fix(release): repair v0.3.1 artifact gates - #143
Merged
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughRelease artifact gates now validate self-host credentials and container security, normalize macOS signing identities, and extend Windows preload readiness timing. Tests cover the updated smoke scripts, Compose configuration, signing behavior, and packaged-app readiness. ChangesRelease artifact gates
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/scripts/release-workflows.test.ts`:
- Around line 384-396: Extend the release workflow tests around the existing
self-host smoke assertions and the related coverage near the later referenced
block with executable negative-path cases, not only string-presence checks. Add
isolated tests using mocked Docker/Compose inputs or extracted testable helpers
to verify invalid and duplicate credentials, missing authentication
configuration, image or security mismatches, and wrong-origin readiness failures
return the expected exit status and diagnostics.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 61b95425-5936-4bdb-8979-be5628945375
📒 Files selected for processing (7)
.changeset/release-artifact-gates.md.github/scripts/smoke-selfhost-image.shapps/desktop/desktop-builder-config.tsapps/desktop/scripts/smoke-packaged.tsapps/desktop/src/main/desktop-builder-config.test.tsapps/selfhost/docker-compose.ymltests/scripts/release-workflows.test.ts
Comment on lines
+384
to
+396
| expect(selfhostSmoke).toContain("docker image inspect --format '{{.Id}}'"); | ||
| expect(selfhostSmoke).toContain("docker inspect --format '{{.Image}}'"); | ||
| expect(selfhostSmoke).toContain("read -r token < <(openssl rand -hex 32)"); | ||
| expect(selfhostSmoke).toContain("read -r member_token < <(openssl rand -hex 32)"); | ||
| expect(selfhostSmoke).toContain('[[ "$token" == "$member_token" ]]'); | ||
| expect(selfhostSmoke).not.toContain("TOKEN_PLACEHOLDER"); | ||
| expect(selfhostSmoke).toContain("length == 1"); | ||
| expect(selfhostSmoke).toContain('.[0] == "no-new-privileges:true"'); | ||
| expect(selfhostSmoke).toContain("Self-host image proof failed"); | ||
| expect(selfhostCompose).toContain( | ||
| "SELFTUNE_AUTH_TOKEN: ${SELFTUNE_AUTH_TOKEN:?Generate a token with openssl rand -hex 32 and set SELFTUNE_AUTH_TOKEN in .env}", | ||
| ); | ||
| expect(selfhostCompose).not.toContain("SELFTUNE_AUTH_TOKEN_PLACEHOLDER"); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Add executable error-path coverage.
These assertions only prove source strings exist; they do not prove invalid or duplicate credentials, missing authentication configuration, image/security mismatches, or wrong-origin readiness failures produce the expected exit status and diagnostics. Add isolated negative-path tests with mocked Docker/Compose inputs or testable helper extraction.
As per path instructions, tests under tests/**/*.ts must cover error paths, not just happy paths.
Also applies to: 493-501
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/scripts/release-workflows.test.ts` around lines 384 - 396, Extend the
release workflow tests around the existing self-host smoke assertions and the
related coverage near the later referenced block with executable negative-path
cases, not only string-presence checks. Add isolated tests using mocked
Docker/Compose inputs or extracted testable helpers to verify invalid and
duplicate credentials, missing authentication configuration, image or security
mismatches, and wrong-origin readiness failures return the expected exit status
and diagnostics.
Source: Path instructions
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repairs the v0.3.0 release blockers without rebinding the immutable tag: strips the electron-builder identity prefix while preserving full runtime trust pins; restores distinct generated self-host proof credentials and Compose interpolation; strengthens exact image and container hardening diagnostics; and gives the Windows wrong-origin preload readiness check a bounded 120-second window on the same process. Includes a patch changeset for v0.3.1. Focused release tests, Desktop typecheck and full unit suite, lint, format, shell syntax, publication-safety regression, and mirrored-source checks pass.