fix(vermeer): add Web UI build pipeline

.github/workflows/vermeer-ci.yml

@@ -0,0 +1,109 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+name: "Vermeer CI"
+
+on:
+  push:
+    branches:
+      - master
+      - /^release-.*$/
+    paths:
+      - vermeer/**
+      - .github/workflows/vermeer-ci.yml
+  pull_request:
+    paths:
+      - vermeer/**
+      - .github/workflows/vermeer-ci.yml
+
+defaults:
+  run:
+    working-directory: vermeer
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vermeer-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Cache Go modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('vermeer/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
+
+      - name: Download Go modules
+        run: go mod download
+
+      - name: Download UI assets
+        run: ./scripts/download_ui_assets.sh
+
+      - name: Generate embedded assets
+        run: cd asset && go generate
+
+      - name: Build
+        run: CGO_ENABLED=0 go build -o vermeer
+
+      - name: Verify binary exists
+        run: test -x vermeer
+
+      - name: Verify release metadata exists
+        run: |
+          test -f release-docs/LICENSE
+          test -f release-docs/NOTICE
+          test -d release-docs/licenses
+
+  vermeer-docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker image (dry-run)
+        uses: docker/build-push-action@v6
+        with:
+          context: vermeer
+          push: false
+          tags: vermeer:ci-check
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Verify release metadata in image
+        run: |
+          docker run --rm --entrypoint test vermeer:ci-check -f /go/bin/release-docs/LICENSE
+          docker run --rm --entrypoint test vermeer:ci-check -f /go/bin/release-docs/NOTICE
+          docker run --rm --entrypoint test vermeer:ci-check -d /go/bin/release-docs/licenses

README.md

@@ -146,7 +146,7 @@ For quick start and single-machine deployments, we recommend **Vermeer**:
 # Pull the image
 docker pull hugegraph/vermeer:latest
 
-# Change config path in docker-compose.yml
+# Change config path in docker-compose.yaml
 volumes:
       - ~/:/go/bin/config # Change here to your actual config path, e.g., vermeer/config
 

vermeer/.dockerignore

@@ -14,6 +14,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-*data*
-*test*
-*.git*
+.git/
+.gitignore
+.gitattributes
+test/
+vermeer_test.go
+vermeer_test.sh
+vermeer_data/
+asset/assets_vfsdata.go
+ui/node_modules/
+ui/package-lock.json
+ui/ui/lib/bootstrap-4.3.1-dist/
+ui/ui/lib/bootstrap4-glyphicons/
+ui/ui/lib/jquery-3.5.1.min.js
+ui/ui/lib/jquery-license
+_tmp_extractor/
+tools/supervisord/*/supervisord
+tools/protoc/*/protoc
+tools/protoc/*/bin/
+tools/protoc/*/include/

vermeer/.gitignore

@@ -99,6 +99,14 @@ tools/protoc/*/include/
 ######################
 asset/assets_vfsdata.go
 
+# UI dependencies (downloaded via scripts/download_ui_assets.sh) #
+######################
+ui/node_modules/
+ui/package-lock.json
+ui/ui/lib/*
+!ui/ui/lib/functions.js
+!ui/ui/lib/vermeer.css
+
 # AI assistant specific files (we only maintain AGENTS.md) #
 ######################
 CLAUDE.md

vermeer/Dockerfile

@@ -15,16 +15,19 @@
 # limitations under the License.
 #
 FROM golang:1.23-alpine AS builder
+RUN apk add --no-cache npm bash curl
 COPY ./ /src/
 WORKDIR /src/
 ENV CGO_ENABLED="0"
+RUN ./scripts/download_ui_assets.sh
 RUN cd asset && go generate
 RUN go build -o /go/bin/app
 
 FROM alpine
 EXPOSE 8080
 COPY --from=builder /go/bin/app /go/bin/app
 COPY --from=builder /src/config/ /go/bin/config/
+COPY --from=builder /src/release-docs/ /go/bin/release-docs/
 COPY --from=builder /usr/local/go/lib/time/zoneinfo.zip /
 ENV TZ=Asia/Shanghai
 ENV ZONEINFO=/zoneinfo.zip

vermeer/Makefile

@@ -15,13 +15,13 @@
 # limitations under the License.
 #
 
-.PHONY: all init download-binaries generate-assets build clean help
+.PHONY: all init download-binaries download-ui-assets generate-assets build clean help
 
 # Default target
 all: generate-assets build
 
 # Initialize project (first time setup)
-init: download-binaries
+init: download-binaries download-ui-assets
 	@echo "Installing Go dependencies..."
 	go mod download
 	@echo "Project initialized successfully!"
@@ -31,8 +31,17 @@ download-binaries:
 	@echo "Downloading binary dependencies..."
 	@./scripts/download_binaries.sh || (echo "Failed to download binaries" && exit 1)
 
+# Download UI assets (jQuery, Bootstrap, Glyphicons)
+download-ui-assets:
+	@if [ ! -f "ui/ui/lib/.downloaded" ]; then \
+		echo "Downloading UI assets..."; \
+		./scripts/download_ui_assets.sh || (echo "Failed to download UI assets" && exit 1); \
+	else \
+		echo "UI assets already exist, skipping download."; \
+	fi
+
 # Generate assets (vfsdata.go for web UI)
-generate-assets:
+generate-assets: download-ui-assets
 	@echo "Generating assets..."
 	@cd asset && go generate || (echo "Failed to generate assets" && exit 1)
 	@echo "Assets generated successfully!"
@@ -66,20 +75,26 @@ clean-all: clean
 	@rm -rf tools/protoc/*/protoc
 	@rm -rf tools/protoc/*/bin
 	@rm -rf tools/protoc/*/include
+	@echo "Cleaning downloaded UI assets..."
+	@rm -rf ui/node_modules ui/package-lock.json
+	@rm -f ui/ui/lib/.downloaded ui/ui/lib/jquery-license
+	@rm -rf ui/ui/lib/bootstrap-*-dist ui/ui/lib/bootstrap4-glyphicons
+	@rm -f ui/ui/lib/jquery-*.min.js
 	@echo "All clean completed!"
 
 # Help
 help:
 	@echo "Vermeer Build System"
 	@echo ""
 	@echo "Usage:"
-	@echo "  make init              - First time setup (download binaries + go mod download)"
+	@echo "  make init              - First time setup (download binaries + UI assets + go mod download)"
 	@echo "  make download-binaries - Download supervisord and protoc binaries for your platform"
+	@echo "  make download-ui-assets - Download jQuery, Bootstrap, Glyphicons to ui/ui/lib/"
 	@echo "  make generate-assets   - Generate assets_vfsdata.go from web UI (required before build)"
 	@echo "  make build             - Build vermeer for current platform (default: local architecture)"
 	@echo "  make build-linux-amd64 - Build for Linux AMD64 (for deployment)"
 	@echo "  make build-linux-arm64 - Build for Linux ARM64 (for ARM servers)"
 	@echo "  make clean             - Remove generated files and binaries (keep downloaded tools)"
-	@echo "  make clean-all         - Remove everything including downloaded tools"
+	@echo "  make clean-all         - Remove everything including downloaded tools and UI assets"
 	@echo "  make all               - Generate assets and build (default target)"
 	@echo "  make help              - Show this help message"

vermeer/README.md

@@ -89,7 +89,12 @@ vermeer/
 │   ├── master.ini
 │   └── worker.ini
 ├── tools/               # Binary dependencies (supervisord, protoc)
-└── ui/                  # Web dashboard
+└── ui/                  # Web dashboard source and dependencies
+    ├── package.json     # Frontend dependencies (jQuery, Bootstrap)
+    └── ui/
+        ├── master.html  # Master dashboard page
+        ├── worker.html  # Worker dashboard page
+        └── lib/         # Downloaded at build time (git-ignored)
 ```
 
 ## Quick Start
@@ -107,8 +112,8 @@ Create a dedicated config directory (e.g., `~/vermeer-config/`) with `master.ini
 Run with Docker:
 
 ```bash
-# Master node
-docker run -v ~/vermeer-config:/go/bin/config hugegraph/vermeer --env=master
+# Master node (with Web UI enabled)
+docker run -v ~/vermeer-config:/go/bin/config hugegraph/vermeer --env=master -auth token -auth_token_factor 1234
 
 # Worker node
 docker run -v ~/vermeer-config:/go/bin/config hugegraph/vermeer --env=worker
@@ -158,6 +163,7 @@ Configure parameters in `vermeer.sh`, then:
 #### Prerequisites
 
 - Go 1.23 or later
+- Node.js/npm (for downloading UI assets)
 - `curl` and `unzip` utilities (for downloading dependencies)
 - Internet connection (for first-time setup)
 
@@ -226,10 +232,41 @@ task_strategy = 1
 
 # Number of parallel tasks
 task_parallel_num = 1
+
+# Authentication mode (none or token)
+# Set to "token" to enable Web UI and API authentication
+auth = none
+
+# Token authentication factor (required when auth=token)
+auth_token_factor = 1234
 ```
 
 **Note**: HugeGraph connection details (`pd_peers`, `server`, `graph`) are provided in the graph load API request, not in the configuration file. See [HugeGraph Integration](#hugegraph-integration) section for details.
 
+### Generating Auth Token
+
+When `auth=token` is enabled, you need to generate a token for login. Use the built-in token generator:
+
+```bash
+# Run with Go
+go run tools/token/token_generator.go -user admin -space default -factor 1234 -i
+
+# Or run in Docker (no local Go required)
+docker run --rm -v $(pwd):/src -v $(pwd)/config:/src/config golang:1.23-alpine sh -c "cd /src && go run tools/token/token_generator.go -user admin -space default -factor 1234 -i"
+```
+
+Parameters:
+- `-user` — Username (default: `foo`)
+- `-space` — Graph space name (default: `bar`)
+- `-factor` — Must match `auth_token_factor` in `master.ini`
+- `-client` — Client identifier (default: `hg`)
+- `-i` — Generate immortal token (never expires)
+
+The generated token can be used in two ways:
+
+1. **HTTP Header**: `Authorization: Bearer <token>`
+2. **Login API**: `POST /api/v1/login` with body `{"token": "<token>"}` (sets cookie)
+
 ### Worker Configuration (`worker.ini`)
 
 ```ini
@@ -278,6 +315,8 @@ worker_group = default
 
 Vermeer exposes a REST API on port `6688` (configurable in `master.ini`).
 
+> **Note**: The Web UI (`/ui/*`) is only available when `auth=token` is configured. Set `auth_token_factor` in `master.ini` or pass `-auth token -auth_token_factor <value>` via command line.
+
 ### Key Endpoints
 
 | Endpoint | Method | Description |
@@ -502,7 +541,9 @@ vermeer/tools/protoc/linux64/protoc vermeer/apps/protos/*.proto --go-grpc_out=ve
 
 ## Monitoring
 
-Access the Web UI dashboard at `http://master-ip:6688/ui/` for:
+Access the Web UI dashboard at `http://master-ip:6688/ui/master.html` for:
+
+> **Note**: The Web UI requires `auth=token` in `master.ini` (or `-auth token` via command line). Without token authentication, the UI routes are not registered.
 
 - Worker status and resource usage
 - Active and completed tasks

vermeer/asset/asset.go

@@ -25,4 +25,4 @@ import (
 )
 
 // Assets contains the project's assets.
-var Assets http.FileSystem = http.Dir("../ui")
+var Assets http.FileSystem = http.Dir("../ui/ui")

vermeer/asset/asset_dev_ui.go

@@ -27,5 +27,5 @@ import (
 
 func init() {
 	// for ui development
-	Assets = http.Dir(common.AppRootPath() + "/ui/")
+	Assets = http.Dir(common.AppRootPath() + "/ui/ui/")
 }

vermeer/build.sh

@@ -33,17 +33,21 @@ go mod download
 echo "Checking binary dependencies..."
 ./scripts/download_binaries.sh
 
-# Generate assets if not exist
-if [ ! -f "asset/assets_vfsdata.go" ]; then
-    echo "Generating assets..."
-    cd asset && go generate && cd ..
+# Download UI assets if stamp file is missing
+echo "Checking UI assets..."
+if [ ! -f "ui/ui/lib/.downloaded" ]; then
+    ./scripts/download_ui_assets.sh
 fi
+
+# Always regenerate embedded assets so UI source changes are picked up
+echo "Generating assets..."
+cd asset && go generate && cd ..
 ARCH=$1
 CGO_ENABLED=0 GOOS=linux GOARCH="$ARCH" go build
 
 VERSION=$(cat ./apps/version/version.go | grep 'Version' | awk -F '"' '{print $2}')
 cp tools/supervisord/linux_"$ARCH"/supervisord supervisord
-tar --exclude=config/afs_client.conf -zcvf vermeer-"$VERSION"-"$ARCH".tar.gz vermeer config/ supervisord vermeer.sh mem_supervisor.sh
+tar --exclude=config/afs_client.conf -zcvf vermeer-"$VERSION"-"$ARCH".tar.gz vermeer config/ supervisord vermeer.sh mem_supervisor.sh release-docs/LICENSE release-docs/NOTICE release-docs/licenses/
 
 mkdir "$BUILD_REPO_WS"/output
 mv vermeer-"$VERSION"-"$ARCH".tar.gz "$BUILD_REPO_WS"/output/

vermeer/config/worker.ini

@@ -12,12 +12,13 @@
 ; WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 ; See the License for the specific language governing permissions and
 ; limitations under the License.
-
 [default]
 log_level=info
 debug_mode=release
 http_peer=0.0.0.0:6788
 grpc_peer=0.0.0.0:6789
 master_peer=127.0.0.1:6689
 run_mode=worker
-worker_group=default
+worker_group=default
+auth=none
+auth_token_factor=1234