Use stable release asset names - #65
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
🧰 Additional context used🧠 Learnings (4)📚 Learning: 2026-06-05T08:32:22.004ZApplied to files:
📚 Learning: 2026-06-01T13:58:55.642ZApplied to files:
📚 Learning: 2026-06-01T13:58:55.642ZApplied to files:
📚 Learning: 2026-06-01T13:58:55.642ZApplied to files:
🔇 Additional comments (2)
📝 WalkthroughWalkthroughThis PR standardizes release artifact filenames to stable platform-architecture patterns (e.g., Arroxy-win-x64-Setup.exe). Build config, release and validation workflows, helper scripts, README locale strings, and tests were updated to produce, reference, and validate the new filenames. ChangesArtifact Naming Standardization
🎯 3 (Moderate) | ⏱️ ~25 minutes
🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
coderabbitai
Bot
added
documentation
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@eslint.config.mjs`:
- Line 12: The migration summary is misleading because the eslint.config.mjs
"ignores" array contains both 'refs' and '.ref' (the array named ignores
includes entries 'refs' and '.ref'); update the config so the summary matches
the actual contents: either remove the redundant 'refs' entry from the ignores
array (keeping '.ref') or change the migration summary text to accurately state
that both 'refs' and '.ref' are present (or that 'refs' was retained), and
ensure any related comment or changelog referring to "removing refs and adding
.ref" is adjusted to reflect the chosen change.
In `@scripts/alias-latest-release-assets.sh`:
- Around line 1-71: Add a runtime check for the rtk shim and set command
variables (e.g. GH, GREP, MV, RM) to either use "rtk <cmd>" when rtk is
available or the plain command otherwise, then replace all direct invocations of
gh, grep, mv, and rm in the script with the corresponding variables ($GH, $GREP,
$MV, $RM) so the script uses rtk-prefixed commands when present; update uses in
functions/blocks that reference gh release view/download/upload, grep -Fxq
"$..." <<<"$assets", mv "$source_path" "$alias_path", and rm -f "$alias_path" to
use the new variables.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 38769906-e165-4519-82b7-302262e49074
⛔ Files ignored due to path filters (42)
README.am.mdis excluded by!README*.mdand included by*,**/*README.ar.mdis excluded by!README*.mdand included by*,**/*README.bn.mdis excluded by!README*.mdand included by*,**/*README.de.mdis excluded by!README*.mdand included by*,**/*README.el.mdis excluded by!README*.mdand included by*,**/*README.es.mdis excluded by!README*.mdand included by*,**/*README.fr.mdis excluded by!README*.mdand included by*,**/*README.hi.mdis excluded by!README*.mdand included by*,**/*README.ja.mdis excluded by!README*.mdand included by*,**/*README.mdis excluded by!README*.mdand included by*,**/*README.my.mdis excluded by!README*.mdand included by*,**/*README.om.mdis excluded by!README*.mdand included by*,**/*README.ps.mdis excluded by!README*.mdand included by*,**/*README.ru.mdis excluded by!README*.mdand included by*,**/*README.sr.mdis excluded by!README*.mdand included by*,**/*README.sw.mdis excluded by!README*.mdand included by*,**/*README.uk.mdis excluded by!README*.mdand included by*,**/*README.ur.mdis excluded by!README*.mdand included by*,**/*README.uz.mdis excluded by!README*.mdand included by*,**/*README.vi.mdis excluded by!README*.mdand included by*,**/*README.zh.mdis excluded by!README*.mdand included by*,**/*readme-src/locales/am.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/ar.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/bn.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/de.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/el.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/es.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/fr.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/hi.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/ja.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/my.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/om.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/ps.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/ru.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/sr.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/sw.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/uk.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/ur.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/uz.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/vi.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/locales/zh.mjsis excluded by!readme-src/locales/!(en).mjsand included by**/*readme-src/template.mdis excluded by!readme-src/template.mdand included by**/*
📒 Files selected for processing (12)
.github/workflows/flatpak.yml.github/workflows/installer-smoke.yml.github/workflows/release.yml.github/workflows/release_to_winget.yml.gitignoreelectron-builder.json5eslint.config.mjsreadme-src/locales/en.mjsscripts/alias-latest-release-assets.shscripts/build/build-windows.ps1scripts/render-flatpak-manifest.pytests/unit/release-asset-names.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Cold start (macos-arm64)
- GitHub Check: Build Windows installer
- GitHub Check: Cold start (windows)
- GitHub Check: Cold start (linux)
- GitHub Check: check
- GitHub Check: build
- GitHub Check: check
🧰 Additional context used
📓 Path-based instructions (10)
.github/workflows/**
⚙️ CodeRabbit configuration file
Review GitHub Actions for least-privilege permissions, unsafe secret exposure, untrusted PR execution, shell quoting, release/tag correctness, artifact handling, and whether commands can fail silently.
Files:
.github/workflows/release_to_winget.yml.github/workflows/installer-smoke.yml.github/workflows/flatpak.yml.github/workflows/release.yml
scripts/**
⚙️ CodeRabbit configuration file
Review shell and Node/Bun scripts for unsafe command construction, unquoted variables, path traversal, platform-specific assumptions, missing error handling, and release/build reproducibility.
Files:
scripts/render-flatpak-manifest.pyscripts/build/build-windows.ps1scripts/alias-latest-release-assets.sh
**/*.{sh,bash}
📄 CodeRabbit inference engine (AGENTS.md)
Always prefix shell commands with
rtkfor token optimization, unless RTK is unavailable (check viacommand -v rtk)
Files:
scripts/alias-latest-release-assets.sh
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Prefer
interfacefor defining object shapes in TypeScript
Files:
tests/unit/release-asset-names.test.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Type safety throughout — favor strict typing, exhaustive checks, and discriminated unions. Avoid
anyandunknownunless justified.
Files:
tests/unit/release-asset-names.test.ts
**/*.test.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use
bun run test(vitest), notbun test, to respect vitest config and per-file//@vitest-environment`` directives
Files:
tests/unit/release-asset-names.test.ts
**/*.test.ts
📄 CodeRabbit inference engine (AGENTS.md)
When adding idempotent IPC registration (ipcMain.removeHandler, autoUpdater.removeAllListeners), add the method as
vi.fn()to matchingvi.mock()blocks
Files:
tests/unit/release-asset-names.test.ts
**/*.{ts,json}
📄 CodeRabbit inference engine (AGENTS.md)
Keep classification regexes and closed enums synchronized with i18n locale entries;
i18n-contract.test.tsenforces all locales have strings for every enum value
Files:
tests/unit/release-asset-names.test.ts
tests/**
⚙️ CodeRabbit configuration file
Prioritize meaningful coverage, determinism, and whether tests validate behavior. Do not nitpick formatting or implementation style unless it makes the test unreliable.
Files:
tests/unit/release-asset-names.test.ts
.github/workflows/release.yml
📄 CodeRabbit inference engine (AGENTS.md)
Pre-release tags use semver suffix (e.g.
v0.4.0-beta.1);publish-scoop/publish-homebrewjobs guardif: !contains(github.ref_name, '-')so beta tags don't bump public package managers
Files:
.github/workflows/release.yml
🧠 Learnings (12)
📓 Common learnings
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to .github/workflows/release.yml : Pre-release tags use semver suffix (e.g. `v0.4.0-beta.1`); `publish-scoop`/`publish-homebrew` jobs guard `if: !contains(github.ref_name, '-')` so beta tags don't bump public package managers
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to build/beforeBuild.mjs : Pin `electron-builder ≥ 26.9.0` (26.8.x has buffer over-read on cold-heap); drop `build/installer.nsh`; any custom NSIS callback must guard with `${If} ${Silent}`
Applied to files:
electron-builder.json5
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Keep `scripts/test-binaries/` directory tracked (now anchored: `**/build/embedded/` and `/test-binaries/` in .gitignore)
Applied to files:
.gitignoretests/unit/release-asset-names.test.ts
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to **/*.test.{ts,tsx,js,jsx} : Use `bun run test` (vitest), not `bun test`, to respect vitest config and per-file `// vitest-environment` directives
Applied to files:
eslint.config.mjstests/unit/release-asset-names.test.ts
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to {src/shared/schemas.ts,readme-src/strings.mjs} : Keep `SUPPORTED_LANGS` in `src/shared/schemas.ts` and `LOCALES` in `readme-src/strings.mjs` in lockstep with the landing-site locale list
Applied to files:
eslint.config.mjsreadme-src/locales/en.mjs
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to **/*.{ts,json} : Keep classification regexes and closed enums synchronized with i18n locale entries; `i18n-contract.test.ts` enforces all locales have strings for every enum value
Applied to files:
eslint.config.mjstests/unit/release-asset-names.test.ts
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to src/**/*.ts : Extract pure helpers (no I/O) into separate modules with fixture-driven tests alongside, using pattern: `tests/fixtures/yt-dlp-stderr/<kind>/*.txt` + test file
Applied to files:
tests/unit/release-asset-names.test.ts
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to **/*.test.ts : When adding idempotent IPC registration (ipcMain.removeHandler, autoUpdater.removeAllListeners), add the method as `vi.fn()` to matching `vi.mock()` blocks
Applied to files:
tests/unit/release-asset-names.test.ts
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: When adding new README feature, add `what_N` key to every locale in `readme-src/strings.mjs` and corresponding template entry; run build and commit sources + regenerated files together
Applied to files:
readme-src/locales/en.mjs
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to README*.md : README files are generated from `readme-src/strings.mjs` + `readme-src/template.md` — never edit README*.md directly; run `node readme-src/build.mjs` after updates
Applied to files:
readme-src/locales/en.mjs
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: GitHub Releases, Scoop, Homebrew Cask, and Winget all publish together from a single `v*` tag; tag must be annotated, not lightweight
Applied to files:
.github/workflows/release.yml
📚 Learning: 2026-06-01T13:58:55.642Z
Learnt from: CR
Repo: antonio-orionus/Arroxy PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-06-01T13:58:55.642Z
Learning: Applies to .github/workflows/release.yml : Pre-release tags use semver suffix (e.g. `v0.4.0-beta.1`); `publish-scoop`/`publish-homebrew` jobs guard `if: !contains(github.ref_name, '-')` so beta tags don't bump public package managers
Applied to files:
.github/workflows/release.yml
🪛 zizmor (1.25.2)
.github/workflows/flatpak.yml
[info] 100-100: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 102-102: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
.github/workflows/release.yml
[warning] 377-377: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🔇 Additional comments (21)
.github/workflows/release.yml (7)
369-379: Static analysis false positive: template expansion is safe here.The zizmor warning at line 377 flags
$FILEas potentially attacker-controllable, but the variable is populated fromfind flatpak-artifact -name "*.flatpak"whereflatpak-artifactis an artifact directory downloaded viaactions/download-artifact@v8from this workflow's ownbuild-flatpakjob. The.flatpakis built by the trustedflatpak/flatpak-github-actions/flatpak-builder@v6action and cannot be tampered with by external actors.
178-179: LGTM!
199-214: LGTM!
235-241: LGTM!
335-335: LGTM!
420-420: LGTM!
465-466: LGTM!Also applies to: 480-484
.github/workflows/flatpak.yml (2)
100-103: Static analysis false positive: template expansions are from trusted sources.The zizmor warnings at lines 100 and 102 flag step outputs as potentially attacker-controllable. However,
steps.resolve.outputs.versionandsteps.resolve.outputs.sha256are extracted by a trusted Python script from this repo's own GitHub release metadata (tag name and SHA256SUMS asset). This workflow triggers on push tomainor PRs targetingmain, not on arbitrary external input. The values are not attacker-controllable in this threat model.
75-75: LGTM!Also applies to: 95-95, 103-103
electron-builder.json5 (1)
36-60: LGTM!scripts/render-flatpak-manifest.py (1)
73-77: LGTM!.github/workflows/installer-smoke.yml (3)
63-65: LGTM!
93-93: LGTM!Also applies to: 162-162
229-231: LGTM!.github/workflows/release_to_winget.yml (1)
32-32: LGTM!scripts/build/build-windows.ps1 (2)
382-382: LGTM!
401-401: LGTM!scripts/alias-latest-release-assets.sh (1)
21-32: Confirm blockmap alias pairs match the actual electron-builder release assets
Inscripts/alias-latest-release-assets.sh(lines 21-32),pairsincludes.blockmapmappings for the Windows Setup EXE and macOS DMGs, but none for the Portable EXE, AppImage, tar.gz, or flatpak. Confirm that electron-builder (and your GitHub Release upload) generates and publishes.blockmapfiles for only those installer types—if blockmaps are produced/uploaded for additional targets (or with different naming), thepairslist must be updated to match.readme-src/locales/en.mjs (1)
84-84: LGTM!Also applies to: 92-92, 158-158, 162-162, 185-185, 215-215, 222-222, 231-231
tests/unit/release-asset-names.test.ts (1)
1-62: LGTM!.gitignore (1)
61-61: ⚡ Quick winClarify why
.refis being added to.gitignore
.gitignorenow ignores.ref; what does this file pattern represent in this repo (generated artifact, temp file, reference data, etc.)?- How does ignoring
.refrelate to the PR goal of “Use stable release asset names”, and is it safe that these files are excluded from version control?
1 participant
Summary
This PR standardizes release asset filenames to stable, platform- and arch-specific names (no embedded version) across builds, release workflows, docs, and tooling so asset URLs are deterministic.
User-facing changes
Internal / refactor changes
Risk areas
Tests and checks to run