Feat: Publish prebuilt abctl and authbridge-proxy release binaries - #715
Conversation
New users had to `go build` abctl and authbridge-proxy locally. Both are pure-Go (CGO_ENABLED=0, no cgo), so ship prebuilt binaries on each v* tag. Add .github/workflows/release-binaries.yaml: on a v* tag, cross-compile both binaries for linux+darwin × amd64+arm64 (GOWORK=off CGO_ENABLED=0, each cmd module resolves authlib via its replace => ../../authlib — no workspace), package tar.gz, generate SHA-256 checksums, and attach them to the GitHub Release via the gh CLI. workflow_dispatch does a dry build that uploads workflow artifacts only (no Release). All actions are pinned to commit SHAs (Verify Action Pinning). Linux builds are fully static; darwin builds are portable (Go links libSystem) and unsigned. Add version stamping: `var version = "dev"` + a `--version` flag to cmd/abctl and cmd/authbridge-proxy, injected via -ldflags -X main.version; authbridge-proxy also logs its version at startup. Document downloads in authbridge/README.md: download + checksum verify, the macOS Gatekeeper (xattr) note, and the static-vs-portable distinction. Verified: all 8 os/arch combos cross-build; --version prints the injected tag; linux binaries are `statically linked` (file); gofmt/go vet clean. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
|
Warning Review limit reached
Next review available in: 35 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds GitHub Actions automation to build and publish versioned ChangesBinary release and version reporting
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/release-binaries.yaml (1)
30-31: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAvoid persisting the release token in checkout credentials.
This job has
contents: write, while publishing already receivesGH_TOKENexplicitly. Disable credential persistence so the build steps do not retain an authenticated Git credential.Proposed hardening
- name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4 + with: + persist-credentials: false
actions/checkoutpersists credentials by default and supports opting out withpersist-credentials: false. (github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-binaries.yaml around lines 30 - 31, Update the Checkout step using actions/checkout to set persist-credentials to false, ensuring the release token is not retained in Git credentials while leaving the existing explicit GH_TOKEN publishing flow unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@authbridge/cmd/authbridge-proxy/main.go`:
- Around line 60-63: Run gofmt on the listed abctl Go files—json_colorize.go,
styles.go, e2e_test.go, and templates_test.go—and include the resulting
formatting-only changes; do not alter behavior or unrelated files.
In `@authbridge/README.md`:
- Around line 29-30: Update the macOS binary guidance in the README to retain
only the xattr quarantine-removal command and remove the codesign --sign -
ad-hoc signing alternative.
---
Nitpick comments:
In @.github/workflows/release-binaries.yaml:
- Around line 30-31: Update the Checkout step using actions/checkout to set
persist-credentials to false, ensuring the release token is not retained in Git
credentials while leaving the existing explicit GH_TOKEN publishing flow
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 850fb4a1-599f-493a-bb85-c621d54c3706
📒 Files selected for processing (4)
.github/workflows/release-binaries.yamlauthbridge/README.mdauthbridge/cmd/abctl/main.goauthbridge/cmd/authbridge-proxy/main.go
| // version is the authbridge-proxy build version, overridden at release time | ||
| // via -ldflags "-X main.version=<tag>". Defaults to "dev" for local builds. | ||
| var version = "dev" | ||
|
|
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for module in authbridge/cmd/abctl authbridge/cmd/authbridge-proxy; do
unformatted="$(find "$module" -type f -name '*.go' -print0 | xargs -0 gofmt -l)"
test -z "$unformatted" || {
printf 'Run go fmt ./... in %s:\n%s\n' "$module" "$unformatted" >&2
exit 1
}
(cd "$module" && GOWORK=off go vet ./...)
done
proxy_go_version="$(cd authbridge/cmd/authbridge-proxy && go env GOVERSION)"
case "$proxy_go_version" in go1.25.*) ;; *)
echo "authbridge-proxy must use Go 1.25; got $proxy_go_version" >&2
exit 1
esacRepository: rossoctl/cortex
Length of output: 357
Run go fmt on the unformatted files before merge.
authbridge/cmd/abctl still has Go files that need formatting:
authbridge/cmd/abctl/tui/json_colorize.goauthbridge/cmd/abctl/tui/styles.goauthbridge/cmd/abctl/cluster/e2e_test.goauthbridge/cmd/abctl/edit/templates_test.go
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@authbridge/cmd/authbridge-proxy/main.go` around lines 60 - 63, Run gofmt on
the listed abctl Go files—json_colorize.go, styles.go, e2e_test.go, and
templates_test.go—and include the resulting formatting-only changes; do not
alter behavior or unrelated files.
Source: Coding guidelines
| - **macOS** binaries are portable but unsigned; after extracting, clear the Gatekeeper | ||
| quarantine once: `xattr -dr com.apple.quarantine ./abctl` (or `codesign --sign - ./abctl`). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Remove the ad-hoc signing alternative.
codesign --sign - creates an identityless ad-hoc signature; Apple documents that such signatures cannot pass Gatekeeper. Keep the quarantine-removal command, but do not present ad-hoc signing as an alternative. (developer.apple.com)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@authbridge/README.md` around lines 29 - 30, Update the macOS binary guidance
in the README to retain only the xattr quarantine-removal command and remove the
codesign --sign - ad-hoc signing alternative.
Update cmd/abctl/README.md and the weather-agent abctl demo to lead with downloading a prebuilt abctl from the Releases page (linking the new "Download prebuilt binaries" section in authbridge/README.md), keeping build-from-source as an alternative. Follows the release-binaries workflow added in this PR. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
esnible
left a comment
esnible
left a comment
There was a problem hiding this comment.
This is a clean, well-scoped PR adding a v*-tag-triggered workflow that cross-compiles abctl and authbridge-proxy (linux/darwin × amd64/arm64), publishes tarballs + sha256 checksums to the Release, plus --version flags and docs.
Security hygiene is excellent: minimal top-level contents: read with contents: write scoped to the job, untrusted inputs.tag passed via env (never interpolated into the script), all actions SHA-pinned (verified against the pins already used in build.yaml/ci.yaml/scorecard.yaml), set -euo pipefail, and the publish step gated on github.ref_type == 'tag'. Both main.go files already import fmt, so the --version additions compile cleanly (confirmed by green Go CI).
Only finding is cosmetic (see inline nit): the action-pin version comments mislabel their SHAs.
Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, Go, Docs, embedded Shell
Agent/IDE config (.claude/.vscode): none
Commits: 2 commits, all signed-off: yes
CI status: passing (all checks green; Spellcheck skipped)
Assisted-By: Claude Code
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v5 | ||
| with: | ||
| go-version-file: authbridge/cmd/authbridge-proxy/go.mod | ||
|
|
There was a problem hiding this comment.
nit: The SHAs here are correct and match the pins already used elsewhere in the repo, but the trailing version comments are stale/wrong:
actions/checkout@9c091bb2...is v7.0.0 (not# v4)actions/setup-go@924ae3a1...is v6 (not# v5, line 40)actions/upload-artifact@043fb46d...is v7.0.1 (not# v4, line 95)
Compare build.yaml/ci.yaml/scorecard.yaml, which label the same SHAs. The pins themselves are safe; only the comments mislabel the version. Worth correcting so they don't drift from reality.
github-project-automation
Bot
moved this from New/ToDo
to Done
in Rossoctl Issue Prioritization
3 participants
Summary
New users currently have to
go buildabctlandauthbridge-proxylocally. Both are pure-Go (CGO_ENABLED=0, no cgo in their trees), so this ships prebuilt, downloadable binaries on everyv*tag — no local toolchain needed.Change
.github/workflows/release-binaries.yaml(new) — on av*tag:abctl+authbridge-proxyfor linux + macOS × amd64 + arm64 (8 artifacts), using the sameGOWORK=off CGO_ENABLED=0per-module build the Dockerfiles already use (eachcmd/*resolves authlib via itsreplace => ../../authlib, so no workspace is needed), plus-trimpathand-ldflags "-s -w -X main.version=<tag>";<bin>_<tag>_<os>_<arch>.tar.gz, generateschecksums.txt(sha256), and attaches all to the GitHub Release via theghCLI;workflow_dispatchdoes a dry build that uploads workflow artifacts only (no Release), for testing.Version stamping —
cmd/abctlandcmd/authbridge-proxygainvar version = "dev"+ a--versionflag (injected at release via-ldflags -X main.version);authbridge-proxyalso logs its version at startup.Docs —
authbridge/README.mdgains a "Download prebuilt binaries" section: download, checksum verify, the macOS Gatekeeperxattrnote, and the static-vs-portable distinction.Notes
file→statically linked); macOS binaries are portable but linklibSystem(Go can't fully static-link darwin) and are unsigned — users clear the Gatekeeper quarantine once (xattr -dr com.apple.quarantine). Notarization (Apple Developer ID) is out of scope.go install; a source-tree cross-build works as-is (proven by the existing Dockerfiles).Testing Instructions
--versionprints the injected tag;fileconfirms linux builds are statically linked;gofmt/go vetclean.v0.0.0-testtag on a fork to confirm the 8 tarballs +checksums.txtattach to that Release andsha256sum -cpasses; on macOS the binary runs after clearing quarantine.Follow-up (not in this PR)
abctlhas no PR-time CI today; adding it toci.yaml's Go matrix would catch a broken abctl before tag time. Kept separate to avoid surfacing pre-existing abctl lint in this PR.Assisted-By: Claude (Anthropic AI) noreply@anthropic.com
Summary by CodeRabbit
New Features
abctlandauthbridge-proxyacross supported Linux and macOS platforms.--versionsupport toabctlandauthbridge-proxy.Documentation