fix(release): ship macOS updater artifacts (.app.tar.gz + .sig) and fail loudly on a missing platform - #224
Open
remcostoeten wants to merge 1 commit into
Open
fix(release): ship macOS updater artifacts (.app.tar.gz + .sig) and fail loudly on a missing platform#224remcostoeten wants to merge 1 commit into
remcostoeten wants to merge 1 commit into
Conversation
…tform is missing
The `app` bundle target was absent from `bundle.targets`, so on macOS the
bundler logged "configured to create updater artifacts but no updater-enabled
targets were built", deleted Dora.app, and produced only the .dmg. The
`bundle/macos/*.app.tar.gz{,.sig}` upload glob then matched nothing (silently,
because upload-artifact defaults to `if-no-files-found: warn`) and
generate-latest-json.ts built latest.json from the .sig files it happened to
find — leaving darwin out of the manifest since at least v0.36.0.
Adds `app` to the bundle targets and hardens the pipeline so this cannot
regress silently: preflight now requires the `app` target and
createUpdaterArtifacts, the per-platform uploads use `if-no-files-found:
error`, the macOS job asserts its three artifacts before uploading, the
publish gate requires every signed updater asset (including .app.tar.gz and
its .sig), and generate-latest-json.ts exits non-zero with an actionable
message when an expected platform is absent.
Fixes #223
Contributor
|
🧙 Sourcery has finished reviewing your pull request! Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📝 WalkthroughWalkthroughTauri now produces the macOS app bundle target and signed updater artifacts. CI and release workflows fail when expected artifacts are missing. Manifest generation validates required platforms, supports configurable requirements, and has expanded test coverage. ChangesUpdater artifact pipeline
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant TauriBuild
participant ReleaseWorkflow
participant GenerateLatestJson
participant PublishRelease
TauriBuild->>ReleaseWorkflow: produce signed platform updater artifacts
ReleaseWorkflow->>ReleaseWorkflow: verify expected uploaded files
ReleaseWorkflow->>GenerateLatestJson: provide release artifact paths
GenerateLatestJson->>GenerateLatestJson: map signatures and validate platforms
GenerateLatestJson-->>PublishRelease: generate validated latest.json
PublishRelease->>PublishRelease: validate required release asset patterns
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The required platform list and updater asset patterns are now hardcoded in both
generate-latest-json.tsand the release bash gate; consider centralizing these definitions or adding a single source of truth to reduce the risk of future divergence. - The macOS updater artifact verification logic is duplicated between
release.ymlandci-mac.yml; extracting a shared script or reusable step would make it easier to keep the checks consistent over time.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The required platform list and updater asset patterns are now hardcoded in both `generate-latest-json.ts` and the release bash gate; consider centralizing these definitions or adding a single source of truth to reduce the risk of future divergence.
- The macOS updater artifact verification logic is duplicated between `release.yml` and `ci-mac.yml`; extracting a shared script or reusable step would make it easier to keep the checks consistent over time.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/ci-mac.yml (1)
35-47: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicated macOS updater-artifact verification script. Both workflows implement the identical
compgen -Gloop overdmg/*.dmg,macos/*.app.tar.gz, andmacos/*.app.tar.gz.sig; the shared root cause is having no single source of truth for this check.
.github/workflows/ci-mac.yml#L35-L47: replace the inline script with a call to a shared script (e.g.tools/scripts/verify-macos-artifacts.sh)..github/workflows/release.yml#L291-L308: replace the inline script with the same shared script/action so both workflows stay in sync if Tauri's output paths ever change.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci-mac.yml around lines 35 - 47, The macOS artifact verification loop is duplicated across both workflows. Add a shared verification script, such as tools/scripts/verify-macos-artifacts.sh, containing the existing checks, then replace the inline scripts in .github/workflows/ci-mac.yml lines 35-47 and .github/workflows/release.yml lines 291-308 with calls to that script so both workflows use one source of truth..github/workflows/release.yml (1)
178-190: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winLinux and Windows uploads lack the per-artifact check macOS now has.
if-no-files-found: erroronly fails when the wholepathlist matches zero files, so a single missing signature file (e.g.*.AppImage.sigor*.exe.sig) among otherwise-present files won't be caught untilpublish-release's laterREQUIRED_PATTERNSscan — the root cause is the absence of a dedicated pre-upload existence check like the new macOS step.
.github/workflows/release.yml#L178-L190: add a pre-upload step verifying*.AppImage,*.AppImage.sig,*.deb, and*.rpmeach individually exist, mirroring the macOS verification step..github/workflows/release.yml#L247-L255: add the equivalent per-file check for*.exeand*.exe.sigbefore upload.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 178 - 190, Before the Linux upload step at .github/workflows/release.yml:178-190, add a dedicated per-artifact existence check for *.AppImage, *.AppImage.sig, *.deb, and *.rpm, mirroring the macOS verification step; before the Windows upload step at .github/workflows/release.yml:247-255, add the equivalent individual checks for *.exe and *.exe.sig. Ensure each missing pattern fails before artifact upload rather than relying on if-no-files-found.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/ci-mac.yml:
- Around line 35-47: The macOS artifact verification loop is duplicated across
both workflows. Add a shared verification script, such as
tools/scripts/verify-macos-artifacts.sh, containing the existing checks, then
replace the inline scripts in .github/workflows/ci-mac.yml lines 35-47 and
.github/workflows/release.yml lines 291-308 with calls to that script so both
workflows use one source of truth.
In @.github/workflows/release.yml:
- Around line 178-190: Before the Linux upload step at
.github/workflows/release.yml:178-190, add a dedicated per-artifact existence
check for *.AppImage, *.AppImage.sig, *.deb, and *.rpm, mirroring the macOS
verification step; before the Windows upload step at
.github/workflows/release.yml:247-255, add the equivalent individual checks for
*.exe and *.exe.sig. Ensure each missing pattern fails before artifact upload
rather than relying on if-no-files-found.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 02c7cfe2-8386-4eed-8b22-50ec7009161c
📒 Files selected for processing (5)
.github/workflows/ci-mac.yml.github/workflows/release.yml__tests__/generate-latest-json.test.tsapps/desktop/src-tauri/tauri.conf.jsontools/scripts/generate-latest-json.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #223
Root cause (confirmed from the v0.37.0 macOS job log)
bundle.targetsinapps/desktop/src-tauri/tauri.conf.jsonwas an explicit list —deb, rpm, appimage, nsis, dmg— with noapp. On macOS that is the only updater-enabled target, so the bundler did exactly this in run 30212273445:So: no
.app-> no.app.tar.gz-> the upload glob matched nothing. It was silent becauseactions/upload-artifactdefaults toif-no-files-found: warn, andgenerate-latest-json.tsderives platforms purely from the.sigfiles it happens to find, so it happily wrote a two-platform manifest and exited 0.Ruled out: the signing secrets are passed to
release-macosexactly like the other jobs (the log showsTAURI_SIGNING_PRIVATE_KEY: ***/..._PASSWORD: ***), andcreateUpdaterArtifactswas alreadytrue.Changes
tauri.conf.json— addapptobundle.targets. It is macOS-only; Tauri filters package types per target OS, so Linux/Windows bundling is unchanged.release.ymlpreflight — require theapptarget and assertcreateUpdaterArtifacts === true.release.ymlper-platform uploads —if-no-files-found: erroron all three, plus an explicit pre-upload check inrelease-macosthat the.dmg,.app.tar.gzand.app.tar.gz.sigall exist (the upload action only errors when every pattern misses, so the glob-level check is what actually catches this class of bug).release.ymlpublish gate — the "at least N assets" check now also requires each signed updater asset by pattern:.exe,.exe.sig,.AppImage,.AppImage.sig,.dmg,.app.tar.gz,.app.tar.gz.sig(count bumped 9 -> 11).generate-latest-json.ts— refactored into exported pure functions (collectPlatforms,assertPlatformsPresent,buildManifest) with a thin CLImain(). It now exits non-zero with an actionable message when any oflinux-x86_64,windows-x86_64,darwin-aarch64is missing.--require-platforms=overrides the set (nonedisables the check) for local use.ci-mac.yml— pass the signing secrets and assert the three macOS artifacts, so the existingworkflow_dispatchmac build doubles as a dry-run for this fix. This is also required: withappin the targets, a macOS build now signs, and would fail without the key.Verification
__tests__/generate-latest-json.test.ts— 9 tests, all passing. Covers platform mapping, the tag-scoped URL, and the missing-platform failure (including "a.dmgalone does not count as macOS coverage", i.e. the exact v0.36/v0.37 shape)..sigfiles the script exits 1 with the missing-platform message; addingDora.app.tar.gz.sigmakes it exit 0 with all three platforms.Missing required release assets matching: \.app\.tar\.gz$ \.app\.tar\.gz\.sig$— and against the expected post-fix list, where it passes.oxfmt --checkandoxlintclean on the changed TS files.Not verifiable without a real macOS run
That the bundler now actually emits
bundle/macos/Dora.app.tar.gz{,.sig}can only be proven on a mac runner. TheCI Macworkflow_dispatch run on this branch is the dry-run for it; otherwise the next tagged release is the proof — and if it regresses, the release now fails red instead of shipping a darwin-lesslatest.json.Note: the mac updater channel is
darwin-aarch64only (release-macos runs onmacos-latest, which is Apple Silicon). Intel macs still have no updater channel — out of scope here.Summary by Sourcery
Ensure macOS updater artifacts are built and shipped for releases and fail the pipeline when required updater platforms or assets are missing.
New Features:
Bug Fixes:
Enhancements:
CI:
Tests:
Summary by CodeRabbit
New Features
Bug Fixes
Tests