fix(release): make RC updater proof Bash 3.2 safe - #712
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 49 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe RC canary workflow now exchanges updater ZIP verification values through temporary files. The release gate detects Bash 3.2-incompatible command-substitution-wrapped Node heredocs, and unit tests cover both updater ZIP name and checksum cases. ChangesRC canary verification hardening
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
evaOS review status: completedPR: #712 - fix(release): make RC updater proof Bash 3.2 safe evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #712 Review URL: #712 (review) |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![evaos-code-review-bot[bot]](https://avatars.githubusercontent.com/in/4184532?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #712 - fix(release): make RC updater proof Bash 3.2 safe
Head: 485237b4a5669eb7c4e21e50b7ca03407acbad9a into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 1/5 (~16 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-beta-rc-canary.yml |
modified | +10/-8 | Changed file | Low |
scripts/evaosBetaReleaseGate.js |
modified | +11/-0 | Changed file | Moderate: validated P3 finding |
tests/unit/process/evaosBetaReleaseGate.test.ts |
modified | +12/-0 | Test coverage | Low |
Review Signal
Validated inline findings: 1 (P0: 0, P1: 0, P2: 0, P3: 1).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Release regression: 1
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #711.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
|
Release-manager note: the distribution gate binds the selected successful RC run head SHA to the exact release commit. Therefore the existing unpublished |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/evaos-beta-rc-canary.yml:
- Around line 339-342: Normalize the validated digest before writing it in the
trusted-manifest handling block: after the existing SHA-256 format check,
convert asset.sha256 to lowercase and pass that normalized value to
fs.writeFileSync. Keep the case-insensitive validation and asset binding
behavior unchanged.
In `@scripts/evaosBetaReleaseGate.js`:
- Around line 925-930: Update the heredoc detection in the workflow validation
around workflowText to use regex matching rather than exact includes strings,
tolerating whitespace between `$(` and `node` and across multiline formatting
while still identifying both ZIP_NAME and EXPECTED_SHA shell assignments. Add a
regression case covering formatted variants, and keep JavaScript
Oxfmt/Prettier-compatible with single quotes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c6eab8b1-3509-40f7-b9b0-0290ce416dd7
📒 Files selected for processing (3)
.github/workflows/evaos-beta-rc-canary.ymlscripts/evaosBetaReleaseGate.jstests/unit/process/evaosBetaReleaseGate.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Coverage Test
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{js,jsx,ts,tsx}: Name utility files using camelCase, such as formatDate.ts.
Prefix unused parameters with_.
Format code with Oxfmt using Prettier-compatible rules: inline single-element arrays that fit on one line, require trailing commas in multiline arrays and objects, and use single quotes for strings.
Files:
scripts/evaosBetaReleaseGate.jstests/unit/process/evaosBetaReleaseGate.test.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript; do not useanyand do not leave implicit returns.
Use the path aliases@/*,@process/*, and@renderer/*.
Prefertypeoverinterfaceaccording to the Oxlint configuration.
Write code comments in English and use JSDoc for public functions.
Files:
tests/unit/process/evaosBetaReleaseGate.test.ts
**/*.{test,spec}.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Vitest 4 for tests and maintain at least 80% coverage.
Files:
tests/unit/process/evaosBetaReleaseGate.test.ts
🔇 Additional comments (2)
.github/workflows/evaos-beta-rc-canary.yml (1)
308-311: LGTM!Also applies to: 325-338, 343-344
tests/unit/process/evaosBetaReleaseGate.test.ts (1)
1139-1156: LGTM!
evaOS review status: completedPR: #712 - fix(release): make RC updater proof Bash 3.2 safe evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #712 Review URL: #712 (review) |
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Walkthrough
PR: #712 - fix(release): make RC updater proof Bash 3.2 safe
Head: d9521980cff9e4d6c955a02e2b60a90cbce6d73f into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 1/5 (~16 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-beta-rc-canary.yml |
modified | +10/-8 | Changed file | Low |
scripts/evaosBetaReleaseGate.js |
modified | +8/-0 | Changed file | Low |
tests/unit/process/evaosBetaReleaseGate.test.ts |
modified | +23/-0 | Test coverage | Low |
Review Signal
No validated inline findings.
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
No finding categories.
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #711.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
|
v2.1.36 beta.2 local-finalization proof (publication remains fail-closed):
|
1 participant
Pull Request
Description
Fix the v2.1.36 RC workflow failure observed in run
29427128970. macOS Bash 3.2 recursively tokenized the updater-ZIP Node heredoc while it was nested inside command substitution and stopped withunexpected EOF while looking for matching '"'before any candidate installation.The workflow now writes both Node-derived updater values to runner-temp files and reads them after each heredoc completes. The release gate rejects restoration of either unsafe updater command-substitution heredoc.
Related Issues
29427128970Type of Change
fix- Bug fix (non-breaking change which fixes an issue)feat- New feature (non-breaking change which adds functionality)perf- Performance improvementrefactor- Code restructuring (no behavior change)docs- Documentation updateAtomic PR Checklist (Rule 1)
<type>(<scope>): <subject>in EnglishLocal Checks (Rule 2)
oxfmt --checkpasses for all three changed filesoxlintreports 0 errors; 6 unrelated pre-existing test warnings remainbunx tsc --noEmit- deferred to canonical remote CIgit diff --checkpassesRuntime Verification
/bin/bash -nunder Apple Bash 3.2.57Agent Handoff
100yenadmin/evaOS-GUI.github/workflows/evaos-beta-rc-canary.yml,scripts/evaosBetaReleaseGate.js,tests/unit/process/evaosBetaReleaseGate.test.tsevaos-beta-v2.1.36-evaos-beta.1; trusted manifest run2942642498429427128970; local Bash syntax proof; focused 74-test release-gate suiteScreenshots
N/A.
Additional Context
The signed/notarized candidate assets and trusted manifest validated before the failing step. No candidate app was installed during the failed run. The fix does not change artifact bytes or the release commit.
Thank you for contributing.
Summary by CodeRabbit
Bug Fixes
Tests