Improve nightly preview release workflow - #384
Conversation
|
Warning Review limit reached
Next review available in: 25 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Walkthrough发布工作流新增发布配置输出、Windows MSVC x64 Release 可执行文件构建、按工具链拆分的库包，以及 nightly 发布替换和详细 Release 产物说明。 Changes发布流水线
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
478-481: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win建议关闭凭据持久化。
该 job 不执行 git 推送操作。
actions/checkout默认把GITHUB_TOKEN写入.git/config，凭据可能被后续步骤或产物意外携带。设置persist-credentials: false可缩小暴露面。🔒 建议改动
- name: Checkout repository uses: actions/checkout@v4 with: submodules: recursive + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 478 - 481, Update the actions/checkout step in the release job to disable credential persistence by setting persist-credentials to false alongside the existing recursive submodule configuration.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 767: Update the 7z command in the release packaging step to run from
$PACKAGE_DIR and archive only the package directory name, preventing an extra
release-assets/ path prefix inside the ZIP.
- Around line 814-831: Update the release lookup around release_json so curl
failures are not suppressed indiscriminately: treat HTTP 404 as “no existing
release,” but propagate or fail the workflow for 5xx responses, network errors,
timeouts, and other non-success statuses. Preserve the existing deletion flow
when a release is found and the “No existing release” message only for a
confirmed 404.
- Around line 494-519: Update the “Package executables” PowerShell step to
receive the version through the step’s env mapping instead of interpolating
needs.validate-and-setup.outputs.version inside the script. Validate the
resulting version before constructing $dist, permitting only a safe
artifact/path character set and exiting with a clear error for invalid values;
continue using the validated value for the directory, README, archive, and
downstream artifact naming.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 478-481: Update the actions/checkout step in the release job to
disable credential persistence by setting persist-credentials to false alongside
the existing recursive submodule configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 452f4dcd-cf15-4b51-b64b-f6fe1fe67563
📒 Files selected for processing (1)
.github/workflows/release.yml
6f29abb to
a524bbb
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (5)
.github/workflows/release.yml (5)
46-47: 🔒 Security & Privacy | 🟠 Major不要把原始 tag 直接用于脚本、版本和工件路径。
github.ref_name在当前脚本中直接插值。GitHub 将 ref 内容视为不可信输入。Git ref 也允许使用/分隔组件。形如v25.11/foo的 tag 会使回退版本包含/，从而破坏下游目录名和 artifact 名称。(docs.github.com)请通过环境变量传入
github.ref和github.ref_name。验证后只使用安全 slug，原始 tag 仅用于日志。建议改动
env: INPUT_VERSION: ${{ inputs.version }} + INPUT_REF: ${{ github.ref }} + INPUT_REF_NAME: ${{ github.ref_name }} ... - elif [ "${{ github.event_name }}" = "push" ] && [ -n "${{ github.ref_name }}" ] && [[ "${{ github.ref }}" == refs/tags/* ]]; then + elif [ "${{ github.event_name }}" = "push" ] && [ -n "$INPUT_REF_NAME" ] && [[ "$INPUT_REF" == refs/tags/* ]]; then ... - TAG_NAME="${{ github.ref_name }}" + TAG_NAME="$INPUT_REF_NAME" + TAG_SLUG=$(printf '%s' "$TAG_NAME" | sed 's/[^A-Za-z0-9._-]/_/g') ... - VERSION="${VERSION}-tag-${TAG_NAME}" + VERSION="${VERSION}-tag-${TAG_SLUG}" ... - echo "version_tag=test-${TAG_NAME}" >> $GITHUB_OUTPUT + echo "version_tag=test-${TAG_SLUG}" >> $GITHUB_OUTPUTAlso applies to: 151-155
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 46 - 47, 更新 release workflow 中使用版本和工件路径的逻辑：不要将 github.ref 或 github.ref_name 直接插入脚本、版本或路径。将其通过环境变量传入，在校验后生成并复用不含路径分隔符的安全 slug；原始 tag 仅保留用于日志输出，并确保 INPUT_VERSION 等下游值使用该安全 slug。Source: MCP tools
135-140: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win不要同时设置
release_draft=true和release_make_latest=true。GitHub REST API 不允许 draft 或 prerelease 被设为 latest。当前官方分支会同时传入这两个值，发布请求可能直接失败；若需要先审核，将
release_make_latest设为false，草稿发布后再单独更新为 latest。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 135 - 140, Update the official release output configuration around release_draft and release_make_latest so it does not enable both simultaneously. Set release_make_latest to false when release_draft remains true, preserving the existing draft workflow; any later promotion to latest must occur separately after publication.Source: MCP tools
345-360: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win让 MinGW 构建步骤在失败时立即失败。
shell: msys2 {0}和shell: cmd都是命令解释器，不会自动终止失败后的后续命令。WinLibs 步骤中cmake --build ...失败后，仍会执行mkdir build-release、cd build-release、cmake ..，导致错误被后续成功命令掩盖并上传不完整 artifacts。请在 MSYS2 脚本开头添加
set -euo pipefail；在前置 CMD 和 MSYS2 构建步骤的每条易失败命令后添加|| exit /b 1/|| exit，再继续后续收集命令；在上传前也要确认.a库文件已生成。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 345 - 360, Update the MSYS2 build step around “Build with MSYS2” to enable fail-fast behavior with set -euo pipefail, and ensure each failure-prone setup or CMake command stops the script before artifact collection. Apply the corresponding explicit failure exits to the preceding CMD and MSYS2 build steps as requested, and validate that at least one .a library exists before uploading artifacts.Source: MCP tools
362-380: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift为 WinLibs 压缩包增加 SHA-256 校验。
该步骤会使用第三方 release asset 解压后提供的
cmake、gcc、make、ninja构建发布产物，但只对下载完成和解压是否失败做判断。如果压缩资产被替换，构建器和最终产物都可能被篡改。为每个矩阵项配置对应 zip 的 SHA-256，在下载后、Expand-Archive前先校验，校验失败立即终止工作流。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 362 - 380, 在“Download and Setup WinLibs GCC”步骤中为每个矩阵项增加对应 ZIP 的 SHA-256 配置，并在 Invoke-WebRequest 成功后、Expand-Archive 执行前计算 mingw64.zip 的哈希并与 matrix 中的期望值严格比较；校验失败时输出错误并立即以失败状态终止工作流，校验通过后再继续解压。
173-186: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win为
nightly发布增加并发保护或提交校验。master 推送使用固定
version_tag=nightly，并且replace_existing_release=true。当前工作流没有concurrency限制，后续步骤会强制移动和重新创建refs/tags/nightly，较旧提交的工作流如果最后完成会覆盖最新提交的 nightly 发布。请添加按 master-nightly 的concurrency取消旧运行，或在强制推送前校验nightly是否仍指向本次提交。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 173 - 186, 为 nightly 发布流程增加并发保护，使用工作流级别或相关 job 的 concurrency 配置按 master-nightly 分组，并取消正在运行的旧任务；确保较旧提交的工作流不会继续覆盖最新的 nightly 标签和发布。保留现有 nightly 输出设置，包括 version_tag、replace_existing_release 和发布名称配置。
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
204-256: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win请固定 VS 构建使用的 Windows runner。
VS2019 和 VS2022 矩阵都使用
windows-latest。截至 2026 年 8 月 9 日，该标签指向 Windows Server 2025，且 runner 镜像内容会变化。相同的v142或v143配置可能使用不同的生成器和工具链版本，导致发布产物不可复现。(github.com)请使用固定镜像，例如
windows-2022，或显式安装并验证所需工具链。建议改动
- os: windows-latest + os: windows-2022🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 204 - 256, Replace the windows-latest runner in every VS2019 and VS2022 matrix entry with a fixed Windows image such as windows-2022, keeping the existing v142/v143, architecture, and configuration combinations unchanged.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 46-47: 更新 release workflow 中使用版本和工件路径的逻辑：不要将 github.ref 或
github.ref_name 直接插入脚本、版本或路径。将其通过环境变量传入，在校验后生成并复用不含路径分隔符的安全 slug；原始 tag
仅保留用于日志输出，并确保 INPUT_VERSION 等下游值使用该安全 slug。
- Around line 135-140: Update the official release output configuration around
release_draft and release_make_latest so it does not enable both simultaneously.
Set release_make_latest to false when release_draft remains true, preserving the
existing draft workflow; any later promotion to latest must occur separately
after publication.
- Around line 345-360: Update the MSYS2 build step around “Build with MSYS2” to
enable fail-fast behavior with set -euo pipefail, and ensure each failure-prone
setup or CMake command stops the script before artifact collection. Apply the
corresponding explicit failure exits to the preceding CMD and MSYS2 build steps
as requested, and validate that at least one .a library exists before uploading
artifacts.
- Around line 362-380: 在“Download and Setup WinLibs GCC”步骤中为每个矩阵项增加对应 ZIP 的
SHA-256 配置，并在 Invoke-WebRequest 成功后、Expand-Archive 执行前计算 mingw64.zip 的哈希并与
matrix 中的期望值严格比较；校验失败时输出错误并立即以失败状态终止工作流，校验通过后再继续解压。
- Around line 173-186: 为 nightly 发布流程增加并发保护，使用工作流级别或相关 job 的 concurrency 配置按
master-nightly 分组，并取消正在运行的旧任务；确保较旧提交的工作流不会继续覆盖最新的 nightly 标签和发布。保留现有 nightly
输出设置，包括 version_tag、replace_existing_release 和发布名称配置。
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 204-256: Replace the windows-latest runner in every VS2019 and
VS2022 matrix entry with a fixed Windows image such as windows-2022, keeping the
existing v142/v143, architecture, and configuration combinations unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b4a1c75e-abab-4000-b6f0-49a7fa502040
📒 Files selected for processing (1)
.github/workflows/release.yml
1 participant
Summary by CodeRabbit