Repository navigation
CI: version native helpers independently and split preview/release native pipelines - #1253
theoephraim wants to merge 2 commits into
Conversation
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
Two cache-contract gaps remain: Windows entries cannot be reused from Ubuntu, and entitlement/resource-only changes can reuse a stale macOS bundle.
Reviewed changes: Reviewed the shared cache-key action and the release/preview workflows that produce and consume native binaries.
- Shared cache keys: Release planning and PR cache checks now compute the same content-addressed keys on Ubuntu.
- Preview reuse: Preview builds use exact cache hits instead of source-change gates, with artifact downloads on misses and cancellation checks before publishing.
- Main cache warming: Release builds now populate signed/notarized caches on eligible non-publish pushes, and the obsolete signed-only macOS cache save is removed.
Native cache checks, builds, and preview publishing were skipped in this PR's CI; the findings below were verified against the workflow producers and upstream cache implementation.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the cache-contract fixes added since the previous Pullfrog review.
- Enabled cross-OS reuse: Enabled portable Rust binary cache saves so Ubuntu can find Windows entries; the hashed workflow change also invalidates old keys.
- Expanded macOS invalidation: Added entitlements and bundle resources to the shared hash so changes to those inputs rebuild the cached app.
Validated the fixes against the native build inputs and upstream cache implementation. Native cache checks, builds, and preview publishing were skipped in CI, so live cache reuse remains unverified.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
Important
The Rust cache-poisoning hardening still allows cached Cargo state to supply production executable bytes.
Reviewed changes: Reviewed the production cache-trust changes since the previous Pullfrog review.
- Rebuilt production Rust artifacts: Made varlock publishes always invoke the Rust build and download current-run artifacts instead of restoring native binary caches.
- Pinned macOS signing identity: Required the project's Apple team in cached-bundle signature verification before notarization and smoke checks.
Validated the Apple requirement syntax against upstream documentation and reproduced Cargo accepting a substituted executable as Fresh in an isolated fixture. Native builds and preview publishing were skipped in PR CI; signed macOS execution and live cache reuse remain unverified.
gpt-6.1-sol ｜ 𝕏
theoephraim
changed the title
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the pipeline separation and script compatibility changes since the previous Pullfrog review at 3349cbbc.
- Separated production builds: Removed release binary-cache reuse and disabled Cargo and Swift build caches before signing and publishing current-run artifacts.
- Removed preview signing secrets: Switched changed native helpers to unsigned Rust and ad-hoc signed macOS builds, with
--adhocbypassing signing-environment loading. - Reused published helpers: Added release-tag source checks that omit unchanged helpers from npm previews and fetch their published packages for standalone previews.
- Added preview cache gating: Shared content-addressed keys across preview producers and consumers, warmed unsigned caches on main, and test-built touched native inputs or workflows.
- Fixed script portability: Used Node-compatible module paths and a CLI guard that avoids executing output generation when imported.
Workflow validation passed with existing Depot runner labels allowed. Exercised source detection and the import guard, and verified the omitted-helper dependency contract against the workspace resolver and upstream pkg-pr-new behavior. Full native builds, live cache reuse, and preview publication remain unverified; no CI test-suite run was available for this head at inspection.
gpt-6.1-sol ｜ 𝕏
theoephraim
changed the title
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
varlock-website | c1a6dbc | Commit Preview URL Branch Preview URL |
Nov 03 2026, 09:12 PM |
There was a problem hiding this comment.
Important
Standalone previews can fail on helper version PRs by fetching a version that has not been published yet.
Reviewed changes: Reviewed the independent helper versioning and release-selection changes since the prior review at 75b0e2de.
- Separated helper versions: Removed varlock from the native fixed group, retained Rust platform lockstep, and added helper-to-varlock patch cascades.
- Added native bump enforcement: Required helper bump coverage for native source changes and replaced release-tag comparisons with pending-release detection.
- Updated release staging: Built only helpers in the publish set and fetched the remaining exact-version published binaries for checksums and CLI packaging.
- Shared published-helper fetching: Resolved re-cut helper versions from published varlock pins and reused the fetcher in standalone previews.
- Updated documentation: Explained independent helper versions and checksum verification under each varlock release.
Validated the changed workflows with actionlint and linted the three scripts. Exercised native gating, preview selection, and published-helper fetching; reproduced the version-PR failure in an isolated worktree. Full native builds and live preview publication remain unverified.
gpt-6.1-sol ｜ 𝕏
138eea1 to
679220c
Compare
|
The changes in this PR will be included in the next version bump.
|
There was a problem hiding this comment.
Important
No new issues found in this delta. The previously reported standalone-preview failure on helper version PRs remains unresolved, so approval is still withheld.
Reviewed changes: Reviewed the net changes since 138eea1a, separating the rewritten history and updates inherited from main.
- Restricted bump coverage: Required native source changes to have a helper bump file introduced on the current branch, rather than accepting an inherited bump from main.
- Installed preview dependencies: Added dependency installation before standalone-preview planning so native detection uses the repository's pinned bumpy.
Native-source gating and ESLint passed. Verified branch attribution against the installed bumpy's actual output. CI completed build-and-test and all three Rust builds; the macOS build was still running at inspection. Live standalone-preview publication remains unverified.
gpt-6.1-sol ｜ 𝕏
679220c to
c1a6dbc
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the native pending-release detection fix since 679220cf.
- Recognized unpublished helper versions: Added exact release-tag checks so standalone previews build unsigned helpers after versioning consumes their bump files, while already released sides retain the published-helper fallback.
Validated eight released/unpublished/pending-bump scenarios against the actual script, checked caller tag-fetch configuration and the bumpy tag naming contract, and ran ESLint. The previously reported standalone-preview issue is resolved. Live standalone-preview publication remains unverified because that workflow was skipped without its label.
gpt-6.1-sol ｜ 𝕏
c1a6dbc to
05ceba6
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the added release bump since c1a6dbc.
- Added a varlock patch release: Added an end-user note about independent native helper versions and enabled this branch's npm preview without selecting native helper packages.
Verified actual PR preview selection and traced staging and exact-version dependency resolution. bumpy check exited successfully with existing Rust helper README bump warnings. Preview publication was still running at inspection, so a live preview install remains unverified.
gpt-6.1-sol ｜ 𝕏
varlock
@varlock/astro-integration
@varlock/cloudflare-integration
@varlock/nuxt-integration
@varlock/vite-integration
@varlock/native-helper-darwin
@varlock/1password-plugin
@varlock/bitwarden-plugin
@varlock/keepass-plugin
@varlock/pass-plugin
@varlock/proton-pass-plugin
commit: |
05ceba6 to
08e01b2
Compare
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes: Reviewed the CodeQL trigger changes since 05ceba6.
- Narrowed native analysis triggers: Restricted Swift analysis to its package source tree and Rust analysis to
src/,Cargo.toml, andCargo.lock, while retaining JavaScript/TypeScript analysis for excluded build scripts and full scheduled scans.
Validated the patterns with 19 targeted checks and compared them against the current native manifests and source layout. Live CodeQL analysis remains unverified; language detection was still running at inspection.
gpt-6.1-sol ｜ 𝕏
There was a problem hiding this comment.
Important
The temporary pipeline-test changes need to be removed before merging; they currently also affect production releases.
Reviewed changes: Reviewed the native preview test additions since 08e01b2.
- Added a darwin helper bump: Selected the macOS helper for this branch's npm preview without selecting Rust helpers.
- Added visible build markers: Inserted a disabled menu item and a
pipelineTestfield in the Swift helper'sstatusresponse.
Verified actual preview selection, native bump coverage, and production build paths. bumpy check exited successfully with existing Rust README warnings. The macOS preview build was still running at inspection, so live marker verification remains untested.
gpt-6.1-sol ｜ 𝕏
| "@varlock/native-helper-darwin": patch | ||
| --- | ||
|
|
||
| TEMPORARY pipeline test for PR 1253, do not merge |
There was a problem hiding this comment.
[P2] This temporary bump is a real production release input, and the menu/status markers are unconditional rather than preview-only. If merged as-is, the next release would publish a signed macOS helper displaying PR 1253 preview helper build and include the temporary test message in its changelog.
Technical details
# Remove the pipeline-test artifacts before merge
## Affected sites
- `.bumpy/zz-temp-pipeline-test.md:2-5`: schedules a darwin patch release with temporary changelog text.
- `packages/encryption-binary-swift/swift/Sources/VarlockEnclave/StatusBarMenu.swift:67-70`: inserts the test marker in every build mode.
- `packages/encryption-binary-swift/swift/Sources/VarlockEnclave/main.swift:170`: adds the temporary status field in every build mode.
- `.github/workflows/release.yaml:121-129`: builds selected darwin releases from these same sources with `mode: release`.
## Required outcome
- After preview validation, remove the temporary bump file and both Swift markers before merging.
- Retain the independent-versioning changes and their existing varlock patch bump.
Problem
varlockrebuilt all native binaries, including a Developer ID signed macOS build. PR CI's cache keys never matched whatrelease.yamlsaved, and main's caches expired after 7 idle days anyway.OP_CI_TOKENafter running the branch's ownbun installand build. That token reads the wholeVarlockCIvault (Apple cert, notarization password,OVSX_PAT, Azure IDs).target/+ registry, Swift.build). Cache keys are predictable, and any job in main's cache scope (schedule,workflow_run, a compromised dependency in a push run such as the nightlynext@canarytests) can save an entry first. A planted Cargo or Swift build output would then be signed with our Developer ID, notarized, and published.varlock, so every varlock release had to republish (and so rebuild) binaries that almost never change.Fix
Native helpers are versioned independently
@varlock/native-helper-*leave the bumpyfixedgroup withvarlock. A helper is only released when its binary changes.varlockstill pins exact versions (workspace:*), so each varlock version maps to one set of released binaries, and a helper bump cascades a varlock patch release carrying the new pin. The three Rust helpers stay afixedgroup (one crate builds them).scripts/native-sources.tsnow failsbuild-and-testwhen a branch changes a side's native sources and no bump file on that branch names one of its helpers (a bump file already on main does not count), printing thebumpy addcommand. Bump typenonecovers changes that do not affect the shipped binary (this PR adds one for the dev-onlybuild-swift.ts --adhocflag). Version-PR branches are exempt since they consume the bump files.Releases
release.yamlbuilds, signs, and notarizes natives from source only for helpers in the publish set. No binary caches and no build caches. For helpers not being released, the release job stages the published version varlock pins (scripts/fetch-native-helpers.ts), which feedsSHA256SUMS.txtand the CLI binaries. npm versions are immutable, so a pinned version is always what our release workflow published. Re-cuts (binary-release.yaml,build-cli-binaries-macos.yaml) read the helper versions from the published varlock'soptionalDependenciesinstead of assuming@<varlock version>.PR previews never sign anything
varlockresolves the published, signed, notarized helpers at their pinned version. This is the common case and needs no native jobs, caches, or secrets.build-swift.ts --adhocnever loads the 1Password-backed env schema), unsigned Rust. No secrets are passed. Builds are cached by a content hash of the native sources and build workflows, andtest.yamlon main saves the same caches while a helper release is pending, so other PRs reuse them.build-native-*.yamltest-builds that side even when its preview uses the published helpers, so a broken build fails in its own PR, not at release.binary-preview.yaml(labeled SEA previews) follows the same rule.Also: the win32 preview binary cache is saved with
enableCrossOsArchive, so the Ubuntu restore finds it.Also: CodeQL's Swift and Rust jobs now trigger only on Swift sources (
encryption-binary-swift/swift/) and Rust sources (src/,Cargo.toml,Cargo.lock), not on build scripts or docs in those packages (the scripts are TypeScript, covered by the JS analysis).Implications
dev.varlock.enclave, "Varlock Secure Enclave" menu title), sharing release keychain grants and the daemon. That is the same binary users run; the preview marker now only appears when the preview contains unreleased native code. Local dev checkouts andpack:localstill use local builds.Why ad-hoc is fine for previews (verified locally)
~/.config/varlock/secure-enclave/keys, not bound to a code identity. The 1.23.0 release helper, a local Developer ID dev build, and an ad-hoc build each decrypt keys generated by the others (--no-authkeys).dev.varlock.enclave+ team) and local dev (dev.varlock.enclave.dev+ team) are already separate identities and stable across rebuilds. An ad-hoc preview's identity is its cdhash, so each preview build asks for keychain access again, under the separatedev.varlock.enclave.previewbundle id.How to verify
build-swift.tsand the build workflows, so its CI test-builds both sides unsigned with no secrets;build-native-macosruns the Secure Enclave and JS interop tests against the ad-hoc bundle.native-sources.ts/check-release-packages.tson scratch branches: Swift change without a helper bump fails with the fix command; with anonebump passes; with a darwinpatchbump the preview includes darwin + varlock and builds macOS only; a version-PR style helper version bump passes.fetch-native-helpers.ts --varlock-version 1.23.0stages all four helpers and the darwin bundle passes a team-pinnedcodesign --verify.varlockpatch bump, which adds a changelog note about the versioning change) includes no helper packages, so itsrelease-preview-packagesstages no natives and the previewvarlockdepends on@varlock/native-helper-*@1.24.0from npm.staged @varlock/native-helper-...@1.24.0.