fix: device-agent winres.json location for go-winres

fix(ci): restore swagger docs step + fix release needs (remove build-docs dependency)
ci: fix missing closing quote in release condition
2026-06-18 09:55:48 +07:00 · 2026-06-18 09:44:29 +07:00 · 2026-06-18 09:33:25 +07:00 · 2026-06-18 09:23:56 +07:00 · 2026-06-18 09:14:31 +07:00 · 2026-06-18 09:09:51 +07:00
10 changed files with 127 additions and 26 deletions
@@ -6,6 +6,8 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
    steps:
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -21,11 +23,34 @@ jobs:
        with:
          node-version: '24'

+      - name: Hash source files
+        id: hash-src
+        run: echo "hash=$(find apps/dashboard-ui -type f \( -name '*.vue' -o -name '*.ts' -o -name '*.js' -o -name '*.css' -o -name '*.json' -o -name '*.html' \) | sort | xargs sha256sum | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v3
+        id: cache-build
+        with:
+          path: apps/dashboard-ui/dist
+          key: build-dashboard-${{ steps.hash-src.outputs.hash }}
+
+      - name: Hash package-lock
+        id: hash-npm
+        run: echo "hash=$(sha256sum apps/dashboard-ui/package-lock.json | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v3
+        id: cache-npm
+        with:
+          path: ~/.npm
+          key: npm-dashboard-${{ steps.hash-npm.outputs.hash }}
+          restore-keys: npm-dashboard-
+
      - name: Install
+        if: steps.cache-build.outputs.cache-hit != 'true'
        working-directory: apps/dashboard-ui
        run: npm ci || npm install

      - name: Build
+        if: steps.cache-build.outputs.cache-hit != 'true'
        working-directory: apps/dashboard-ui
        run: npm run build

@@ -6,6 +6,8 @@ on:
 jobs:
  cross-build:
    runs-on: ubuntu-latest
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
    steps:
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -20,8 +22,31 @@ jobs:
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
+          cache: true
+
+      - uses: https://gitea.com/actions/go-hashfiles@v0.0.1
+        id: hash-src
+        with:
+          patterns: |
+            apps/device-agent/**/*.go
+            apps/device-agent/go.mod
+            apps/device-agent/go.sum
+
+      - uses: actions/cache@v3
+        id: cache-build
+        with:
+          path: apps/device-agent/bin
+          key: build-device-agent-${{ steps.hash-src.outputs.hash }}
+
+      - name: Generate Windows resources (UAC manifest + icon)
+        if: steps.cache-build.outputs.cache-hit != 'true'
+        working-directory: apps/device-agent
+        run: |
+          go install github.com/tc-hib/go-winres@latest
+          go-winres make

      - name: Build all platforms
+        if: steps.cache-build.outputs.cache-hit != 'true'
        working-directory: apps/device-agent
        shell: bash
        run: |
@@ -6,6 +6,8 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
    steps:
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -20,18 +22,33 @@ jobs:
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
+          cache: true

-      - name: Download Go modules
-        working-directory: apps/server-core
-        run: go mod download
+      - uses: https://gitea.com/actions/go-hashfiles@v0.0.1
+        id: hash-src
+        with:
+          patterns: |
+            apps/server-core/**/*.go
+            apps/server-core/go.mod
+            apps/server-core/go.sum
+
+      - uses: actions/cache@v3
+        id: cache-build
+        with:
+          path: |
+            apps/server-core/bin
+            apps/server-core/docs
+          key: build-server-core-${{ steps.hash-src.outputs.hash }}

      - name: Generate Swagger docs
+        if: steps.cache-build.outputs.cache-hit != 'true'
        working-directory: apps/server-core
        run: |
          go install github.com/swaggo/swag/cmd/swag@v1.16.6
          swag init -g main.go --parseDependency --parseInternal

      - name: Build
+        if: steps.cache-build.outputs.cache-hit != 'true'
        working-directory: apps/server-core
        run: go build -o bin/server-core .

@@ -4,30 +4,31 @@ on:
  push:
    tags:
      - 'dev-*'
+      - 'v*-dev*'
      - 'v*-beta*'
      - 'v*-test*'
      - 'v[0-9]*.[0-9]*.[0-9]'

 jobs:
-  # --- TESTS (only for test tags) ---
+  # ====================================================================
+  # TESTS — test tags only
+  # ====================================================================
  server-core-test:
    if: contains(gitea.ref_name, 'test')
    runs-on: ubuntu-latest
    steps:
-      - name: Configure git auth for submodules
-        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
+          token: ${{ secrets.BUILD_TOKEN }}
+          persist-credentials: true
+      - name: Configure git auth for submodules
+        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
-      - name: Generate swagger docs
-        working-directory: apps/server-core
-        run: |
-          go install github.com/swaggo/swag/cmd/swag@v1.16.6
-          swag init -g main.go --parseDependency --parseInternal
+          cache: true
      - name: Test (skip nftables - needs root)
        working-directory: apps/server-core
        run: go test $(go list ./... | grep -v internal/firewall) -tags dev -cover -count=1
@@ -36,15 +37,18 @@ jobs:
    if: contains(gitea.ref_name, 'test')
    runs-on: ubuntu-latest
    steps:
-      - name: Configure git auth for submodules
-        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
+          token: ${{ secrets.BUILD_TOKEN }}
+          persist-credentials: true
+      - name: Configure git auth for submodules
+        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'
+          cache: true
      - name: Test
        working-directory: apps/device-agent
        run: go test ./... -cover
@@ -53,12 +57,14 @@ jobs:
    if: contains(gitea.ref_name, 'test')
    runs-on: ubuntu-latest
    steps:
-      - name: Configure git auth for submodules
-        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
+          token: ${{ secrets.BUILD_TOKEN }}
+          persist-credentials: true
+      - name: Configure git auth for submodules
+        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
@@ -69,7 +75,9 @@ jobs:
        working-directory: apps/dashboard-ui
        run: npm run build

-  # --- BUILD + RELEASE (only for dev/beta/release tags, no tests needed) ---
+  # ====================================================================
+  # BUILD — dev/beta/release tags (skip test tags)
+  # ====================================================================
  build-server-core:
    if: "!contains(gitea.ref_name, 'test')"
    runs-on: ubuntu-latest
@@ -88,16 +96,23 @@ jobs:
    uses: ./.gitea/workflows/build_dashboard.yaml
    secrets: inherit

+  # ====================================================================
+  # DOCS — release tags only (skip dev/beta/test)
+  # ====================================================================
  build-docs:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
    runs-on: ubuntu-latest
    uses: ./.gitea/workflows/docs_call.yaml
    secrets: inherit

+  # ====================================================================
+  # RELEASE — dev/beta/release tags (skip test)
+  # ====================================================================
  release:
-    if: "!contains(gitea.ref_name, 'test')"
-    needs: [build-server-core, build-device-agent, build-dashboard, build-docs]
+    if: "!contains(gitea.ref_name, 'test') && !failure()"
+    needs: [build-server-core, build-device-agent, build-dashboard]
    uses: ./.gitea/workflows/release_call.yaml
    with:
-      prerelease: ${{ contains(gitea.ref_name, 'dev-') || contains(gitea.ref_name, 'beta') }}
+      prerelease: ${{ contains(gitea.ref_name, 'dev') }}
+      draft: ${{ contains(gitea.ref_name, 'beta') }}
    secrets: inherit
@@ -21,6 +21,17 @@ jobs:
        with:
          node-version: '24'

+      - name: Hash package-lock
+        id: hash-npm
+        run: echo "hash=$(sha256sum apps/docs/package-lock.json 2>/dev/null || echo 'none') | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.npm
+          key: npm-docs-${{ steps.hash-npm.outputs.hash }}
+          restore-keys: npm-docs-
+
      - name: Install
        working-directory: apps/docs
        run: npm ci || npm install
@@ -8,6 +8,11 @@ on:
        required: false
        type: boolean
        default: false
+      draft:
+        description: 'Mark as draft'
+        required: false
+        type: boolean
+        default: false

 permissions:
  contents: write
@@ -65,7 +70,7 @@ jobs:
          fi

          # Create release
-          JSON_BODY=$(printf '{"tag_name":"%s","name":"%s","body":"Release %s","draft":false,"prerelease":%s}' "$TAG" "$TAG" "$TAG" "${{ inputs.prerelease }}")
+          JSON_BODY=$(printf '{"tag_name":"%s","name":"%s","body":"Release %s","draft":%s,"prerelease":%s}' "$TAG" "$TAG" "$TAG" "${{ inputs.draft }}" "${{ inputs.prerelease }}")
          RELEASE_RESP=$(curl -s -X POST \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
@@ -13,7 +13,7 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 ├── apps/
 │   ├── server-core/    # Go/Gin API backend (submodule)
 │   ├── dashboard-ui/   # Vue 3 + Vite frontend (submodule)
-│   └── device-agent/   # Go stealth daemon (submodule)
+│   └── device-agent/   # Go stealth daemon + system tray (submodule)
 ├── docker-compose.yml  # Production orchestration
 ├── docker-compose.dev.yml  # Dev (air hot-reload)
 ├── Makefile            # up/down/dev/migrate/reset-db
@@ -50,7 +50,10 @@ NexusGuard SD-WAN Suite — Enterprise Zero-Trust SD-WAN with WireGuard tunnelin
 | Symbol | Type | Location | Role |
 |--------|------|----------|------|
 | `main()` (server-core) | func | `apps/server-core/main.go` | Entry: CLI flags + Gin init |
-| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: agent daemon lifecycle |
+| `main()` (device-agent) | func | `apps/device-agent/main.go` | Entry: systray + agent daemon lifecycle |
+| `onReady()` / `onExit()` | func | `apps/device-agent/main.go` | System tray setup and cleanup |
+| `startAgent()` / `stopAgent()` | func | `apps/device-agent/main.go` | Agent connect/disconnect lifecycle |
+| `generateIcon()` | func | `apps/device-agent/icon.go` | 16x16 shield icon for tray |
 | `config.Load()` | func | `apps/server-core/internal/config/` | Env-based config loader |
 | `config.LoadConfFile()` | func | `apps/server-core/internal/config/config_loader.go` | Config file parser (.env / nexusguard.conf) |
 | `auth.Init()` | func | `apps/server-core/internal/auth/` | JWT sign/verify init |