Harden manual store submission workflow - #990
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughThis PR separates manual preflight and tag-based release jobs, adds a preflight-only store submission command, refactors store submission for injected dependencies and environment handling, and expands unit-test coverage for validation and execution modes. ChangesTagged release flow split
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to The workflow now separates credential-free manual artifact validation from tag-triggered store submission, with no actionable merge-blocking risk remaining after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant npm
participant submitStores
participant GitHubCLI
GitHubActions->>npm: Manual dispatch runs release:submit:preflight
npm->>submitStores: Invoke --preflight-only
GitHubActions->>GitHubCLI: Tag release creates or reuses a release
GitHubActions->>GitHubCLI: Upload release artifacts with replacement enabled
GitHubActions->>npm: Tag release runs store submission
npm->>submitStores: Invoke store submission
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary by QodoHarden tagged-release workflow to prevent secret exposure on manual dispatch
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a3d0e2303d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
This PR hardens the tagged-release GitHub Actions workflow to prevent credential exposure when collaborators manually trigger workflow_dispatch, while keeping real store submissions restricted to trusted tag-push runs.
Changes:
- Removed the workflow-wide
GH_TOKENand instead injectsGH_TOKENonly into the push-onlygh releasesteps. - Prevents credential persistence during manual runs by setting
actions/checkoutpersist-credentialsto only persist onpush. - Splits store submission into a manual-only dry-run step (with dummy store env vars and forced
--dry-run) and a push-only real submission step (withsecrets.*).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Code Review by Qodo
1.
|
a3d0e23 to
c8380f7
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight-only mode to the store submission script and exposes it via a new npm script. It refactors the submission logic to support dependency injection, enabling comprehensive unit testing of different submission modes and failure paths. The review feedback suggests adding a defensive null check for the parsed manifest object to prevent a potential TypeError when accessing its version property.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
|
Code review by qodo was updated up to the latest commit c8380f7 |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous Review Summaries (11 snapshots, latest commit a122e5c)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit a122e5c)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 18d1963)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 3e842ff)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 3d3e9f0)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 875c42f)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 5f4ad50)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 20f69a1)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit 2302190)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Previous review (commit a87ab63)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Previous review (commit e08da38)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit c8380f7)Status: 3 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
All three issues were previously identified by other reviewers (gemini-code-assist[bot] and qodo-code-review[bot]). No new issues found in this review. Reviewed by step-3.7-flash-20260528 · Input: 210.5K · Output: 32.8K · Cached: 739.8K |
c8380f7 to
e08da38
Compare
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight-only mode to the store submission script, allowing validation of release artifacts and manifest files without performing the actual upload or submission. It also refactors the submitStores function to support dependency injection, making it highly testable, and adds comprehensive unit tests. A review comment suggests merging the custom environment variables with process.env when spawning the child process to ensure critical system environment variables are preserved.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Code review by qodo was updated up to the latest commit e08da38 |
e08da38 to
a87ab63
Compare
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight-only mode to the store submission script, allowing validation of release artifacts and the Firefox manifest without performing the actual submission or requiring store environment variables. It also refactors the submission script to support dependency injection, enabling comprehensive unit tests. The review feedback suggests refactoring 'runPublishExtension' to accept a 'baseEnv' option, which would avoid mutating the global 'process.env' in tests and simplify the test setup.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Code review by qodo was updated up to the latest commit a87ab63 |
a87ab63 to
2302190
Compare
|
Code review by qodo was updated up to the latest commit 4d5cb89 |
4d5cb89 to
369b23e
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
scripts/submit-stores.mjs:194
runPublishExtension()only inspects the numeric exit code and ignores thesignalargument from theexitevent. If the child is terminated by a signal,codewill benulland the current error message becomespublish-extension exited with code null, which is not very actionable.
child.once('error', reject)
child.once('exit', (code) => {
if (code === 0) {
resolve()
return
}
reject(new Error(`publish-extension exited with code ${code}`))
})
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight mode (--preflight-only) to the store submission script, allowing validation of release artifacts and the Firefox manifest without requiring store credentials or performing actual submissions. It also refactors the script to use require.resolve for locating the browser extension publisher CLI, improves environment variable validation, and adds comprehensive unit tests covering the new preflight functionality, environment merging, and error handling. There are no review comments, and I have no additional feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Code review by qodo was updated up to the latest commit 369b23e |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge OverviewIncremental review against previous review commit Files Reviewed (4 files)
Note: 31 additional files appear in the git range diff between the prior review commit and HEAD, but those originate from Previous Review Summaries (13 snapshots, latest commit 369b23e)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 369b23e)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 4d5cb89)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit a122e5c)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 18d1963)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 3e842ff)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 3d3e9f0)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 875c42f)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 5f4ad50)Status: No Issues Found | Recommendation: Merge Files Reviewed (4 files)
Previous review (commit 20f69a1)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit 2302190)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Previous review (commit a87ab63)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Previous review (commit e08da38)Status: 2 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
Fix these issues in Kilo Cloud Previous review (commit c8380f7)Status: 3 Issues Found (Previously Flagged) | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (4 files)
All three issues were previously identified by other reviewers (gemini-code-assist[bot] and qodo-code-review[bot]). No new issues found in this review. Reviewed by hy3:free · Input: 54.2K · Output: 2.8K · Cached: 337.2K |
369b23e to
5dbddc7
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tagged-release.yml:
- Around line 113-117: Update the release creation step using gh release create
so it first attempts gh release view for RELEASE_TAG and only creates the draft
when the release does not exist; also add --clobber to each release asset upload
command so reruns replace existing assets.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 501c839d-89be-4a27-a8c8-f781b9916946
📒 Files selected for processing (4)
.github/workflows/tagged-release.ymlpackage.jsonscripts/submit-stores.mjstests/unit/release/submit-stores.test.mjs
🚧 Files skipped from review as they are similar to previous changes (2)
- scripts/submit-stores.mjs
- tests/unit/release/submit-stores.test.mjs
Manual dispatches should validate release artifacts without invoking publish-browser-extension's authenticated dry-run path. Run workflow_dispatch as a read-only GitHub Actions preflight job with no persisted checkout credentials. Keep real store submission on tag pushes only. Cover artifact, manifest shape, process environment, and credential boundaries with targeted tests.
Retry transient fetch and push races, abort conflicted rebases, and surface failures in the step summary without blocking publication.
5dbddc7 to
9aa2a51
Compare
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9aa2a511fd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Code review by qodo was updated up to the latest commit 9aa2a51 |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Reuse existing releases and clobber partial uploads so retries can finish. Skip master sync when it already contains a newer manifest version. Reject malformed store credentials before they reach publisher code.
4a180b3 to
466db4b
Compare
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
You have reached your Codex usage limits for security reviews. Please try again later. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 466db4b7b7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const [remote, requested] = process.argv.slice(1) | ||
| const parse = (version) => version.split(".").map(Number) | ||
| const compare = (left, right) => { | ||
| for (let index = 0; index < 3; index += 1) { |
There was a problem hiding this comment.
When an older three-component tag is retried after a newer four-component release (for example, v2.6.1 after v2.6.1.1), this loop compares only the first three components, treats the versions as equal, and allows the older manifest commit to be rebased and pushed onto master. Fresh evidence beyond the earlier downgrade finding is the updated guard's explicit index < 3 truncation; compare all supplied numeric components, padding missing components as needed.
Useful? React with 👍 / 👎.
| if ! gh release view "$RELEASE_TAG" >/dev/null 2>&1; then | ||
| gh release create "$RELEASE_TAG" -d -F CURRENT_CHANGE.md -t "$RELEASE_TAG" | ||
| fi |
There was a problem hiding this comment.
When a completed tag workflow is rerun, gh release view succeeds for the already-published release, so this branch skips creation but still reaches the five gh release upload --clobber commands and the unconditional store submission. Checked .github/workflows/tagged-release.yml; gh release upload --help states that --clobber deletes existing assets before replacement and that a failed upload loses the originals, so a rerun can partially remove public assets and then attempt to republish an already-released store version. Query isDraft and only resume draft releases, or exit before uploads and submission when the release is already published.
Useful? React with 👍 / 👎.
Motivation
Manual dispatches should validate release artifacts without exposing store credentials or entering the authenticated store submission path.
Description
.github/workflows/tagged-release.ymlinto a read-onlymanual_preflightjob forworkflow_dispatchand a push-onlyreleasejob forv*tags.GH_TOKENexposure.release:submit:preflightand--preflight-onlyso manual runs validate required release artifacts and Firefox manifest metadata without invokingpublish-extension.secrets.*values are injected.Testing
git diff --check github/master...HEADnode --import ./tests/setup/browser-shim.mjs --test tests/unit/release/submit-stores.test.mjsnpm run lintnpm testnpm run buildnpm run release:firefox-sourcesnpm run release:submit:preflightwithout store secretstestspassed on this PRCodex Task
Summary by CodeRabbit
Summary
New Features
Bug Fixes
Tests
Chores