fix: distribute beta RC through GitHub Releases - #271
Conversation
📝 WalkthroughWalkthroughThe release workflow now publishes beta RCs to GitHub Releases (validates draft/prerelease and platform assets, edits release to publish, verifies final state) and adds an operator-facing controlled-release and rollback document for evaOS Workbench Beta. ChangesBeta RC Distribution and Docs
Sequence Diagram(s)sequenceDiagram
participant Workflow as release-distribute.yml
participant GHCLI as GitHub CLI
participant Release as GitHub Release
Workflow->>GHCLI: gh release view --repo $GITHUB_REPOSITORY
GHCLI->>Release: Query release metadata (isDraft, isPrerelease, assets)
Release-->>GHCLI: Return metadata
GHCLI-->>Workflow: Validate draft && isPrerelease && asset-platform checks
Workflow->>GHCLI: gh release edit --repo $GITHUB_REPOSITORY --draft=false --prerelease=true
GHCLI->>Release: Update release (draft=false, prerelease=true, set publishedAt)
Release-->>GHCLI: Return updated metadata (publishedAt, isPrerelease)
GHCLI-->>Workflow: Verify publishedAt present and isPrerelease true
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
071ca94 to
bddfb09
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release-distribute.yml (1)
27-34:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
release_target_platforms=macosdoes not actually prevent non-macOS assets from being published.Line 28 promises macOS-only distribution, but the workflow only narrows the download/validation set.
gh release edit --draft=falsepublishes the entire draft release as-is, so any.exe,.msi, or.debassets already attached to that draft become public too.Block this by either:
- failing when a
macospublish target still has non-macOS assets attached to the draft, or- deleting non-macOS assets before publishing.
Also applies to: 129-149, 286-296
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-distribute.yml around lines 27 - 34, The workflow's release_target_platforms choice (release_target_platforms) doesn't prevent non-macOS assets from being published because gh release edit --draft=false simply un-drafts the existing draft; update the publish steps (the places that call gh release edit --draft=false around the publish/upload stages mentioned) to enforce macOS-only publishing by detecting and removing or rejecting non-macOS assets when release_target_platforms == "macos": implement a pre-publish step that lists draft release assets (via gh release view/list or gh api repos/releases/:id/assets), check asset names/extensions (.exe, .msi, .deb, .AppImage, etc.), then either fail with a clear error if disallowed assets exist or call gh api or gh release delete to remove those non-macOS assets before running gh release edit --draft=false.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/evaos/public-beta-packaging-rollback.md`:
- Around line 34-41: The documentation contains a hardcoded user-specific path
"/Users/lume/.agents/skills/macos-release-credential-bootstrap/scripts/macos_release_credential_preflight.sh"
which leaks a local path and won't work on other machines; update the
instruction in public-beta-packaging-rollback.md to reference a repo-relative
script location (e.g., ./scripts/macos_release_credential_preflight.sh), an
environment variable (e.g., $MACOS_RELEASE_SCRIPT), or add a prerequisite step
that instructs operators how to install/locate the
macos_release_credential_preflight.sh script before running the command, and
ensure the example command shows the new placeholder (env var or relative path)
instead of the absolute user path.
---
Outside diff comments:
In @.github/workflows/release-distribute.yml:
- Around line 27-34: The workflow's release_target_platforms choice
(release_target_platforms) doesn't prevent non-macOS assets from being published
because gh release edit --draft=false simply un-drafts the existing draft;
update the publish steps (the places that call gh release edit --draft=false
around the publish/upload stages mentioned) to enforce macOS-only publishing by
detecting and removing or rejecting non-macOS assets when
release_target_platforms == "macos": implement a pre-publish step that lists
draft release assets (via gh release view/list or gh api
repos/releases/:id/assets), check asset names/extensions (.exe, .msi, .deb,
.AppImage, etc.), then either fail with a clear error if disallowed assets exist
or call gh api or gh release delete to remove those non-macOS assets before
running gh release edit --draft=false.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: d95e13cf-f25f-4f24-b3f5-be26b146cb5e
📒 Files selected for processing (2)
.github/workflows/release-distribute.ymldocs/evaos/public-beta-packaging-rollback.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)
- GitHub Check: Coverage Test
- GitHub Check: Unit Tests (macos-14)
- GitHub Check: Build Test (macos-x64)
- GitHub Check: Build Test (windows-arm64)
- GitHub Check: Unit Tests (windows-2022)
- GitHub Check: Build Test (linux)
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Build Test (windows-x64)
- GitHub Check: Unit Tests (ubuntu-latest)
🧰 Additional context used
🪛 zizmor (1.25.2)
.github/workflows/release-distribute.yml
[error] 37-37: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[warning] 37-37: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[warning] 111-111: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 292-292: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 298-298: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
bddfb09 to
5ba94af
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-distribute.yml:
- Around line 290-325: Re-fetch the release's current asset metadata right
before invoking gh release edit (use TAG/RELEASE_JSON as in the script) and
compare that asset list against the previously validated manifest snapshot
(compare asset names, counts, sizes and checksums/digests when available); if
any mismatch or drift is detected, abort with an error so gh release edit is not
executed — implement this check between the second RELEASE_JSON assignment and
the gh release edit call, failing closed on any difference.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 29f0ab0a-c2df-43b6-a17e-2cfe710ad6e7
📒 Files selected for processing (2)
.github/workflows/release-distribute.ymldocs/evaos/public-beta-packaging-rollback.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Build Test (linux)
- GitHub Check: Build Test (windows-arm64)
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Build Test (windows-x64)
- GitHub Check: Build Test (macos-x64)
- GitHub Check: Unit Tests (windows-2022)
🧰 Additional context used
🪛 LanguageTool
docs/evaos/public-beta-packaging-rollback.md
[grammar] ~75-~75: Use a hyphen to join words.
Context: ...tate were changed. ## Operator rollback proof commands ```bash codesign --verif...
(QB_NEW_EN_HYPHEN)
🪛 zizmor (1.25.2)
.github/workflows/release-distribute.yml
[error] 37-37: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[warning] 37-37: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[warning] 115-115: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 295-295: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 307-307: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 313-313: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🔇 Additional comments (1)
docs/evaos/public-beta-packaging-rollback.md (1)
34-41: Hardcoded local preflight path is still present.This still hardcodes
/Users/lume/..., so the instructions remain machine-specific and leak a local username. Please replace it with a repo-relative path, prerequisite note, or environment variable as already flagged earlier.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/release-distribute.yml (1)
354-370:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRe-verify the release asset set immediately before publish.
This second
gh release viewonly rechecks draft/prerelease flags. If the draft’s assets change after the earlier manifest/proof validation,gh release editcan still publish binaries that no longer match the validated manifest and RC proof. Re-fetch the current asset metadata here and fail closed on any name/count/size/checksum drift versus the trusted manifest before editing the release.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-distribute.yml around lines 354 - 370, Before calling gh release edit, re-run gh release view to fetch current release asset metadata into RELEASE_JSON, parse the assets and compare name/count/size/checksum against the previously validated manifest and RC proof (the same trusted data used earlier); if any drift is detected (missing/extra assets, size or checksum mismatches), abort with a non-zero exit and descriptive error instead of proceeding to gh release edit -- this check should be implemented in the same node script block that reads RELEASE_JSON (the node <<'NODE' block that parses release and checks isDraft/isPrerelease) so the verification occurs immediately prior to invoking gh release edit.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-distribute.yml:
- Around line 140-143: The early exit branch that logs and calls process.exit(0)
for non-'macos' targets currently skips validating required platforms when
release_target_platforms is 'all'; modify the logic around the if (target !==
'macos') { console.log(...); process.exit(0); } block to, when target === 'all',
validate the release assets collection contains all required platform families
(windows, linux, macos) before exiting — i.e., compute requiredFamilies =
['windows','linux','macos'], check assets include at least one asset per family
(using whatever asset list/variable is present in this workflow), log a clear
error and fail (process.exit(1)) if any family is missing, otherwise allow the
existing console.log/process.exit(0) path to continue; keep the existing
behavior for other non-'macos' single-platform targets.
---
Duplicate comments:
In @.github/workflows/release-distribute.yml:
- Around line 354-370: Before calling gh release edit, re-run gh release view to
fetch current release asset metadata into RELEASE_JSON, parse the assets and
compare name/count/size/checksum against the previously validated manifest and
RC proof (the same trusted data used earlier); if any drift is detected
(missing/extra assets, size or checksum mismatches), abort with a non-zero exit
and descriptive error instead of proceeding to gh release edit -- this check
should be implemented in the same node script block that reads RELEASE_JSON (the
node <<'NODE' block that parses release and checks isDraft/isPrerelease) so the
verification occurs immediately prior to invoking gh release edit.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3fdd0049-e867-4993-9193-0cfdc015d582
📒 Files selected for processing (2)
.github/workflows/release-distribute.ymldocs/evaos/public-beta-packaging-rollback.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Build Test (linux)
- GitHub Check: Build Test (windows-x64)
- GitHub Check: Build Test (windows-arm64)
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Build Test (macos-x64)
- GitHub Check: Unit Tests (windows-2022)
🧰 Additional context used
🪛 LanguageTool
docs/evaos/public-beta-packaging-rollback.md
[grammar] ~76-~76: Use a hyphen to join words.
Context: ...tate were changed. ## Operator rollback proof commands ```bash codesign --verif...
(QB_NEW_EN_HYPHEN)
🪛 zizmor (1.25.2)
.github/workflows/release-distribute.yml
[error] 37-37: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
5ba94af to
d6c7a81
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release-distribute.yml (1)
237-256:⚠️ Potential issue | 🟠 Major | ⚡ Quick winDownload every asset family you allow to publish.
The platform gate accepts
.pkg,.rpm,.appimage,.appx/.msix/.nupkg, etc., but the download step never fetches them. That means the later identity/updater/manifest checks only inspect a subset of the assets that will be published, so an unchecked asset can still ship on the prerelease.Example fix
case "${EVAOS_RELEASE_TARGET_PLATFORMS}" in all) patterns=( --pattern "*.dmg" + --pattern "*.pkg" --pattern "*.exe" --pattern "*.msi" + --pattern "*.appx" + --pattern "*.appxbundle" + --pattern "*.msix" + --pattern "*.msixbundle" + --pattern "*.nupkg" --pattern "*.deb" + --pattern "*.rpm" + --pattern "*.appimage" + --pattern "*.snap" + --pattern "*.pacman" + --pattern "*.tar.gz" + --pattern "*.tar.xz" + --pattern "*.tar.bz2" --pattern "*.zip" --pattern "*.yml" --pattern "evaos-beta-release-manifest.json" ) ;; macos) patterns=( --pattern "*.dmg" + --pattern "*.pkg" --pattern "*.zip" --pattern "latest-mac.yml" --pattern "latest-arm64-mac.yml" --pattern "evaos-beta-release-manifest.json" )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-distribute.yml around lines 237 - 256, The release workflow's asset download patterns (the patterns array inside the case on EVAOS_RELEASE_TARGET_PLATFORMS) omit many allowed package families (.pkg, .rpm, .appimage, .msix/.appx/.nupkg, .snap, etc.), so update the patterns declarations for the relevant cases (the "all" and per-platform branches such as "macos") to include those missing extensions; add entries like --pattern "*.pkg" --pattern "*.rpm" --pattern "*.appimage" --pattern "*.msix" --pattern "*.appx" --pattern "*.nupkg" --pattern "*.snap" (and any other platform-specific package names) so the download step fetches every asset family the gate accepts and subsequent identity/updater/manifest checks cover all publishable artifacts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release-distribute.yml:
- Around line 237-256: The release workflow's asset download patterns (the
patterns array inside the case on EVAOS_RELEASE_TARGET_PLATFORMS) omit many
allowed package families (.pkg, .rpm, .appimage, .msix/.appx/.nupkg, .snap,
etc.), so update the patterns declarations for the relevant cases (the "all" and
per-platform branches such as "macos") to include those missing extensions; add
entries like --pattern "*.pkg" --pattern "*.rpm" --pattern "*.appimage"
--pattern "*.msix" --pattern "*.appx" --pattern "*.nupkg" --pattern "*.snap"
(and any other platform-specific package names) so the download step fetches
every asset family the gate accepts and subsequent identity/updater/manifest
checks cover all publishable artifacts.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9f16a1c2-4fda-4ed0-9819-78b9208ef564
📒 Files selected for processing (2)
.github/workflows/release-distribute.ymldocs/evaos/public-beta-packaging-rollback.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Build Test (windows-x64)
- GitHub Check: Build Test (windows-arm64)
- GitHub Check: Unit Tests (windows-2022)
- GitHub Check: Coverage Test
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Build Test (linux)
- GitHub Check: Build Test (macos-x64)
🔇 Additional comments (1)
docs/evaos/public-beta-packaging-rollback.md (1)
1-88: LGTM!
1 participant
Summary
Why
The RC artifact and canary are green, but
release-distribute.ymlfailed because it expected unused AWS/S3 secrets (AWS_REGION,AWS_ROLE_ARN,AWS_S3_BUCKET). evaOS does not use AWS/S3 for this controlled RC distribution.Validation
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release-distribute.yml"); puts "YAML OK"'\n-actionlint -ignore 'SC2086' .github/workflows/release-distribute.yml\n-git diff --check\n-prek run --files .github/workflows/release-distribute.yml docs/evaos/public-beta-packaging-rollback.md\n\n## Follow-up after merge\nRerunDistribute evaOS Beta Release Assetsonmainfor tagevaos-beta-v2.1.12-evaos-beta.0-4110ba4withrc_proof_run_id=27418927082andrelease_target_platforms=macos.Summary by CodeRabbit
Documentation
Chores