feat: auto desktop pre-release on every master merge#21
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe GitHub Actions release workflow is rewritten to trigger on pushes to ChangesDesktop Release Workflow Rewrite
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Preview deployed
Updates automatically on every push. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
78-80: ⚡ Quick winHarden tag generation against rare collisions.
Line 80 uses second-level timestamps only; concurrent/near-simultaneous runs can generate the same tag and fail release creation.
Suggested hardening
- - name: Generate timestamp tag + - name: Generate timestamp tag id: tag - run: echo "name=build-$(date -u +%Y%m%d-%H%M%S)" >> "$GITHUB_OUTPUT" + run: echo "name=build-$(date -u +%Y%m%d-%H%M%S)-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 78 - 80, The tag generation in the "Generate timestamp tag" step uses only second-level precision with the date format %Y%m%d-%H%M%S, which can cause collisions when concurrent or near-simultaneous workflow runs occur. Enhance the timestamp-based tag by adding additional entropy such as milliseconds or microseconds from the date command, or append a random component (like using $RANDOM or a UUID) to ensure uniqueness across concurrent executions. The output variable name should remain unchanged while updating the echo command that writes to GITHUB_OUTPUT to include this additional collision-prevention measure.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 7-8: The workflow currently has a top-level permissions block that
grants contents: write access to all jobs in the workflow, which unnecessarily
exposes repository write access during the build process. Move the contents:
write permission from the global permissions section to a job-specific
permissions block that applies only to the release job, ensuring build jobs do
not retain write access. Apply this same narrowing pattern to any other
job-level permissions blocks mentioned in the workflow to follow the principle
of least privilege.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 78-80: The tag generation in the "Generate timestamp tag" step
uses only second-level precision with the date format %Y%m%d-%H%M%S, which can
cause collisions when concurrent or near-simultaneous workflow runs occur.
Enhance the timestamp-based tag by adding additional entropy such as
milliseconds or microseconds from the date command, or append a random component
(like using $RANDOM or a UUID) to ensure uniqueness across concurrent
executions. The output variable name should remain unchanged while updating the
echo command that writes to GITHUB_OUTPUT to include this additional
collision-prevention measure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fb2bfbcb-1a0b-4dd3-8624-8b6a1242405b
📒 Files selected for processing (1)
.github/workflows/release.yml
hiranyasemindi
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
What this replaces
The previous release.yml referenced non-existent action versions (checkout@v6, upload-artifact@v7, download-artifact@v8, action-gh-release@v3) and required a manual v* tag push to trigger. This was never functional.
Build pipeline
push to master triggers:
macOS note
The app is ad-hoc signed so it runs locally. Gatekeeper will warn on first open -- right-click > Open to bypass. Full notarization requires Apple Developer credentials and is out of scope here.
Test plan
Summary by CodeRabbit