chore(mobile): relax release check#2636
Merged
Merged
Conversation
GitHub hides a ruleset's bypass_actors list from non-admin tokens, so the release App token cannot read it and every candidate publication fails closed at this check. Restore the current_user_can_bypass validation the publisher relied on before, and revert the matching fixtures and RELEASING.md wording. Follow-up: grant the release App Administration:read if we want the exact-actor assertion back. Signed-off-by: npub1re830n24qhgstulznk5dxdluccspxkxxdq643lm4q3zwwwjgsuqqmcmdrm <1e4f17cd5505d105f3e29da8d337fcc6201358c6683558ff750444e73a488700@buzz.block.builderlab.xyz> Co-authored-by: npub1re830n24qhgstulznk5dxdluccspxkxxdq643lm4q3zwwwjgsuqqmcmdrm <1e4f17cd5505d105f3e29da8d337fcc6201358c6683558ff750444e73a488700@buzz.block.builderlab.xyz>
brow
marked this pull request as ready for review
July 23, 2026 22:25
brow
changed the title
brow
changed the title
brow
changed the title
brow
enabled auto-merge (squash)
July 23, 2026 23:25
wesbillman
approved these changes
Jul 24, 2026
wesbillman
left a comment
wesbillman
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed the revert and traced the release candidate publisher path. The removed bypass-actor query is unreadable to the deliberately narrow App token and is the direct cause of the production publication failure. The retained checks still fail closed on inactive protection, loss of the App token’s effective always-bypass, rule drift, scope drift, and exclusions, before any tag object is created. The reduced drift detection is accurately documented. CI is green at 503d182, including both mobile release contract scripts. No blocking findings.
brow
pushed a commit
that referenced
this pull request
Jul 24, 2026
…r-only * origin/main: (28 commits) Clarify agent harness defaults in create flow (#2601) chore(mobile): relax release check (#2636) fix: expose community icon control on open relays (#2640) chore(release): release Buzz Desktop version 0.4.24 (#2627) feat: remember per-community navigation location (#2629) fix(desktop): suppress Windows console flashes and reject WSL bash alias (#2587) fix(desktop): fix Windows PATH clobber and .cmd shim EINVAL (#2563) Update SECURITY.md chore(mobile): lighter-weight release process (#2144) Gate default relay auto-connect behind release flag (#2589) fix(desktop): fast-track relay restart reconnects (#2579) fix(sharing): preserve agent/team snapshot tEXt chunks through media sanitization (#2438) fix(acp): restrict DM turns to owner and verified siblings (#2591) test(desktop): live relay kill/restart reconnect gate (#2583) fix(relay): send 1012 restart close to all clients on graceful drain (#2575) fix(desktop): retry failed initial relay dials (#2564) Refine channel lifecycle settings (#2427) Fix avatar upload lifecycle edge cases (#2277) fix(observer): eager archive hydration on panel open + 200-frame pages (#2574) fix(cli): install rustls crypto provider to unbreak WSS publishes in release builds (#2590) ... Co-authored-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz> Signed-off-by: npub102wg7q285p64ch2fjvstmf2ntn2sz3c4u5hmwatalc76mhsuauysftjtfj <7a9c8f0147a0755c5d499320bda5535cd5014715e52fb7757dfe3dadde1cef09@buzz.block.builderlab.xyz> # Conflicts: # desktop/src-tauri/build.rs # desktop/src/features/agents/ui/AgentDefinitionDialog.tsx # desktop/src/testing/e2eBridge.ts # desktop/tests/helpers/bridge.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed?
Reverts commit 169d3e43f that was added to #2144 during review.
require_release_tag_rulesetreturns to validating the App token's effectivecurrent_user_can_bypassvalue.Why?
The exact bypass-actor assertion added in #2144's final review round cannot work with the release App's permissions.
GitHub returns a ruleset's
bypass_actorslist only to admin-capable tokens; everyone else getsnull. The release App deliberately has only Contents write and Metadata read, so the assertion fails on every candidate publication and blocks all mobile releases. Verified in production: run 30048723817 failed withcould not verify Release tag ruleset 14378754 bypass actors.The only way to make it work would be granting the release App Administration read, and that is the wrong trade. It widens what a compromised release credential can see across repository administration solely to power a self-check, on a credential whose value comes from being narrow.
Relying on
current_user_can_bypassinstead was the original deliberate design, not an oversight: RELEASING.md documented that the App "does not require GitHub Releases permissions, repository Administration permission, or a mobile release-branch ruleset" and that "the publisher validates the App token's effectivecurrent_user_can_bypassvalue rather than reading the ruleset's hidden bypass actor list."What we give up is the drift check requested in review: a second bypass actor quietly added to the ruleset would no longer be caught at publication time. That remains a known, accepted gap.
The retained check still fails closed if the release App itself loses its
alwaysbypass. If we want drift detection back, the right home is an out-of-band audit running with admin credentials (for example a scheduled check), not the release path.How is it tested?
scripts/test-mobile-release-candidate-publisher.shandscripts/test-mobile-release-contract.shpass at this head.