ci: use env credentials for mobile builds#2289
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAndroid and iOS GitHub Actions workflows were simplified: local credential-save steps and explicit app id / output-upload/retention CLI flags were removed. Capgo build requests now run directly, receiving credentials, iOS provisioning map, and build-output configuration via environment variables. ChangesMobile Build Workflow Updates
Possibly Related PRs
Suggested Reviewers
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Merging this PR will not alter performance
Comparing 
Footnotes
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/build_mobile_ios.yml (1)
72-103: ⚖️ Poor tradeoffProvisioning profile parsing uses UTF-8 decoding of a binary CMS container, which is fragile.
iOS provisioning profiles are binary CMS-signed containers with an embedded plist. While the plist XML is embedded as plaintext, decoding the binary wrapper as UTF-8 can produce invalid sequences that may cause the regex to fail with certain profile structures. The code has no error handling beyond checking if the name match exists.
Since the job runs on
ubuntu-latest, macOS tools likesecurity cms -Dare unavailable. To improve robustness, either verify the regex approach works across varied provisioning profile structures, or use a Node.js CMS/PKCS#7 parsing library (e.g.,asn1.js,pkijs) to extract the plist cleanly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build_mobile_ios.yml around lines 72 - 103, The inline Bun script that builds provisioning_map_base64 currently decodes the base64 profile with Buffer.from(...).toString("utf8") and then uses a regex (nameMatch) to find the plist name, which is fragile for binary CMS containers; replace this by parsing the CMS/PKCS#7 container properly (e.g., use a Node PKCS#7/ASN.1 library such as pkijs or asn1.js) inside the bun script to extract the embedded plist XML, then run the existing nameMatch/decodeXml logic against that extracted plist string; add robust error handling around the parsing step so provisioning_map_base64 construction fails with a clear error if the CMS parsing or plist extraction fails.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/build_mobile_ios.yml:
- Around line 72-103: The inline Bun script that builds provisioning_map_base64
currently decodes the base64 profile with Buffer.from(...).toString("utf8") and
then uses a regex (nameMatch) to find the plist name, which is fragile for
binary CMS containers; replace this by parsing the CMS/PKCS#7 container properly
(e.g., use a Node PKCS#7/ASN.1 library such as pkijs or asn1.js) inside the bun
script to extract the embedded plist XML, then run the existing
nameMatch/decodeXml logic against that extracted plist string; add robust error
handling around the parsing step so provisioning_map_base64 construction fails
with a clear error if the CMS parsing or plist extraction fails.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 35b76873-c369-485d-a140-1bba5f0c46b2
📒 Files selected for processing (2)
.github/workflows/build_mobile_android.yml.github/workflows/build_mobile_ios.yml
riderx
force-pushed
the
codex/fix-mobile-build-env-credentials
branch
from
6ec2a3c to
e71d36c
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build_mobile_android.yml:
- Around line 55-57: The environment variable BUILD_OUTPUT_RETENTION_SECONDS is
set to a duration string ("7d") which the Capgo CLI rejects; change it to a
numeric seconds value (use "604800" for 7 days) in the workflow where
BUILD_OUTPUT_UPLOAD_ENABLED and BUILD_OUTPUT_RETENTION_SECONDS are defined so
the bunx `@capgo/cli` build request --platform android --path . invocation gets a
valid numeric retention value.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0f92c852-0dfd-4d9b-b98a-35ff2ff0ae4e
📒 Files selected for processing (2)
.github/workflows/build_mobile_android.yml.github/workflows/build_mobile_ios.yml
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
1 participant
Summary (AI generated)
build credentials savesteps.build requestthrough environment variables.Motivation (AI generated)
The iOS and Android GitHub Actions should not write local Capgo CLI build credentials in CI. The workflows should use GitHub secrets as environment variables on the build request itself, and the command should stay simple instead of running Bash helpers around it.
Business Impact (AI generated)
This restores the manual native mobile build workflows while keeping CI credential handling simpler: signing material stays in GitHub Actions environment variables for the single build request instead of being written into local Capgo CLI credential storage.
Test Plan (AI generated)
bun install --frozen-lockfilebun run lint:backendbun lintbun run cli:build && vue-tsc --noEmitshell: bash,set -euo, app-config step references, legacy provisioning profile secret, orbuild credentialscommand remains in the mobile build workflows.git diff --check -- .github/workflows/build_mobile_android.yml .github/workflows/build_mobile_ios.yml@capgo/cli@latest build request --helpfor supported build request credential fields.Screenshots (AI generated)
Not applicable. This is a GitHub Actions workflow change.
Checklist (AI generated)
bun run lint:backend && bun run lint.Summary by CodeRabbit