chore: release 1.21.2

fix: binaries assets

.dockerignore

@@ -1,11 +1,9 @@
-# Git
 .git
 .gitignore
-
-# MD files
 CHANGELOG.md
 README.md
 RELEASE.md
-
-#IDE configurations
 .idea
+target
+dump.rdb
+.superpowers

.github/workflows/codecov.yml

@@ -1,86 +1,3 @@
-#name: Codecov Rust
-#
-#on:
-#  push:
-#    branches: ["main"]
-#  pull_request:
-#    branches: ["main"]
-#
-#env:
-#  CARGO_TERM_COLOR: always
-#
-#jobs:
-#  coverage:
-#    runs-on: ubuntu-latest
-#    steps:
-#      - uses: actions/checkout@v4
-#
-#      - name: Install Rust toolchain
-#        uses: dtolnay/rust-toolchain@stable
-#        with:
-#          components: llvm-tools-preview
-#
-#      - name: Build test image (with grcov included)
-#        run: docker compose -f docker-compose.test.yml build agent-test
-#
-#      - name: Run tests in container
-#        env:
-#          CARGO_TARGET_DIR: /app/target
-#          CARGO_INCREMENTAL: 0
-#          RUSTFLAGS: "-C instrument-coverage -C link-dead-code"
-#          LLVM_PROFILE_FILE: "/app/coverage/cargo-test-%p-%m.profraw"
-#        run: |
-#          docker compose -f docker-compose.test.yml run \
-#            -e CARGO_TARGET_DIR \
-#            -e CARGO_INCREMENTAL \
-#            -e RUSTFLAGS \
-#            -e LLVM_PROFILE_FILE \
-#            agent-test bash -c "cargo clean && cargo test --verbose && sync"
-#
-#      - name: Verify profraw files exist
-#        run: |
-#          docker compose -f docker-compose.test.yml run agent-test \
-#            find /app/coverage -type f -name "*.profraw" | wc -l || true
-#
-#      - name: Generate coverage report inside container
-#        run: |
-#          docker compose -f docker-compose.test.yml run agent-test bash -c "
-#            rustup component add llvm-tools &&
-#            grcov /app/coverage \
-#              --binary-path /app/target/debug \
-#              -s /app \
-#              --llvm \
-#              -t lcov \
-#              --branch \
-#              --ignore-not-existing \
-#              --ignore '/app/target/*' \
-#              --ignore '/*' \
-#              -o /app/lcov.info
-#          "
-#
-#      - name: Copy lcov.info from container to host
-#        run: |
-#          docker compose -f docker-compose.test.yml cp agent-test:/app/lcov.info ./lcov.info
-#
-#      - name: Remove container
-#        run: |
-#          docker rm agent-test-run
-#
-#      - name: Show basic coverage report info (debug)
-#        run: |
-#          echo "lcov.info size:" $(wc -c ./lcov.info | awk '{print $1}')
-#          head -n 30 ./lcov.info || true
-#
-#      - name: Upload coverage to Codecov
-#        uses: codecov/codecov-action@v5
-#        with:
-#          files: ./lcov.info
-#          flags: unittests
-#          name: rust-unit-coverage
-#          verbose: true
-#          fail_ci_if_error: true
-#        env:
-#          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 name: Codecov Rust
 
 on:
@@ -99,15 +16,11 @@ env:
 jobs:
   coverage:
     runs-on: ubuntu-latest
+
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: llvm-tools-preview
-
-      - name: Build test image (with grcov included)
+      - name: Build test image
         run: docker compose -f docker-compose.test.yml build agent-test
 
       - name: Start agent-test container
@@ -115,28 +28,32 @@ jobs:
 
       - name: Run tests inside container
         run: |
-          docker compose -f docker-compose.test.yml exec \
+          docker compose -f docker-compose.test.yml exec -T \
             -e CARGO_TARGET_DIR \
             -e CARGO_INCREMENTAL \
             -e RUSTFLAGS \
             -e LLVM_PROFILE_FILE \
             agent-test bash -c "
-              cargo clean &&
-              cargo test --verbose &&
+              mkdir -p /app/coverage &&
+              rm -rf /app/target/* /app/coverage/* &&
+              cargo test --verbose -- --test-threads=2 &&
               sync
             "
 
       - name: Verify profraw files exist
         run: |
-          docker compose -f docker-compose.test.yml exec \
-            -e LLVM_PROFILE_FILE \
-            agent-test find /app/coverage -type f -name "*.profraw" | wc -l || true
+          docker compose -f docker-compose.test.yml exec -T \
+            agent-test bash -c '
+              count=$(find /app/coverage -type f -name "*.profraw" | wc -l)
+              echo "profraw files: $count"
+              test "$count" -gt 0
+            '
 
       - name: Generate coverage report inside container
         run: |
-          docker compose -f docker-compose.test.yml exec \
+          docker compose -f docker-compose.test.yml exec -T \
             agent-test bash -c "
-              rustup component add llvm-tools &&
+              rustup component add llvm-tools-preview &&
               grcov /app/coverage \
                 --binary-path /app/target/debug \
                 -s /app \
@@ -145,17 +62,17 @@ jobs:
                 --branch \
                 --ignore-not-existing \
                 --ignore '/app/target/*' \
-                --ignore '/*' \
                 -o /app/lcov.info
             "
 
       - name: Copy lcov.info from container to host
         run: docker compose -f docker-compose.test.yml cp agent-test:/app/lcov.info ./lcov.info
 
-      - name: Show basic coverage report info (debug)
+      - name: Show basic coverage report info
         run: |
           echo "lcov.info size:" $(wc -c ./lcov.info | awk '{print $1}')
           head -n 30 ./lcov.info || true
+          test -s ./lcov.info
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
@@ -165,8 +82,9 @@ jobs:
           name: rust-unit-coverage
           verbose: true
           fail_ci_if_error: true
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ secrets.CODECOV_TOKEN }}
+          use_pypi: true
 
       - name: Stop and remove container
-        run: docker compose -f docker-compose.test.yml down
+        if: always()
+        run: docker compose -f docker-compose.test.yml down --volumes

.github/workflows/ghcr.yml

@@ -0,0 +1,134 @@
+name: GHCR Publish
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      ref:
+        required: true
+        type: string
+      add_latest:
+        required: false
+        type: boolean
+        default: false
+      dockerfile:
+        required: false
+        type: string
+        default: "./docker/Dockerfile"
+      target:
+        required: false
+        type: string
+        default: "prod"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.platform == 'linux/amd64' && 'ubuntu-latest' || 'ubuntu-24.04-arm' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [ linux/amd64, linux/arm64 ]
+    steps:
+      - name: Prepare vars
+        id: prep
+        run: |
+          ARCH="${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}"
+          echo "arch=$ARCH" >> "$GITHUB_OUTPUT"
+          echo "image=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/agent" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 1
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ inputs.dockerfile }}
+          platforms: ${{ matrix.platform }}
+          target: ${{ inputs.target }}
+          provenance: false
+          outputs: type=image,name=${{ steps.prep.outputs.image }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=ghcr-${{ steps.prep.outputs.arch }}
+          cache-to: type=gha,mode=max,scope=ghcr-${{ steps.prep.outputs.arch }},ignore-error=true
+
+      - name: Export digest
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          mkdir -p /tmp/digests
+          touch "/tmp/digests/${DIGEST#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digest-${{ steps.prep.outputs.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    name: Create multi-arch manifest
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Prepare vars
+        id: prep
+        run: echo "image=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/agent" >> "$GITHUB_OUTPUT"
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digest-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ steps.prep.outputs.image }}
+          tags: |
+            type=semver,pattern={{version}},value=${{ inputs.version }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }}
+            type=semver,pattern={{major}},value=${{ inputs.version }}
+            type=raw,value=latest,enable=${{ inputs.add_latest }}
+
+      - name: Create and push manifest list
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ steps.prep.outputs.image }}@sha256:%s ' *)
+
+      - name: Inspect
+        run: docker buildx imagetools inspect ${{ steps.prep.outputs.image }}:${{ inputs.version }}

.github/workflows/release.yml

@@ -100,6 +100,15 @@ jobs:
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
 
+  publish-docker-ghcr:
+    needs: create-release
+    if: ${{ needs.create-release.result == 'success' }}
+    uses: ./.github/workflows/ghcr.yml
+    with:
+      version: ${{ needs.create-release.outputs.version }}
+      ref: ${{ needs.create-release.outputs.version }}
+      add_latest: true
+
   publish-helm:
     needs: create-release
     if: ${{ needs.create-release.result == 'success' }}
@@ -109,11 +118,24 @@ jobs:
     secrets:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  build-windows:
+    needs: create-release
+    if: ${{ needs.create-release.result == 'success' }}
+    uses: ./.github/workflows/windows-release.yml
+    with:
+      version: ${{ needs.create-release.outputs.version }}
+      ref: ${{ needs.create-release.outputs.version }}
+      draft_tag: ${{ needs.create-release.outputs.draft_tag }}
+    secrets:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   finalize-release:
     needs:
       - create-release
       - publish-docker
+      - publish-docker-ghcr
       - publish-helm
+      - build-windows
     runs-on: ubuntu-latest
     outputs:
       release_tag: ${{ steps.publish_release_step.outputs.release_tag }}

.github/workflows/windows-release.yml

@@ -0,0 +1,85 @@
+name: Build Windows release
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Release version (git tag), e.g. 1.18.4'
+        type: string
+        required: false
+      ref:
+        description: 'Git ref to check out and build'
+        type: string
+        required: false
+      draft_tag:
+        description: 'Draft GitHub release tag to attach the asset to (e.g. untagged-xxxx). Empty = skip upload.'
+        type: string
+        required: false
+    secrets:
+      GH_TOKEN:
+        required: false
+
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref to check out and build'
+        type: string
+        required: false
+
+jobs:
+  build-windows:
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+
+      - name: Set up Rust toolchain (MSVC)
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+
+      - name: Cache cargo build
+        uses: Swatinem/rust-cache@v2
+
+      - name: Build (cargo release)
+        shell: pwsh
+        run: cargo build --release --bin app
+
+      - name: Prepare artifact zip
+        id: prepare_artifact
+        shell: pwsh
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          $tag = $env:RELEASE_VERSION
+          if (-not $tag) { $tag = $env:GITHUB_SHA }
+
+          $exe = "target\release\app.exe"
+          if (-not (Test-Path $exe)) { Write-Error "Built binary $exe not found in target/release"; exit 1 }
+
+          $outDir = "artifact"
+          New-Item -ItemType Directory -Path $outDir -Force | Out-Null
+          # Ship under the package name, not the internal bin name "app".
+          Copy-Item -Path $exe -Destination "$outDir\portabase-agent.exe"
+
+          $zipName = "windows-release-$tag.zip"
+          if (Test-Path $zipName) { Remove-Item $zipName }
+          Compress-Archive -Path "$outDir\*" -DestinationPath $zipName -Force
+          "zip=$zipName" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-release
+          path: ${{ steps.prepare_artifact.outputs.zip }}
+
+      - name: Attach asset to draft release
+        if: ${{ inputs.draft_tag != '' }}
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+        run: |
+          gh release upload "${{ inputs.draft_tag }}" "${{ steps.prepare_artifact.outputs.zip }}" --clobber

.gitignore

@@ -3,4 +3,9 @@
 /src/data/
 
 .DS_Store
-.env
+.env
+
+.claude
+/docs
+
+.superpowers

CITATION.cff

@@ -27,5 +27,5 @@ keywords:
   - self-hosted
   - portabase
 license: Apache-2.0
-version: 1.10.0
+version: 1.21.2
 date-released: '2026-02-24'

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portabase-agent"
-version = "1.10.0"
+version = "1.21.2"
 edition = "2024"
 
 [dependencies]
@@ -19,10 +19,11 @@ log = "0.4.29"
 toml = "0.9.10"
 reqwest = { version = "0.13.1", features = ["json", "blocking", "multipart", "stream", "query"] }
 anyhow = "1.0.100"
-tokio = { version = "1.49.0", features = ["rt", "rt-multi-thread", "macros", "fs"] }
+tokio = { version = "1.49.0", features = ["rt", "rt-multi-thread", "macros", "fs", "process", "io-util"] }
 async-trait = "0.1.89"
 tempfile = "3.24.0"
-openssl = "0.10.75"
+hmac = "0.12"
+sha2 = "0.10"
 hex = "0.4.3"
 flate2 = "1.1.5"
 tar = "0.4.44"
@@ -35,9 +36,14 @@ rand = "0.9.2"
 bytes = "1.11.0"
 async-stream = "0.3.6"
 uuid = { version = "1.20.0", features = ["v4"] }
-tokio-util = "0.7.18"
+tokio-util = { version = "0.7.18", features = ["compat", "io"] }
+tiberius = { version = "0.12", default-features = false, features = ["rustls", "chrono"] }
 aws-config = "1.8.13"
 aws-sdk-s3 = { version = "1.122.0", features = ["behavior-version-latest"] }
+azure_core = "1.0.0"
+azure_storage_blob = "1.0.0"
+google-cloud-storage = "1.15"
+google-cloud-auth = "1.13"
 async-compression = { version = "0.4.37", features = ["tokio", "gzip"] }
 tokio-tar = "0.3.1"
 oauth2 = "5.0.0"
@@ -52,6 +58,8 @@ testcontainers = "0.27.1"
 testcontainers-modules = { version = "0.15.0", features = ["postgres", "redis", "valkey", "mysql", "mariadb", "mongo"] }
 postgres = "0.19.12"
 url = "2.5.8"
+percent-encoding = "2.3.2"
+bollard = "0.20.0"
 
 [dev-dependencies]
 tokio = { version = "1", features = ["full"] }