chore(repo): sync with upstream main - #3
Conversation
Everything in this PR is a semver-compatible or patch/minor bump.
Larger migrations (uniffi 0.31→0.32, gradle 8→9, agp 8→9,
kotlin 2.2→2.4, typescript 5→6) are held for their own PRs.
Rust (cargo update — 61 crates within existing semver ranges):
iroh 1.0.0 → 1.0.2, iroh-{base,relay,services,dns} 1.0.0 → 1.0.2,
uniffi 0.31.1 → 0.31.2, napi 3.9.2 → 3.10.3, plus many transitives.
Kotlin (patch/minor within same majors):
Gradle wrapper 8.13 → 8.14.5
Kotlin plugins 2.2.20 → 2.2.21
AGP 8.13.0 → 8.13.2
Dokka 2.0.0 → 2.2.0
Vanniktech 0.34.0 → 0.37.0
JS:
@napi-rs/cli ^3.6.2 → ^3.7.2
typedoc ^0.27.6 → ^0.28.20
GitHub Actions:
actions/checkout master/v4 → v5 (fixes @master weak pin)
actions/setup-node v4 → v6 (was mixed; standardize)
actions/setup-java v4 → v5
actions/setup-python v5 → v6
Held for follow-up PRs (need code changes or need review):
- uniffi 0.31 → 0.32 (breaking API in 0.x versions)
- actions/upload-artifact v4 → v7, download-artifact v4 → v8
- actions/deploy-pages v4 → v5, upload-pages-artifact v3 → v5
- gradle/actions v4 → v6, android-actions/setup-android v3 → v4
- Gradle 8 → 9, AGP 8 → 9, Kotlin 2.2 → 2.4, TypeScript 5 → 6
Verified locally: rust tests (17), kotlin tests (19), js tests (20),
python tests (20) all pass.
arm64-only to match the existing macOS-arm64 policy. Resolves n0-computer#268.
* chore(release): v1.1.0 * chore(release): bake Swift xcframework SHA de50fa366fce51234368e77bd46395a41a6ac4b82124645228f33ea85db6fa17 [skip swift-release] * ci(release): swap gh CLI for action-gh-release Self-hosted macOS runner has no gh in PATH; the marketplace action handles create/update/upload with the workflow token. * chore(release): bake Swift xcframework SHA ad46dadf09f9224157512992923562931ed60f252414230d50893a4d515c5776 [skip swift-release] --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
ci: use marketplace actions instead of runner-installed tooling - softprops/action-gh-release@v3 for release create/update/upload (no gh CLI) - setup-java@v5(17) before setup-android in build-kotlin-android - pin docs.yml swift job to xcode16 label (iOS 17 SDK path)
…#275) - apt install file before verify-kotlin-artifact (task uses `file -b`) - workflow_dispatch trigger, publish steps gated to tag ref only so the branch can be exercised end-to-end without touching registries.
# Conflicts: # iroh-js/index.js # iroh-js/npm/android-arm-eabi/package.json # iroh-js/npm/android-arm64/package.json # iroh-js/npm/darwin-arm64/package.json # iroh-js/npm/linux-arm-gnueabihf/package.json # iroh-js/npm/linux-arm-musleabihf/package.json # iroh-js/npm/linux-arm64-gnu/package.json # iroh-js/npm/linux-arm64-musl/package.json # iroh-js/npm/linux-x64-gnu/package.json # iroh-js/npm/linux-x64-musl/package.json # iroh-js/npm/win32-arm64-msvc/package.json # iroh-js/npm/win32-x64-msvc/package.json # iroh-js/yarn.lock
📝 WalkthroughWalkthroughChangesThe 1.1.0 update adds categorized FFI errors across Rust, Swift, Kotlin, and Python; adds Mac Catalyst support to Swift artifacts; updates JavaScript binding loading; bumps package and build-tool versions; and revises CI and release workflows. Structured error API
Swift Mac Catalyst support
JavaScript binding loading
Release and build tooling
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant RustFFI
participant LanguageBinding
Caller->>RustFFI: invoke operation
RustFFI-->>LanguageBinding: return categorized error
LanguageBinding-->>Caller: expose kind, message, debug message
sequenceDiagram
participant RustBuild
participant XCFrameworkBuilder
participant SwiftPackage
RustBuild->>XCFrameworkBuilder: provide Mac Catalyst library
XCFrameworkBuilder->>SwiftPackage: publish five-target xcframework
SwiftPackage-->>SwiftPackage: verify Mac Catalyst platform
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
src/error.rs (1)
67-70: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse the user-facing
Displaymessage infrom_debug.Every upstream error mapped through
from_iroh_err!gets its verboseDebugrepr stored in bothmessageanddebug_message, while theanyhow/CallbackErrorpaths keepmessagehuman-readable and only put theDebugrepr indebug_message. Since these upstream errors implementDisplay, capture both outputs and split the helper into a Display-based message field plus a separate Debug field.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/error.rs` around lines 67 - 70, Update IrohError::from_debug to accept a Display-capable value, storing its user-facing Display output in message and its verbose Debug output separately in debug_message. Preserve the existing IrohError construction while ensuring from_iroh_err! follows the same message/debug split as anyhow and CallbackError paths.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci_swift.yml:
- Line 24: Disable persisted checkout credentials by adding persist-credentials:
false to every actions/checkout@v5 invocation in
.github/workflows/ci_swift.yml:24, .github/workflows/release_swift.yml:24-27,
and .github/workflows/docs.yml:30, 55, 83, 108, and 129; retain the release
upload step without enabling authenticated git access.
In @.github/workflows/release.yml:
- Around line 47-53: Update the release workflow’s “Promote draft release (or
create fresh)” step to keep the release as a draft rather than publishing it
before asset jobs complete. Add a separate final publication step that runs only
after all required build and upload jobs succeed, reusing the release version
and publishing the prepared draft.
- Around line 49-53: Update both softprops/action-gh-release usages in the
create-release and build-and-publish-libs jobs to reference the reviewed
full-length commit SHA instead of the mutable v3 tag. Keep the existing release
configuration unchanged.
In `@iroh-js/npm/darwin-arm64/package.json`:
- Line 3: All seven platform package manifests have version 1.1.0 but stale
descriptions referencing `@number0/iroh`@1.0.0; update each description to
reference 1.1.0 in iroh-js/npm/darwin-arm64/package.json:3-3,
iroh-js/npm/linux-arm-gnueabihf/package.json:3-3,
iroh-js/npm/linux-arm-musleabihf/package.json:3-3,
iroh-js/npm/linux-arm64-gnu/package.json:3-3,
iroh-js/npm/linux-arm64-musl/package.json:3-3,
iroh-js/npm/linux-x64-gnu/package.json:3-3, and
iroh-js/npm/linux-x64-musl/package.json:3-3, unless compatibility with 1.0.0 is
intentional and explicitly documented.
In `@make_swift.sh`:
- Around line 69-70: Update the workflow that runs the Swift xcframework task,
particularly the target installation step in docs workflow configuration, to
install aarch64-apple-ios-macabi alongside aarch64-apple-darwin. Match the
complete Rust target list already used by the Swift CI and release workflows so
clean runners can execute make_swift.sh successfully.
In `@Package.swift`:
- Around line 50-51: Update the local xcframework selection guarded by
useLocalXcframework to also verify that the required Catalyst slice exists, or
validate the xcframework’s intended AvailableLibraries entries before choosing
path "Iroh.xcframework". If the Catalyst slice is absent, use the existing
release-zip fallback instead of selecting the incomplete local artifact.
---
Nitpick comments:
In `@src/error.rs`:
- Around line 67-70: Update IrohError::from_debug to accept a Display-capable
value, storing its user-facing Display output in message and its verbose Debug
output separately in debug_message. Preserve the existing IrohError construction
while ensuring from_iroh_err! follows the same message/debug split as anyhow and
CallbackError paths.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 99c2bc76-be5d-4438-aa2d-e4e72a66c054
⛔ Files ignored due to path filters (2)
Cargo.lockis excluded by!**/*.lockiroh-js/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (43)
.github/workflows/ci.yml.github/workflows/ci_js.yml.github/workflows/ci_kotlin.yml.github/workflows/ci_python.yml.github/workflows/ci_swift.yml.github/workflows/docs.yml.github/workflows/release.yml.github/workflows/release_swift.yml.github/workflows/wheels.yml.gitignoreCargo.tomlIrohLib/Sources/IrohLib/IrohLib.swiftIrohLib/Tests/IrohLibTests/IrohLibTests.swiftMakefile.tomlPackage.swiftiroh-js/Cargo.tomliroh-js/index.jsiroh-js/npm/android-arm-eabi/package.jsoniroh-js/npm/android-arm64/package.jsoniroh-js/npm/darwin-arm64/package.jsoniroh-js/npm/linux-arm-gnueabihf/package.jsoniroh-js/npm/linux-arm-musleabihf/package.jsoniroh-js/npm/linux-arm64-gnu/package.jsoniroh-js/npm/linux-arm64-musl/package.jsoniroh-js/npm/linux-x64-gnu/package.jsoniroh-js/npm/linux-x64-musl/package.jsoniroh-js/npm/win32-arm64-msvc/package.jsoniroh-js/npm/win32-x64-msvc/package.jsoniroh-js/package.jsonkotlin/android/build.gradle.ktskotlin/gradle/libs.versions.tomlkotlin/gradle/wrapper/gradle-wrapper.propertieskotlin/lib/build.gradle.ktskotlin/lib/src/main/kotlin/computer/iroh/iroh_ffi.ktkotlin/lib/src/test/kotlin/computer/iroh/KeyTest.ktmake_swift.shpyproject.tomlpython/key_test.pypython/main.pyscripts/release/swift_upload_draft.shsrc/endpoint.rssrc/error.rssrc/key.rs
💤 Files with no reviewable changes (1)
- scripts/release/swift_upload_draft.sh
| runs-on: [self-hosted, macOS, ARM64, xcode16] | ||
| steps: | ||
| - uses: actions/checkout@master | ||
| - uses: actions/checkout@v5 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository files matching workflow names:\n'
git ls-files '.github/workflows/*' | grep -E '(^\.github/workflows/ci_swift\.yml$|^\.github/workflows/release_swift\.yml$|^\.github/workflows/docs\.yml$)' || true
printf '\n--- .github/workflows/ci_swift.yml (lines 1-80) ---\n'
if [ -f .github/workflows/ci_swift.yml ]; then
nl -ba .github/workflows/ci_swift.yml | sed -n '1,100p'
fi
printf '\n--- .github/workflows/release_swift.yml (lines 1-140) ---\n'
if [ -f .github/workflows/release_swift.yml ]; then
nl -ba .github/workflows/release_swift.yml | sed -n '1,160p'
fi
printf '\n--- .github/workflows/docs.yml relevant checkout/build steps ---\n'
if [ -f .github/workflows/docs.yml ]; then
# Print around checkout lines and any later git/gh/script steps that reference checkout destinations.
python3 - <<'PY'
import re
from pathlib import Path
p=Path('.github/workflows/docs.yml')
lines=p.read_text().splitlines()
hits=[]
for i,l in enumerate(lines,1):
if 'actions/checkout@v5' in l:
start=max(1,i-4); end=min(len(lines),i+35)
hits.append((i,start,end))
for i,start,end in hits:
print(f'--- docs around checkout line {i} ---')
nl=list(enumerate(lines,1))[start-1:end]
for j,line in nl:
print(f'{j:4}: {line}')
print()
# Also locate runner/container config and build commands broadly
for i,line in enumerate(lines,1):
if re.search(r'runs-on:|container:|swift|pip|pip3|node|gradle|npm|git push|gh ', line):
print(f'{i}: {line}')
PY
fiRepository: faw01/iroh-ffi
Length of output: 381
🏁 Script executed:
#!/bin/bash
set -euo pipefail
count_lines() {
awk '{print NR}' "$1" | tail -n 1
}
cat_lines() {
sed -n "${1},${2}p" "$3" | cat -n
}
for f in .github/workflows/ci_swift.yml .github/workflows/release_swift.yml .github/workflows/docs.yml; do
echo "== $f: line count =="
count_lines "$f"
done
echo "== ci_swift key lines =="
for range in "1,90" "90,150"; do
start=$(echo "$range"|cut -d, -f1)
end=$(echo "$range"|cut -d, -f2)
echo "--- ci_swift $start-$end ---"
sed -n "${start},${end}p" .github/workflows/ci_swift.yml | cat -n
done
echo "== release_swift key lines =="
sed -n '1,180p' .github/workflows/release_swift.yml | cat -n
echo "== docs checkout and remote/build-related lines =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/docs.yml')
lines=p.read_text().splitlines()
import re, sys
keywords_patterns=[
re.compile(r'action:|uses:'),
re.compile(r'with:|persist-credentials|token:|fetch-depth:'),
re.compile(r'run:|shell:'),
re.compile(r'git\s+|gh\s+|swift|pip|pip3|node|npm|yarn|gradle|cargo'),
]
for idx,line in enumerate(lines,1):
if any(p.search(line) for p in keywords_patterns):
print(f'{idx}: {line}')
PYRepository: faw01/iroh-ffi
Length of output: 7430
🌐 Web query:
actions/checkout persist-credentials default true README
💡 Result:
In the actions/checkout GitHub Action, the persist-credentials input defaults to true [1][2][3]. When set to true (the default), the action configures the provided authentication token or SSH key with the local git configuration [2][3][4]. This allows subsequent steps in your job to execute authenticated git commands, such as git fetch, directly [2][4]. The action is designed to remove these credentials during the post-job cleanup process [1][4]. If you wish to prevent the action from persisting these credentials, you can explicitly opt-out by setting the input to false in your workflow file [1][4]: - uses: actions/checkout@v4 with: persist-credentials: false Recent versions of the action have improved how these credentials are stored, moving them from the local git config to a location under $RUNNER_TEMP to enhance security [5].
Citations:
- 1: https://github.com/actions/checkout/?tab=readme-ov-file
- 2: https://github.com/actions/checkout/blob/master/adrs/0153-checkout-v2.md
- 3: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 4: https://github.com/actions/checkout
- 5: https://github.com/actions/checkout/tree/v6.0.0
Disable persisted checkout credentials across the self-hosted workflows.
actions/checkout persists GITHUB_TOKEN by default, so every checkout on these self-hosted jobs leaves credentials available for later build/script steps. Add persist-credentials: false unless a later step explicitly needs authenticated remote access; for .github/workflows/release_swift.yml, the only currently visible later remote caller is the release upload step, not authenticated git pushes.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 24-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 3 files
.github/workflows/ci_swift.yml#L24-L24(this comment).github/workflows/release_swift.yml#L24-L27.github/workflows/docs.yml#L30-L30.github/workflows/docs.yml#L55-L55.github/workflows/docs.yml#L83-L83.github/workflows/docs.yml#L108-L108.github/workflows/docs.yml#L129-L129
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci_swift.yml at line 24, Disable persisted checkout
credentials by adding persist-credentials: false to every actions/checkout@v5
invocation in .github/workflows/ci_swift.yml:24,
.github/workflows/release_swift.yml:24-27, and .github/workflows/docs.yml:30,
55, 83, 108, and 129; retain the release upload step without enabling
authenticated git access.
Source: Linters/SAST tools
| - name: Promote draft release (or create fresh) | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| TAG: ${{ env.RELEASE_VERSION }} | ||
| shell: bash | ||
| run: | | ||
| set -eu | ||
| if gh release view "$TAG" --json isDraft -q .isDraft 2>/dev/null | grep -q true; then | ||
| echo "Promoting existing draft $TAG to published" | ||
| gh release edit "$TAG" --draft=false | ||
| elif ! gh release view "$TAG" >/dev/null 2>&1; then | ||
| echo "Creating fresh published release $TAG (no draft from release_swift.yml)" | ||
| gh release create "$TAG" --title "$TAG" --notes "" | ||
| else | ||
| echo "Release $TAG already published" | ||
| fi | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| uses: softprops/action-gh-release@v3 | ||
| with: | ||
| tag_name: ${{ env.RELEASE_VERSION }} | ||
| name: ${{ env.RELEASE_VERSION }} | ||
| draft: false |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows || true
echo
echo "== release workflow outline/size =="
if [ -f .github/workflows/release.yml ]; then
wc -l .github/workflows/release.yml
sed -n '1,180p' .github/workflows/release.yml | cat -n
fi
echo
echo "== search release/action permissions/usages =="
rg -n "softprops/action-gh-release|draft:\s*(false|true)|permissions:|upload|Contents|contents:write|create-release|release" .github workflows 2>/dev/null || trueRepository: faw01/iroh-ffi
Length of output: 16199
Keep the release draft until all assets are attached and validated.
create-release runs first, promotes the Swift draft to published, and every downstream asset job depends on its success. If a later build or upload job fails, the GitHub release can already be public without the remaining assets. Keep promotion draft-only and add a final publication step after the required jobs succeed.
🧰 Tools
🪛 zizmor (1.26.1)
[info] 49-49: action functionality is already included by the runner (superfluous-actions): use gh release in a script step
(superfluous-actions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 47 - 53, Update the release
workflow’s “Promote draft release (or create fresh)” step to keep the release as
a draft rather than publishing it before asset jobs complete. Add a separate
final publication step that runs only after all required build and upload jobs
succeed, reusing the release version and publishing the prepared draft.
| uses: softprops/action-gh-release@v3 | ||
| with: | ||
| tag_name: ${{ env.RELEASE_VERSION }} | ||
| name: ${{ env.RELEASE_VERSION }} | ||
| draft: false |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
if [ -f .github/workflows/release.yml ]; then
wc -l .github/workflows/release.yml
sed -n '1,150p' .github/workflows/release.yml
else
echo "missing .github/workflows/release.yml"
fi
echo
echo "== uses softprops/action-gh-release occurrences =="
rg -n "softprops/action-gh-release|permissions:|GITHUB_TOKEN|release|permissions:" .github/workflows/release.yml || true
echo
echo "== all release action occurrences in workflows =="
rg -n "softprops/action-gh-release" .github/workflows || trueRepository: faw01/iroh-ffi
Length of output: 8740
🌐 Web query:
GitHub Actions security hardening action-gh-release commit SHA pinning softprops/action-gh-release release write permissions
💡 Result:
To harden the security of GitHub Actions workflows, especially those involving sensitive tasks like creating releases, it is highly recommended to pin actions to their full-length (40-character) commit SHA rather than using mutable version tags (e.g., @v1, @v3) [1][2][3][4]. Pinning to a commit SHA provides an immutable reference, which protects your workflow from supply chain attacks where a compromised action repository could otherwise silently update the code executed in your CI/CD environment [3][4][5]. For the softprops/action-gh-release action, you can continue to track updates by pinning to a specific SHA while keeping the version as a trailing comment [3][5]: uses: softprops/action-gh-release@ # v3.0.1 Permissions requirements: To create a GitHub release, your workflow job requires write access to the contents of the repository [6][7][8]. You should configure this explicitly in your workflow file to follow the principle of least privilege [7][9]: permissions: contents: write Important Considerations: 1. Default Token Limitations: The default secrets.GITHUB_TOKEN may not trigger downstream workflows on release events (e.g., 'on: release: { types: [published] }') [6][10]. If your release process relies on secondary workflows triggered by a release, you may need to use a Personal Access Token (PAT) with appropriate permissions [6][11]. 2. Alternative Approaches: Some security-conscious projects have moved away from third-party release actions entirely, opting to use the built-in GitHub CLI (gh) directly within their workflows to reduce dependencies and potential attack vectors [12][8]. The command gh release upload or gh release create can be used with the same contents: write permission [12][8]. 3. Repository Settings: Ensure that your repository's Actions settings under Workflow permissions are configured to allow the GITHUB_TOKEN to have the necessary read and write access [9][8]. If these are set to restricted (read-only), your workflow will fail even if permissions are correctly defined in the YAML [9][8].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md
- 3: https://starsling.dev/best-practices/github-actions/pin-action-shas
- 4: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 5: Update softprops/action-gh-release action to v3 amitsingh-007/bypass-links#4057
- 6: https://github.com/softprops/action-gh-release
- 7: https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions
- 8: https://stackoverflow.com/questions/76362343/creating-a-release-using-github-action-fails-with-http-403
- 9: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository
- 10: https://github.com/step-security/action-gh-release
- 11: https://stackoverflow.com/questions/72383123/what-permissions-are-needed-for-github-actions-to-create-a-tag-and-release-for-a
- 12: Fix #471: chore: replace softprops/action-gh-release with gh CLI in p... NVIDIA-NeMo/DataDesigner#488
Pin release operations to full commit SHAs.
create-release and build-and-publish-libs each run softprops/action-gh-release@v3 in jobs with contents: write/-upload-release-assets. Pin the action to its reviewed full-length commit SHA instead of the mutable v3 tag at both .github/workflows/release.yml:47-49 and :.github/workflows/release.yml:122-124.
🧰 Tools
🪛 zizmor (1.26.1)
[info] 49-49: action functionality is already included by the runner (superfluous-actions): use gh release in a script step
(superfluous-actions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 49 - 53, Update both
softprops/action-gh-release usages in the create-release and
build-and-publish-libs jobs to reference the reviewed full-length commit SHA
instead of the mutable v3 tag. Keep the existing release configuration
unchanged.
| { | ||
| "name": "dumbridge-iroh-darwin-arm64", | ||
| "version": "1.0.0", | ||
| "version": "1.1.0", |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Keep platform package metadata consistent.
All seven manifests now declare version 1.1.0, but their descriptions still say they are drop-in packages for @number0/iroh@1.0.0. Update the description to 1.1.0, or explicitly document why compatibility intentionally targets 1.0.0.
iroh-js/npm/darwin-arm64/package.json#L3-L3: update the stale description.iroh-js/npm/linux-arm-gnueabihf/package.json#L3-L3: update the stale description.iroh-js/npm/linux-arm-musleabihf/package.json#L3-L3: update the stale description.iroh-js/npm/linux-arm64-gnu/package.json#L3-L3: update the stale description.iroh-js/npm/linux-arm64-musl/package.json#L3-L3: update the stale description.iroh-js/npm/linux-x64-gnu/package.json#L3-L3: update the stale description.iroh-js/npm/linux-x64-musl/package.json#L3-L3: update the stale description.
📍 Affects 7 files
iroh-js/npm/darwin-arm64/package.json#L3-L3(this comment)iroh-js/npm/linux-arm-gnueabihf/package.json#L3-L3iroh-js/npm/linux-arm-musleabihf/package.json#L3-L3iroh-js/npm/linux-arm64-gnu/package.json#L3-L3iroh-js/npm/linux-arm64-musl/package.json#L3-L3iroh-js/npm/linux-x64-gnu/package.json#L3-L3iroh-js/npm/linux-x64-musl/package.json#L3-L3
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@iroh-js/npm/darwin-arm64/package.json` at line 3, All seven platform package
manifests have version 1.1.0 but stale descriptions referencing
`@number0/iroh`@1.0.0; update each description to reference 1.1.0 in
iroh-js/npm/darwin-arm64/package.json:3-3,
iroh-js/npm/linux-arm-gnueabihf/package.json:3-3,
iroh-js/npm/linux-arm-musleabihf/package.json:3-3,
iroh-js/npm/linux-arm64-gnu/package.json:3-3,
iroh-js/npm/linux-arm64-musl/package.json:3-3,
iroh-js/npm/linux-x64-gnu/package.json:3-3, and
iroh-js/npm/linux-x64-musl/package.json:3-3, unless compatibility with 1.0.0 is
intentional and explicitly documented.
| echo "Building aarch64-apple-ios-macabi" | ||
| cargo build --release --target aarch64-apple-ios-macabi |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Install the new target in every workflow that runs this task.
swift-xcframework now unconditionally builds aarch64-apple-ios-macabi, but .github/workflows/docs.yml still installs only aarch64-apple-darwin. A clean docs runner will fail before xcframework assembly. Add the full target list used by the Swift CI and release workflows.
Proposed workflow fix
- targets: aarch64-apple-darwin
+ targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios,aarch64-apple-darwin,aarch64-apple-ios-macabi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@make_swift.sh` around lines 69 - 70, Update the workflow that runs the Swift
xcframework task, particularly the target installation step in docs workflow
configuration, to install aarch64-apple-ios-macabi alongside
aarch64-apple-darwin. Match the complete Rust target list already used by the
Swift CI and release workflows so clean runners can execute make_swift.sh
successfully.
| .macOS("14.5"), | ||
| .macCatalyst("17.5") |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repo files around Package.swift:"
fd -a 'Package.swift$' . | sed 's#^\./##'
echo
if [ -f Package.swift ]; then
echo "Package.swift relevant lines:"
nl -ba Package.swift | sed -n '1,140p'
echo
echo "Search useLocalXcframework availability/localXcframework:"
rg -n "useLocalXcframework|LocalXcframework|availableLibraries|macCatalyst|macOS\\(|xcframework" Package.swift . --glob '!**/.build/**' --glob '!**/Packages/**' --glob '!**/DerivedData/**' | head -200
fiRepository: faw01/iroh-ffi
Length of output: 290
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Package.swift lines 1-140:"
awk '{printf "%6d %s\n", NR, $0}' Package.swift | sed -n '1,140p'
echo
echo "Search symbols:"
rg -n "useLocalXcframework|LocalXcframework|availableLibraries|macCatalyst|macOS\\(|xcframework" Package.swift . --glob '!**/.build/**' --glob '!**/Packages/**' --glob '!**/DerivedData/**' | head -200 || true
echo
echo "Git status/diff stat:"
git status --short
git diff --stat HEAD..HEAD 2>/dev/null || trueRepository: faw01/iroh-ffi
Length of output: 14733
Require the Catalyst slice before selecting the local xcframework.
useLocalXcframework is keyed only on Iroh.xcframework/macos-arm64/libiroh_ffi.a, so this package can select path: "Iroh.xcframework" even when the Catalyst slice is missing from the local build artifact. Catalyst builds then fail instead of falling back to the release zip. Check for the Catalyst slice or validate the intended AvailableLibraries slices before using the local path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Package.swift` around lines 50 - 51, Update the local xcframework selection
guarded by useLocalXcframework to also verify that the required Catalyst slice
exists, or validate the xcframework’s intended AvailableLibraries entries before
choosing path "Iroh.xcframework". If the Catalyst slice is absent, use the
existing release-zip fallback instead of selecting the incomplete local
artifact.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0db15de. Configure here.
| .iOS("17.5"), | ||
| .macOS("14.5") | ||
| .macOS("14.5"), | ||
| .macCatalyst("17.5") |
There was a problem hiding this comment.
Stale local xcframework breaks Catalyst
Medium Severity
Adding .macCatalyst("17.5") makes Mac Catalyst a supported platform, but choosing the local Iroh.xcframework still only checks for macos-arm64/libiroh_ffi.a. After upgrading without rebuilding, an older four-slice tree can be selected and Catalyst builds fail because the macabi slice is missing.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 0db15de. Configure here.
4 participants
Summary
n0-computer/iroh-ffimain(9 commits: v1.1.0 release, dep bumps incl. napi-rs CLI 3.7.2, uniffi error-handling improvements, Mac Catalyst xcframework slice, CI/release workflow cleanups) intodumbridge.dumbridge-irohnames everywhere, versions follow upstream to 1.1.0,index.jstakes upstream's new napi codegen with our package-name rename re-applied, and upstream's committedoptionalDependenciesblock is dropped (the fork's preflight guard requires napi pre-publish to write it at publish time).yarn.lockregenerated with the vendored Yarn 4.proxyFromEnv/proxyUrl/caExtraRootsPem) is untouched by upstream and survives intact.Test plan
cargo checkiniroh-js/and repo rootcargo fmt --all --checkwith the CI confignode --checkonindex.jsand the probe scriptNote
Medium Risk
Release and CI workflow behavior changed (draft promotion, artifact retention, dependency majors), plus a new Mac Catalyst slice and structured error API that consumers must adopt; fork-specific npm optional-deps flow remains a publish-time concern.
Overview
This PR merges upstream iroh-ffi into the dumbridge fork: workspace and bindings bump to v1.1.0,
Cargo.lockrefreshes iroh 1.0.2 / uniffi 0.31.2 / napi-rs 3.10.x, and JS packages stay on dumbridge-iroh naming with upstream’s regenerated loader (1.1.0 binding checks, stricterNAPI_RS_FORCE_WASI, Node <16-safeerror.cause).FFI / Swift: Generated Swift gains
IrohErrorKindpluskind(),isKind(), anddebugMessage()onIrohError; UTF-8 decoding avoids Foundation BOM stripping; callback vtables usenonisolated(unsafe)for Swift 6.Package.swiftadds Mac Catalyst, a fifth xcframework target (aarch64-apple-ios-macabi), and updated release checksum/tag.CI / release: Actions pin checkout@v5, setup-node/python/java major bumps; artifact
retention-dayscut storage;softprops/action-gh-releasereplacesghCLI for Swift draft + tag releases; Kotlin release adds Java on Android build andfilefor verify; Swift/docs runners target xcode16;Makefile.tomlverifies Mac Catalyst builds.Kotlin: Maven coords 1.1.0, Gradle 8.14.5, AGP 8.13.2, Kotlin 2.2.21, Dokka 2.2.0, maven-publish 0.37.0.
Reviewed by Cursor Bugbot for commit 0db15de. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
New Features
Bug Fixes