feat(mac-release): Developer ID signing + Owletto rebrand + submodule bump#894
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe macOS release workflow was refactored from Lobu to Owletto: release contract checks now target Owletto/com.owletto.mac, an optional provisioning-profile install was added for SIGNED builds, archive/sign/DMG steps were updated to use Owletto paths, the owletto submodule was bumped, and context7.json was populated. ChangesOwletto Release Workflow Migration
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/mac-release.yml:
- Around line 271-281: The PP_ARG expansion is unquoted when passed to
xcodebuild which will split profiles with spaces; set PP_ARG as a single quoted
string containing the PROVISIONING_PROFILE_SPECIFIER value (using the secret
APPLE_PROVISION_PROFILE_NAME) and expand it quoted in the xcodebuild invocation
(i.e., make PP_ARG a single token and use a quoted "$PP_ARG" when calling
xcodebuild) so the profile name with spaces is preserved; update the code around
the PP_ARG assignment and the xcodebuild line accordingly (references: PP_ARG,
APPLE_PROVISION_PROFILE_NAME, steps.profile.outputs.installed, xcodebuild).
In `@packages/owletto`:
- Line 1: The packages/owletto submodule is pointing to a non-existent commit
(2a513a20f55e5660452dd8416324ea0157028eae) in the lobu-ai/owletto repo; verify
the intended commit hash exists in lobu-ai/owletto (and that the Owletto rename
and merge from lobu-ai/owletto#187 are pushed), then update the submodule
pointer to a valid commit: open the packages/owletto submodule entry (the
submodule ref in .gitmodules/.git/config or the gitlink in the superproject),
replace the bad SHA with the correct pushed commit, commit that change in the
superproject, and run git submodule sync && git submodule update --init to
confirm the submodule now checks out successfully.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 016f1c35-5436-4c26-8e6e-d0975d51ed9e
📒 Files selected for processing (2)
.github/workflows/mac-release.ymlpackages/owletto
buremba
added a commit
that referenced
this pull request
May 18, 2026
…d-split pi review of #894 flagged that PROVISIONING_PROFILE_SPECIFIER built into a scalar and expanded unquoted as `$PP_ARG` would split a profile name containing spaces (e.g. "Owletto Developer ID") into three xcodebuild arguments. Switch to a bash array so each element survives word-splitting, and only append the specifier when the profile-install step actually ran.
Member
Author
pi review appliedFixed: Acknowledged, not fixed (intentional scope): pi also flagged that the bundle-id change |
…tto submodule Pair PR for lobu-ai/owletto#187 (rebrand Lobu.xcodeproj → Owletto.xcodeproj and switch to the new Apple Developer team CCV9Q352W3 under emre@lobu.ai). mac-release.yml updates: - All paths follow the rename: packages/owletto/apps/mac/Lobu.xcodeproj → Owletto.xcodeproj, Lobu/Info.plist → Owletto/Info.plist, Lobu.entitlements → Owletto.entitlements. - Scheme assertion: 'Lobu' → 'Owletto'; -scheme Owletto passed to xcodebuild; archive path Lobu.xcarchive → Owletto.xcarchive. - Bundle id assertion EXPECTED_BUNDLE_ID: ai.lobu.mac → com.owletto.mac. - Provisioning-profile handling becomes optional. The "Install provisioning profile" step is gated on env.PROFILE_BASE64 != '' and PROVISIONING_PROFILE_SPECIFIER is only passed to xcodebuild when a profile was actually installed. Without restricted entitlements (no HealthKit yet, pending Apple's Capability Request approval), signed + notarized builds run without a profile. - Header docs rewritten: list the 5 required secrets (APPLE_CERT_P12_BASE64, APPLE_CERT_PASSWORD, APPLE_TEAM_ID, APPLE_ID, APPLE_APP_PASSWORD) and the 2 optional ones, documenting the Apple Capability Request flow for adding HealthKit later. Submodule bump: - packages/owletto 970eb500 → 2a513a20 to pick up the Owletto.xcodeproj layout from lobu-ai/owletto#187. Without this bump the release contract step would fail (Lobu.xcodeproj no longer exists in the submodule).
…d-split pi review of #894 flagged that PROVISIONING_PROFILE_SPECIFIER built into a scalar and expanded unquoted as `$PP_ARG` would split a profile name containing spaces (e.g. "Owletto Developer ID") into three xcodebuild arguments. Switch to a bash array so each element survives word-splitting, and only append the specifier when the profile-install step actually ran.
Notarization rejected the first signed run with 'binary not signed with valid Developer ID' / 'signature does not include a secure timestamp' errors on Sparkle.framework's nested helpers (Updater.app, Autoupdate, Downloader.xpc, Installer.xpc). Xcode's archive doesn't apply Developer ID + secure timestamp to these when Sparkle is integrated via SPM. Add a post-archive step that re-signs each helper leaf-first with --options runtime --timestamp, then re-signs the framework and umbrella app so the new helper signatures get sealed into the parent. Final codesign --verify --deep --strict before the bundle is handed to Build DMG / notarytool.
buremba
force-pushed
the
feat/mac-release-signed
branch
from
77feff7 to
3c2d07f
Compare
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
buremba
added a commit
that referenced
this pull request
May 18, 2026
Two fixes wrapped together because both are needed to land this PR. 1. owletto submodule now points at 0275737 (the squash-merge of lobu-ai/owletto#188 into main), so it's reachable from owletto/main and check-drift stops failing. 2. .github/workflows/ci.yml's mac-build-smoke job still references Lobu.xcodeproj + scheme Lobu, but the rebrand in #894 renamed both to Owletto. Update the paths so the job builds again. This was pre-existing breakage on main, not introduced by this branch.
buremba
added a commit
that referenced
this pull request
May 18, 2026
…ative auto-pair (#896) * feat(server,chrome-ext): mint session_token alongside child PAT for native auto-pair POST /api/me/devices/mint-child-token now returns a Better Auth session_token alongside the worker PAT. The Owletto Chrome extension's native auto-pair needs this so the embedded iframe (which runs on the gateway origin with its own session) lands signed-in instead of bouncing the user to a second password prompt. The session is minted via internalAdapter.createSession() for the same user the bridge bearer authenticates, mirroring how /api/local-init mints bootstrap sessions. Mint failures are logged + ignored — the child PAT is still returned so the worker can poll; the iframe just falls back to the sign-in screen (matching pre-handoff behavior). Pairs with owletto#188, which: - Forwards session_token through ChromeBridgeHost.swift. - Adds installGatewaySessionCookie helper in sidepanel.js that hits /api/exchange-token in a top-level tab before storage.set so the cookie is in the jar by the time the iframe mounts. - Fixes a latent path bug: tryLocalInit was calling /api/auth/exchange-token, which the Better Auth /api/auth/* catch-all 404s. Real route is /api/exchange-token. Bumps owletto submodule to the matching SHA. * chore(submodule): bump owletto to d4a2616 (silent session-cookie refresh) Picks up the second commit on owletto#188: renderInitialView now does a native-bridge handshake on every paired boot so the iframe gets a fresh session cookie before mounting. Closes the already-paired gap that the first commit didn't cover (storage.accessToken existing meant mountEmbeddedApp was called directly, skipping the cookie install). * chore(submodule): bump owletto to 14b641c (silent refresh no longer leaks workers) Codex review caught it: the silent refresh in renderInitialView was calling mint-child-token just to extract session_token, but that endpoint also creates worker_id + PAT + device_workers row server-side — all discarded. Every side-panel open leaked one row. Fixed in owletto by handing the stored access_token to /api/exchange-token directly (resolveDeepLinkToken accepts PATs). No new minting, no leak. * chore: bump owletto to merged main + fix mac-build-smoke after rebrand Two fixes wrapped together because both are needed to land this PR. 1. owletto submodule now points at 0275737 (the squash-merge of lobu-ai/owletto#188 into main), so it's reachable from owletto/main and check-drift stops failing. 2. .github/workflows/ci.yml's mac-build-smoke job still references Lobu.xcodeproj + scheme Lobu, but the rebrand in #894 renamed both to Owletto. Update the paths so the job builds again. This was pre-existing breakage on main, not introduced by this branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Companion to lobu-ai/owletto#187. After both merge, dispatching
mac-releaseproduces a Developer ID signed + notarizedOwletto.dmg.mac-release.yml: paths updated for theLobu.xcodeproj → Owletto.xcodeprojrename in the submodule, scheme assertion + xcodebuild invocation switch to-scheme Owletto, archive path toOwletto.xcarchive, andEXPECTED_BUNDLE_IDtocom.owletto.mac.GH secrets already set on this repo
`APPLE_CERT_P12_BASE64`, `APPLE_CERT_PASSWORD`, `APPLE_TEAM_ID=CCV9Q352W3`, `APPLE_ID=emre@lobu.ai`, `APPLE_APP_PASSWORD`. `SPARKLE_ED_PRIVATE_KEY` already in place. `APPLE_PROVISION_PROFILE_*` intentionally not set — added later when HealthKit ships.
Test plan
Summary by CodeRabbit