Merge branch 'main' into fix/auth-error-handling

Author: gqcn

.github/workflows/main-ci.yml

@@ -1,21 +1,11 @@
 # LinaPro backend main CI workflow.
-# Runs on every push and pull request to main.
+# Runs on every push and pull request branch.
 name: Main CI
 
 on:
   push:
     branches:
-    - main
-    - develop
-    - feat/**
-    - fix/**
-
-  pull_request:
-    branches:
-    - main
-    - develop
-    - feat/**
-    - fix/**
+    - '**'
 
   workflow_dispatch:
     inputs:
@@ -34,6 +24,10 @@ env:
   TZ: "Asia/Shanghai"
 
 jobs:
+  windows-command-smoke:
+    name: Windows command smoke
+    uses: ./.github/workflows/reusable-windows-command-smoke.yml
+
   backend-unit-tests:
     name: Go unit tests
     uses: ./.github/workflows/reusable-backend-unit-tests.yml
@@ -48,18 +42,18 @@ jobs:
 
     steps:
       - name: Setup Timezone
-        uses: szenius/set-timezone@v2.0
-        with:
-          timezoneLinux: "Asia/Shanghai"
+        run: |
+          sudo ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+          echo Asia/Shanghai | sudo tee /etc/timezone
 
       - name: Checkout Repository
         uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: "1.25"
-          cache-dependency-path: '**/go.sum'
+          cache: false
 
       - name: Run SQLite Backend Smoke
         run: |

.github/workflows/nightly-build.yml

@@ -22,6 +22,10 @@ env:
   PLATFORMS: "linux/amd64,linux/arm64"
 
 jobs:
+  windows-command-smoke:
+    name: Windows command smoke
+    uses: ./.github/workflows/reusable-windows-command-smoke.yml
+
   nightly-image:
     name: Build and publish nightly image
     runs-on: ubuntu-latest
@@ -32,13 +36,13 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: "1.25"
-          cache-dependency-path: "**/go.sum"
+          cache: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: "10.30.3"
           run_install: false

.github/workflows/nightly-test.yml

@@ -19,6 +19,10 @@ env:
   TZ: "Asia/Shanghai"
 
 jobs:
+  windows-command-smoke:
+    name: Windows command smoke
+    uses: ./.github/workflows/reusable-windows-command-smoke.yml
+
   backend-unit-tests:
     name: Go unit tests
     uses: ./.github/workflows/reusable-backend-unit-tests.yml
@@ -50,21 +54,21 @@ jobs:
 
     steps:
       - name: Setup Timezone
-        uses: szenius/set-timezone@v2.0
-        with:
-          timezoneLinux: "Asia/Shanghai"
+        run: |
+          sudo ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+          echo Asia/Shanghai | sudo tee /etc/timezone
 
       - name: Checkout Repository
         uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: "1.25"
-          cache-dependency-path: "**/go.sum"
+          cache: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: "10.30.3"
           run_install: false

.github/workflows/release-build.yml

@@ -20,6 +20,10 @@ env:
   PLATFORMS: "linux/amd64,linux/arm64"
 
 jobs:
+  windows-command-smoke:
+    name: Windows command smoke
+    uses: ./.github/workflows/reusable-windows-command-smoke.yml
+
   release-image:
     name: Build and publish release image
     if: ${{ github.event.created == true && startsWith(github.ref, 'refs/tags/') }}
@@ -31,13 +35,13 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: "1.25"
-          cache-dependency-path: "**/go.sum"
+          cache: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: "10.30.3"
           run_install: false

.github/workflows/reusable-backend-unit-tests.yml

@@ -34,18 +34,18 @@ jobs:
 
     steps:
       - name: Setup Timezone
-        uses: szenius/set-timezone@v2.0
-        with:
-          timezoneLinux: "Asia/Shanghai"
+        run: |
+          sudo ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+          echo Asia/Shanghai | sudo tee /etc/timezone
 
       - name: Checkout Repository
         uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: "1.25"
-          cache-dependency-path: "**/go.sum"
+          cache: false
 
       - name: Initialize Database Schema
         run: |

.github/workflows/reusable-frontend-unit-tests.yml

@@ -18,15 +18,15 @@ jobs:
 
     steps:
       - name: Setup Timezone
-        uses: szenius/set-timezone@v2.0
-        with:
-          timezoneLinux: "Asia/Shanghai"
+        run: |
+          sudo ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+          echo Asia/Shanghai | sudo tee /etc/timezone
 
       - name: Checkout Repository
         uses: actions/checkout@v5
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           version: "10.30.3"
           run_install: false

.github/workflows/reusable-windows-command-smoke.yml

@@ -0,0 +1,44 @@
+# Reusable LinaPro Windows command smoke workflow.
+name: Reusable Windows Command Smoke
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  windows-command-smoke:
+    name: Windows command smoke
+    runs-on: windows-2025-vs2026
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.25"
+          cache: false
+
+      - name: Verify linactl Basic Commands
+        shell: pwsh
+        run: |
+          go run ./hack/tools/linactl help
+          go run ./hack/tools/linactl status
+          go run ./hack/tools/linactl prepare-packed-assets
+          go run ./hack/tools/linactl wasm dry-run=true
+
+      - name: Verify make.cmd From cmd.exe
+        shell: cmd
+        run: |
+          make.cmd help
+          make.cmd status
+
+      - name: Verify make.cmd From PowerShell
+        shell: pwsh
+        run: |
+          .\make.cmd help
+          .\make.cmd status

README.md

@@ -208,11 +208,35 @@ corepack enable
 cd apps/lina-vben
 pnpm install
 cd ../..
+go run ./hack/tools/linactl init confirm=init
+go run ./hack/tools/linactl mock confirm=mock
+go run ./hack/tools/linactl dev
+```
+
+Linux and macOS users can keep using the compatibility `Makefile` entrypoint:
+
+```bash
 make init confirm=init
 make mock confirm=mock
 make dev
 ```
 
+Windows users can use the cross-platform Go entrypoint above. The repository also provides a thin `make.cmd` wrapper for `cmd.exe`; because `cmd.exe` resolves executable file extensions in the current directory, the `.cmd` suffix can be omitted and the command can be written as `make`:
+
+```cmd
+make init confirm=init
+make mock confirm=mock
+make dev
+```
+
+In PowerShell, call the wrapper with the current-directory prefix. On default Windows environments, the `.cmd` suffix can also be omitted as `.\make`. Use `.\make.cmd` when you want to avoid ambiguity with another installed `make` command:
+
+```powershell
+.\make init confirm=init
+.\make mock confirm=mock
+.\make dev
+```
+
 The default backend link is:
 
 ```yaml
@@ -221,9 +245,9 @@ database:
     link: "pgsql:postgres:postgres@tcp(127.0.0.1:5432)/linapro?sslmode=disable"
 ```
 
-`make init` is an operations bootstrap command. It uses the configured database account and requires permission to connect to the system database, create and drop the target database, terminate target-database connections, create tables and indexes, write comments, and insert seed data. If those permissions are missing, initialization fails instead of falling back to a lower-privilege runtime mode.
+`linactl init` and `make init` are operations bootstrap commands. They use the configured database account and require permission to connect to the system database, create and drop the target database, terminate target-database connections, create tables and indexes, write comments, and insert seed data. If those permissions are missing, initialization fails instead of falling back to a lower-privilege runtime mode.
 
-For external hosted `PostgreSQL`, such as `RDS` or `Aliyun PolarDB`, point `database.default.link` at the provider host and port. Use an initialization account with the permissions above for `make init`, then run the service with the same configured database unless your deployment process replaces the config with a runtime account after initialization.
+For external hosted `PostgreSQL`, such as `RDS` or `Aliyun PolarDB`, point `database.default.link` at the provider host and port. Use an initialization account with the permissions above for `linactl init` or `make init`, then run the service with the same configured database unless your deployment process replaces the config with a runtime account after initialization.
 
 For a single-node development demo, switch the link to `SQLite`:
 

README.zh-CN.md

@@ -209,11 +209,35 @@ corepack enable
 cd apps/lina-vben
 pnpm install
 cd ../..
+go run ./hack/tools/linactl init confirm=init
+go run ./hack/tools/linactl mock confirm=mock
+go run ./hack/tools/linactl dev
+```
+
+`Linux`和`macOS`用户可以继续使用兼容`Makefile`入口：
+
+```bash
 make init confirm=init
 make mock confirm=mock
 make dev
 ```
 
+`Windows`用户可以使用上面的跨平台`Go`入口。仓库根目录也提供`cmd.exe`薄包装入口`make.cmd`；在`cmd.exe`中会按可执行文件扩展名查找当前目录脚本，因此可直接省略`.cmd`后缀使用`make`：
+
+```cmd
+make init confirm=init
+make mock confirm=mock
+make dev
+```
+
+在`PowerShell`中，需要使用当前目录前缀调用；默认`Windows`环境下也可以省略`.cmd`后缀写成`.\make`。如需避免与本机已安装的其他`make`命令混淆，可使用`.\make.cmd`：
+
+```powershell
+.\make init confirm=init
+.\make mock confirm=mock
+.\make dev
+```
+
 默认后端连接为：
 
 ```yaml
@@ -222,9 +246,9 @@ database:
     link: "pgsql:postgres:postgres@tcp(127.0.0.1:5432)/linapro?sslmode=disable"
 ```
 
-`make init`是运维初始化命令，会直接使用配置中的数据库账号。该账号必须具备连接系统库、创建和删除目标数据库、终止目标库连接、建表、建索引、写入注释和写入`Seed`数据的权限。权限不足时初始化会失败，不会降级到低权限运行时模式。
+`linactl init`和`make init`是运维初始化命令，会直接使用配置中的数据库账号。该账号必须具备连接系统库、创建和删除目标数据库、终止目标库连接、建表、建索引、写入注释和写入`Seed`数据的权限。权限不足时初始化会失败，不会降级到低权限运行时模式。
 
-使用外部托管`PostgreSQL`，例如`RDS`或阿里云`PolarDB`时，请将`database.default.link`指向供应商提供的主机和端口。执行`make init`时使用具备上述权限的初始化账号；如果部署流程需要运行时低权限账号，请在初始化完成后再替换运行配置。
+使用外部托管`PostgreSQL`，例如`RDS`或阿里云`PolarDB`时，请将`database.default.link`指向供应商提供的主机和端口。执行`linactl init`或`make init`时使用具备上述权限的初始化账号；如果部署流程需要运行时低权限账号，请在初始化完成后再替换运行配置。
 
 如需单节点开发演示，可切换为`SQLite`链接：
 

apps/lina-core/Makefile

@@ -1,4 +1,3 @@
-ROOT_DIR    = $(shell pwd)
 NAMESPACE   = "default"
 DEPLOY_NAME = "template-single"
 DOCKER_NAME = "template-single"
@@ -10,49 +9,20 @@ include ./hack/hack.mk
 # prepare-packed-assets: 准备宿主 manifest 与插件相关嵌入资源，供后续后端构建打包使用
 .PHONY: prepare-packed-assets
 prepare-packed-assets:
-	@../../hack/scripts/prepare-packed-assets.sh
+	@go run ../../hack/tools/linactl prepare-packed-assets
 
 # build: Prepare embedded assets, then build the host backend binary via GoFrame config
 # build: 先准备嵌入资源，再按 hack/config.yaml 调用 GoFrame 构建宿主后端二进制
 build: prepare-packed-assets
 
-# Confirmation helper shared by destructive local targets.
-# 本地高风险目标共用的确认辅助逻辑。
-define require_confirm
-	@if [ "$(confirm)" != "$(1)" ]; then \
-		echo "✗ make $(1) requires explicit confirmation for safety"; \
-		echo "  Use: make $(1) confirm=$(1)"; \
-		exit 1; \
-	fi
-endef
-
 # init: Initialize host DDL and seed data only; requires confirm=init, supports rebuild=true
 # init: 初始化数据库，仅执行宿主 DDL 与 Seed 数据；需 confirm=init，可追加 rebuild=true 重建数据库
 .PHONY: init
 init:
-	$(call require_confirm,init)
-	@echo "Initializing database..."
-	@tmp_log="$$(mktemp)"; \
-	if go run main.go init --confirm=$(confirm) --sql-source=local $(if $(rebuild),--rebuild=$(rebuild),) > "$$tmp_log" 2>&1; then \
-		cat "$$tmp_log"; \
-		rm -f "$$tmp_log"; \
-	else \
-		status="$$?"; \
-		cat "$$tmp_log"; \
-		if grep -Eqi "dial tcp|connection refused|connect: connection|failed to connect|i/o timeout|no such host" "$$tmp_log"; then \
-			echo "PostgreSQL is not ready. Start PostgreSQL first."; \
-			echo "Local example: docker run --name linapro-postgres -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=linapro -p 5432:5432 -d postgres:14-alpine"; \
-		fi; \
-		rm -f "$$tmp_log"; \
-		exit "$$status"; \
-	fi
-	@echo "✓ Database initialization complete"
+	@go run ../../hack/tools/linactl init confirm=$(confirm) $(if $(rebuild),rebuild=$(rebuild),)
 
 # mock: Load mock demo/test data from manifest/sql/mock-data after init; requires confirm=mock
 # mock: 加载 manifest/sql/mock-data 下的 Mock 演示/测试数据；需先执行 init，并传入 confirm=mock
 .PHONY: mock
 mock:
-	$(call require_confirm,mock)
-	@echo "Loading mock data..."
-	@go run main.go mock --confirm=$(confirm) --sql-source=local
-	@echo "✓ Mock data load complete"
+	@go run ../../hack/tools/linactl mock confirm=$(confirm)