fix(ci): unblock release pipeline and auto-sync plugin code pins#101
Conversation
The code-intelligence-lsp plugin runs `code lsp-multiplex`, but the pinned @pleaseai/code@0.1.13 predates that command (added in #100, unreleased), so the LSP server crashed with "Unknown command: lsp-multiplex". Releases were blocked because create-github-app-token had no app credentials. - ci: upgrade create-github-app-token v1 -> v3 and use client-id (recommended input; requires secrets CLIENT_ID and PRIVATE_KEY) - release: auto-bump every plugin's @pleaseai/code pin to the code version on each packages/code release via extra-files json updaters (pins were manual) - plugins: bump code-intelligence-lsp pin to 0.1.14 (the release that ships lsp-multiplex)
📝 WalkthroughWalkthroughUpdates the release-please workflow token step, bumps the ChangesRelease Please Config and Workflow
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
Greptile SummaryThis PR fixes two independent problems: a blocked Release Please pipeline (missing GitHub App credentials) and a crashing
Confidence Score: 5/5Safe to merge — all three changes are targeted, self-contained fixes with no side-effects on other workflows or packages. The workflow change correctly adopts the recommended client-id + private-key inputs, uses properly scoped names, and stores only the private key as a secret. The extra-files list covers exactly the 14 plugins that depend on @pleaseai/code. No logic errors or missing guards were found. No files require special attention. Important Files Changed
Reviews (3): Last reviewed commit: "fix(ci): match app-token vars to provisi..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/release-please.yml (1)
36-41: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winConsider scoping the app token's permissions.
zizmor flags that this step "inherits blanket installation permissions" since no
permission-*inputs are set. Since this token is only used to drivegoogleapis/release-please-action, consider adding explicitpermission-contents: write/permission-pull-requests: write(or whatever the action actually needs) to reduce blast radius if the token/step is ever compromised or misused.🔒 Example of scoping permissions
- uses: actions/create-github-app-token@v3 id: app-token with: # client-id is the recommended input (supersedes the legacy app-id). client-id: ${{ secrets.CLIENT_ID }} private-key: ${{ secrets.PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-please.yml around lines 36 - 41, The app token generated in the `actions/create-github-app-token@v3` step is currently unscoped and inherits blanket installation permissions. Update the `app-token` step to set explicit `permission-*` inputs for only what `googleapis/release-please-action` needs, such as `permission-contents` and `permission-pull-requests`, so the token is least-privileged. Keep the change localized to the `release-please` workflow step that configures `client-id` and `private-key`.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/release-please.yml:
- Around line 36-41: The app token generated in the
`actions/create-github-app-token@v3` step is currently unscoped and inherits
blanket installation permissions. Update the `app-token` step to set explicit
`permission-*` inputs for only what `googleapis/release-please-action` needs,
such as `permission-contents` and `permission-pull-requests`, so the token is
least-privileged. Keep the change localized to the `release-please` workflow
step that configures `client-id` and `private-key`.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7f7d4176-502f-4742-880e-1b9e6a51227b
📒 Files selected for processing (3)
.github/workflows/release-please.ymlplugins/code-intelligence-lsp/package.jsonrelease-please-config.json
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 3 files
Architecture diagram
sequenceDiagram
participant GHWorkflow as GitHub Actions Workflow
participant GHAppAPI as GitHub App Token API
participant ReleasePlease as Release Please Action
participant Config as release-please-config.json
participant PluginPkg as Plugin package.json files
participant NPM as npm Registry
participant LSPPlugin as code-intelligence-lsp Runtime
Note over GHWorkflow,LSPPlugin: CHANGED: Release pipeline now uses client-id/private-key and extra-files updaters
GHWorkflow->>GHWorkflow: Trigger (push to main / release branch)
GHWorkflow->>GHAppAPI: CHANGED: create-github-app-token v3 with client-id + private-key
Note over GHWorkflow,GHAppAPI: Secrets CLIENT_ID and PRIVATE_KEY required
GHAppAPI-->>GHWorkflow: GitHub App installation token
GHWorkflow->>ReleasePlease: Run release-please-action with token
ReleasePlease->>Config: Read extra-files updaters for @pleaseai/code
Note over ReleasePlease,Config: NEW: extra-files bumps all LSP plugin pins on each code release
loop For each plugin package.json (clangd, csharp, dart, etc.)
ReleasePlease->>PluginPkg: Update $.dependencies['@pleaseai/code'] to new version
PluginPkg-->>ReleasePlease: JSON updated
end
alt Release is created
ReleasePlease->>NPM: Publish @pleaseai/code@newVersion
NPM-->>ReleasePlease: Published
end
Note over LSPPlugin: After release, LSP plugin installs @pleaseai/code@newVersion
LSPPlugin->>LSPPlugin: Run code lsp-multiplex (no crash)
1 participant
Summary
Releases were blocked and the
code-intelligence-lspplugin was crashing at runtime. This PR fixes both.Root cause: the
code-intelligence-lspplugin installs@pleaseai/codefrom npm and runscode lsp-multiplex, but the pinned@pleaseai/code@0.1.13predates that command (added in PR #100, still unreleased), so the LSP server crashed withUnknown command: lsp-multiplex. Releases were blocked because the Release Please workflow'screate-github-app-tokenstep had no App credentials configured (Input required and not supplied: app-id).Changes
.github/workflows/release-please.yml— upgradecreate-github-app-tokenv1→v3 and switch to the recommendedclient-idinput (+private-key), using variableRELEASE_GITHUB_APP_CLIENT_ID(client id is public) and secretRELEASE_GITHUB_APP_PRIVATE_KEY.release-please-config.json— auto-bump every LSP plugin's@pleaseai/codepin to the code version on eachpackages/coderelease viaextra-filesjson updaters (jsonpath: $.dependencies['@pleaseai/code']); pins were previously manual and never auto-synced.plugins/code-intelligence-lsp/package.json— bump the@pleaseai/codepin0.1.13→0.1.14(the release that shipslsp-multiplex).Required manual step (after merge)
Two GitHub repo/org credentials must be set for the Release Please workflow to run:
RELEASE_GITHUB_APP_CLIENT_ID— a repo/org Variable (client id is a public identifier, not a secret); value = the GitHub App's Client IDRELEASE_GITHUB_APP_PRIVATE_KEY— a repo/org Secret; value = the GitHub App's private key (.pemcontents)The legacy
PF_BOT_APP_IDsecret is no longer needed —client-idsupersedesapp-id.Also note:
@pleaseai/code@0.1.14must be published (via the resulting Release Please PR) beforecode-intelligence-lspactually works end-to-end; the plugin pin bump and the npm publish of@pleaseai/code@0.1.14land together in that release PR.Test Plan
RELEASE_GITHUB_APP_CLIENT_IDand secretRELEASE_GITHUB_APP_PRIVATE_KEYare set in repo/org settingscode-intelligence-lsp's@pleaseai/codepin automatically@pleaseai/code@0.1.14publishes, confirmcode-intelligence-lspplugin'slsp-multiplexcommand works without crashingSummary by cubic
Unblocks the release pipeline and fixes the
code-intelligence-lspcrash by upgrading the GitHub App token step and bumping@pleaseai/codeto0.1.14. Also auto-syncs all LSP plugins’@pleaseai/codepins on eachpackages/coderelease.Bug Fixes
actions/create-github-app-tokento v3; usevars.RELEASE_GITHUB_APP_CLIENT_ID+secrets.RELEASE_GITHUB_APP_PRIVATE_KEY.@pleaseai/codeinplugins/code-intelligence-lspfrom0.1.13to0.1.14(addslsp-multiplex).extra-filesupdaters so every LSP plugin’s@pleaseai/codepin trackspackages/codereleases.Migration
RELEASE_GITHUB_APP_CLIENT_IDand secretRELEASE_GITHUB_APP_PRIVATE_KEY.PF_BOT_APP_IDis no longer used.@pleaseai/code@0.1.14publishes,code-intelligence-lspwill runlsp-multiplexwithout crashing.Written for commit eea9744. Summary will update on new commits.
Summary by CodeRabbit