fix: set version env var

[UladzislauK-Writer]

Summary by CodeRabbit

• Chores

  • Updated the publish pipeline to pass the framework version from the release tag into the install step, aligning build artifacts with the tagged version.
  • Improves consistency and traceability of release builds across environments.

• Notes

  • No user-facing changes.

[coderabbitai]

Walkthrough

The publish workflow now exports WRITER_FRAMEWORK_VERSION from the extracted tag version and prefixes the install step command with this environment variable. No other steps or logic were changed.

Changes

Cohort / File(s)	Summary of Changes
GitHub Actions Publish Workflow .github/workflows/publish.yml	Modified install step to run: WRITER_FRAMEWORK_VERSION=${{ steps.extract_version.outputs.version }} poetry run alfred install.ci; no other workflow logic altered.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant GH as GitHub Actions
  participant EV as Extract Version Step
  participant CI as Install Step
  participant Pub as Publish Step

  Dev->>GH: Push tag
  GH->>EV: Run extract_version
  EV-->>GH: outputs.version
  GH->>CI: Run "alfred install.ci"<br/>with env WRITER_FRAMEWORK_VERSION=outputs.version
  CI-->>GH: Install completes
  GH->>Pub: Continue publish workflow
  Pub-->>Dev: Release process proceeds

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix: update publishing tag #1135 — Also changes .github/workflows/publish.yml, adjusting tag pattern that the version extraction depends on.
• feat: renew publishing to PyPI #1086 — Introduces/updates the extract-version step whose output this PR now uses to set WRITER_FRAMEWORK_VERSION.

Suggested reviewers

• raaymax

Poem

I hop through YAML fields at night,
Setting vars by tag’s soft light.
A nibble here—version in paw—
Install hops true, obeying law.
CI drums a gentle beat,
Release-carrots lined up neat. 🥕✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues Check	⚠️ Warning	Although the workflow now prefixes the install command with WRITER_FRAMEWORK_VERSION, the pull request does not include any changes to actually publish development releases as PyPI release candidates per AB-349, so it only partially addresses the linked issue.	Please extend the CI workflow to include or invoke the steps that build and upload the release candidate artifacts to PyPI using the newly set WRITER_FRAMEWORK_VERSION so that dev releases are published as intended.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title succinctly and accurately describes the core change of setting a version environment variable and follows conventional commit style without including extraneous details.
Out of Scope Changes Check	✅ Passed	All modifications are confined to the CI publish workflow and directly relate to passing the extracted version into the install step, with no unrelated or extraneous changes introduced.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch vlad/AB-349

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between f49625e and 0c6fd5d.

📒 Files selected for processing (1)

• .github/workflows/publish.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)

• GitHub Check: build (3.13)
• GitHub Check: build (3.10)
• GitHub Check: build (3.12)
• GitHub Check: build (3.9)
• GitHub Check: build (3.11)
• GitHub Check: build (3.12)
• GitHub Check: build (3.13)
• GitHub Check: tests (webkit)
• GitHub Check: tests (chromium)
• GitHub Check: tests (firefox)
• GitHub Check: build (3.11)
• GitHub Check: build (3.10)
• GitHub Check: build (3.9)

🔇 Additional comments (1)

.github/workflows/publish.yml (1)

52-52: WRITER_FRAMEWORK_VERSION placement is correct
install.ci runs both npm ci and npm run build, and the build injects WRITER_FRAMEWORK_VERSION into Vite (used in vite.config.ts/.custom.ts and BuilderSidebar.vue); since no other steps depend on it, keeping it inline is appropriate.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🧪 Early access (Sonnet 4.5): enabled

We are currently testing the Sonnet 4.5 model, which is expected to improve code review quality. However, this model may lead to increased noise levels in the review comments. Please disable the early access features if the noise level causes any inconvenience.

Note:

• Public repositories are always opted into early access features.
• You can enable or disable early access features from the CodeRabbit UI or by updating the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[hackerone-code]

HackerOne Code Security Review

🟢 Scan Complete: 1 Issue(s)
🟠 Validation Complete: One or more Issues looked potentially actionable, so this was escalated to our network of engineers for manual review. Once this is complete you'll see an update posted.

Here's how the code changes were interpreted and info about the tools used for scanning.

📖 Summary of Changes

The GitHub Actions workflow configuration for publishing was modified to include an additional environment variable WRITER_FRAMEWORK_VERSION during the dependency installation and code generation phase. This variable is dynamically set using the version extracted from the current tag, potentially enabling version-specific build or deployment behaviors.

File	Summary
.github/workflows/publish.yml	The workflow file was updated to include an additional environment variable WRITER_FRAMEWORK_VERSION when running the "install ci dependencies and generate code" step, which is set to the extracted version from the tag.

ℹ️ Issues Detected

NOTE: These may not require action!

Below are unvalidated results from the Analysis Tools that ran during the latest scan for transparency. We investigate each of these for accuracy and relevance before surfacing them as a potential problem.

How will I know if something is a problem?
When validation completes, any concerns that warrant attention prior to merge will be posted as inline comments. These will show up in 2 ways:

• Expert review (most cases): Issues will be posted by experts who manually reviewed and validated them. These are real HackerOne engineers (not bots) reviewing through an integrated IDE-like tool. You can communicate with them like any other reviewer. They'll stay assigned and get notified with commit & comment updates.
• Automatically: In cases where our validation checks have highest confidence the problem is legitimate and urgent. These will include a description of contextual reasoning why & actionable next steps.

File & Line

Issue

.github/workflows/publish.yml Line 52

The change adds an environment variable 'WRITER_FRAMEWORK_VERSION' to the CI installation command, which is derived from user-controlled input (GitHub tag). While the tag format is validated with a regex pattern, this value is passed directly to a command without additional validation. If the 'alfred install.ci' script uses this environment variable in an unsafe way (like in shell commands or eval statements), it could potentially lead to command injection.

🧰 Analysis tools

• [ ✅ ] HackerOne AI Code Analysis
• [ ✅ ] HackerOne AI Code Validation
• [ ✅ ] semgrep
• [ ✅ ] bandit

⏱️ Latest scan covered changes up to commit 0c6fd5d (latest)