Harden manual store submission workflow - #990
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review. 📝 WalkthroughWalkthroughThis PR separates manual preflight and tag-based release jobs, adds a preflight-only store submission command, refactors store submission for injected dependencies and environment handling, and expands unit-test coverage for validation and execution modes. ChangesTagged release flow split
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to The workflow now separates manual artifact validation from authenticated store submission, with store credentials limited to tag releases; no actionable merge-blocking risk remains after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant npm
participant submitStores
participant GitHubCLI
GitHubActions->>npm: Manual dispatch runs release:submit:preflight
npm->>submitStores: Invoke --preflight-only
GitHubActions->>GitHubCLI: Tag release creates or reuses a release
GitHubActions->>GitHubCLI: Upload artifacts with replacement enabled
GitHubActions->>npm: Tag release runs store submission
npm->>submitStores: Invoke store submission
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary by QodoHarden tagged-release workflow to prevent secret exposure on manual dispatch
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a3d0e2303d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
This PR hardens the tagged-release GitHub Actions workflow to prevent credential exposure when collaborators manually trigger workflow_dispatch, while keeping real store submissions restricted to trusted tag-push runs.
Changes:
- Removed the workflow-wide
GH_TOKENand instead injectsGH_TOKENonly into the push-onlygh releasesteps. - Prevents credential persistence during manual runs by setting
actions/checkoutpersist-credentialsto only persist onpush. - Splits store submission into a manual-only dry-run step (with dummy store env vars and forced
--dry-run) and a push-only real submission step (withsecrets.*).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Code Review by Qodo
1.
|
a3d0e23 to
c8380f7
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight-only mode to the store submission script and exposes it via a new npm script. It refactors the submission logic to support dependency injection, enabling comprehensive unit testing of different submission modes and failure paths. The review feedback suggests adding a defensive null check for the parsed manifest object to prevent a potential TypeError when accessing its version property.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
|
Code review by qodo was updated up to the latest commit c8380f7 |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous Review Summaries (11 snapshots, latest commit a122e5c)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit a122e5c)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 18d1963)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 3e842ff)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 3d3e9f0)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 875c42f)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 5f4ad50)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 20f69a1)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit 2302190)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Previous review (commit a87ab63)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Previous review (commit e08da38)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit c8380f7)Status: 3 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
All three issues were previously identified by other reviewers (gemini-code-assist[bot] and qodo-code-review[bot]). No new issues found in this review. Reviewed by step-3.7-flash-20260528 · Input: 210.5K · Output: 32.8K · Cached: 739.8K |
c8380f7 to
e08da38
Compare
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight-only mode to the store submission script, allowing validation of release artifacts and manifest files without performing the actual upload or submission. It also refactors the submitStores function to support dependency injection, making it highly testable, and adds comprehensive unit tests. A review comment suggests merging the custom environment variables with process.env when spawning the child process to ensure critical system environment variables are preserved.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Code review by qodo was updated up to the latest commit e08da38 |
e08da38 to
a87ab63
Compare
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight-only mode to the store submission script, allowing validation of release artifacts and the Firefox manifest without performing the actual submission or requiring store environment variables. It also refactors the submission script to support dependency injection, enabling comprehensive unit tests. The review feedback suggests refactoring 'runPublishExtension' to accept a 'baseEnv' option, which would avoid mutating the global 'process.env' in tests and simplify the test setup.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Code review by qodo was updated up to the latest commit a87ab63 |
a87ab63 to
2302190
Compare
|
Code review by qodo was updated up to the latest commit d2d4f7b |
Manual dispatches should validate release artifacts without invoking publish-browser-extension's authenticated dry-run path. Run workflow_dispatch as a read-only GitHub Actions preflight job with no persisted checkout credentials. Keep real store submission on tag pushes only. Cover artifact, manifest shape, process environment, and credential boundaries with targeted tests.
Retry transient fetch and push races, abort conflicted rebases, and surface failures in the step summary without blocking publication.
Reuse existing releases and clobber partial uploads so retries can finish. Skip master sync when it already contains a newer manifest version. Reject malformed store credentials before they reach publisher code.
Treat missing version components as zero to prevent older tags from bypassing the master sync guard. Leave completed releases untouched on workflow retries.
Keep manifest version values consistent with the release metadata path instead of silently accepting surrounding whitespace.
Reject prerelease tags before syncing manifest versions. Build all browser archives before upload and distinguish missing releases from GitHub API failures during reruns.
Validate canonical manifest versions before syncing release tags. Build artifacts before upload and record successful store submissions so draft reruns can retry publication without resubmitting stores.
Run each store submission independently and persist its completion marker. Reruns skip stores that already succeeded, keep Firefox metadata retryable, and reject invalid master versions before release synchronization.
Limit artifact and manifest validation to the stores being submitted.\n\nPrevent new releases for superseded tags while allowing existing drafts to\nresume incomplete store submissions.
Reject all-zero Chromium versions and clear unselected ZIP variables.\n\nSerialize same-tag releases and skip superseded reruns before artifact\npublication.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
/agentic_review |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
.github/workflows/tagged-release.yml:47
- This group is unique per tag, so it does not serialize releases that target the same
masterbranch and browser-store listings. If two version tags are pushed close together, both jobs can pass the superseded-version check and submit concurrently; the older package can then race or follow the newer package. Use a repository-wide release queue/lock around the master sync and store side effects.
group: tagged-release-${{ github.ref_name }}
|
Code review by qodo was updated up to the latest commit c56b695 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c56b695825
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if: github.event_name == 'push' | ||
| runs-on: macos-14 | ||
| concurrency: | ||
| group: tagged-release-${{ github.ref_name }} |
There was a problem hiding this comment.
When two different version tags are pushed close together, this tag-specific group lets both release jobs run concurrently. Fresh evidence beyond the resolved superseded-tag finding is that an older job can pass the monotonic check and push first, after which a newer job advances master while the older job continues without another version check. The bundled publish-extension --help describes its default command as submitting extensions for review, so the older job can reach the stores after the newer version and fail or attempt an out-of-order submission. Use a release-wide concurrency group or re-check the remote version immediately before store publication.
Useful? React with 👍 / 👎.
|
/agentic_review |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Code review by qodo was updated up to the latest commit 8ff04fd |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 8ff04fd2cc
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
Keep tag-triggered release reruns from replacing binaries already submitted to a store. Serialize master sync and reject equivalent version spellings before creating a release.
|
/agentic_review |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Code review by qodo was updated up to the latest commit 4b9ef50 |
Motivation
Manual dispatches should validate release artifacts without exposing store credentials or entering the authenticated store submission path.
Description
.github/workflows/tagged-release.ymlinto a read-onlymanual_preflightjob forworkflow_dispatchand a push-onlyreleasejob forv*tags.GH_TOKENexposure.release:submit:preflightand--preflight-onlyso manual runs validate required release artifacts and Firefox manifest metadata without invokingpublish-extension.secrets.*values are injected.Testing
git diff --check github/master...HEADnode --import ./tests/setup/browser-shim.mjs --test tests/unit/release/submit-stores.test.mjsnpm run lintnpm testnpm run buildnpm run release:firefox-sourcesnpm run release:submit:preflightwithout store secretstestspassed on this PRCodex Task
Summary by CodeRabbit
Summary
New Features
Bug Fixes
Tests
Chores