Add macOS artifacts to desktop release pipeline and unify publish flow#6
Merged
Conversation
- Move release version/name/config validation into a shared prepare job - Add macOS build, verification, artifact uploads, and publish flow alongside Windows - Extend dashboard/workflow update feed handling for macOS .dmg/.zip artifacts
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRefactors the desktop release workflow into prepare/build/publish jobs, adds macOS packaging and release artifacts, generalizes update-feed parsing and download endpoints for macOS, updates marketing/UI copy and CSS, adds build scripts, tests, and README documentation for multi-platform releases. ChangesDesktop release + macOS support
Sequence DiagramsequenceDiagram
actor Developer as Developer
participant GH as "GitHub Actions"
participant Prep as "prepare job"
participant Win as "windows job"
participant Mac as "macos job"
participant Pub as "publish job"
participant Releases as "GitHub Releases API"
participant R2 as "R2 Storage"
participant Feed as "Public update feeds"
Developer->>GH: Trigger desktop-release workflow
GH->>Prep: start prepare
Prep->>Prep: validate env & semver, emit version/release_name
Prep-->>GH: outputs ready
par Platform builds
GH->>Win: start windows job (uses outputs)
Win->>Win: stamp package.json, build, verify .exe/.yml, upload artifacts
and
GH->>Mac: start macos job (uses outputs)
Mac->>Mac: stamp package.json, build, verify .dmg/.zip/.yml, upload artifacts
end
GH->>Pub: start publish job (depends on artifacts)
Pub->>Pub: download artifacts, validate latest.yml and latest-mac.yml
Pub->>Releases: upload assets (exe, dmg, zip, blockmap, yml)
Pub->>R2: publish files with content-type/cache-control
Pub->>Feed: validate public feeds (curl retry loop)
Pub-->>Developer: release completed
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~50 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Member
Author
|
bugbot run verbose=true |
|
Bugbot request id: serverGenReqId_53940c63-c4ba-4366-9d0e-4419e66ad1a0 |
Member
Author
|
bugbot run |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
laryn-transcribe | 9fa976f | May 05 2026, 03:43 PM |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/desktop-release.yml:
- Around line 14-16: The concurrency group currently uses desktop-release-${{
inputs.version }} so different versions can run concurrently and race on shared
keys (latest.yml / latest-mac.yml); change the concurrency group to a constant
value like desktop-release (remove ${{ inputs.version }}) and enable
cancel-in-progress: true so only one desktop release workflow runs at a time and
newer runs cancel older ones, preventing out-of-order uploads.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 322c8881-34ed-4f48-9b80-3e23cc3487bc
⛔ Files ignored due to path filters (1)
apps/desktop/assets/logo.pngis excluded by!**/*.png
📒 Files selected for processing (8)
.github/workflows/desktop-release.ymlREADME.mdapps/dashboard/src/App.tsxapps/desktop/package.jsonapps/worker/src/billing.test.tsapps/worker/src/dashboard-assets.tsapps/worker/src/index.tspackage.json
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found across 9 files
Confidence score: 2/5
- There is a concrete merge risk in
.github/workflows/desktop-release.yml:pip installis likely to fail on Ubuntu 24.04 due to PEP 668, which can break the release pipeline outright. - A high-impact race condition is present in the version-scoped concurrency setup; parallel runs for different versions can overwrite shared
latest.yml/latest-mac.ymlartifacts with older metadata. - Security risk is elevated because workflow inputs are injected directly into shell commands, creating a command-injection path; passing inputs via environment variables is the safer pattern.
- Pay close attention to
.github/workflows/desktop-release.yml- release reliability and workflow command safety need fixes before merging.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/desktop-release.yml">
<violation number="1" location=".github/workflows/desktop-release.yml:15">
P1: Use a single desktop-release concurrency group instead of a version-scoped group. Different versions can currently publish in parallel and the slower run may overwrite shared `latest.yml`/`latest-mac.yml` feeds with older metadata.</violation>
<violation number="2" location=".github/workflows/desktop-release.yml:36">
P1: Direct injection of GitHub Action inputs into shell scripts exposes the workflow to command injection. Pass the input via an environment variable instead.</violation>
<violation number="3" location=".github/workflows/desktop-release.yml:327">
P0: The pipeline will fail here because `pip install` on Ubuntu 24.04 enforces PEP 668. Remove this step as `awscli` is already pre-installed on GitHub-hosted runners.</violation>
</file>
Architecture diagram
sequenceDiagram
participant User as Manual Trigger
participant GHWorkflow as GitHub Actions Workflow
participant Prepare as prepare job
participant WinJob as windows job
participant MacJob as macos job
participant PublishJob as publish job
participant Repo as Code Repository
participant Deps as pnpm Dependencies
participant Builder as electron-builder
participant R2 as Cloudflare R2
participant Worker as Cloudflare Worker
participant Browser as User Browser
Note over User,Worker: Desktop Release Pipeline - macOS & Windows
User->>GHWorkflow: Trigger workflow with semver version
GHWorkflow->>Prepare: Start prepare job (ubuntu-latest)
Prepare->>Prepare: Validate env vars & secrets
Prepare->>Prepare: Validate semver input
Prepare->>Prepare: Generate two-word release name
Prepare-->>GHWorkflow: Output version + release_name
par Windows Build
GHWorkflow->>WinJob: Start (needs prepare)
WinJob->>Repo: Checkout code
WinJob->>Deps: pnpm install --frozen-lockfile
WinJob->>WinJob: Stamp version & release_name in package.json
WinJob->>WinJob: pnpm typecheck
WinJob->>Builder: pnpm desktop:dist:win
Builder->>WinJob: Build NSIS installer + latest.yml + .exe.blockmap
WinJob->>WinJob: Verify release files exist & latest.yml references correct version
WinJob-->>GHWorkflow: Upload desktop-windows-release artifact
and macOS Build
GHWorkflow->>MacJob: Start (needs prepare)
MacJob->>Repo: Checkout code
MacJob->>Deps: pnpm install --frozen-lockfile
MacJob->>MacJob: Stamp version & release_name in package.json
MacJob->>MacJob: pnpm typecheck
MacJob->>Builder: pnpm desktop:dist:mac
Builder->>MacJob: Build DMG + ZIP + latest-mac.yml + .blockmap
MacJob->>MacJob: Verify macOS release files exist
MacJob->>MacJob: Check latest-mac.yml for correct version & paths
MacJob->>MacJob: codesign verification
MacJob->>MacJob: hdiutil verify DMG integrity
MacJob->>MacJob: unzip -t ZIP integrity
MacJob->>MacJob: lipo confirm ARM64 architecture
MacJob-->>GHWorkflow: Upload desktop-macos-release artifact
end
GHWorkflow->>PublishJob: Start (needs windows + macos)
PublishJob->>WinJob: Download desktop-windows-release artifact
PublishJob->>MacJob: Download desktop-macos-release artifact
PublishJob->>PublishJob: Verify all expected files present (.exe, .dmg, .zip, .blockmap, latest.yml, latest-mac.yml)
PublishJob->>PublishJob: Create GitHub Release with all artifacts
PublishJob->>R2: Push latest.yml + .exe + .blockmap to Windows update feed
PublishJob->>R2: Push latest-mac.yml + .dmg + .zip + .blockmap to macOS update feed
PublishJob->>PublishJob: Poll public URLs to verify feed propagation
Note over Worker,Browser: User Download Flow (runtime)
User->>Browser: Visit /download page
Browser->>Worker: GET /downloads/laryn-windows-latest.exe
Worker->>R2: Fetch latest.yml from update feed
R2-->>Worker: latest.yml content
Worker->>Worker: Parse latest.yml for Windows installer path
Worker-->>Browser: 302 Redirect to latest .exe in R2
alt macOS download
Browser->>Worker: GET /downloads/laryn-mac-latest.dmg
Worker->>R2: Fetch latest-mac.yml from update feed
R2-->>Worker: latest-mac.yml content
Worker->>Worker: NEW: Parse latest-mac.yml for macOS DMG path (extractLatestArtifactPath)
alt Feed available
Worker-->>Browser: 302 Redirect to latest .dmg in R2
else Feed not available
Worker-->>Browser: 503 "Not available yet"
end
end
Note over WinJob,MacJob: Desktop app includes uiohook-napi & node-gyp-build in asarUnpack for native modules
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
- Use a stable concurrency group and enable cancel-in-progress for desktop releases - Pass workflow version input through an environment variable before script parsing - Remove redundant AWS CLI install step from the publish phase
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/desktop-release.yml:
- Around line 68-70: The guard that tests the shell variable "version" (the if
[[ ! "$version" =~ ... ]] check) is too lax and accepts invalid prereleases;
replace this inline regex with a full SemVer 2.0.0 validator or otherwise
perform canonical SemVer validation (e.g., call the official semver validator
via the semver npm package or use the full SemVer 2.0.0 regex from semver.org)
so that malformed prereleases like "1.2.3-01" or "1.2.3-.." are rejected before
proceeding; update the if condition to use that stricter validation against
"$version".
- Around line 338-367: The release script currently uploads feed files
(latest.yml and latest-mac.yml) inside the same for-loop as the binary
artifacts, which can let clients fetch updated feeds that reference artifacts
not yet uploaded; change the logic so feed files are excluded from this first
pass and are uploaded only after all binaries finish uploading — e.g. in the
loop around release-assets/* skip names matching latest.yml|latest-mac.yml (or
move their case branch out), run aws s3 cp for binaries as-is, then run a
separate upload step that uploads latest.yml and latest-mac.yml via the same aws
s3 cp command (with content_type "text/yaml" and cache_control "no-cache") once
the loop completes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 78231cab-5ee6-46fa-b12f-2edeeb02ee16
📒 Files selected for processing (1)
.github/workflows/desktop-release.yml
Member
Author
|
bugbot run |
Member
Author
|
bugbot run verbose=true |
|
Bugbot request id: serverGenReqId_997a9d81-f039-4a6f-9524-76cea0558d26 |
- Validate desktop version input with a stricter SemVer regex - Handle `latest.yml` and `latest-mac.yml` uploads in a dedicated step with text/yaml content type and no-cache headers
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
preparejob in.github/workflows/desktop-release.ymlto validate release config, enforce semver input, and generate a shared two-word release name.windowsrelease job to consume shared prepare outputs and upload installer artifacts for fan-in.macosrelease job (dist:mac) that buildsdmg+zip, validates mac release artifacts, checkslatest-mac.yml, verifies code signature/zip/dmg integrity, and confirms ARM64 architecture.publishjob to combine Windows/macOS artifacts, verify expected files and feed contents, create a multi-file GitHub release, push update feeds/assets to R2, and verify public feed propagation.dist:mac) and includeuiohook-napi/node-gyp-buildinasarUnpack.apps/dashboard/src/App.tsxandREADME.mdto reflect cross-platform desktop delivery and hosted latest installers.apps/worker/src/billing.test.ts.Testing
prepare.latest*.ymlversion/path assertions.codesign,hdiutil verify,unzip -t, and ARM64lipocheck)..exe,.dmg,.zip,.blockmap,latest.yml, andlatest-mac.yml.Summary by CodeRabbit
New Features
Documentation
Tests