Register local signed DMG manifest workflow - #399
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (8)
🔇 Additional comments (1)
📝 WalkthroughWalkthroughAdds a manual GitHub Actions workflow to generate, verify, upload, and attach a local-signed beta DMG manifest, and updates release-asset validation to handle the ChangesBeta Manifest Registration and Arm64 Asset Checks
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/evaos-beta-local-signed-dmg-manifest.yml:
- Around line 64-66: The workflow-level permissions are too broad because
`contents: write` is granting extra access to every job and step. Reduce the
top-level permissions in this workflow to the minimum needed, then set
`contents: write` only on the `register-manifest` job that contains the “Attach
manifest to GitHub prerelease” step; keep `actions: read` at the workflow level
and add a brief comment explaining why the job needs elevated access.
- Around line 54-62: The `release_target_platforms` choice in the workflow
exposes `macos-arm64`, but `scripts/verify-release-assets.sh` only accepts `all`
or `macos`, so the downstream verification step will fail. Update the workflow
dispatch/input mapping around `EVAOS_RELEASE_TARGET_PLATFORMS` and the “Verify
finalized release assets” step to either remove the `macos-arm64` option or
normalize it to `macos` before calling the script, and ensure the verified DMG
set matches the selected platform profile.
- Around line 181-187: The Verify local-signed fallback manifest step is
interpolating github.event.inputs.tag directly into the shell command, which
leaves the run block in the workflow vulnerable to injection; move the tag into
an env variable alongside GH_TOKEN and GITHUB_REPOSITORY, then have the node
invocation read it from the environment instead of using direct ${...}
substitution. Use the existing Verify local-signed fallback manifest step as the
place to update, keeping the same pattern already used for the other inputs in
this workflow.
- Around line 100-103: The Checkout release refs step currently persists Git
credentials unnecessarily even though gh is already authenticated via GH_TOKEN.
Update the actions/checkout@v6 configuration in that job to disable credential
persistence by adding persist-credentials: false alongside fetch-depth: 0, so
the checkout step does not write the token into local git config for later
steps.
- Line 3: Add a workflow-level concurrency group in the manifest registration
workflow so only one run per tag can execute at a time; update the workflow near
the existing on/disptach configuration to use a tag-based key, and make sure it
serializes runs that invoke the release upload and shared release-assets
handling in the manifest registration job.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4c59f9b5-daef-479b-a3ff-5b184fd5b7ee
📒 Files selected for processing (1)
.github/workflows/evaos-beta-local-signed-dmg-manifest.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (9)
- GitHub Check: Build Test (windows-arm64)
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Build Test (windows-x64)
- GitHub Check: Build Test (macos-x64)
- GitHub Check: Build Test (linux)
- GitHub Check: Unit Tests (macos-14)
- GitHub Check: Unit Tests (ubuntu-latest)
- GitHub Check: Unit Tests (windows-2022)
- GitHub Check: Coverage Test
🧰 Additional context used
🪛 zizmor (1.26.1)
.github/workflows/evaos-beta-local-signed-dmg-manifest.yml
[warning] 100-103: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 65-65: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[warning] 144-144: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 187-187: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 204-204: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 216-216: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 101-101: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 190-190: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 65-65: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[warning] 3-62: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🔇 Additional comments (1)
.github/workflows/evaos-beta-local-signed-dmg-manifest.yml (1)
101-101: 🩺 Stability & AvailabilityPin GitHub Actions to commit SHAs
actions/checkout@v6andactions/upload-artifact@v4are floating major tags. Replace them with full commit SHAs if this workflow needs to meet the repo’s action-pinning policy.
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/evaos-beta-local-signed-dmg-manifest.yml (1)
175-202: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftAnchor manifest provenance to the source run, not dispatch inputs.
write-manifesttrusts dispatch-supplied source metadata, thenverify-manifestcomparesreleaseCommitto the samesource_ci_head_shainput. That makes the trust gate self-attesting: a mistyped or wrongsource_ci_run_id/SHA/branch/conclusion can still produce and upload a “verified” manifest.Before writing the manifest, fetch the source run by
source_ci_run_idand require:
- workflow is
Build and Release- conclusion is
success- head branch is
evaos/beta-rc-20260612- head SHA matches the provided source SHA
Then use the fetched values as the manifest/verification source of truth.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/evaos-beta-local-signed-dmg-manifest.yml around lines 175 - 202, Anchor the manifest provenance in the actual source workflow run instead of the dispatch inputs. Update the logic behind write-manifest and verify-manifest in evaosBetaReleaseGate.js to look up the source run using EVAOS_BETA_LOCAL_DMG_SOURCE_RUN_ID, then validate its workflow name, conclusion, head branch, and head SHA before writing the manifest. Use the fetched run data as the source of truth for the manifest fields and verification checks, rather than relying on source_ci_* inputs directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/verify-release-assets.sh`:
- Line 38: The beta asset identity gate in assert_evaos_beta_asset_identity is
too permissive because it matches non-beta evaOS Workbench names as well.
Tighten the case pattern in verify-release-assets.sh so it only accepts
beta-specific markers (including the Beta suffix/variants) and removes the plain
evaOS Workbench forms, preserving the strict beta trust check.
---
Outside diff comments:
In @.github/workflows/evaos-beta-local-signed-dmg-manifest.yml:
- Around line 175-202: Anchor the manifest provenance in the actual source
workflow run instead of the dispatch inputs. Update the logic behind
write-manifest and verify-manifest in evaosBetaReleaseGate.js to look up the
source run using EVAOS_BETA_LOCAL_DMG_SOURCE_RUN_ID, then validate its workflow
name, conclusion, head branch, and head SHA before writing the manifest. Use the
fetched run data as the source of truth for the manifest fields and verification
checks, rather than relying on source_ci_* inputs directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 917dbce7-848c-4b42-8186-410c9ebf7e1a
📒 Files selected for processing (2)
.github/workflows/evaos-beta-local-signed-dmg-manifest.ymlscripts/verify-release-assets.sh
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: Build Test (windows-arm64)
- GitHub Check: Unit Tests (windows-2022)
- GitHub Check: Build Test (linux)
- GitHub Check: Build Test (windows-x64)
🧰 Additional context used
🪛 zizmor (1.26.1)
.github/workflows/evaos-beta-local-signed-dmg-manifest.yml
[warning] 69-69: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[warning] 80-80: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🔇 Additional comments (2)
.github/workflows/evaos-beta-local-signed-dmg-manifest.yml (1)
39-73: LGTM!Also applies to: 99-102, 112-173, 201-234
scripts/verify-release-assets.sh (1)
15-19: LGTM!Also applies to: 50-51, 100-102, 151-152, 173-173, 182-184, 201-202
1 participant
Summary
evaos-beta-local-signed-dmg-manifest.ymlon the default branchevaos/beta-rc-20260612Why
GitHub only exposes
workflow_dispatchworkflows that exist on the default branch. The macOS arm64 release promotion needs this workflow to register the trusted manifest for the locally finalized signed/notarized/stapled DMG.Validation
git diff --checkactionlint .github/workflows/evaos-beta-local-signed-dmg-manifest.ymlFixes #395 release-gate dispatch for
evaos-beta-v2.1.22-evaos-beta.0.Summary by CodeRabbit
macos-arm64release target, with updated identity matching and validation rules.macos-arm64.