ci: add desktop build check to CI pipeline and simplify vite obfuscat… - #3
Merged
Conversation
…ion/chunking config Co-authored-by: Atib Ur Rehman <rehmanateebur@gmail.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe changes add Tauri desktop build validation to hosted and local CI, introduce Linux Snap release publishing, update production build and asset routing, add project governance and licensing documents, and document development workflows. ChangesDesktop build and release pipeline
Production build configuration
Project governance and documentation
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
74-103: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRestrict
desktop-build'sGITHUB_TOKENscope. Addpermissions: contents: readto this job; none of its steps need write access, and this avoids inheriting broader repo defaults.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 74 - 103, Add a job-level permissions block to desktop-build granting only contents: read, ensuring the job does not inherit broader GITHUB_TOKEN permissions while leaving its existing steps unchanged.Source: Linters/SAST tools
🧹 Nitpick comments (1)
vite.config.ts (1)
120-125: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winKeep an explicit vendor split for the heavy shared deps. Removing
manualChunksdrops the cache boundary between app code and libraries likerecharts/jspdf, so app edits can invalidate more of the bundle. If that separation still matters, use a Vite 7-supported chunking config instead of the default.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@vite.config.ts` around lines 120 - 125, Restore an explicit vendor chunk split in the Vite build configuration near the existing build.rollupOptions settings, using a Vite 7-supported manualChunks configuration. Ensure heavy shared dependencies such as recharts and jspdf remain isolated from application code so app changes do not invalidate the vendor bundle.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 78-79: Update the actions/checkout@v4 step in the workflow to set
persist-credentials to false, preventing the checkout token from being stored in
the workspace git configuration while leaving the existing checkout behavior
unchanged.
In `@Makefile`:
- Line 15: Update the Makefile target dependency declaration for desktop-build
so it depends on frontend-build, ensuring frontend dependencies are installed
before any desktop build and preserving correct ordering under parallel ci-local
execution.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 74-103: Add a job-level permissions block to desktop-build
granting only contents: read, ensuring the job does not inherit broader
GITHUB_TOKEN permissions while leaving its existing steps unchanged.
---
Nitpick comments:
In `@vite.config.ts`:
- Around line 120-125: Restore an explicit vendor chunk split in the Vite build
configuration near the existing build.rollupOptions settings, using a Vite
7-supported manualChunks configuration. Ensure heavy shared dependencies such as
recharts and jspdf remain isolated from application code so app changes do not
invalidate the vendor bundle.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 125d9784-7854-4023-b0c1-246a0f16e3d6
📒 Files selected for processing (3)
.github/workflows/ci.ymlMakefilevite.config.ts
| @echo " make desktop-build - Verify Tauri desktop app build compiles (--no-bundle)" | ||
|
|
||
| ci-local: format-check clippy test frontend-build | ||
| ci-local: format-check clippy test frontend-build desktop-build |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
make -n desktop-build
make -n -j ci-localRepository: iTeebot/flow
Length of output: 192
🏁 Script executed:
#!/bin/bash
set -eu
# Inspect the Makefile targets around the reported lines.
wc -l Makefile
cat -n Makefile | sed -n '1,120p'Repository: iTeebot/flow
Length of output: 2063
🏁 Script executed:
#!/bin/bash
set -eu
# Map the Makefile structure to check whether desktop-build already depends on frontend-build
# and whether ci-local can invoke them concurrently.
rg -n '^(ci-local|desktop-build|frontend-build):' Makefile
cat -n Makefile | sed -n '1,120p'Repository: iTeebot/flow
Length of output: 2155
🏁 Script executed:
#!/bin/bash
set -eu
wc -l Makefile
cat -n Makefile | sed -n '1,120p'Repository: iTeebot/flow
Length of output: 2063
🏁 Script executed:
#!/bin/bash
set -eu
# Inspect the Tauri config and package scripts referenced by desktop-build.
fd -a 'tauri.conf.*|package.json|pnpm-workspace.yaml' .
rg -n 'beforeBuildCommand|tauri build|pnpm run build|install|frontend' .Repository: iTeebot/flow
Length of output: 1692
🏁 Script executed:
#!/bin/bash
set -eu
fd -a 'tauri.conf.*|package.json|pnpm-workspace.yaml' .
rg -n 'beforeBuildCommand|tauri build|pnpm run build|install|frontend' .Repository: iTeebot/flow
Length of output: 1692
Make desktop-build depend on frontend-build. desktop-build doesn’t install frontend deps, so a clean make desktop-build can fail, and make -j ci-local can start it before the frontend step finishes. The Tauri hook also runs pnpm build during the desktop build.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` at line 15, Update the Makefile target dependency declaration for
desktop-build so it depends on frontend-build, ensuring frontend dependencies
are installed before any desktop build and preserving correct ordering under
parallel ci-local execution.
…tegy Co-authored-by: Atib Ur Rehman <rehmanateebur@gmail.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
vite.config.ts (1)
55-63: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueRemove the inert
debugProtectionIntervalsetting.It only applies when
debugProtectionis enabled, so withdebugProtection: falseit has no effect.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@vite.config.ts` around lines 55 - 63, Remove the inert debugProtectionInterval property from the obfuscation configuration near debugProtection in vite.config.ts, leaving the existing debugProtection setting and all other options unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@vite.config.ts`:
- Around line 55-63: Remove the inert debugProtectionInterval property from the
obfuscation configuration near debugProtection in vite.config.ts, leaving the
existing debugProtection setting and all other options unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: deeda5d1-c565-4c9c-92a6-ef5271534129
📒 Files selected for processing (2)
.github/workflows/ci.ymlvite.config.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/ci.yml
…eparate snap builds and improved matrix builds
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 180-188: Update the “Update Version Code” validation in the
release workflow to reject any GITHUB_REF_NAME containing a prerelease suffix,
so only plain vMAJOR.MINOR.PATCH tags continue to the stable publishing path.
Preserve the existing version extraction and update-version.cjs invocation for
valid stable tags, and apply the same stable-only guard to the corresponding
release block noted by the comment.
- Around line 174-178: Update the credentialed release job’s “Setup Node.js”
step to disable the pnpm cache by removing its cache configuration, and disable
any Rust cache configuration in the same job. Keep Node version selection via
node-version-file unchanged and ensure release build/publish steps do not
restore caches.
- Around line 201-215: The Build and Package Snap step currently relies on
Tauri’s --bundles snap, which does not produce the required artifact. Update the
workflow to build the Debian package, invoke Snapcraft using the repository’s
snapcraft.yaml to wrap that .deb, and ensure the generated .snap is available
for the release action.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8d4357ff-9bee-47cc-92ab-b999a7f61376
📒 Files selected for processing (2)
.github/workflows/release.ymlsrc-tauri/tauri.conf.json
✅ Files skipped from review due to trivial changes (1)
- src-tauri/tauri.conf.json
…on guidelines - Updated README.md to reflect open source status and contribution guidelines. - Changed package.json to set "private" to false, allowing public access. - Added scripts to update version in snapcraft.yaml. - Created issue templates for bug reports and feature requests. - Added pull request template to standardize contributions. - Introduced CHANGELOG.md to document project updates. - Added CODE_OF_CONDUCT.md to establish community standards. - Created CONTRIBUTING.md to guide new contributors. - Added LICENSE file for AGPL-3.0 compliance. - Established SECURITY.md for reporting vulnerabilities. - Developed DEVELOPMENT.md for setup and workflow guidance. - Created documentation index in docs/README.md. - Added snapcraft.yaml for packaging the application. Co-authored-by: Atib Ur Rehman <rehmanateebur@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
220-231: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAvoid expanding
${{ github.ref_name }}directly inside therunshell body.
github.ref_nameis interpolated into the shell script before execution (lines 229–230), which is the template-injection sink flagged by static analysis. It's largely mitigated here since the earlier "Update Version Code" step fails the job for any tag not matching^v[0-9]+\.[0-9]+\.[0-9]+$, but pass it via an environment variable to remove the sink and keep the guard as defense-in-depth.🔒 Proposed hardening
- name: Upload Snap to GitHub Release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + REF_NAME: ${{ github.ref_name }} run: | SNAP_FILE=$(find . -maxdepth 1 -name "*.snap" | head -1) if [ -z "$SNAP_FILE" ]; then echo "Warning: no .snap file found, skipping GitHub Release upload" exit 0 fi - echo "Uploading $SNAP_FILE to GitHub Release ${{ github.ref_name }}..." - gh release upload "${{ github.ref_name }}" "$SNAP_FILE" --clobber || \ + echo "Uploading $SNAP_FILE to GitHub Release $REF_NAME..." + gh release upload "$REF_NAME" "$SNAP_FILE" --clobber || \ echo "Release may not exist yet (created by desktop job). Snap will be uploaded by Snap Store step."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 220 - 231, Update the “Upload Snap to GitHub Release” step to pass github.ref_name through an environment variable, then reference that variable inside the run script instead of directly interpolating the GitHub expression. Preserve the existing release upload behavior and the prior version-format validation guard.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/ISSUE_TEMPLATE/bug_report.yml:
- Line 13: Quote the placeholder value in the issue template so the colon in
“Example: ...” is parsed as literal text rather than a YAML mapping delimiter.
In @.github/ISSUE_TEMPLATE/config.yml:
- Around line 3-5: Add a concrete private reporting destination for the
“Security report” entry in the issue template, such as a valid security contact
email or GitHub private vulnerability-reporting URL, and ensure the linked
guidance directs reporters there before they use public issue channels.
In @.github/ISSUE_TEMPLATE/feature_request.yml:
- Line 12: Update the placeholder value in the feature request YAML
configuration to quote the entire example string, preserving the existing text
while ensuring the embedded colon is treated as literal content.
In `@README.md`:
- Around line 194-197: Update the README prerequisites/setup instructions to
explain how to install or enable pnpm via Corepack before the existing pnpm
install step, and specify the supported pnpm version using the repository’s
configured version where available.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 220-231: Update the “Upload Snap to GitHub Release” step to pass
github.ref_name through an environment variable, then reference that variable
inside the run script instead of directly interpolating the GitHub expression.
Preserve the existing release upload behavior and the prior version-format
validation guard.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2c636e1d-5e23-4798-9333-6a9955ef0c26
📒 Files selected for processing (18)
.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/PULL_REQUEST_TEMPLATE/pull_request_template.md.github/workflows/release.yml.gitignoreCHANGELOG.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdLICENSEREADME.mdSECURITY.mddocs/DEVELOPMENT.mddocs/README.mdpackage.jsonscripts/update-version.cjssnap/snapcraft.yamlsrc-tauri/tauri.conf.json
✅ Files skipped from review due to trivial changes (8)
- docs/README.md
- CHANGELOG.md
- SECURITY.md
- .gitignore
- CONTRIBUTING.md
- .github/PULL_REQUEST_TEMPLATE/pull_request_template.md
- docs/DEVELOPMENT.md
- src-tauri/tauri.conf.json
Co-authored-by: Atib Ur Rehman <rehmanateebur@gmail.com>
…refine GitHub release scripts and issue templates Co-authored-by: Atib Ur Rehman <rehmanateebur@gmail.com>
Member
Author
|
@coderabbitai resume |
✅ Action performedReviews resumed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…ion/chunking config
Summary by CodeRabbit
desktop-build), includingci-local/help updates.