Fix release packaging for macOS and Linux#290
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdds linux-x64 as a packaged desktop target: updates runtime contracts, makes executable inspection format-aware (ELF vs Mach-O), generalizes runtimeKey-based staging/pruning, provisions platform-specific native deps, and adds CI/release/test jobs to build, validate, and release Linux Electron artifacts. ChangesLinux x64 Runtime Build and Packaging
Sequence Diagram(s)sequenceDiagram
participant ReleaseWF as Release Workflow
participant Validate as validate-and-bump
participant BuildMacOS as build-macos
participant BuildLinux as build-linux
participant CreateRelease as create-release
participant PublishCLI as publish-cli
Validate->>BuildMacOS: trigger macOS packaging
Validate->>BuildLinux: trigger Linux packaging
BuildMacOS->>CreateRelease: upload macOS artifacts
BuildLinux->>CreateRelease: upload Linux artifacts
CreateRelease->>CreateRelease: collect release files (include .AppImage/.deb)
CreateRelease->>PublishCLI: trigger CLI publish
PublishCLI->>PublishCLI: bun publish --access public
Estimated code review effort🎯 4 (Complex) | ⏱️ ~75 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 359-363: Update the "Package Linux (x64)" job so it runs runtime
contract validation and runtime smoke checks before packaging: insert steps to
run the npm scripts via bun (e.g. "bun run validate:runtime" and "bun run
validate:runtime-smoke") prior to "bun run build:all" and the existing "bunx
electron-builder --linux --publish never", and ensure any failure from these
validation commands fails the job so artifacts are not published.
In `@scripts/prune-pencil-cli-binaries.cjs`:
- Around line 549-551: The curl and tar invocations inside
ensureCanvasRuntimePackage() can hang indefinitely; add a timeout option to both
execFileSync calls to avoid stalling the job. Update the two execFileSync calls
that run "curl" (with args ["-fsSL", url, "-o", tarballPath]) and "tar"
(["-xzf", tarballPath, "-C", tempRoot]) to include a timeout value in the
options (e.g., { stdio: ["ignore","pipe","pipe"], timeout: 120000 }) or pull a
configurable timeout constant and use that so both downloads and extraction will
abort after the configured ms.
In `@scripts/runtime/electron-builder-before-pack.cjs`:
- Around line 216-218: The allowlist guard currently treats an unmapped builder
arch as "omitted" and returns early; update the condition in the check using
SUPPORTED_PACKAGED_RUNTIME_KEYS, ARCH_BY_BUILDER_VALUE and the local arch so
that only a known, mapped arch that is present in supportedArches causes an
early return (i.e., require arch to be truthy before checking
supportedArches.has(arch)); this ensures assertPackagedRuntimePlatform({
electronPlatformName: "linux", arch: 99 }) and similar cases do not bypass the
platform check and instead fall through to the proper error handling in
beforePack.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9c3327ac-fe59-4f4b-a755-a5df3f67ad41
📒 Files selected for processing (12)
.github/workflows/release.yml.github/workflows/test.ymlelectron-builder.ymlpackage.jsonscripts/prepare-gh-cli.mjsscripts/prune-pencil-cli-binaries.cjsscripts/runtime/agent-clis.tsscripts/runtime/electron-builder-before-pack.cjsscripts/runtime/gh-cli-contract.jsonscripts/runtime/native-runtime.tsscripts/runtime/validate.tstest/unit/runtime/electron-builder-before-pack.test.ts
Greenlight — Round 3Fixed all three CodeRabbit findings in 7aa675c:
Local verification: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc65a2b60e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "package:mac:dir": "node scripts/runtime/package-mac-dir.cjs", | ||
| "package:win": "node scripts/runtime/unsupported-packaged-platform.cjs Windows", | ||
| "package:linux": "node scripts/runtime/unsupported-packaged-platform.cjs Linux", | ||
| "package:linux": "bun run build:all && electron-builder --linux", |
There was a problem hiding this comment.
Enabling package:linux produces AppImage/deb files, but the packaged desktop still refuses to start on Linux: resolveRuntimeEntries() in apps/desktop/main/backend-process.ts throws whenever app.isPackaged and process.platform !== "darwin". In any packaged Linux build from this script or the new release job, the app will abort before spawning the backend, so the Linux artifacts are not usable until that guard/runtime path is updated.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 92e6cc4. Packaged startup now permits darwin and linux, and the backend spawn test covers packaged Linux launching through Resources/bin/deus-runtime with the bundled bin directory on PATH.
| run: | | ||
| bun run build:all | ||
| bun run validate:runtime | ||
| bun run smoke:runtime-source |
There was a problem hiding this comment.
On the new Ubuntu release job this smoke runs after staging the Linux CLIs, but the source runtime only treats darwin-arm64/darwin-x64 as dev-staged runtime keys (apps/runtime/index.ts and shared/lib/cli-path.ts never return linux-x64). As a result smoke:runtime-source starts agent-server without DEUS_BUNDLED_BIN_DIR, cannot emit the required bundled claude/codex paths, and the Linux release job times out/fails before packaging can be uploaded.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 92e6cc4. Source-runtime CLI discovery now recognizes linux-x64 in both apps/runtime/index.ts and shared/lib/cli-path.ts; the shared CLI path test covers staged Linux dev binaries.
| - name: Publish to npm | ||
| working-directory: apps/cli | ||
| run: npm publish --access public --provenance | ||
| run: bun publish --access public |
There was a problem hiding this comment.
This replaces the previous npm publish --provenance with bun publish --access public, so releases from this workflow will no longer publish the CLI package with npm provenance even though the job still requests id-token: write. I checked bun publish --help; it lists publish flags like --access, --tag, --otp, and --auth-type, but no provenance flag, so this command drops the supply-chain attestation that the old workflow produced.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Declined intentionally. The repo instructions require Bun for package operations and explicitly say never npm/yarn; local bun publish --help does not support --provenance, so keeping npm publish --provenance would violate the project command policy. The workflow still uses the pinned Bun version for release consistency.
Greenlight — Round 10Fixed the two Linux runtime blockers in 92e6cc4:
Decision: declined the npm provenance suggestion because this repo’s release instructions require Bun-only package operations and Bun does not expose a provenance flag here. Local verification: |
1 participant
Summary
Verification
Notes
Summary by CodeRabbit
New Features
Tests
Chores