fix(release): use org-ci's attest job that names the environment by diazdesandi · Pull Request #62 · thaw-app/Floe

diazdesandi · 2026-10-31T22:16:17Z

Summary

Points release.yml at the org-ci commit whose attest job names the environment, so a real release can finish.

Scope: This PR changes one focused thing (bug fix or feature) plus minimal plumbing. Larger refactors need prior agreement in an issue.

Linked issue

Closes: N/A

PR Type

Area

Does this PR introduce a breaking change?

Yes - if yes, please describe the impact and migration path
No

What is the new behavior?

0.3.0's release (run 41200086639) failed at build / attest with Secret APPLE_APPLICATION_CERT is required, but not provided. Floe keeps those secrets only in prod, and the job named no environment. thaw-app/org-ci#26 fixed that, and this PR moves the pin to its merge, c3ccb74.

A real release now asks for prod approval once more, for the attest job. docs/DEVELOPMENT.md says so, and says a dry run can't test this job.

PR Checklist

The PR title follows Conventional Commits (e.g. fix(runtime): …); PR Metadata checks this.
I've built and run the app locally and verified that it works as expected.
I've run the relevant checks from docs/DEVELOPMENT.md (list them below), e.g. bun runtime/smoke.ts extensions/hello planets.
If I changed project.yml, I ran xcodegen generate and committed Floe.xcodeproj.
I've noted which macOS versions I tested on.
I've updated documentation as needed.
If this PR changes dependencies / lockfiles (Package.resolved, runtime/bun.lock, Actions pins, etc.), dependency-sca is green, or any .github/osv-scanner.toml suppression includes both reason and ignoreUntil (see Thaw/Floe Security Policy).

Checks run:

actionlint .github/workflows/release.yml: passes.

Known limitations / follow-ups

The fix is only proven by a real release. After this merges, the unpublished 0.3.0 tag moves to the merge commit and the release runs again.
sonar.projectVersion still says 0.1.0, which this PR leaves alone.

Other information

AI helped: Claude Code with Claude Opus 5.5 made the change and wrote this description.

Summary by CodeRabbit

Documentation
- Clarified that dry-run releases skip attestation, so only a real release tests that step.
- Specified that a real release requires three production approvals: one each for the build, attestation, and publishing stages. The updated guidance distinguishes dry-run behavior from the approval requirements for a real release.

Floe keeps its Apple secrets only in prod, and the attest job had no environment, so 0.3.0's release failed there after the build passed. Signed-off-by: René Jiménez <diazdesandi@proton.me>

strix-security · 2026-10-31T22:16:23Z

Strix Security Review

✅ No open security findings.

PR summary: Updates the pinned org-ci reusable build workflow to a commit that names the release environment on the attest job, so a real release no longer fails for missing Apple signing secrets, plus a documentation note about the extra `prod` approval.

Review summary

This PR moves the release.yml pin on thaw-app/org-ci's build-macos-app.yml from commit 369e3b5 to c3ccb74 and adds a short docs note. Both references remain full 40-character commit pins, so the supply-chain posture is unchanged, and the pinned commit is the merged org-ci change it claims to be (its only difference from the previous pin is adding environment: ${{ inputs.environment }} to the attest job, which runs no application code and references no secrets). The caller's inputs (environment: prod, attest, secrets: inherit) and permissions are untouched, and the documentation edit has no runtime effect. No security issues found in this diff.

_{Review 1 on this PR · c12408a · requested Oct 31 22:16 UTC when the PR was opened}

Reviewed by Strix
_{Re-run review · Configure security review settings}

Signed-off-by: René Jiménez <diazdesandi@proton.me>

github-actions · 2026-10-31T22:16:30Z

Labels: ci, cd, ops, fix

All convention checks passed. ✅

cc @diazdesandi

coderabbitai · 2026-10-31T22:16:32Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 25efa83a-984f-4a57-9e4f-9a61f224b22f

Commits

Reviewing files that changed from the base of the PR and between 294352e and 00d4cac.

Files selected for processing: 2

.github/workflows/release.yml
docs/DEVELOPMENT.md

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The release workflow now uses a different pinned revision of its reusable build workflow. The release instructions state that dry runs skip attestation and list the prod approvals required for a real release.

Changes: Release workflow

Layer / File(s)	Summary
Workflow revision and approval instructions `.github/workflows/release.yml`, `docs/DEVELOPMENT.md`	The build job uses a new pinned reusable workflow revision. The release instructions state that dry runs skip attestation and list `prod` approval for the build, attestation job, and publishing of a real release.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Possibly related issues

How to contribute #1 — The issue lists signed and notarized releases as incomplete. This PR updates the release workflow but does not complete or verify a real release.

Possibly related PRs

thaw-app/Floe#54 — This PR updates the same pinned org-ci reusable workflow integration and release approval instructions.

Merge Risk: Minimal · up to 00d4c

The release workflow and approval documentation are consistent; no actionable merge-blocking risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the release workflow fix: using the org-ci attest job that names its environment.
Description check		The description is complete and matches the template. It explains the failure, the workflow pin update, expected behavior, documentation changes, validation performed, and known limitations. The unche…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is complete and matches the template. It explains the failure, the workflow pin update, expected behavior, documentation changes, validation performed, and known limitations. The unchecked local-build and macOS-version items are not material for this CI-only change.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

sonarqubecloud · 2026-10-31T22:17:56Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

fix(release): use org-ci's attest job that names the environment

c12408a

Floe keeps its Apple secrets only in prod, and the attest job had no environment, so 0.3.0's release failed there after the build passed. Signed-off-by: René Jiménez <diazdesandi@proton.me>

github-actions Bot added cd ci fix ops labels Oct 31, 2026

docs(release): count the approvals a release asks for

00d4cac

Signed-off-by: René Jiménez <diazdesandi@proton.me>

diazdesandi merged commit 2083ecd into development Oct 31, 2026
9 checks passed

diazdesandi deleted the fix/release-attest-environment branch October 31, 2026 23:17

Navigation Menu

Repository navigation

fix(release): use org-ci's attest job that names the environment - #62

fix(release): use org-ci's attest job that names the environment#62
diazdesandi merged 2 commits into
developmentfrom
fix/release-attest-environment

diazdesandi commented Oct 31, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

strix-security Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 31, 2026

Uh oh!

coderabbitai Bot commented Oct 31, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Oct 31, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

diazdesandi commented Oct 31, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked issue

PR Type

Area

Does this PR introduce a breaking change?

What is the new behavior?

PR Checklist

Known limitations / follow-ups

Other information

Summary by CodeRabbit

Uh oh!

strix-security Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Strix Security Review

Uh oh!

github-actions Bot commented Oct 31, 2026

Uh oh!

coderabbitai Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 31, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

diazdesandi commented Oct 31, 2026 •

edited by coderabbitai Bot

Loading

strix-security Bot commented Oct 31, 2026 •

edited

Loading

coderabbitai Bot commented Oct 31, 2026 •

edited

Loading