ci: Add Flatpak deployment pipeline - #71
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that builds and publishes the Flatpak repository, plus README instructions for configuring that repository and installing AlterSend from it. ChangesFlatpak publishing
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant OSTreeRepository
participant FlatpakBuilder
participant ActionsGhPages
GitHubActions->>OSTreeRepository: Check out and validate repository
GitHubActions->>FlatpakBuilder: Build Flatpak bundle and repository
GitHubActions->>ActionsGhPages: Publish updated OSTree repository
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/flatpak-publish.yml (3)
28-31: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin all secret-bearing actions to immutable SHAs.
The Flatpak builder is pinned, but
actions/checkout@v4andpeaceiris/actions-gh-pages@v4remain mutable tag references while handling credentials and publishing access. Pin these actions to verified full-length commit SHAs. GitHub recommends SHA pinning to ensure the reviewed action code cannot change underneath the workflow. (docs.github.com)Also applies to: 58-60
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/flatpak-publish.yml around lines 28 - 31, Update the secret-bearing action references in the Flatpak publish workflow, including both actions/checkout steps and peaceiris/actions-gh-pages, to verified immutable full-length commit SHAs while preserving their existing actions and inputs.
27-37: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable credential persistence for both checkouts.
actions/checkoutpersists its token in local Git configuration by default. The first checkout leaves credentials available during later build steps, while the second checkout relies on deletingrepo/.gitafterward. Setpersist-credentials: falseon both steps instead. (github.com)- name: Checkout repository uses: actions/checkout@v4 + with: + persist-credentials: false - name: Checkout existing OSTree repo for delta updates uses: actions/checkout@v4 + with: + persist-credentials: false repository: denislupookov/altersend-flatpak🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/flatpak-publish.yml around lines 27 - 37, Update both checkout steps in the workflow, including the primary repository checkout and the existing OSTree repository checkout, to set actions/checkout’s persist-credentials option to false. Keep the existing repository, ref, path, token, and continue-on-error settings unchanged.Source: Linters/SAST tools
30-45: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winDo not treat every checkout failure as an empty OSTree repository.
continue-on-error: truehides authentication, network, wrong-branch, and partial-checkout failures. The subsequentrepo/configexistence check is not sufficient to distinguish a valid OSTree repository from arbitrary or incomplete content. Preflight the external repository explicitly and only initialize a new repository when it is confirmed empty; fail the job for other checkout errors.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/flatpak-publish.yml around lines 30 - 45, Update the “Checkout existing OSTree repo for delta updates” and “Clean and verify OSTree repo” steps to explicitly preflight the external repository and distinguish a confirmed empty repository from authentication, network, wrong-branch, partial-checkout, or invalid-content failures. Remove the blanket continue-on-error behavior, validate the checkout result and OSTree structure before deleting .git, initialize a fresh repo only when emptiness is confirmed, and fail the workflow for all other errors.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/flatpak-publish.yml:
- Around line 3-10: Add a job-level condition to the Flatpak publishing workflow
so it runs for push events on main but skips workflow_dispatch runs unless
github.ref equals refs/heads/main. Apply the guard to the publishing job rather
than changing the existing triggers.
---
Nitpick comments:
In @.github/workflows/flatpak-publish.yml:
- Around line 28-31: Update the secret-bearing action references in the Flatpak
publish workflow, including both actions/checkout steps and
peaceiris/actions-gh-pages, to verified immutable full-length commit SHAs while
preserving their existing actions and inputs.
- Around line 27-37: Update both checkout steps in the workflow, including the
primary repository checkout and the existing OSTree repository checkout, to set
actions/checkout’s persist-credentials option to false. Keep the existing
repository, ref, path, token, and continue-on-error settings unchanged.
- Around line 30-45: Update the “Checkout existing OSTree repo for delta
updates” and “Clean and verify OSTree repo” steps to explicitly preflight the
external repository and distinguish a confirmed empty repository from
authentication, network, wrong-branch, partial-checkout, or invalid-content
failures. Remove the blanket continue-on-error behavior, validate the checkout
result and OSTree structure before deleting .git, initialize a fresh repo only
when emptiness is confirmed, and fail the workflow for all other errors.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b75d50a5-6b48-4937-8434-a9aa9996352a
📒 Files selected for processing (1)
.github/workflows/flatpak-publish.yml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 90-91: Update the Flatpak installation instructions to avoid
presenting the unsigned repository as an official installation path: either add
OSTree repository signing and publish the verification key before removing
--no-gpg-verify, or clearly label the current commands as an explicitly unsafe
preview.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/flatpak-publish.yml (2)
31-46: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winFail closed when the external OSTree checkout fails.
continue-on-error: truemakes network/authentication failures indistinguishable from an intentionally empty repository. The following cleanup can then initialize and publish a new repository over the existing one, losing delta history and potentially disrupting clients. Only initialize a genuinely empty repository; otherwise runostree fsckand abort on checkout or validation failures.Proposed direction
- name: Checkout existing OSTree repo for delta updates uses: actions/checkout@v4 - continue-on-error: true with: repository: denislupookov/altersend-flatpak ref: main path: repo token: ${{ secrets.FLATPAK_PUBLISH_TOKEN }} - name: Clean and verify OSTree repo run: | - rm -rf repo/.git - if [ ! -f "repo/config" ]; then - echo "Not a valid OSTree repository (likely a fresh GitHub repo). Cleaning up so flatpak-builder can initialize it." + if [ -f repo/config ]; then + ostree fsck --repo=repo + rm -rf repo/.git + elif [ -z "$(find repo -mindepth 1 -maxdepth 1 ! -name .git -print -quit)" ]; then rm -rf repo + else + echo "External repository is neither empty nor a valid OSTree repository." >&2 + exit 1 fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/flatpak-publish.yml around lines 31 - 46, Update the “Checkout existing OSTree repo for delta updates” and “Clean and verify OSTree repo” steps to fail closed: remove continue-on-error, distinguish a genuinely empty repository from checkout failures, and never delete or reinitialize repo after an unsuccessful checkout. For an existing checkout, remove Git metadata, validate repo/config, run ostree fsck, and abort the workflow on any validation failure; only allow flatpak-builder initialization when the repository is intentionally empty.
21-22: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPin privileged publishing job dependencies to immutable references.
This publishing container runs with
--privilegedand later accepts a writing token (secrets.FLATPAK_PUBLISH_TOKEN) inside the same job. Pin the container image by digest,actions/checkout@v4to full commit SHAs across lines 29 and 32, andpeaceiris/actions-gh-pages@v4to a full commit SHA. The Flatpak builder action is already pinned.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/flatpak-publish.yml around lines 21 - 22, Pin the privileged publishing job’s mutable dependencies to immutable references: replace the Flatpak container tag with its full image digest, pin both actions/checkout@v4 usages around lines 29 and 32 to full commit SHAs, and pin peaceiris/actions-gh-pages@v4 to its full commit SHA. Leave the already-pinned Flatpak builder action unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/flatpak-publish.yml:
- Around line 31-46: Update the “Checkout existing OSTree repo for delta
updates” and “Clean and verify OSTree repo” steps to fail closed: remove
continue-on-error, distinguish a genuinely empty repository from checkout
failures, and never delete or reinitialize repo after an unsuccessful checkout.
For an existing checkout, remove Git metadata, validate repo/config, run ostree
fsck, and abort the workflow on any validation failure; only allow
flatpak-builder initialization when the repository is intentionally empty.
- Around line 21-22: Pin the privileged publishing job’s mutable dependencies to
immutable references: replace the Flatpak container tag with its full image
digest, pin both actions/checkout@v4 usages around lines 29 and 32 to full
commit SHAs, and pin peaceiris/actions-gh-pages@v4 to its full commit SHA. Leave
the already-pinned Flatpak builder action unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: cc3fad6d-24c2-45f3-9f75-9ff75e47fc4c
📒 Files selected for processing (1)
.github/workflows/flatpak-publish.yml
|
@coderabbitai OSTree Delta History: Removed continue-on-error and added the ostree fsck validation to ensure the delta history is never accidentally overwritten due to a network failure during checkout (fixed in Dependency Pinning: Updated the privileged container to use its exact sha256 digest, and pinned all GitHub Actions to their full immutable commit SHAs (fixed in |
|
Tip For best results, initiate chat on the files or code changes.
🐇✨ If you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! |
0a34fe0 to
d5834e2
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/flatpak-publish.yml (1)
28-37: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDisable credential persistence for both checkouts.
Both
actions/checkoutsteps keep the token in the workspace Git config by default. Addpersist-credentials: falseto each checkout: the initial fetch can still authenticate, but later build/deploy steps cannot reuse those persisted credentials.Proposed fix
- name: Checkout repository uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: Checkout existing OSTree repo for delta updates uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: + persist-credentials: false repository: denislupookov/altersend-flatpak🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/flatpak-publish.yml around lines 28 - 37, Update both checkout steps in the workflow, including the repository checkout and the existing OSTree repository checkout, to set persist-credentials to false while preserving their current authentication inputs and checkout configuration.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/flatpak-publish.yml:
- Around line 28-37: Update both checkout steps in the workflow, including the
repository checkout and the existing OSTree repository checkout, to set
persist-credentials to false while preserving their current authentication
inputs and checkout configuration.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 483c58f2-a114-4d5f-b674-a07a61f2a4eb
📒 Files selected for processing (2)
.github/workflows/flatpak-publish.ymlREADME.md
🚧 Files skipped from review as they are similar to previous changes (1)
- README.md
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/flatpak-publish.yml:
- Around line 28-29: Update both actions/checkout steps in the workflow to set
persist-credentials to false, ensuring checkout credentials are not retained for
subsequent build or workflow commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5d8738fd-bb79-407a-9d27-f05b07e7812c
📒 Files selected for processing (2)
.github/workflows/flatpak-publish.ymlREADME.md
🚧 Files skipped from review as they are similar to previous changes (1)
- README.md
|
@coderabbitai review |
✅ Action performedReview finished.
|
1 participant
Summary
Adds a CI/CD pipeline for Flatpak that publishes to an OSTree repository hosted on GitHub Pages. This handles building the bundle, cryptographically signing the commits, and maintaining a delta-update repository so users don't have to download the full bundle for every update.
Changes
.github/workflows/flatpak-publish.ymlto automate Flatpak builds viaflatpak-builderinside an isolated, privileged container.peaceiris/actions-gh-pages) to host the OSTree repository.altersend.flatpakrepofile with the embedded public GPG key on every run. Users can download and click this file to add the official remote in one click, without terminal commands.ostree fsckauto-healing logic. If the repository ever becomes corrupted, the pipeline will detect it, wipe the corrupt directory, and automatically reinitialize it from scratch.node-modules.json) to drastically optimize workflow run time and resources.Setup Required (For Denis)
Before this workflow can run successfully on your account, you need to set up the hosting repository and the required security secrets:
1. Create the Deployment Repository
altersend-flatpak.2. Setup GitHub Pages Token
repopermissions.altersendrepository, go to Settings > Secrets and variables > Actions.FLATPAK_PUBLISH_TOKENand paste your PAT.3. Setup GPG Signing Keys
gpg --quick-gen-key "AlterSend Flatpak <flatpak@altersend.com>").gpg --armor --export-secret-keys <fingerprint>.altersendrepository Actions Secrets, add a secret namedFLATPAK_GPG_PRIVATE_KEYcontaining the entire exported private key block.FLATPAK_GPG_PASSPHRASE, and uncomment lines 66-67 in.github/workflows/flatpak-publish.yml.Known Limitations & Future Improvements
25.08SDK, but the official Docker image used for the build environment is currently stuck on24.08. This causes the pipeline to dynamically download the25.08SDK at build time (adding ~3-4 minutes). Once a25.08Docker image is released, we can bump the container version to instantly fix this.x86_64to save GitHub Actions minutes. We can easily add ARM64 support in the future by adding a matrix job withubuntu-24.04-arm(similar to the AppImage workflow).Testing
(Tested pipeline execution on personal fork, confirming successful OSTree creation, 1.3GB cache restorations, delta updates, GPG signature verification, and successful local installation via the deployed
.flatpakrepofile).Screenshots / recordings
(Not applicable - CI pipeline changes only)
Related issues
(None)