Skip to content

Prepare App Store version before validation - #7979

Merged
azooz2003-bit merged 3 commits into
mainfrom
fix-ios-appstore-submission-prep
Jul 13, 2026
Merged

azooz2003-bit merged 3 commits into
mainfrom
fix-ios-appstore-submission-prep

Conversation

@azooz2003-bit

@azooz2003-bit azooz2003-bit commented Jul 13, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

  • declare that official cmux iOS does not use third-party content
  • attach the exact processed build to version 1.0.0 before strict readiness validation
  • keep submission preparation explicit and reusable through --prepare-submission

Root cause

  • the production lane uploaded and processed build 20260713085348 successfully, then strict validation found content rights unset and no build attached to the version

Testing

  • first commit adds a behavior test that fails with four preparation failures
  • second commit makes python3 tests/test_ios_appstore_lane_identity.py pass
  • bash -n ios/scripts/validate-app-store-release.sh
  • production App Store run after merge is the API-level regression proof

View with Codesmith Autofix with Codesmith
Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.


Summary by cubic

Prepares the App Store version before validation to stop readiness failures. We now declare user‑controlled third‑party content, attach the selected processed build to version 1.0.0, then run strict validation.

  • Bug Fixes
    • Added a --prepare-submission step in ios/scripts/validate-app-store-release.sh to set content rights to user‑controlled third‑party content and attach the selected build (requires build ID/number).
    • Enabled the step in .github/workflows/ios-app-store.yml so preparation runs before strict validation.
    • Added a behavior test to confirm content-rights update, build attachment, and that both happen before validation.

Written for commit 045fafc. Summary will update on new commits.

Review in cubic

Summary by CodeRabbit

  • New Features

    • Added a --prepare-submission mode to the App Store release validator to prepare submission by setting content-rights and attaching the selected build to the specified app version before proceeding with readiness checks.
    • Updated the iOS App Store workflow’s primary validation run to enable this preparation step.
  • Tests

    • Added a new test verifying the expected App Store Connect operations and that content-rights updates and build attachment occur before the final readiness validation call.

@vercel

vercel Bot commented Jul 13, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
cmux Ready Ready Preview, Comment Jul 13, 2026 11:35am
cmux-staging Building Building Preview, Comment Jul 13, 2026 11:35am

@coderabbitai

coderabbitai Bot commented Jul 13, 2026 •

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The iOS App Store validation script adds a --prepare-submission mode that updates content rights, resolves the requested App Store version, attaches a build, and then validates readiness. The workflow enables this mode, with tests covering the App Store Connect calls and ordering.

Changes

App Store submission preparation

Layer / File(s) Summary
Submission preparation flow
.github/workflows/ios-app-store.yml, ios/scripts/validate-app-store-release.sh
Adds the --prepare-submission option and runs content-rights updates, version lookup, and build attachment before readiness validation.
Preparation behavior coverage
tests/test_ios_appstore_lane_identity.py
Extends the fake App Store Connect tool and tests preparation payloads, selected identifiers, call ordering, and test execution wiring.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant ValidateScript
  participant AppStoreConnect
  GitHubActions->>ValidateScript: invoke with --prepare-submission
  ValidateScript->>AppStoreConnect: update content rights
  ValidateScript->>AppStoreConnect: list versions
  AppStoreConnect-->>ValidateScript: return version-id
  ValidateScript->>AppStoreConnect: attach build
  ValidateScript->>AppStoreConnect: validate readiness
Loading

Suggested reviewers: lawrencecchen

🚥 Pre-merge checks | ✅ 24 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description covers summary and testing, but omits the demo video, review trigger block, and checklist required by the template. Add the missing template sections: Demo Video, Review Trigger, and Checklist, and keep Summary and Testing aligned with the change.
✅ Passed checks (24 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Cmux Swift Actor Isolation ✅ Passed No Swift source changed in the PR diff; only workflow, shell, and Python test files were modified, so actor-isolation rules are unaffected.
Cmux Swift Blocking Runtime ✅ Passed No Swift files changed; the diff is limited to shell/Python, so it doesn’t introduce production Swift blocking primitives.
Cmux Browser Automation Off-Main ✅ Passed No browser-automation sources changed; only ios/scripts/validate-app-store-release.sh and its test were modified, so the off-main WebKit rule is not applicable.
Cmux Expensive Synchronous Load ✅ Passed Diff only changes a Bash script and a Python test; no production Swift code or interactive Swift load path was added or moved.
Cmux Cache Substitution Correctness ✅ Passed PASS: The PR only adds a fresh ASC version lookup and build attachment before validation; it does not replace any authoritative read with a cached/opportunistic value.
Cmux No Hacky Sleeps ✅ Passed No new fixed sleeps, polling, or wall-clock delays were added; the shell change adds submission prep only, and the new test is deterministic. Workflow YAML waits are out of scope.
Cmux Algorithmic Complexity ✅ Passed PASS: The new production shell path is a single filtered version lookup plus attach step; no nested scans, repeated rescans, or hot-path collection rebuilding.
Cmux Swift Concurrency ✅ Passed Diff only changes a shell script and a Python test; no Swift sources were touched, so no legacy async Swift patterns were introduced.
Cmux Swift @Concurrent ✅ Passed The PR diff only touches YAML, a shell script, and a Python test; no Swift files or @concurrent-related changes are present.
Cmux Swift File And Package Boundaries ✅ Passed No Swift production files changed; the PR only touches a shell script, workflow, and Python test, so the Swift boundary rule is not implicated.
Cmux Swiftpm Lockfiles ✅ Passed PR changes only workflow/script/test files; no Package.resolved, Package.swift, xcodeproj, or .gitignore lockfile changes are present.
Cmux Swift Logging ✅ Passed The PR only changes a shell script and a Python test; no production Swift code or logging was added or modified, so the Swift logging rule is not applicable.
Cmux User-Facing Error Privacy ✅ Passed New user-visible text is generic App Store validation/help copy; no secrets, raw upstream messages, internal provider names, or other banned details are exposed.
Cmux Full Internationalization ✅ Passed Only a shell-script help/log and test assertion changed; no Swift, web UI, metadata, or locale files were touched, so full-internationalization rules aren't implicated.
Cmux Swiftui State Layout ✅ Passed PR touches only an iOS shell script and Python tests; no SwiftUI files or state/layout patterns from the rule were introduced.
Cmux Architecture Rethink ✅ Passed No Swift files changed; the diff is workflow/script/test-only and adds a clear submission-prep owner/invariant, not an architectural symptom patch.
Cmux Swift Auxiliary Window Close Shortcuts ✅ Passed PASS: The diff only touches a shell script and a Python test; no Swift NSWindow/WindowGroup changes or cmuxAuxiliaryWindowIdentifiers registrations are present.
Cmux Source Artifacts ✅ Passed All changed paths are workflow/script/test source files; no local outputs, caches, temp dirs, or other artifact paths were added.
Cmux No Test Or Debug Seam In Production Source ✅ Passed PR changes only a workflow script and Python test; no Swift files under production Sources/ were modified.
Cmux No Ambient Global State ✅ Passed The commit only changes a shell script and a Python test; no Swift source is touched, so the ambient-global-state rule doesn’t apply.
Title check ✅ Passed The title clearly states the main change: preparing the App Store version before validation.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-ios-appstore-submission-prep

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@greptile-apps

greptile-apps Bot commented Jul 13, 2026 •

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR prepares the App Store version before strict readiness validation. The main changes are:

  • Adds a reusable --prepare-submission option.
  • Declares the app’s third-party content rights.
  • Attaches the processed build to version 1.0.0.
  • Enables preparation in the production App Store workflow.
  • Adds behavior coverage for ASC calls and ordering.

Confidence Score: 4/5

The latest changes do not introduce another distinct blocking issue.

  • The workflow supplies the uploaded version and build number to the preparation step.
  • The script performs both required mutations before strict validation.
  • The new test checks the ASC arguments and execution order.

Important Files Changed

Filename Overview
.github/workflows/ios-app-store.yml Enables submission preparation before strict App Store readiness validation.
ios/scripts/validate-app-store-release.sh Adds content-rights declaration and processed-build attachment behind an explicit option.
tests/test_ios_appstore_lane_identity.py Covers preparation arguments, build attachment, and operation ordering.

Reviews (2): Last reviewed commit: "Declare user-controlled App Store conten..." | Re-trigger Greptile

Comment on lines +154 to +157
VERSION_ID="$(
asc versions list --app "$APP" --version "$VERSION" --platform IOS --output json |
python3 -c 'import json,sys; body=json.load(sys.stdin); data=body.get("data") if isinstance(body,dict) else body; data=data if isinstance(data,list) else ([data] if isinstance(data,dict) else []); print(data[0].get("id", "") if data else "")'
)"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 First Match Can Select Wrong Version

If asc versions list returns more than one record for the requested filters, this parser silently selects the first ID without checking its version, platform, state, or result count. The workflow can then attach the processed build to an older or otherwise unintended App Store version instead of failing safely; require exactly one matching iOS version before performing the mutation.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ios/scripts/validate-app-store-release.sh`:
- Around line 154-157: Centralize the ASC version-ID JSON extraction currently
duplicated in the VERSION_ID assignment and the iOS workflow. Create a shared
helper or script containing the existing data-shape and id extraction logic,
update both callers to reuse it, and remove their inline Python copies while
preserving the current empty-result behavior.

In `@tests/test_ios_appstore_lane_identity.py`:
- Around line 930-942: Remove the explicit log_failure=False argument from the
_run invocation in the App Store submission preparation test so failures print
diagnostics using the default behavior, matching the sibling success-path test
while preserving the existing command and return-code assertion.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d547c367-5d36-4e22-be7c-f2d2b64bf056

📥 Commits

Reviewing files that changed from the base of the PR and between 393df98 and 4ac6f5e.

📒 Files selected for processing (3)
  • .github/workflows/ios-app-store.yml
  • ios/scripts/validate-app-store-release.sh
  • tests/test_ios_appstore_lane_identity.py

Comment on lines +154 to +157
VERSION_ID="$(
asc versions list --app "$APP" --version "$VERSION" --platform IOS --output json |
python3 -c 'import json,sys; body=json.load(sys.stdin); data=body.get("data") if isinstance(body,dict) else body; data=data if isinstance(data,list) else ([data] if isinstance(data,dict) else []); print(data[0].get("id", "") if data else "")'
)"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicated ASC version-id JSON extraction.

This python one-liner resolving VERSION_ID from asc versions list --output json is byte-for-byte the same logic already present in .github/workflows/ios-app-store.yml (lines 178-181). Two copies of non-trivial JSON-shape handling (data as dict vs list, .get("id","")) will silently drift if one is updated and not the other. Consider extracting a shared helper (e.g. a small function in this script that the workflow step also calls, or a shared script sourced by both) instead of a third copy of the same logic.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ios/scripts/validate-app-store-release.sh` around lines 154 - 157, Centralize
the ASC version-ID JSON extraction currently duplicated in the VERSION_ID
assignment and the iOS workflow. Create a shared helper or script containing the
existing data-shape and id extraction logic, update both callers to reuse it,
and remove their inline Python copies while preserving the current empty-result
behavior.

Comment on lines +930 to +942
result = _run(
[
"bash",
str(ROOT / "ios" / "scripts" / "validate-app-store-release.sh"),
"--build-id",
ASC_BUILD_ID,
"--prepare-submission",
],
env=env,
tmp=tmp,
log_failure=False,
)
_check(result.returncode == 0, "App Store validation helper prepares submission state")

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

log_failure=False on a success-path assertion hides diagnostics.

This test expects returncode == 0 (line 942), yet passes log_failure=False, so if the script unexpectedly fails, _run won't print stdout/stderr — unlike the sibling success-path test above (line 888-893) which leaves the default log_failure=True. This makes a CI regression on this exact test much harder to debug.

🐛 Proposed fix
     result = _run(
         [
             "bash",
             str(ROOT / "ios" / "scripts" / "validate-app-store-release.sh"),
             "--build-id",
             ASC_BUILD_ID,
             "--prepare-submission",
         ],
         env=env,
         tmp=tmp,
-        log_failure=False,
     )
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
result = _run(
[
"bash",
str(ROOT / "ios" / "scripts" / "validate-app-store-release.sh"),
"--build-id",
ASC_BUILD_ID,
"--prepare-submission",
],
env=env,
tmp=tmp,
log_failure=False,
)
_check(result.returncode == 0, "App Store validation helper prepares submission state")
result = _run(
[
"bash",
str(ROOT / "ios" / "scripts" / "validate-app-store-release.sh"),
"--build-id",
ASC_BUILD_ID,
"--prepare-submission",
],
env=env,
tmp=tmp,
)
_check(result.returncode == 0, "App Store validation helper prepares submission state")
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_ios_appstore_lane_identity.py` around lines 930 - 942, Remove the
explicit log_failure=False argument from the _run invocation in the App Store
submission preparation test so failures print diagnostics using the default
behavior, matching the sibling success-path test while preserving the existing
command and return-code assertion.

@cursor

cursor Bot commented Jul 13, 2026

Copy link
Copy Markdown

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

@azooz2003-bit
azooz2003-bit enabled auto-merge (squash) July 13, 2026 09:22
@azooz2003-bit
azooz2003-bit merged commit 0cac703 into main Jul 13, 2026
33 of 35 checks passed

This branch was successfully deployed

1 active deployment
Preview – cmux — 045fafc7 Deployed Jul 13, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant