[Eeems]

Summary by CodeRabbit

• Chores
  • Updated platform-specific image and fuse components to newer patch versions.
  • Improved diagnostics when the required platform executable is unavailable during testing.
  • Updated automated build, testing, caching, artifact, and release tooling.
  • Refined release workflow configuration while maintaining Python 3.13 support.
  • Release scripts now stop promptly when a command fails, improving reliability.
  • Strengthened checks and failure reporting across automated release processes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1bca5f57-8375-4f02-b5a5-dfc9a704f493

📥 Commits

Reviewing files that changed from the base of the PR and between a5b106a and 270dc9f.

📒 Files selected for processing (1)

• scripts/github-make-executable.sh

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

Walkthrough

The change updates platform-specific dependencies, executable validation, shell error handling, and GitHub Actions versions for remote, device, and release jobs.

Changes

Dependency, executable, and CI maintenance

Layer / File(s)	Summary
Align platform-specific dependency versions pyproject.toml, requirements.txt	The non-Linux remarkable-update-image dependency changes to 1.4.2. The Linux remarkable-update-fuse dependency changes to 1.4.3.
Strengthen executable validation Makefile, scripts/github-make-executable.sh	The test-executable target reports missing executables and lists dist. The executable build script now exits on command and pipeline failures.
Update CI workflow actions .github/workflows/main.yml	Remote, device, and release jobs use newer checkout, Python setup, cache, artifact upload, and artifact download action versions. The disabled test_device block is reformatted.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Jayy001/codexctl#147: Updates the same platform-specific dependencies.
• Jayy001/codexctl#148: Updates the same dependencies in requirements.txt.
• Jayy001/codexctl#182: Updates the same dependencies in both declaration files.

Merge Risk: 🟠 High · up to 270dc

The dependency and release-workflow changes can prevent builds from installing, expose write-capable credentials to a third-party build environment, and allow part of the build pipeline to fail without failing the job. These issues create concrete security and release-readiness risk, so the PR should not merge until they are fixed or explicitly accepted by the owner.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the primary dependency and GitHub Actions updates. It is concise and specific enough for the changeset.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch updates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[TyceHerrman]

@Eeems or @Jayy001, I’m working on packaging codexctl for nix on macos. This pr would let me use remarkable-update-image 1.4.2 and its newer cryptography dependency while respecting codexctl’s declared requirements.

failing jobs

• intel macos: Nuitka fails scanning cryptography’s _rust.abi3.so dependency on homebrew’s libssl.3.dylib
• reMarkable: package installation fails with a debian mirror 404 for libsepol1 before compilation

The reMarkable failure looks like stale package indexes or an outdated build image

investigated the intel failure. The dependency bump pulls in cryptography 50, which no longer ships intel macos wheels. CI builds it from source against Homebrew OpenSSL, then Nuitka 2.8.10 fails while packaging those external libraries.

I tested a standalone intel build under Rosetta using this PR’s source, Nuitka 4.3.3, and real cryptography 50. Explicitly bundling OpenSSL’s libraries and legacy provider and configuring the provider location worked. With the original OpenSSL directories hidden, CLI help, SHA-256/AES-GCM/Blowfish checks, and generated firmware-fixture extraction all passed. Loader tracing confirmed it used the bundled libraries.

Upgrading Nuitka alone avoided the scan error in a reduced test but still left the external dependency, so bundling matters too. The PR’s exact release build and native intel CI would still need validation.

happy to help out further if you'd like. I don’t have an intel mac set up for testing right now, but could get an old macbook set up for this