag matches VERSION (release gate)
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          file="$(tr -d '[:space:]' < VERSION)"
+          if [ "$tag" != "$file" ]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} does not match VERSION ($file). Bump VERSION + CHANGELOG, then tag v$file."
+            exit 1
+          fi
+          if ! grep -q "\[$file\]" CHANGELOG.md; then
+            echo "::warning::No CHANGELOG.md entry found for $file."
+          fi
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Build binaries
+        run: bash build.sh
+
+      - name: Checksums for the release assets
+        run: |
+          # Stable, version-less asset names (modelsdb.exe / modelsdb) so users
+          # can download and overwrite their existing binary in place.
+          ( cd dist && sha256sum modelsdb.exe modelsdb > SHA256SUMS && cat SHA256SUMS )
+
+      - name: Sign SHA256SUMS (self-update trust anchor)
+        # The in-app self-update verifies this ed25519 signature (with the public
+        # key embedded in internal/selfupdate/pubkey.go) before trusting a
+        # downloaded binary. MODELSDB_SIGN_KEY is the base64 private key repo
+        # secret. It never prints the key; it only writes dist/SHA256SUMS.sig.
+        env:
+          MODELSDB_SIGN_KEY: ${{ secrets.MODELSDB_SIGN_KEY }}
+        run: go run ./cmd/sign sums dist/SHA256SUMS
+
+      - name: Extract release notes from CHANGELOG
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          awk -v ver="$v" '
+            $0 ~ ("^## \\[" ver "\\]") { grab=1; next }
+            grab && /^## \[/ { exit }
+            grab { print }
+          ' CHANGELOG.md > RELEASE_NOTES.md
+          if [ ! -s RELEASE_NOTES.md ]; then echo "Release v$v" > RELEASE_NOTES.md; fi
+          echo "--- release notes ---"; cat RELEASE_NOTES.md
+
+      - name: Publish release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        with:
+          body_path: RELEASE_NOTES.md
+          files: |
+            dist/modelsdb.exe
+            dist/modelsdb
+            dist/SHA256SUMS
+            dist/SHA256SUMS.sig

.github/workflows/release.yml

@@ -0,0 +1,5 @@
+# Agent Guide
+
+See **[CLAUDE.md](./CLAUDE.md)** for the agent rules; it points to `README.md` (overview/usage), `ARCHITECTURE.md` (backend/data design), and `DESIGN.md` (UI/CSS/JS choices) for the details.
+
+This file is intentionally a pointer so every harness reads the same source.