Publish and verify compiled TinyBus module - #3
Conversation
Co-authored-by: Medulla <medulla@tinyhumans.ai>
|
Warning Review limit reached
Next review available in: 51 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe release workflow now creates ChangesRelease and module validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant ChecksumScript
participant GitHubRelease
ReleaseWorkflow->>ChecksumScript: Generate checksum.toml for .tar.gz assets
ChecksumScript-->>ReleaseWorkflow: Return SHA-256 manifest
ReleaseWorkflow->>GitHubRelease: Create release with archives and checksum.toml
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-authored-by: Medulla <medulla@tinyhumans.ai>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 289-290: Add a trailing line-continuation backslash to the
release-assets/* line in the gh release create command so the following --repo
"$REPOSITORY" argument remains part of the same shell command.
- Around line 281-287: Update the release command preceding this checksum block
so the `release-assets/*` continuation includes the trailing backslash, keeping
`--repo` part of the same command. In the checksum manifest loop, validate each
`sha256sum` result before writing its entry and propagate failures instead of
emitting empty hashes. Exclude the `.crate` asset from the `[sha256]` manifest
while retaining the existing tarball checksum handling.
- Around line 284-285: Update the asset checksum generation around the printf
command to compute the sha256sum result separately before publishing. Capture
the digest in a variable, ensure hashing or its pipeline failure causes the
workflow to exit, and only invoke printf after a successful digest computation.
- Around line 279-285: Fix the release command continuation so the arguments
following release-assets/*, including --repo, remain part of the same command.
Update the checksum pipeline to propagate sha256sum failures and stop instead of
emitting an empty digest. In ModuleHost::load_github_release, reject missing or
empty [sha256] entries before any extraction or loading occurs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 07272d03-5f37-4d8b-8f19-34504759e87f
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (6)
.github/workflows/release.ymlREADME.mdcrates/tinydocs-module/tests/module_e2e.rsdocs/plans/tinybus-module.mddocs/specs/tinybus-module.mdvendor/tinybus
| printf '"%s" = "%s"\n' \ | ||
| "$(basename "$asset")" "$(sha256sum "$asset" | awk '{print $1}')" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' "$(false | awk '{print $1}')"
echo "The outer command still reached this line."Repository: tinyhumansai/tinydocs
Length of output: 203
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/release.yml' '.github/workflows'
printf '%s\n' '--- release workflow lines 250-310 ---'
sed -n '250,310p' .github/workflows/release.yml
printf '%s\n' '--- all relevant checksum/release references ---'
rg -n -C 3 'sha256sum|release-assets|gh release create|checksum|TinyBus|tar\.gz' .github README.md docs 2>/dev/null || trueRepository: tinyhumansai/tinydocs
Length of output: 15212
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow lines 130-250 ---'
sed -n '130,250p' .github/workflows/release.yml
printf '%s\n' '--- checksum parser and artifact references ---'
rg -n -C 4 'checksum\.toml|modules\.toml|sha256|load_github_release|checksum_file|upload-artifact|path:' . \
-g '!target' -g '!node_modules' 2>/dev/null || true
printf '%s\n' '--- shell syntax for the release command ---'
bash -n <<'SH'
set -euo pipefail
gh release create "$RELEASE_TAG" release-assets/*
--repo "$REPOSITORY" \
--verify-tag \
--title "$RELEASE_TAG" \
--generate-notes
SH
printf '%s\n' 'bash -n accepted the release command'
printf '%s\n' '--- command-substitution failure behavior ---'
bash -c 'set -euo pipefail; result="$(false | awk "{print \$1}")"; printf "result=<%s>\n" "$result"; echo reached' || true
bash -c 'set -euo pipefail; printf "result=<%s>\n" "$(false | awk "{print \$1}")"; echo reached' || trueRepository: tinyhumansai/tinydocs
Length of output: 7849
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- pipeline status with pipefail ---'
bash -c 'set -o pipefail; false | awk "{print \$1}"; printf "pipeline_status=%s\n" "$?"'
printf '%s\n' '--- assignment status with pipefail, without errexit ---'
bash -c 'set -o pipefail; result="$(false | awk "{print \$1}")"; printf "assignment_status=%s result=<%s>\n" "$?" "$result"'
printf '%s\n' '--- assignment with errexit, status captured by the parent ---'
bash -c 'set -euo pipefail; result="$(false | awk "{print \$1}")"; printf "reached_with_result=<%s>\n" "$result"'
printf 'nested_shell_status=%s\n' "$?"
printf '%s\n' '--- printf command-substitution status ---'
bash -c 'set -euo pipefail; printf "result=<%s>\n" "$(false | awk "{print \$1}")"; echo reached'
printf 'nested_shell_status=%s\n' "$?"
printf '%s\n' '--- release command line boundaries ---'
bash -c 'set -x; gh() { printf "gh_args:"; printf " <%s>" "$@"; printf "\n"; return 0; }; \
set -euo pipefail; \
gh release create "$RELEASE_TAG" release-assets/* \
--repo "$REPOSITORY" \
--verify-tag \
--title "$RELEASE_TAG" \
--generate-notes' 2>&1 || printf 'nested_shell_status=%s\n' "$?"Repository: tinyhumansai/tinydocs
Length of output: 596
Propagate sha256sum failures before publishing.
The sha256sum pipeline runs inside a printf argument. A failed sha256sum can be followed by successful awk, so printf can write an empty digest without triggering set -euo pipefail.
Capture the digest separately and exit when hashing fails.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 284 - 285, Update the asset
checksum generation around the printf command to compute the sha256sum result
separately before publishing. Capture the digest in a variable, ensure hashing
or its pipeline failure causes the workflow to exit, and only invoke printf
after a successful digest computation.
1 participant
Summary
Validation
Public API: None.
Related issue: None.
Summary by CodeRabbit
New Features
checksum.tomlwith SHA-256 hashes for archive verification.Bug Fixes
Documentation