fix: fail closed on production publishing

[SunkenInTime]

What changed

• make release-mode cloud configuration fail closed unless a build intentionally selects development or supplies a complete production Convex URL and client ID
• guard stable desktop, Store, stable Pages, and production backend paths before version bumps, builds, deploys, uploads, publishing, or release commits
• add a Production-environment Convex deploy workflow that requires a production-scoped key and runs TypeScript and Convex tests first
• add prerelease-only 4.6.1+97 metadata and document the external production setup

Verification

• powershell -ExecutionPolicy Bypass -File scripts/test_release_safety.ps1
• fvm flutter test test/cloud_build_config_test.dart (9 passed)
• fvm flutter test (611 passed, 2 expected skips)
• fvm flutter analyze --no-fatal-infos (no errors; existing info notices only)
• fvm flutter analyze lib/config/cloud_build_config.dart lib/main.dart test/cloud_build_config_test.dart --no-fatal-infos
• npx tsc --noEmit
• npm run test:convex (33 passed)
• workflow YAML parsed with Prettier
• direct stable desktop, Store, and stable Pages entry points rejected this feature branch before mutation/build
• git diff --check

No production Convex deployment or secret was created. The PR wires the required one-time setup without inventing external values.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e0b9b4ba-da9d-4b5f-a6bc-117fe93f0fd8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This change makes release cloud selection explicit and adds safeguards for public desktop, Store, Pages, and Convex production releases. Release-mode startup was exercised with no cloud environment and stopped with the expected error, while debug startup selected development; the focused Flutter configuration suite passed all 10 tests. The production Convex workflow guards were exercised safely without deploying and rejected non-main branches, incorrect confirmation, missing keys, and keys without the required production prefix.

T-Rex validation blocked

• tool: pwsh / powershell is not installed in the Linux environment. The stable desktop and Store scripts could not be executed to prove missing production configuration and non-main branch rejection before release work.
• service: GitHub Production environment settings and its protected secret are unavailable locally. The workflow declares the Production environment, but its required-reviewer configuration and the provisioned key's scope could not be confirmed.

Configure VMs

Confidence Score: 3/5

The verified Flutter and workflow controls behave as intended, but desktop and Store release protection still needs execution in a PowerShell-capable environment.

Release-mode cloud configuration and the production workflow guard logic were executed with both rejecting and allowed controlled inputs. The PowerShell release scripts could not run because their interpreter is missing, and GitHub environment settings cannot be inspected from this checkout.

Files Needing Attention: scripts/common_release.ps1, scripts/build_desktop_release.ps1, scripts/build_store_release.ps1, and scripts/test_release_safety.ps1 need runtime verification with PowerShell. .github/workflows/deploy-convex-production.yml needs GitHub Production environment and secret configuration confirmation.

T-Rex Logs

What T-Rex did

• Ran the cloud configuration entry point in debug mode without a compile-time cloud environment; it resolved to development.
• Ran the identical entry point in release-product mode; it raised the required explicit-environment error.
• Ran the focused Flutter cloud configuration suite; all 10 tests passed.
• Executed three verification commands: the debug probe, the release-state probe, and the narrow Flutter test; results showed development config, a state error due to explicit environment, and all tests passing.
• Determination blocked because the required PowerShell host is unavailable, preventing runtime verification of non-main rejection; guard/documentation points were captured for review.

_{Ran code and verified through T-Rex}

_{Reviews (6): Last reviewed commit: "fix(release): require canonical Convex p..." | Re-trigger Greptile}

[SunkenInTime]

Addressed the current Greptile review feedback in 75660c1. The default full-directory Pages path now detects stable updater/download trees and enforces the main-branch guard before any publish work. Focused release-safety tests cover the regression.

@greptileai

[SunkenInTime]

Addressed the current Greptile security finding in ac4c281. The dispatch confirmation is now bound through the step environment and compared as quoted Bash data. The release-safety suite also forbids direct expression interpolation in the shell condition.

@greptileai

[SunkenInTime]

Addressed the current Greptile endpoint-validation finding in d9200fa. Production builds now require a canonical single-label https://.convex.cloud origin in both Dart and PowerShell. Arbitrary HTTPS, .convex.site, spoofed suffixes, and path-bearing values fail closed; focused tests retain a valid .convex.cloud acceptance case.

@greptileai

[SunkenInTime]

Current-head Windows evidence for d9200fa:

1. powershell -NoProfile -ExecutionPolicy Bypass -File scripts/test_release_safety.ps1
   Result: exit 0. Release safety checks passed.

2. powershell -NoProfile -ExecutionPolicy Bypass -File scripts/assert_release_preflight.ps1 -ReleaseTarget stable-desktop -BranchName icarus-cloud -ProductionConvexDeploymentUrl https://production-example.convex.cloud -ProductionConvexClientId icarus-production
   Result: exit 1 as expected. Release target stable-desktop is public and can only run from branch main; current branch icarus-cloud.

3. powershell -NoProfile -ExecutionPolicy Bypass -File scripts/assert_release_preflight.ps1 -ReleaseTarget stable-desktop -BranchName main -ProductionConvexDeploymentUrl https://production-example.invalid -ProductionConvexClientId icarus-production
   Result: exit 1 as expected after the main branch check. The URL must be a canonical https://.convex.cloud URL.

4. powershell -NoProfile -ExecutionPolicy Bypass -File scripts/assert_release_preflight.ps1 -ReleaseTarget stable-desktop -BranchName main -ProductionConvexDeploymentUrl https://production-example.convex.cloud -ProductionConvexClientId icarus-production
   Result: exit 0. Stable desktop preflight passed.

5. powershell -NoProfile -ExecutionPolicy Bypass -File scripts/assert_release_preflight.ps1 -ReleaseTarget store -BranchName main -ProductionConvexDeploymentUrl https://production-example.convex.cloud -ProductionConvexClientId icarus-production
   Result: exit 0. Store preflight passed.

6. powershell -NoProfile -ExecutionPolicy Bypass -File scripts/assert_release_preflight.ps1 -ReleaseTarget prerelease-desktop -BranchName icarus-cloud
   Result: exit 0. Feature-branch prerelease preflight passed.

These are direct PowerShell executions on Windows, covering the review runner gap. Please use this evidence when evaluating the current head.

@greptileai

[SunkenInTime]

Authoritative current-head Windows evidence is now complete and green for d9200fa:

https://github.com/SunkenInTime/icarus/actions/runs/33830646262/job/100892741794

This GitHub Actions Windows validate job completed SUCCESS. Its native PowerShell Test Release Safety Policy step completed SUCCESS, as did Flutter analysis/tests, the native bridge test, the Windows client and installer builds, and public upgrade/rollback testing.

Please evaluate the unchanged current head using this authoritative Windows job result instead of attempting to reproduce PowerShell inside the Linux review sandbox.

@greptileai

[SunkenInTime]

Superseded by #151, which carries the final reviewed branch and the latest Pages path-safety fix: #151