ci(updater): minisign release artifact signing#723
Conversation
Add sign-release-artifacts job: download zip/dmg/deb from the GitHub Release, emit SHA256SUMS, sign each artifact + manifest, verify with packaging pubkey, and upload *.minisig + SHA256SUMS + minisign.pub. Follow-up to spike #440. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Warning Review limit reached
More reviews will be available in 44 minutes and 47 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new ChangesRelease Artifact Signing
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6f2da25db5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ "$COUNT" -ge 3 ]; then | ||
| exit 0 |
There was a problem hiding this comment.
On release runs this exits as soon as any three assets are visible, but this workflow publishes more than that: the Windows zip and setup exe, the Linux .deb, and the macOS .dmg. If one required artifact is still not visible through the release API (for example the DMG), gh release download can still match the other QtMeshEditor-* assets plus the deb, so the signing step completes and uploads SHA256SUMS without ever signing the missing artifact. Please wait for the exact expected filenames, or fail after download if any are absent, before signing.
Useful? React with 👍 / 👎.
Address review: poll for exact zip/setup/deb/dmg filenames instead of any three assets, and fail if any required file is missing after download. Co-authored-by: Cursor <cursoragent@cursor.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy.yml:
- Line 2044: The `actions/checkout@v4` action at line 2044 uses a floating tag
instead of a pinned commit SHA, which creates supply-chain security risk.
Additionally, the job downloads and signs release artifacts without requiring
git credentials, so persisted credentials are unnecessary. Replace the floating
tag `@v4` with a specific commit SHA and add `with: persist-credentials: false`
to the checkout action configuration to harden against supply-chain drift and
reduce the credential exposure surface.
- Line 2054: Move the `github.ref_name` template expression to an environment
variable to prevent shell injection vulnerabilities. In the
`sign-release-artifacts` job, define an environment variable that captures
`github.ref_name` before any bash commands execute, then replace all direct
interpolations of `${{ github.ref_name }}` with references to this environment
variable throughout the job. Apply the same fix to the `update-homebrew-cask`
job, defining the environment variable once and using it instead of direct
template interpolation in all subsequent bash commands. This ensures that
crafted release tags cannot inject shell syntax and execute arbitrary commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fd3400ec-3611-4066-a5bb-8b9e846c50e0
📒 Files selected for processing (2)
.github/workflows/deploy.ymldocs/AUTO_UPDATER_DESIGN.md
Pin actions/checkout to the v4 commit SHA, disable persisted credentials, and route release tag through RELEASE_TAG env to avoid shell injection. Co-authored-by: Cursor <cursoragent@cursor.com>
|
1 participant
Summary
sign-release-artifactsjob todeploy.yml(runs onrelease: publishedafter platform builds finish).SHA256SUMS, signs each file + manifest with minisign, smoke-verifies withpackaging/updater/minisign.pub, uploads*.minisig+SHA256SUMS+ pubkey.docs/AUTO_UPDATER_DESIGN.mdto document the live CI path.Follow-up to #722 / spike #440. Requires
MINISIGN_SECRET_KEY(+MINISIGN_PASSWORDfor encrypted keys) — already configured.Test plan
.minisig,SHA256SUMS,SHA256SUMS.minisig,minisign.pubminisign -Vm <asset> -x <asset>.minisig -P <pubkey>succeeds locallyMade with Cursor
Summary by CodeRabbit
New Features
Documentation