ci: gate release publication on smoke tests - #8955
Conversation
📝 WalkthroughWalkthroughRelease workflows now validate platform selections, run preflight checks, require complete candidate results, and gate publication. Build workflows adjust package uploads, installer signing, artifact handling, and Go cache usage. ChangesRelease and build workflow updates
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant Preflight
participant CandidateBuilds
participant NightlyGate
participant ArtifactVerification
participant Publication
ReleaseWorkflow->>Preflight: run validation and tests
Preflight->>CandidateBuilds: permit requested platform builds
CandidateBuilds->>NightlyGate: report build results
NightlyGate->>ArtifactVerification: verify requested artifacts
ArtifactVerification->>Publication: allow release publication
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
559-595: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winPin the created tag to the built commit.
release-createnow runs afternightly-gate, so it executes hours after the builds start.gh release createreceives no--target, so for generated tags (schedule andworkflow_dispatchnightly runs, whereRELEASE_TAGis not an existing git tag) it creates the tag from the default branch HEAD at that moment. Commits merged during the build window make the tag point at a commit that was never built, so release notes and update metadata describe the wrong source.Pass the workflow commit as the target. For
pushtag events the tag already exists, and--targetis ignored.🐛 Proposed fix
gh release create "$RELEASE_TAG" \ --draft \ $PRERELEASE_FLAG \ + --target "$GITHUB_SHA" \ --title "$TITLE" \ --notes "Publication [in progress](${WORKFLOW_URL})..."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 559 - 595, Update the gh release create invocation in the Create GitHub Release step to pass the workflow commit SHA via --target, using the existing github context expression for the commit. Keep the current tag, draft, prerelease, title, and notes behavior unchanged; for existing push tags, the target should remain harmlessly ignored.
🧹 Nitpick comments (3)
.github/workflows/build-linux.yml (1)
187-207: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winFail the Linux job when a required package is missing.
.github/workflows/release.ymlrequires every requested DEB, RPM, and Arch package.actions/upload-artifact@v4succeeds with a warning when no files are found, and its default iswarn. (github.com) A missing RPM or Arch package can therefore leavebuild-linuxsuccessful until the later publication check. Setif-no-files-found: erroron all three uploads.Suggested change
- name: Upload Linux RPM candidate uses: actions/upload-artifact@v4 with: name: lantern-installer-rpm-${{ matrix.arch }} path: ${{ env.FULL_INSTALLER_NAME }}.rpm + if-no-files-found: error retention-days: 2 - name: Upload Linux DEB candidate uses: actions/upload-artifact@v4 with: name: lantern-installer-deb-${{ matrix.arch }} path: ${{ env.FULL_INSTALLER_NAME }}.deb + if-no-files-found: error retention-days: 2 - name: Upload Linux Arch candidate uses: actions/upload-artifact@v4 with: name: lantern-installer-pkg-${{ matrix.arch }} path: ${{ env.FULL_INSTALLER_NAME }}.pkg.tar.zst + if-no-files-found: error retention-days: 2🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-linux.yml around lines 187 - 207, Update the three Linux artifact upload steps—“Upload Linux RPM candidate,” “Upload Linux DEB candidate,” and “Upload Linux Arch candidate”—to set actions/upload-artifact’s if-no-files-found option to error, ensuring the build-linux job fails when any required package file is missing.Source: MCP tools
.github/workflows/release.yml (2)
413-417: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueConsider restore-only or disabled Go cache in the release gate.
Static analysis flags cache poisoning here. The Actions cache is writable from other refs in the same repository, and this job gates release publication.
go mod verifylimits the impact, but a release preflight gains little from populating a shared cache. Setcache: falsefor this job, or restrict caching to trusted workflows.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 413 - 417, Update the “Set up Go” step in the release gate to disable Go module caching by setting its cache option to false, preventing this release preflight from populating or trusting a shared writable cache.Source: Linters/SAST tools
1327-1339: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSuppress the failure alert for cancelled runs.
The condition uses
always()without a cancellation guard. When a maintainer cancels a scheduled nightly, every job result becomescancelled, so the job posts a "Lantern nightly blocked" Slack alert for an intentional cancellation. Add!cancelled()if only real failures should page the team.♻️ Proposed change
if: | always() && + !cancelled() && github.event_name == 'schedule' &&🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 1327 - 1339, Update the failure-alert condition surrounding the visible always() expression to include a !cancelled() guard, so scheduled runs intentionally cancelled by a maintainer do not post the “Lantern nightly blocked” Slack alert while genuine job failures still trigger it.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-windows.yml:
- Around line 290-303: Update the “Sign installer” step to expose the version,
signing policy, organization ID, and project slug through step-level environment
variables, then pass those variables via $env: references to sign-windows.ps1.
Keep the existing FULL_INSTALLER_NAME and API token handling unchanged, and
remove direct GitHub expression interpolation from the PowerShell command
arguments.
In @.github/workflows/release.yml:
- Around line 379-382: Disable credential persistence on both checkout steps in
.github/workflows/release.yml: lines 379-382 for the preflight job and 1279-1282
for release-success-notify by setting persist-credentials to false; no other
workflow changes are needed.
---
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 559-595: Update the gh release create invocation in the Create
GitHub Release step to pass the workflow commit SHA via --target, using the
existing github context expression for the commit. Keep the current tag, draft,
prerelease, title, and notes behavior unchanged; for existing push tags, the
target should remain harmlessly ignored.
---
Nitpick comments:
In @.github/workflows/build-linux.yml:
- Around line 187-207: Update the three Linux artifact upload steps—“Upload
Linux RPM candidate,” “Upload Linux DEB candidate,” and “Upload Linux Arch
candidate”—to set actions/upload-artifact’s if-no-files-found option to error,
ensuring the build-linux job fails when any required package file is missing.
In @.github/workflows/release.yml:
- Around line 413-417: Update the “Set up Go” step in the release gate to
disable Go module caching by setting its cache option to false, preventing this
release preflight from populating or trusting a shared writable cache.
- Around line 1327-1339: Update the failure-alert condition surrounding the
visible always() expression to include a !cancelled() guard, so scheduled runs
intentionally cancelled by a maintainer do not post the “Lantern nightly
blocked” Slack alert while genuine job failures still trigger it.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 29ebe60c-92d6-4a8e-bab7-d5cc3dbbeeec
📒 Files selected for processing (4)
.github/workflows/build-linux.yml.github/workflows/build-windows.yml.github/workflows/go.yml.github/workflows/release.yml
| - name: Sign installer | ||
| if: ${{ !inputs.skip_signing }} | ||
| shell: pwsh | ||
| env: | ||
| SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }} | ||
| FULL_INSTALLER_NAME: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }} | ||
| run: | | ||
| ./scripts/ci/sign-windows.ps1 ` | ||
| -FilePath "$env:FULL_INSTALLER_NAME.exe" ` | ||
| -SigningPolicy "${{ env.SIGNPATH_SIGNING_POLICY }}" ` | ||
| -OrganizationId "${{ vars.SIGNPATH_ORG_ID }}" ` | ||
| -ProjectSlug "${{ vars.SIGNPATH_PROJECT_SLUG }}" ` | ||
| -ApiToken $env:SIGNPATH_API_TOKEN ` | ||
| -Description "Installer - GitHub Actions build ${{ inputs.version }}" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 8 'workflow_dispatch|workflow_call|inputs:|version:|SIGNPATH_' .github/workflows || true
rg -n -C 8 'sign-windows\.ps1|SIGNPATH_API_TOKEN' .github scripts || trueRepository: getlantern/lantern
Length of output: 50374
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== build-windows workflow trigger/calls =="
sed -n '1,120p' .github/workflows/build-windows.yml
echo
echo "== build-windows release call and installer sign step =="
sed -n '330,405p' .github/workflows/release.yml
sed -n '286,305p' .github/workflows/build-windows.yml
echo
echo "== scripts/ci/sign-windows.ps1 outline and sign step =="
ast-grep outline scripts/ci/sign-windows.ps1 || true
sed -n '1,260p' scripts/ci/sign-windows.ps1
echo
echo "== workflow call inputs passed to build-windows from release.yml =="
rg -n -C 5 '\.github/workflows/build-windows\.yml|use: \.github/workflows/build-windows|inputs:|version:|installer_base_name:|skip_signing:|SIGNPATH' .github/workflows/release.yml .github/workflows/build-windows.yml .github/workflows/app-smoke-tests.ymlRepository: getlantern/lantern
Length of output: 38000
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== release.yml set-metadata version/build_type logic =="
sed -n '120,200p' .github/workflows/release.yml
echo
echo "== release.yml build-windows call inputs =="
sed -n '486,507p' .github/workflows/release.yml
echo
echo "== all callers of build-windows with signing/signing-related inputs =="
rg -n -C 3 '\.github/workflows/build-windows\.yml|with:|skip_signing:|sign_windows:' .github/workflows/release.yml .github/workflows/app-smoke-tests.yml .github/workflows/build-windows.yml
echo
echo "== GitHub variable secrets declarations =="
rg -n 'SIGNPATH_ORG_ID|SIGNPATH_PROJECT_SLUG|SIGNPATH_SIGNING_POLICY_SLUG|SIGNPATH_API_TOKEN' .github/workflows/release.yml .github/workflows/build-windows.ymlRepository: getlantern/lantern
Length of output: 27220
Keep release values out of PowerShell source.
Interpolating release metadata directly into a PowerShell command risks syntax escaping or injection. Set per-step environment variables for the signing call values, then reference them as $env:... in the sign-windows.ps1 arguments.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 299-299: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 300-300: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 301-301: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 303-303: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-windows.yml around lines 290 - 303, Update the “Sign
installer” step to expose the version, signing policy, organization ID, and
project slug through step-level environment variables, then pass those variables
via $env: references to sign-windows.ps1. Keep the existing FULL_INSTALLER_NAME
and API token handling unchanged, and remove direct GitHub expression
interpolation from the PowerShell command arguments.
Source: Linters/SAST tools
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.sha }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Two new jobs persist the job token in .git/config. Both new checkouts omit persist-credentials: false, and neither job pushes to the repository, so the token stays available to later steps and third-party actions without need.
.github/workflows/release.yml#L379-L382: addpersist-credentials: falseto thepreflightcheckout, which is followed bymake gen,flutter test, and third-party actions..github/workflows/release.yml#L1279-L1282: addpersist-credentials: falseto therelease-success-notifycheckout, which only runs./scripts/ci/format.sh slack.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 379-382: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/release.yml#L379-L382(this comment).github/workflows/release.yml#L1279-L1282
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 379 - 382, Disable credential
persistence on both checkout steps in .github/workflows/release.yml: lines
379-382 for the preflight job and 1279-1282 for release-success-notify by
setting persist-credentials to false; no other workflow changes are needed.
Source: Linters/SAST tools
There was a problem hiding this comment.
Pull request overview
This PR tightens the release pipeline by adding a preflight job and a “candidate gate” that blocks publication unless all requested platform builds (and their smoke suites) succeed.
Changes:
- Adds a
preflightjob to validate workflows, verify Go deps, and run Flutter unit/widget tests before any candidate builds proceed. - Introduces a
nightly-gatejob that enforces all-or-nothing success for the requested platform candidates before any publishing steps run. - Ensures candidate artifacts are verified before S3 publication, and adjusts Windows/Linux artifact upload/signing ordering to support the new gating flow.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Adds preflight + candidate gating and wires publication/release jobs to require gate success; validates candidate artifact completeness before publish. |
| .github/workflows/go.yml | Updates Go CI caching action from actions/cache@v3 to @v4. |
| .github/workflows/build-windows.yml | Moves installer signing earlier and uploads the installer artifact even on failure (warning if missing). |
| .github/workflows/build-linux.yml | Uploads Linux candidate artifacts earlier (after package verification) to preserve them even if later smoke steps fail. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Adds release preflight checks and requires every requested platform to build and pass its smoke tests before publishing artifacts
Summary by CodeRabbit
Release Improvements
Reliability