build(flatpak): add CI build job, update metainfo, fix JVM heap for runners#653
build(flatpak): add CI build job, update metainfo, fix JVM heap for runners#653nitheeshdr wants to merge 3 commits into
Conversation
- Add `build-flatpak` job to the release workflow using flatpak/flatpak-github-actions/flatpak-builder@v6; produces a GitHub-Store-x86_64.flatpak bundle uploaded as the `linux-flatpak` artifact and included in the draft release. - Update release job: add `build-flatpak` to `needs`, stage `linux-flatpak/*.flatpak` files, include in the completeness guard. - Reduce Gradle JVM heap in the Flatpak build from -Xmx6g/-XX:MaxMetaspaceSize=2g to -Xmx4g/-XX:MaxMetaspaceSize=1g so the build fits within GitHub Actions ubuntu-latest runners (7 GB total RAM). - Add releases 1.7.0 through 1.8.2 to metainfo XML so the Flathub listing shows a complete, up-to-date release history. Closes OpenHub-Store#208
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR adds official Flatpak build and release support: a new GitHub Actions job builds a Linux Flatpak artifact, the release staging copies and counts staged ChangesFlatpak Build Pipeline and Configuration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR wires the existing Flatpak packaging manifest into CI and fixes two pre-existing issues that blocked a working build.
Confidence Score: 5/5Safe to merge — all three changed files make straightforward, well-scoped additions with no logic regressions. The CI job is correctly structured: content-addressed cache key, explicit artifact guard ( No files require special attention. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[push to generate-installers] --> B[build-windows]
A --> C[build-macos x64]
A --> D[build-macos arm64]
A --> E[build-linux]
A --> F[build-flatpak]
B --> G[sign-windows]
C --> H[merge-macos-artifacts]
D --> H
G --> R[release: Draft release]
H --> R
E --> R
F --> R
R --> S[Stage all artifacts]
S --> T{Completeness guard}
T -- all groups present --> U[Create/update draft release]
T -- any group missing --> V[Fail: list missing groups]
style F fill:#90EE90,stroke:#333
style U fill:#90EE90,stroke:#333
Reviews (3): Last reviewed commit: "fix(flatpak): add permissions block and ..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-desktop-platforms.yml:
- Around line 513-514: The checkout step "Checkout code" using
actions/checkout@v4 should explicitly disable persisting GitHub credentials: add
the key persist-credentials: false under that step (the step that has name
"Checkout code" and uses "actions/checkout@v4") so credentials are not written
into .git/config and cannot be leaked into build artifacts.
- Around line 509-532: The build-flatpak job currently inherits workflow-level
permissions; add an explicit permissions block on the build-flatpak job to
follow least-privilege practices by restricting access to only what the job
needs (e.g., set permissions: contents: read) so the job can read the repository
and still upload artifacts via the existing actions/upload-artifact step; update
the job named build-flatpak to include this permissions block.
- Line 514: Replace the mutable action tags with immutable commit SHAs: locate
the three uses entries referencing actions/checkout@v4,
flatpak/flatpak-github-actions/flatpak-builder@v6, and
actions/upload-artifact@v4 and update each to the corresponding commit SHA (the
full 40-char commit hash) instead of the tag; follow the same pattern used for
the SignPath action (which is pinned to a commit SHA) to ensure supply-chain
security and reproducibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8057a21a-4c73-48f9-bfe3-23663cb567cf
📒 Files selected for processing (3)
.github/workflows/build-desktop-platforms.ymlpackaging/flatpak/zed.rainxch.githubstore.metainfo.xmlpackaging/flatpak/zed.rainxch.githubstore.yml
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Fetch commit SHAs for action version tags
echo "=== actions/checkout@v4 ==="
gh api repos/actions/checkout/git/refs/tags/v4 --jq '.object.sha'
echo "=== flatpak/flatpak-github-actions/flatpak-builder@v6 ==="
gh api repos/flatpak/flatpak-github-actions/git/refs/tags/flatpak-builder/v6 --jq '.object.sha' 2>/dev/null || \
echo "Note: flatpak-builder may use a different ref structure; check manually"
echo "=== actions/upload-artifact@v4 ==="
gh api repos/actions/upload-artifact/git/refs/tags/v4 --jq '.object.sha'Repository: OpenHub-Store/GitHub-Store
Length of output: 506
🏁 Script executed:
# Examine the workflow file around the mentioned lines
cat -n .github/workflows/build-desktop-platforms.yml | sed -n '125,135p'
cat -n .github/workflows/build-desktop-platforms.yml | sed -n '510,530p'Repository: OpenHub-Store/GitHub-Store
Length of output: 1638
Pin action references to commit SHAs for supply chain security.
Actions at lines 514, 517, and 526 are referenced by mutable tags (@v4, @v6) instead of immutable commit SHAs. A compromised or force-pushed tag could inject malicious code. Pin to specific commit hashes as demonstrated by the SignPath action at line 131.
Update:
- Line 514:
actions/checkout@v4→ pin to specific commit SHA - Line 517:
flatpak/flatpak-github-actions/flatpak-builder@v6→ pin to specific commit SHA - Line 526:
actions/upload-artifact@v4→ pin to specific commit SHA
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 513-514: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 514-514: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-desktop-platforms.yml at line 514, Replace the
mutable action tags with immutable commit SHAs: locate the three uses entries
referencing actions/checkout@v4,
flatpak/flatpak-github-actions/flatpak-builder@v6, and
actions/upload-artifact@v4 and update each to the corresponding commit SHA (the
full 40-char commit hash) instead of the tag; follow the same pattern used for
the SignPath action (which is pinned to a commit SHA) to ensure supply-chain
security and reproducibility.
|
Want your agent to iterate on Greptile's feedback? Try greploops. |
1 participant
Summary
Closes #208.
The Flatpak packaging infrastructure (
packaging/flatpak/) is already onmain. This PR wires it into CI and fixes two issues that blocked a working build:build-flatpak): runsflatpak/flatpak-github-actions/flatpak-builder@v6on every push togenerate-installers, producesGitHub-Store-x86_64.flatpak, and uploads it as thelinux-flatpakartifact. The bundle is staged and included in the draft release alongside.deb,.rpm, AppImage, and Arch packages.-Xmx6g -XX:MaxMetaspaceSize=2g. GitHub Actionsubuntu-latestrunners have 7 GB total RAM, leaving no headroom for the OS andflatpak-builderitself. Reduced to-Xmx4g -XX:MaxMetaspaceSize=1g, matching the project's standardGRADLE_OPTS.zed.rainxch.githubstore.metainfo.xmlpreviously only listed release 1.6.2. Added entries for 1.7.0, 1.8.0, 1.8.1, and 1.8.2 with dates and brief descriptions so the Flathub listing will show an accurate history once the app is submitted.Test plan
generate-installersbranch and verify thebuild-flatpakjob passesGitHub-Store-x86_64.flatpakappears in the draft release assetsflatpak-builder-lint manifest packaging/flatpak/zed.rainxch.githubstore.ymllocally (no errors expected)appstreamcli validate packaging/flatpak/zed.rainxch.githubstore.metainfo.xmlto verify new release entries are validSummary by CodeRabbit
New Features
Chores