Add release workflow, dependabot, fix env config override, protect main

.github/dependabot.yml

@@ -0,0 +1,43 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/New_York
+    commit-message:
+      prefix: chore
+      include: scope
+    labels:
+      - dependencies
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/New_York
+    commit-message:
+      prefix: chore
+      include: scope
+    labels:
+      - dependencies
+    open-pull-requests-limit: 3
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/New_York
+    commit-message:
+      prefix: chore
+      include: scope
+    labels:
+      - dependencies
+    open-pull-requests-limit: 3

.github/workflows/release.yml

@@ -0,0 +1,74 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Bump version and create tag
+        id: tag
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { data: tags } = await github.rest.git.listMatchingRefs({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: 'refs/tags/',
+            });
+            const versions = tags
+              .map(t => t.ref.replace('refs/tags/v', ''))
+              .filter(v => /^\d+\.\d+\.\d+$/.test(v))
+              .sort((a, b) => {
+                const [ma, mb] = [a, b].map(s => s.split('.').map(Number));
+                for (let i = 0; i < 3; i++) {
+                  if (ma[i] !== mb[i]) return ma[i] - mb[i];
+                }
+                return 0;
+              });
+            const latest = versions.length ? versions[versions.length - 1] : '0.0.0';
+            const [major, minor, patch] = latest.split('.').map(Number);
+            const newVersion = `${major}.${minor}.${patch + 1}`;
+            const tag = `v${newVersion}`;
+            await github.rest.git.createRef({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: `refs/tags/${tag}`,
+              sha: context.sha,
+            });
+            core.setOutput('tag', tag);
+            core.setOutput('version', newVersion);
+
+      - name: Generate release notes
+        id: notes
+        run: |
+          PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          if [ -z "$PREV_TAG" ]; then
+            NOTES="Initial release"
+          else
+            NOTES=$(git log --oneline --no-decorate $PREV_TAG..HEAD 2>/dev/null || echo "No changes")
+          fi
+          {
+            echo 'notes<<EOF'
+            echo "$NOTES"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tag.outputs.tag }}
+          name: Release ${{ steps.tag.outputs.tag }}
+          body: ${{ steps.notes.outputs.notes }}
+          token: ${{ secrets.GITHUB_TOKEN }}

internal/config/config.go

@@ -196,8 +196,12 @@ func LoadConfig(path string) (*Config, error) {
 	}
 
 	env := loadEnvConfig()
-	config.APIKey = env["COINEX_API_KEY"]
-	config.SecretID = env["COINEX_SECRET_ID"]
+	if v, ok := env["COINEX_API_KEY"]; ok {
+		config.APIKey = v
+	}
+	if v, ok := env["COINEX_SECRET_ID"]; ok {
+		config.SecretID = v
+	}
 
 	// Validate configuration
 	if err := config.Validate(); err != nil {