Feature release - #100
Conversation
When users enable atomic highlights but don't add atomize blocks to their highlight template, the plugin silently creates an empty Highlight/ folder. This adds warnings in both settings UI and at sync time, updates the default highlight template to include atomize blocks for new users, and hardens the atomizer against non-string basename values. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
update beta
…to 2.4.1-beta.1 [skip ci] ## [2.4.1-beta.1](2.4.0...2.4.1-beta.1) (2026-06-16) ### Bug Fixes * 🐛 always register settings tab even if initialization fails ([87ca7a6](87ca7a6))
|
🎉 This PR is included in version 2.4.1-beta.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe release metadata now targets ChangesRelease automation and runtime behavior updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@manifest.json`:
- Around line 4-5: The manifest.json file contains a duplicate version key where
both "2.4.1-beta.1" and "2.4.1" are specified, causing ambiguity in parsing.
Remove the duplicate version entry (the "2.4.1" line) and keep only the beta
version ("2.4.1-beta.1") to ensure the manifest is unambiguous and the correct
version is used regardless of parsing order.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d196ef3c-cbf1-46a5-81a8-1b5738fd6cac
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (2)
manifest.jsonpackage.json
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
…to 2.4.2-beta.1 [skip ci] ## [2.4.2-beta.1](2.4.1...2.4.2-beta.1) (2026-06-16) ### Bug Fixes * update manifest.json ([8cb402a](8cb402a))
|
🎉 This PR is included in version 2.4.2-beta.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 2.4.2-beta.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Fix regression with respect to saving settings in the latest beta. FIXES: #101
If the user clears the folder name, update the settings with the proper "baseFolderName" default
|
🎉 This PR is included in version 2.4.2-beta.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main.ts`:
- Around line 81-84: In the saveAndApplySettings arrow function, the line that
assigns this.settings = ctx.settings is problematic because ctx is a stale
context reference that was captured before loadAndApplySettings() was invoked,
while this.settings gets reassigned later at line 163 with loaded settings.
Remove the assignment of this.settings from ctx.settings to prevent stale
context values from overwriting the current loaded settings, and simply return
the call to this.saveAndApplySettings() to invoke the actual implementation.
In `@src/ui/settings-tab.ts`:
- Around line 559-561: The validation check for the base folder name in the code
block around the assignment to this.ctx.settings.baseFolderName does not account
for whitespace-only input. Modify the condition that checks if (!value) to first
trim the value string before evaluating it as empty, ensuring that
whitespace-only folder names are also caught and replaced with
DEFAULT_SETTINGS.baseFolderName. This prevents effectively empty folder names
from being persisted to settings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e353cb10-6a36-490f-bbb1-4b36f4b2e86b
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
manifest.jsonpackage.jsonsrc/main.tssrc/ui/settings-tab.ts
✅ Files skipped from review due to trivial changes (1)
- package.json
Ensure last synced date is properly displayed when `reset-last-updated` is called
…to 2.4.2-beta.4 [skip ci] ## [2.4.2-beta.4](2.4.2-beta.3...2.4.2-beta.4) (2026-06-21) ### Bug Fixes * 🩹 improve load sequence to avoid stale context ([4d2ad03](4d2ad03)) * 🩹 update synced date on `reset-last-updated` ([75a5595](75a5595))
|
🎉 This PR is included in version 2.4.2-beta.4 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
…ocks-missing # Conflicts: # package-lock.json # package.json
Replace branch-specific semantic-release extends logic with a simpler post-release workflow step.
There was a problem hiding this comment.
Actionable comments posted: 5
♻️ Duplicate comments (1)
src/main.ts (1)
81-84: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winAvoid copying a stale
ctx.settingsobject back onto the plugin.Line 82 can still clobber freshly loaded settings.
ReadwiseMirrorSettingTabkeeps a long-livedPluginContext, whileloadAndApplySettings()later replacesthis.settingswith a new object at Line 163. After that happens, saving from the tab can write the old snapshot back to disk and lose newer fields likelastUpdated.Suggested fix
saveAndApplySettings: () => { - this.settings = ctx.settings; return this.saveAndApplySettings(); },// Keep the object identity stable when reloading settings. Object.assign(this.settings, DEFAULT_SETTINGS, loaded ?? {});🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main.ts` around lines 81 - 84, The save path in saveAndApplySettings is overwriting the plugin with the long-lived ctx.settings snapshot, which can clobber newer fields after loadAndApplySettings replaces this.settings. Update the reloading logic in loadAndApplySettings to preserve object identity by merging into the existing settings object instead of assigning a new one, and keep ReadwiseMirrorSettingTab/saveAndApplySettings using the current plugin state rather than copying ctx.settings back.
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
44-45: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAvoid direct GitHub expression interpolation inside shell.
Zizmor flags these expansions. Pass the actor through
envand reference shell variables instead.Proposed fix
- name: Configure Git if: github.event_name == 'push' && github.ref == 'refs/heads/main' + env: + GIT_ACTOR: ${{ github.actor }} run: | - git config --global user.name "${{ github.actor }}" - git config --global user.email "${{ github.actor }}`@users.noreply.github.com`" + git config --global user.name "$GIT_ACTOR" + git config --global user.email "$GIT_ACTOR@users.noreply.github.com"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 44 - 45, The release workflow is interpolating GitHub expressions directly inside shell commands, which should be avoided. Update the release job to pass github.actor through env and then use the shell variable in the git config commands instead of inline expression expansion. Look for the git config setup in the release workflow and adjust those steps to reference the environment variable consistently.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 61-63: The release workflow is attesting the wrong artifact paths
in the subject-path list. Update the release attestation entry to match the
actual outputs referenced by rollup.config.mjs and .releaserc.yaml, using the
repository-root main.js plus manifest.json and src/ui/styles/styles.css instead
of build/main.js and build/styles.css. Keep the change localized to the release
job configuration so the attested files match what is actually published.
- Around line 34-40: The release workflow currently lets the audit step fail
open because of continue-on-error in the job before Build plugin and
semantic-release, which can allow high-risk audit or signature failures to still
publish. Remove continue-on-error from that audit-related step in the release
flow, or split the report-only audit into a separate non-release job so
semantic-release only runs after blocking checks pass.
- Around line 42-58: The release workflow is still gated on refs/heads/main, so
the Git config, manifest commit, and artifact attestation steps will not run
after merging into master. Update the if condition on the relevant steps in
release.yml to use refs/heads/master consistently, keeping the existing
github.event_name == 'push' check. Use the step names "Commit manifest.json
(main only)" and "Generate artifact attestation (main release)" as anchors when
updating the condition.
- Around line 57-59: The main release attestation step using actions/attest@v4
is missing required write permissions. Update the workflow permissions for the
release job so the attestation step has both attestations: write and
artifact-metadata: write, then verify the Generate artifact attestation (main
release) step can run successfully under the existing github.event_name and
github.ref condition.
- Line 59: The workflow step using actions/attest is still referenced by a
mutable tag, which violates the unpinned-action policy. Update the uses entry in
the release workflow to the resolved commit SHA for actions/attest instead of
v4, keeping the same step intact and only changing the action reference.
---
Duplicate comments:
In `@src/main.ts`:
- Around line 81-84: The save path in saveAndApplySettings is overwriting the
plugin with the long-lived ctx.settings snapshot, which can clobber newer fields
after loadAndApplySettings replaces this.settings. Update the reloading logic in
loadAndApplySettings to preserve object identity by merging into the existing
settings object instead of assigning a new one, and keep
ReadwiseMirrorSettingTab/saveAndApplySettings using the current plugin state
rather than copying ctx.settings back.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 44-45: The release workflow is interpolating GitHub expressions
directly inside shell commands, which should be avoided. Update the release job
to pass github.actor through env and then use the shell variable in the git
config commands instead of inline expression expansion. Look for the git config
setup in the release workflow and adjust those steps to reference the
environment variable consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8b009baf-03a6-4390-8bcf-6c0c60567d20
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (6)
.github/workflows/release.yml.releaserc.yamlmanifest.jsonpackage.jsonsrc/main.tssrc/utils/plugin-commands.ts
💤 Files with no reviewable changes (1)
- .releaserc.yaml
✅ Files skipped from review due to trivial changes (3)
- manifest.json
- package.json
- src/utils/plugin-commands.ts
| - name: Generate artifact attestation (main release) | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| uses: actions/attest@v4 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the attestation step
wc -l .github/workflows/release.yml
sed -n '1,120p' .github/workflows/release.yml
# Look for any attestation-related docs or permissions elsewhere in the repo
rg -n "attestations: write|actions/attest@v4|artifact attestation|attestation" .github README.md docs . 2>/dev/null | head -n 200Repository: jsonMartin/readwise-mirror
Length of output: 2438
🌐 Web query:
GitHub Actions attestation action requires attestations: write permission actions/attest@v4
💡 Result:
To use the actions/attest@v4 action in a GitHub Actions workflow, you must explicitly configure specific permissions for the GITHUB_TOKEN [1][2]. The required permissions are [3][4]: permissions: id-token: write attestations: write artifact-metadata: write Explanation of required permissions: - id-token: write: Necessary for the action to mint the OIDC (OpenID Connect) token, which is required to request a Sigstore signing certificate [3][4]. - attestations: write: Required to persist the generated attestation [3][4][5]. - artifact-metadata: write: Required to create the artifact storage record [3][4]. When you define the permissions block within your job, all unspecified permissions are set to none [5]. Therefore, ensure you include any other permissions your workflow requires (such as contents: read or packages: write) alongside these three [1][2].
Citations:
- 1: https://docs.github.com/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds
- 2: https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations
- 3: https://github.com/actions/attest/tree/a4159165a0a6351288fadceb29ccd4b2f1f7581a
- 4: https://github.com/actions/attest?tab=readme-ov-file
- 5: https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions
Grant attestation and artifact-metadata write permissions. actions/attest@v4 also needs artifact-metadata: write alongside attestations: write, or this step can fail.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 59-59: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 57 - 59, The main release
attestation step using actions/attest@v4 is missing required write permissions.
Update the workflow permissions for the release job so the attestation step has
both attestations: write and artifact-metadata: write, then verify the Generate
artifact attestation (main release) step can run successfully under the existing
github.event_name and github.ref condition.
| git push | ||
| - name: Generate artifact attestation (main release) | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| uses: actions/attest@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== release workflow excerpt ==\n'
nl -ba .github/workflows/release.yml | sed -n '45,75p'
printf '\n== search for attest and action pinning patterns ==\n'
rg -n "actions/attest@|uses: .*@[v0-9]|uses: .*@[a-f0-9]{40}|pin" .github/workflows -S || true
printf '\n== workflow files overview ==\n'
fd -a -e yml -e yaml .github/workflows || trueRepository: jsonMartin/readwise-mirror
Length of output: 236
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== release workflow excerpt ==\n'
awk 'NR>=45 && NR<=75 { printf "%d:%s\n", NR, $0 }' .github/workflows/release.yml
printf '\n== attest usage ==\n'
rg -n "actions/attest@" .github/workflows || true
printf '\n== pinned action examples ==\n'
rg -n "uses: .*@[a-f0-9]{40}" .github/workflows || true
printf '\n== workflow files ==\n'
find .github/workflows -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) -printRepository: jsonMartin/readwise-mirror
Length of output: 1208
Pin actions/attest to a commit SHA. actions/attest@v4 is still a mutable tag and will trip the unpinned-action policy; replace it with the resolved SHA here.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 59-59: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 59, The workflow step using
actions/attest is still referenced by a mutable tag, which violates the
unpinned-action policy. Update the uses entry in the release workflow to the
resolved commit SHA for actions/attest instead of v4, keeping the same step
intact and only changing the action reference.
Source: Linters/SAST tools
fix: warn when atomize blocks missing from highlight template
|
🎉 This PR is included in version 2.4.2-beta.5 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
🎉 This PR is included in version 2.4.2-beta.6 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
🎉 This PR is included in version 2.4.2-beta.7 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
… persisting [no-ci] Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
🎉 This PR is included in version 2.4.2-beta.8 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 2.4.2-beta.9 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
…lights for last updated date make sure we always have a date for created / updated, even if there are no highlights (anymore).
|
🎉 This PR is included in version 2.4.2-beta.10 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
johannrichard
changed the title
|
🎉 This PR is included in version 2.4.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
3 participants
update beta
Summary by CodeRabbit