fix(release): reject real RC duplicates without stale Spotlight false positives - #714
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe pre-canary workflow now sanitizes failure reports while preserving original exit codes. Desktop inventory gathering filters missing Spotlight results and retains paths whose existence cannot be verified, with tests covering report sanitization, duplicates, removals, and permission errors. ChangesPre-canary integrity
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Workflow
participant DesktopBridge
participant Sanitizer
participant Artifact
Workflow->>DesktopBridge: run pre-canary and capture exit status
DesktopBridge-->>Workflow: qa-report.json and exit code
Workflow->>Sanitizer: sanitize failing and warning checks
Sanitizer-->>Workflow: sanitized summary
Workflow->>Artifact: copy report and return original exit code
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
evaOS review status: stale headPR: #714 - fix(release): reject real RC duplicates without stale Spotlight false positives evaOS review stopped because this queued head is no longer the live PR head. Automation note: agents should wait for this comment to reach PR URL: #714 Details: live=7c1c50299fcb375c5ca081eeca1094ac6a3574c8 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74eceb5b36
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
evaOS review status: stale headPR: #714 - fix(release): reject real RC duplicates without stale Spotlight false positives evaOS review stopped because this queued head is no longer the live PR head. Automation note: agents should wait for this comment to reach PR URL: #714 Details: live=3f83db2688d35debdae380e9b212e957bcaf54a1 |
|
Exact-head checkpoint: 3f83db2 on base f7780d8. Focused tests, lint, formatting, workflow validation, final Codex review, and the blockers-only adversarial delta review are clean. Earlier findings on malformed-report logging, report-message redaction, exit-code preservation, and uninspectable duplicate coverage are fixed at this head. @coderabbitai review |
|
✅ Action performedReview finished.
|
evaOS review status: stale headPR: #714 - fix(release): reject real RC duplicates without stale Spotlight false positives evaOS review stopped because this queued head is no longer the live PR head. Automation note: agents should wait for this comment to reach PR URL: #714 Details: Superseded by a newer PR head. |
coderabbitai
Bot
added
area:release
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/evaos-beta-rc-canary.yml:
- Around line 697-699: The sanitizer logging loop in
.github/workflows/evaos-beta-rc-canary.yml lines 697-699 must cap emitted
sanitized checks at a fixed limit and write only one omission notice when
additional checks are suppressed. Update the related test setup and assertions
in tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts lines 300-325 to
provide more checks than the limit and verify the exact bounded output count and
omission behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: ccea117b-7fcc-4154-b7e1-907db452cbb8
📒 Files selected for processing (3)
.github/workflows/evaos-beta-rc-canary.ymlresources/evaos-beta/bridge/src/evaos_desktop_bridge/pre_canary.pytests/unit/process/prepareEvaosDesktopBridgeResource.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Build Test (macos-arm64)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{js,jsx,ts,tsx}: Name utility files using camelCase, such as formatDate.ts.
Prefix unused parameters with_.
Format code with Oxfmt using Prettier-compatible rules: inline single-element arrays that fit on one line, require trailing commas in multiline arrays and objects, and use single quotes for strings.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript; do not useanyand do not leave implicit returns.
Use the path aliases@/*,@process/*, and@renderer/*.
Prefertypeoverinterfaceaccording to the Oxlint configuration.
Write code comments in English and use JSDoc for public functions.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts
**/*.{test,spec}.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Vitest 4 for tests and maintain at least 80% coverage.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts
🔇 Additional comments (2)
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts (1)
687-687: LGTM!Also applies to: 696-732
resources/evaos-beta/bridge/src/evaos_desktop_bridge/pre_canary.py (1)
263-273: LGTM!Also applies to: 420-429
|
Superseding exact head: 1f82d4b. This closes the current review thread by making --canary-artifact-root additive to the environment/default baseline and fixes the Python 3.12 PermissionError crash while retaining uninspectable registrations fail-closed. Focused Vitest: 29/29. Direct Python 3.12 fail-closed reproduction: passed. Formatting, lint, and diff checks: passed. @coderabbitai review |
|
✅ Action performedReview finished.
|
evaOS review status: stale headPR: #714 - fix(release): reject real RC duplicates without stale Spotlight false positives evaOS review stopped because this queued head is no longer the live PR head. Automation note: agents should wait for this comment to reach PR URL: #714 |
|
Final blocker-fix head: b2182ab. Uninspectable artifact-only bundles now remain as path evidence and fail stale-app checks; sanitizer output is bounded to 20 fixed check lines plus one fixed omission notice. Focused suite: 103/103. Direct Python 3.12 registered-plus-artifact PermissionError proof: passed. Both actionable review threads are replied to and resolved. @codex review |
evaOS review status: completedPR: #714 - fix(release): reject real RC duplicates without stale Spotlight false positives evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #714 Review URL: #714 (review) |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![evaos-code-review-bot[bot]](https://avatars.githubusercontent.com/in/4184532?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #714 - fix(release): reject real RC duplicates without stale Spotlight false positives
Head: b2182ab75ac2e79e9ea8ecc8391a114d7b44475d into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 1/5 (~14 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-beta-rc-canary.yml |
modified | +55/-1 | Changed file | Moderate: validated P2 finding |
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts |
modified | +130/-0 | Test coverage | Moderate: validated P3 finding |
Review Signal
Validated inline findings: 3 (P0: 0, P1: 0, P2: 2, P3: 1).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- CI/build: 1
- Data loss: 1
- Release regression: 1
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: none detected from PR metadata.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
100yenadmin
left a comment
100yenadmin
left a comment
There was a problem hiding this comment.
Exact-head review findings have been dispositioned with fail-closed runtime and CI evidence; no additional source change is required.
v2.1.36 to Mac Access canonical handoffExact lineage
PR #714 changed only:
It did not change Mac Access packages, identities, pairing, connector APIs, selected-binding schemas, or receipt schemas. Contracts Mac Access must inheritConnector/candidate:
Selected binding and execution authority:
Runtime receipt/public proof:
Current proof state
Still unproven:
The superseded Refresh decision
|
|
v2.1.36 beta.3 local-finalization proof (publication remains fail-closed):
|
1 participant
Summary
Release context
RC run 29431909791 reached the installed Workbench pre-canary and exited 2 with its report hidden by set -e. The workflow had extracted and removed temporary Workbench app bundles immediately before inventory. Exact-head evaluation reproduced duplicate_registered_workbench_app from a nonexistent Spotlight path.
The signed/notarized beta.2 tag and draft remain immutable and unpublished. If this source change lands, beta.2 is superseded for distribution and the release lane must build, sign, notarize, register, and canary a fresh immutable candidate from the merge SHA. Publication remains fail-closed.
Validation
Scope boundaries
Changed paths are limited to the RC workflow, the vendored Workbench pre-canary implementation, and its focused unit test. No packages/mac-access, packages/mac-connector-core, docs/evaos/mac-access, identity, customer, staging, tag, release asset, or publication state is changed.
Summary by CodeRabbit
Bug Fixes
Tests