fix: complete platform release gates and 1.4.1 repairs by MisterWanted · Pull Request #206 · GroepOnline/opencodex

MisterWanted · 2026-09-08T04:52:42Z

Summary

Repair the two late release: prepare v1.4.0 and finish review execution fixes #205 findings: valid CLI command table and regression assertions preserving exact-head technical checks.
Repair macOS client artifact publication through the verified system /var alias; keep other symlink paths rejected. Use exact-SHA detached worktrees with owned cleanup instead of repeated shared clones.
Preserve the live-checkout Git deadline on macOS with GNU timeout, gtimeout or a Perl alarm; never fall back to unbounded probes.
Make Windows fixtures use the available POSIX shell and a runnable isolated command environment.
Replace ignored Bun cache inputs and make CI test the packaged Bun 1.4.0 runtime.
Require the full manual Linux/macOS/Windows runtime, quality and installation matrix before publishing. The release helper dispatches that preflight; a successful Linux-only push run cannot satisfy it.
Prepare patch 1.4.1. Published 1.4.0 remains immutable; no tag rewrite or republish.

Security review

Actions remain pinned and permissions/triggers/credential handling are not broadened. Release gates are strengthened with exact-SHA and explicit successful platform-job checks. Client artifact output still rejects untrusted symlink traversal and existing destinations; only the verified macOS /var to /private/var system alias is accepted. Temporary worktrees are exact-SHA and cleaned only at their owned generated paths. Live-checkout probes retain their ten-second bound. No storage-policy behavior change is included.

Test plan

Focused workflow/release/live-checkout checks: 101 passed; CI runtime binding check: 84 passed.
Container/runtime fixtures: 28 passed; client-artifact tests: 11 passed, 3 local PowerShell availability skips.
Typecheck and privacy scan passed; docs build 156 pages and rendered table inspected.
Normal full pre-push and exact-head remote CI remain mandatory. Full manual platform CI will run before merge and again on the final release SHA before publication.

Context: Linux deployment of 1.4.0 is healthy on 7463720. The explicit tag matrix exposed Windows/macOS failures that this owned follow-up addresses; platform success is not yet claimed.

coderabbitai · 2026-09-08T04:52:51Z

Warning

Review limit reached

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d2d29215-1c4f-4546-8e3f-71a3c692592d

📥 Commits

Reviewing files that changed from the base of the PR and between d133d0e and ab55b78.

📒 Files selected for processing (15)

.github/workflows/ci.yml
.github/workflows/release.yml
package.json
scripts/assert-live-checkout-safe.sh
scripts/build-client-artifact.ts
scripts/ci-test-shard.ts
scripts/release.ts
tests/ci-test-shard.test.ts
tests/ci-workflows.test.ts
tests/client-artifact.test.ts
tests/codex-runtime.test.ts
tests/container-image.test.ts
tests/fetch-header-timeout.test.ts
tests/live-checkout.test.ts
tests/release-helper.test.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f3b0b215-5ccb-4b1d-8f69-161b89095ea1

📥 Commits

Reviewing files that changed from the base of the PR and between 7463720 and d133d0e.

📒 Files selected for processing (4)

.github/workflows/ci.yml
docs-site/src/content/docs/reference/cli.md
tests/ci-workflows.test.ts
tests/review-execution-policy.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The pull request updates Bun CI cache configuration, expands the CLI reference command matrix, and adds review-policy test coverage for exact merge-head checks.

Changes

CI cache configuration

Layer / File(s)	Summary
Bun cache setting `.github/workflows/ci.yml`	At line 75, the Bun setup replaces `cache: true` and `cache-bin: true` with `no-cache: false`.

CLI documentation

Layer / File(s)	Summary
Explicit CLI command matrix `docs-site/src/content/docs/reference/cli.md`	Lines 198–207 list each headless dashboard command as a separate, fully qualified CLI invocation.

Review policy test coverage

Layer / File(s)	Summary
Exact-head policy checks `tests/review-execution-policy.test.ts`	Lines 9–10 add whitespace-normalized policy text. Lines 26–34 verify that required technical checks pass on the exact merge head when branch protection is absent.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to d133d

This updates Bun cache configuration, clarifies documented CLI commands, and adds exact-head policy coverage. The changes preserve intended behavior with no current merge-blocking risk identified.

Suggested reviewers: chefgroep, ingwannu, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the pull request as a set of release-gate fixes and 1.4.1 repairs. It is broad, but it relates to the workflow, policy-gate, and documentation fixes in the changeset.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
✅ Committed to branch successfully - (🔄 Check to regenerate)

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/release-review-followup-20260908

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai · 2026-09-08T05:37:56Z

Note

Docstrings generation - SUCCESS
Generated docstrings and committed to branch fix/release-review-followup-20260908 (commit: 1f18cbda52ded3cdb59555afacc80bf08d56a087)

coderabbitai · 2026-09-08T05:38:01Z

Note

Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Generating unit tests... This may take up to 20 minutes.

coderabbitai · 2026-09-08T05:38:07Z

🤖 Coding Agent task started for unit test generation.

@MisterWanted

Docstrings generation was requested by @MisterWanted. The following files were modified: * `scripts/assert-live-checkout-safe.sh` * `scripts/build-client-artifact.ts` * `scripts/release.ts` These files were ignored: * `tests/ci-workflows.test.ts` * `tests/client-artifact.test.ts` * `tests/codex-runtime.test.ts` * `tests/container-image.test.ts` * `tests/live-checkout.test.ts` * `tests/release-helper.test.ts` * `tests/review-execution-policy.test.ts` These file types are not supported: * `.github/workflows/ci.yml` * `.github/workflows/release.yml` * `docs-site/src/content/docs/reference/cli.md` * `package.json`

+  test(
+    "reinstalls frozen dependencies before bundling",
+    async () => {
+      const root = join(import.meta.dir, "..");


MisterWanted · 2026-09-08T06:04:02Z

Exact-head execution review completed at ab55b78. Full manual platform preflight 34192513519 passed all 11 runtime, GUI-quality, npm installation, security and workflow-lint jobs. Normal pre-push: 6854 passed, 5 platform-specific skips, 0 failed. Current PR technical checks and service-lifecycle check passed. Security analysis: trusted macOS path handling is limited to the verified system alias and canonicalized before native-home containment; other symlink paths remain rejected. Immutable release identity, peeled tag references, bounded Git probes and production credential boundaries are preserved. Windows native command stubs are test-only; no argument-validation bypass was added. Concurrent bot changes were preserved and their executable-mode regression fixed. External review is advisory; this is executing-agent verification, not independent approval.

fix: preserve CLI table and review policy gates

261063a

github-actions Bot added the bug label Sep 8, 2026

sentry Bot reviewed Sep 8, 2026

View reviewed changes

Comment thread tests/review-execution-policy.test.ts

OnlineChef (ChefGroep) added 5 commits September 8, 2026 06:56

fix(ci): use supported Bun cache input

d133d0e

fix(client): make isolated artifact builds cross-platform

1e75cbb

fix: support macOS live checkout checks

a67ce99

fix: gate patch releases on complete platform verification

3b09e3b

fix(ci): verify the shipped Bun runtime

7dcaf85

MisterWanted changed the title ~~fix: preserve CLI table and review policy gates~~ fix: complete platform release gates and 1.4.1 repairs Sep 8, 2026

github-code-quality Bot found potential problems Sep 8, 2026

View reviewed changes

Comment thread tests/codex-runtime.test.ts Fixed

OnlineChef (ChefGroep) added 5 commits September 8, 2026 07:18

fix(ci): distinguish jq bindings from shell expansion

b1ce5b9

test: use portable shell shebangs in bounded git fixtures

8a39346

fix: accept macOS system var alias in client shim

16e7a9e

test: allow client artifact builds on Windows

9b12020

test: declare runtime fixture imports before path constants

4b45745

coderabbitai Bot and others added 10 commits September 8, 2026 05:38

fix: preserve live checkout guard executable bit

1dcf7ac

fix(client): canonicalize trusted aliases before containment

2ee6076

test(client): share immutable launcher artifact across behavior cases

b3db530

Add regression tests for release and checkout safeguards

6022ddc

fix(ci): run every test batch while preserving failures

1470870

test: use native Windows release helper fixtures

38d5b66

test: cache native release helper fixtures

df28f60

merge: preserve concurrent regression coverage and portable fixtures

0ed16a5

test: cancel delayed SSE fixture timers

ab55b78

github-code-quality Bot found potential problems Sep 8, 2026

View reviewed changes

Comment thread tests/client-artifact.test.ts

test(

"reinstalls frozen dependencies before bundling",

async () => {

const root = join(import.meta.dir, "..");

MisterWanted merged commit 5724a6a into main Sep 8, 2026
30 checks passed

Navigation Menu

Uh oh!

fix: complete platform release gates and 1.4.1 repairs - #206

fix: complete platform release gates and 1.4.1 repairs#206
MisterWanted merged 21 commits into
mainfrom
fix/release-review-followup-20260908

MisterWanted commented Sep 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 8, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 8, 2026

Uh oh!

coderabbitai Bot commented Sep 8, 2026

Uh oh!

MisterWanted commented Sep 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

MisterWanted commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security review

Test plan

Uh oh!

coderabbitai Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 8, 2026

Uh oh!

coderabbitai Bot commented Sep 8, 2026

Uh oh!

MisterWanted commented Sep 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MisterWanted commented Sep 8, 2026 •

edited

Loading

coderabbitai Bot commented Sep 8, 2026 •

edited

Loading

coderabbitai Bot commented Sep 8, 2026 •

edited

Loading