Fix uniffi release: publish directly via knope, react on the release event by pblazej · Pull Request #1256 · livekit/rust-sdks

pblazej · 2026-07-15T07:54:11Z

Every livekit-uniffi release has stranded (v0.1.2–v0.1.5 are unpublished drafts with no tags): the assets = "marker" draft was never published by CI, and the one-shot draft lookup also raced Knope's creation. Since the Dart/Flutter cdylibs — the only asset the GH release ever hosted — are experimental and deferred, the release no longer needs to stage assets, so this drops the marker and lets Knope publish the livekit-uniffi/v* release + tag directly (like every normal crate). uniffi-packages.yml now reacts to on: release: [published] (filtered to livekit-uniffi/v*) and publishes the Swift xcframework + Android AAR — no draft, no lookup/retry, no manual finalize. The release event fires only for genuine livekit-uniffi releases, so the "released this cycle" gate is free (same publish-directly spirit as the Node/npm flow; since Maven — unlike npm — can't dedupe versions, this event-gating replaces npm's implicit idempotency). ffi-builds.yml and its marker are left unchanged.

Note: on: release firing for a Knope-App-published release is expected (GitHub Apps trigger workflow events; knope-bot's merges already trigger push/pull_request here) but hasn't been exercised in this repo yet — workflow_dispatch is kept as a manual fallback, and it's worth confirming on the first release. The already-stranded drafts (v0.1.2–v0.1.5) are left untouched (non-destructive); publish/clean them up manually as desired.

🤖 Generated with Claude Code

pblazej · 2026-07-15T14:43:54Z

@ladvoc feel free to close it, there must be some more elegant solution to both this and normal ffi

…event Every livekit-uniffi release stranded (v0.1.2-v0.1.5 are unpublished drafts, no tags): the `assets = "marker"` draft was never published by CI, and the one-shot draft lookup raced knope's creation. Since the Dart/Flutter cdylibs (the only asset the GH release hosted) are experimental and deferred, the release no longer needs to stage assets, so drop the marker. knope now publishes the livekit-uniffi release + tag directly, like every normal crate. uniffi-packages.yml reacts to `on: release: [published]` (filtered to livekit-uniffi/v*) and publishes the Swift xcframework + Android AAR — no draft, no lookup/retry, no manual finalize. The release event fires only for genuine livekit-uniffi releases, so the "released this cycle" gate is free (matches the node publish-directly model; Maven, unlike npm, can't dedupe, so this event-gating replaces node's implicit idempotency). ffi-builds.yml and its marker are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ladvoc

Generally makes sense to me, but I will defer to @lukasIO for the Knope config.

devin-ai-integration

Devin Review found 1 new potential issue.

View 3 additional findings in Devin Review.

devin-ai-integration · 2026-07-30T08:20:29Z

        run: |
-          MANUAL_TAG="${{ inputs.tag_name }}"
-          if [ -n "$MANUAL_TAG" ]; then
-            TAG="$MANUAL_TAG"
-            echo "Using manually provided tag: '$TAG'"
-          else
-            TAG=$(gh release list --repo "${{ github.repository }}" \
-              --json 'isDraft,tagName' \
-              --jq "[.[] | select(.isDraft and (.tagName | startswith(\"${TAG_PREFIX}\")))] | first | .tagName // empty")
-            echo "Resolved livekit-uniffi draft release tag: '${TAG:-<none>}'"
-          fi
+          TAG="${{ github.event.release.tag_name || inputs.tag_name }}"
          echo "tag_name=${TAG}" >> "$GITHUB_OUTPUT"
-          # Strip the "livekit-uniffi/v" prefix to get the hosting-repo tag (e.g., 0.0.7)
-          VERSION="${TAG#${TAG_PREFIX}}"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          # Strip the "livekit-uniffi/v" prefix to get the package version (e.g. 0.1.6).
+          echo "version=${TAG#livekit-uniffi/v}" >> "$GITHUB_OUTPUT"


🟨 Release tag name is interpolated directly into a shell command

The new resolve-tag step embeds the release tag straight into a shell assignment (TAG="${{ github.event.release.tag_name || inputs.tag_name }}" at .github/workflows/uniffi-packages.yml:44). GitHub expression interpolation happens before the shell runs, so a tag name containing quotes/$(...)/backticks becomes part of the executed script. The value comes from a release/tag name (or a manual dispatch input), both of which require write access to create, so exploitability is limited — but the resulting shell content is attacker-influenced and the job runs with the repo's token and feeds the tag into downstream publish jobs.

Was this helpful? React with 👍 or 👎 to provide feedback.

Wire the existing uniffi-cdylib.yml into uniffi-packages.yml so every livekit-uniffi release carries the build-<triple>.zip archives (and sha256 sidecars) the Dart build hook downloads at consumer build time. The assets attach to the already-published release, so the knope assets marker stays off (a draft-based flow stranded releases before, #1256). Since this activates the previously dormant uniffi-cdylib.yml on every release, also bind its tag name through env instead of template expanding it into the upload script: tag names may contain shell metacharacters (Actions script injection). The changeset cuts the release that carries the first assets.

pblazej requested a review from ladvoc as a code owner July 15, 2026 07:54