fix: point the website's offline release fallback at 0.0.38 - #58
Merged
Conversation
site/server.mjs serves RELEASE_FALLBACK whenever GitHub's release API is unreachable or rate limited. It was still pinned to v0.0.30 with that release's digests, so any API hiccup would quietly hand every visitor a build eight patches old from the download buttons - a failure that is invisible until someone reports installing the wrong version. Updates the tag and all six artifact digests to the verified 0.0.38 artifacts, and derives the download URLs from a single tag constant so the tag and the URLs cannot drift apart. Adds a regression test that fails when the fallback goes stale: the tag must equal package.json, all five desktop artifacts must be named for the shipping version, and all six digests must be present and distinct. The existing offline-metadata contract hardcoded 0.0.30 as its expected answer, which would have kept passing against a stale fallback forever, so it now derives the expected version from package.json too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe website release fallback now targets ChangesRelease fallback
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@site/server.mjs`:
- Around line 43-48: Update the fallback release entries used by latestRelease()
to reference a published release with valid download URLs and matching
checksums, or publish the existing v0.0.38 release so all six entries resolve
successfully. Verify each fallback asset, including RELEASES, is available when
the GitHub API is unavailable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2b1c48da-d1e8-43bc-8381-9482aff2d78c
📒 Files selected for processing (2)
site/server.mjstest/site.mjs
Comment on lines
+43
to
+48
| ["1Helm-0.0.38-arm64.dmg", "468a5b8d59a23c4419331db20dcdb955f088a046add48296b5d5aa8450120527"], | ||
| ["1Helm-0.0.38-mac-arm64.zip", "4135defe285f9d7e480802d17d81ff37d083a90f6d7dc928f7061a73f9861302"], | ||
| ["1Helm-0.0.38-linux-node.tgz", "12d59534b66c325891d5433eb2c7ab8990ee67c9d56a805b65b9633030c424fc"], | ||
| ["1Helm-0.0.38-windows-x64-setup.exe", "0689afadc996319a22d6a3419d39725453bc46d9bdd8857463a56b7bcf738590"], | ||
| ["1Helm-0.0.38-full.nupkg", "2b25a71f6b3bbb96d7a62cca4bdbd421daed22a1005b1e93d31a77b3d61e86ae"], | ||
| ["RELEASES", "a20bf26fc174a48a2ccd30c4b7ab0289d72c00489761981c89a7eb3c9842f454"], |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
tag="$(sed -nE 's/^const RELEASE_FALLBACK_TAG = "([^"]+)";/\1/p' site/server.mjs)"
fallback="$(mktemp)"
published="$(mktemp)"
trap 'rm -f "$fallback" "$published"' EXIT
sed -nE \
's/^[[:space:]]*\["([^"]+)", "([a-f0-9]{64})"\],$/\1 sha256:\2/p' \
site/server.mjs | sort > "$fallback"
curl -fsSL \
-H 'Accept: application/vnd.github+json' \
"https://api.github.com/repos/gitcommit90/1Helm/releases/tags/${tag}" |
jq -r '.assets[] | "\(.name) \(.digest)"' | sort > "$published"
diff -u "$published" "$fallback"Repository: gitcommit90/1Helm
Length of output: 206
🏁 Script executed:
set -euo pipefail
printf '%s\n' '--- tag and fallback entries ---'
sed -n '1,70p' site/server.mjs
printf '%s\n' '--- remotes ---'
git remote -v
printf '%s\n' '--- local references to release metadata ---'
rg -n '1Helm-0\.0\.38|468a5b8d59a23c4419331db20dcdb955f088a046add48296b5d5aa8450120527|RELEASES' . --glob '!site/server.mjs'
printf '%s\n' '--- GitHub release endpoints ---'
for url in \
'https://api.github.com/repos/gitcommit90/1Helm/releases/tags/v0.0.38' \
'https://github.com/gitcommit90/1Helm/releases/tag/v0.0.38' \
'https://github.com/gitcommit90/1Helm/releases/expanded_assets/v0.0.38'; do
echo "URL: $url"
curl -L -sS -o /tmp/release-response -w 'HTTP %{http_code}\n' \
-H 'Accept: application/vnd.github+json' \
-H 'User-Agent: Mozilla/5.0' "$url"
head -c 300 /tmp/release-response
echo
doneRepository: gitcommit90/1Helm
Length of output: 9334
🏁 Script executed:
set -euo pipefail
tag_ref="$(git ls-remote --tags https://github.com/gitcommit90/1Helm.git 'refs/tags/v0.0.38' 'refs/tags/v0.0.38^{}' || true)"
printf '%s\n' '--- tag refs ---'
printf '%s\n' "$tag_ref"
printf '%s\n' '--- release asset status ---'
while IFS=$'\t' read -r name digest; do
url="https://github.com/gitcommit90/1Helm/releases/download/v0.0.38/$name"
status="$(curl -L -sS -o /dev/null -w '%{http_code} %{url_effective}' \
-H 'User-Agent: Mozilla/5.0' "$url" || true)"
printf '%s\t%s\t%s\n' "$name" "$digest" "$status"
done <<'EOF'
1Helm-0.0.38-arm64.dmg 468a5b8d59a23c4419331db20dcdb955f088a046add48296b5d5aa8450120527
1Helm-0.0.38-mac-arm64.zip 4135defe285f9d7e480802d17d81ff37d083a90f6d7dc928f7061a73f9861302
1Helm-0.0.38-linux-node.tgz 12d59534b66c325891d5433eb2c7ab8990ee67c9d56a805b65b9633030c424fc
1Helm-0.0.38-windows-x64-setup.exe 0689afadc996319a22d6a3419d39725453bc46d9bdd8857463a56b7bcf738590
1Helm-0.0.38-full.nupkg 2b25a71f6b3bbb96d7a62cca4bdbd421daed22a1005b1e93d31a77b3d61e86ae
RELEASES a20bf26fc174a48a2ccd30c4b7ab0289d72c00489761981c89a7eb3c9842f454
EOFRepository: gitcommit90/1Helm
Length of output: 1286
🏁 Script executed:
set -euo pipefail
printf '%s\n' '--- release resolution and consumers ---'
sed -n '68,125p' site/server.mjs
rg -n -C 4 'latestRelease|RELEASE_FALLBACK|browser_download_url|digest' site/server.mjs
printf '%s\n' '--- available tags and package version ---'
git ls-remote --tags https://github.com/gitcommit90/1Helm.git | tail -n 30
sed -nE 's/^[[:space:]]*"version":[[:space:]]*"([^"]+)".*/package version: \1/p' package.jsonRepository: gitcommit90/1Helm
Length of output: 9965
Publish the fallback release or update it to an existing release. The v0.0.38 tag is not published, and all six fallback download URLs return 404. When the GitHub API is unavailable, latestRelease() serves these dead URLs.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@site/server.mjs` around lines 43 - 48, Update the fallback release entries
used by latestRelease() to reference a published release with valid download
URLs and matching checksums, or publish the existing v0.0.38 release so all six
entries resolve successfully. Verify each fallback asset, including RELEASES, is
available when the GitHub API is unavailable.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
site/server.mjsservesRELEASE_FALLBACKwhenever GitHub's release API is unreachable or rate limited. It was still pinned to v0.0.30 with that release's digests — so any API hiccup would quietly hand every visitor a build eight patches old from the download buttons.This is the worst kind of bug for a launch: it never errors. It just serves the wrong version, and you only find out when someone reports installing something you didn't ship.
Fix
RELEASE_FALLBACK_TAGconstant so the tag and the URLs cannot drift apart.Digests are the locally verified artifacts from commit
ab97ecd:1Helm-0.0.38-arm64.dmg468a5b8d…05271Helm-0.0.38-mac-arm64.zip4135defe…13021Helm-0.0.38-linux-node.tgz12d59534…24fc1Helm-0.0.38-windows-x64-setup.exe0689afad…85901Helm-0.0.38-full.nupkg2b25a71f…86aeRELEASESa20bf26f…f454Regression coverage
New test fails when the fallback goes stale: the tag must equal
package.json, all five desktop artifacts must be named for the shipping version, and all six digests must be present and distinct.The pre-existing offline-metadata contract asserted
0.0.30as its expected answer — meaning it would have kept passing against a stale fallback indefinitely. It now derives the expected version frompackage.jsontoo.Verification
npm run ci: 119 tests, 0 failures.🤖 Generated with Claude Code
Summary by CodeRabbit