Repository navigation
release: 0.3.0, with the release-pipeline review fixes - #2
Conversation
Version bump for the first public release. Changes since the 0.2.0 private beta: the navigation pin and CSP base-uri/form-action/frame-ancestors, the hardened-runtime ad-hoc macOS signature, notices bundled in every package, a .deb-only Linux release with a glibc 2.39 floor, and the release workflow.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2d16004c78
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "$schema": "https://schema.tauri.app/config/2", | ||
| "productName": "SQLite Explorer", | ||
| "version": "0.2.0", | ||
| "version": "0.3.0", |
There was a problem hiding this comment.
When the v0.3.0 packages are built, bundle.resources and the release workflow still copy the unchanged THIRD_PARTY_NOTICES.txt, whose heading identifies the product as the “0.2.0 private beta” and whose MPL source-availability section points to the old v0.2.0-beta.1 release. This makes every 0.3.0 installer and its separately uploaded notice carry stale release/source information, so the notice should be updated as part of this version bump.
Useful? React with 👍 / 👎.
- THIRD_PARTY_NOTICES.txt still read "0.2.0 private beta" and sent MPL source requests to releases/tag/v0.2.0-beta.1. That tag never existed in this repository, so every package would ship a broken source pointer. The header is now version-neutral and points at the release page, which carries mpl-dependency-sources.tar.gz. - A prerelease tag drafted an ordinary release, which publishing could make Latest. The manifest now records prerelease, and the workflow adds --prerelease from it. - The DMG was described as ad-hoc signed. Only the app inside is (Tauri skips the disk image for identity "-"; codesign reports the DMG "not signed at all"). The docs and the manifest now say so. - sha256sum does not exist on Windows. The notes now give shasum for macOS, sha256sum for Linux and a PowerShell Get-FileHash check for Windows. That command comes from one exported function, and the Windows build job runs that exact string against its own installer: True for the real hash, False for a wrong one. Regression tests for the notices, prerelease, DMG wording and checksum commands failed before this change and pass after it.
zknpr
changed the title
… graph THIRD_PARTY_NOTICES.txt and third-party/inventory.json were generated once and nothing regenerated or checked them. A dependency bump would have shipped incomplete notices in every package without anything failing. scripts/release/notices.mjs checks that: - the inventory's Cargo components are exactly the packages a release resolves. This uses `cargo metadata` with default features. The raw lock would wrongly demand the 26 qa-webdriver-only crates, which no release builds; - the inventory was built for viewer-dist's pin; - every inventoried component has a section in the notices. It runs in CI, so a dependency-bump PR goes red, and in every release build. Today it passes: the release resolves 442 packages and the inventory lists exactly those 442. With one shipped crate removed from the inventory it fails and names the crate. ci.yml also moves to the Node-24 action SHAs release.yml already uses.
Problem
.deb-only Linux release with a glibc 2.39 floor.Solution
Bump to 0.3.0 everywhere the version lives (
scripts/release/version.mjs --tag v0.3.0passes).Review findings, each verified against the code before fixing:
release.yml:217, #2tauri.conf.json:4)THIRD_PARTY_NOTICES.txt:1read "0.2.0 private beta". Lines 21–23 pointed MPL source requests atreleases/tag/v0.2.0-beta.1, which doesn't exist in this repo.mpl-dependency-sources.tar.gz.release.yml:231)version.mjsacceptsv0.3.0-beta.1, andgh release createhad no--prerelease.prerelease, and the workflow adds the flag from it.code-signing-policy.md:14)codesign -dvreports both the local and the CI DMG as "not signed at all".sha256sumon stock macOS/Windows (#1README.md:48)/sbin/sha256sum --check --ignore-missingworks, but older releases are unverified.shasumfor macOS,sha256sumfor Linux, and a PowerShellGet-FileHashcheck for Windows. That check comes from one exported function, and the Windows build job runs the exact string against its own installer: True for the real hash, False for a wrong one.Notices drift gate (prompted by a review note).
THIRD_PARTY_NOTICES.txtandthird-party/inventory.jsonwere generated once, and nothing checked them.scripts/release/notices.mjsnow fails CI and every release build when any of these drift:cargo metadatawith default features, because rawCargo.lockwould wrongly demand the 26 crates that only the test-onlyqa-webdriverfeature pulls in;viewer-dist's pin;ci.ymlalso moves to the Node-24 action SHAs.Architecture
No app code changes. The release manifest gains a
prereleasefield, andassemble.mjsgains awindows-checksum-commandsubcommand.Per-file changes
package.json,package-lock.json,src-tauri/Cargo.toml,src-tauri/Cargo.lockandsrc-tauri/tauri.conf.jsonchange only their version lines.README.mdanddocs/release-readiness.mdupdate the current-version prose.THIRD_PARTY_NOTICES.txt: the title, the MPL source location and the AppImage wording in the header. The notice bodies are unchanged.scripts/release/assemble.mjs: theprereleasefield, the DMG wording insigning.macos, per-platform checksum commands in the notes, andwindowsChecksumCommand()..github/workflows/release.yml: the conditional--prerelease, and the Windows checksum command run both ways.README.md,docs/code-signing-policy.md,docs/release-readiness.md: the checksum commands and DMG signing wording.scripts/release/release.test.mjs: three regression tests, plus the drift-check unit test.scripts/release/notices.mjs(new),.github/workflows/ci.yml,third-party/README.md: the drift gate, its CI step, and the manual regeneration procedure.Security
The notices fix restores a working MPL §3.2 source pointer in every package. The prerelease fix prevents a beta from becoming Latest.
Test plan
2d16004.npm test26/26.cargo test --locked --lib: 136 passed.0fc3e9b. Windows ran the exact published PowerShell command: True for the real hash, False for a wrong one.serde_jsonfrom the inventory made it fail namingserde_json 1.0.151; restored, it passes.npm test27/27. CI and all three release builds pass on70c10ee, with the drift gate passing in each.v0.3.0, and the workflow drafts the release for candidate QA.