feat(release): publish Sparkle payloads to thaw-app/updates - #840
Merged
Conversation
Keep DMGs on Thaw GitHub Releases; host ZIP, deltas, and appcast on the dedicated updates repo. Point SUFeedURL at the new Pages feed.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe release workflow now separates DMG releases from Sparkle update payloads, publishes payloads and ChangesSparkle release migration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant SparkleRelease
participant ThawRepository
participant UpdatesRepository
ReleaseWorkflow->>SparkleRelease: Build ZIP and delta payloads
SparkleRelease->>ThawRepository: Publish DMG release
SparkleRelease->>UpdatesRepository: Publish Sparkle payload release
ReleaseWorkflow->>UpdatesRepository: Push appcast.xml to gh-pages
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
ops
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 173-200: Reorder the release steps so “Create updates GitHub
Release (ZIP + deltas)” runs before “Create Thaw GitHub Release (DMG)”, ensuring
updates-repository failures occur before the DMG becomes public. Keep each
step’s existing configuration and publication behavior unchanged.
- Around line 140-151: Update the `sparkle-release` action reference in the
release workflow from the temporary commit SHA to a stable merged default-branch
ref or release tag, while preserving all existing inputs including
`updates-repository` and `updates-token`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1cc1af0b-0b8c-493a-918f-5d6c100b338b
📒 Files selected for processing (3)
.github/workflows/release.ymlThaw/Resources/Info.plistdocs/VERIFYING_RELEASES.md
Comment on lines
140
to
151
| uses: thaw-app/org-ci/actions/sparkle-release@9944dd9543eeb383493e428f92e262cb299dc1ff | ||
| with: | ||
| tag: ${{ steps.meta.outputs.tag }} | ||
| channel: ${{ steps.meta.outputs.channel }} | ||
| app-name: ${{ env.APP_NAME }} | ||
| asset-prefix: Thaw | ||
| appcast-title: Thaw | ||
| sparkle-private-key: ${{ secrets.SPARKLE_ED25519_PRIVATE_KEY }} | ||
| updates-repository: ${{ env.UPDATES_REPOSITORY }} | ||
| updates-token: ${{ secrets.UPDATES_GITHUB_TOKEN }} | ||
| release-html-url: https://github.com/${{ github.repository }}/releases/tag/${{ steps.meta.outputs.tag }} | ||
| publish-appcast: "false" |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Confirm the pinned commit exists and check whether it's reachable from org-ci's default branch.
gh api repos/thaw-app/org-ci/commits/9944dd9543eeb383493e428f92e262cb299dc1ff --jq '.sha, .commit.message' 2>&1 || echo "commit lookup failed (private repo or unreachable)"
gh api repos/thaw-app/org-ci/contents/actions/sparkle-release/action.yml?ref=9944dd9543eeb383493e428f92e262cb299dc1ff --jq '.content' 2>&1 | base64 -d 2>/dev/null | grep -A2 'updates-repository\|updates-token'Repository: thaw-app/Thaw
Length of output: 1322
Pin sparkle-release to a stable, merged ref.
The pinned commit exists and contains updates-repository/updates-token, but it is a short-lived commit-sha pin. Once the org-ci change is merged, update this workflow to a stable default-branch ref or tag so the action cannot become unreachable if the source branch is rebased/deleted.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 140 - 151, Update the
`sparkle-release` action reference in the release workflow from the temporary
commit SHA to a stable merged default-branch ref or release tag, while
preserving all existing inputs including `updates-repository` and
`updates-token`.
Fail closed on updates-repository publish before the Thaw DMG goes public, and pin sparkle-release to the merged org-ci main SHA.
github-actions
Bot
added
breaking-change
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
221-226: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winRemove the failed clone directory before the bootstrap clone.
When
gh-pagesdoes not yet exist, the failed branch clone can leave$workpopulated; the fallbackgit clonethen fails because its destination is non-empty. This prevents the workflow from seeding the appcast branch.Proposed fix
if git clone --depth 1 --branch gh-pages "$remote" "$work" 2>/dev/null; then : else + rm -rf "$work" git clone --depth 1 "$remote" "$work" git -C "$work" checkout --orphan gh-pages git -C "$work" rm -rf . >/dev/null 2>&1 || true fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 221 - 226, Update the fallback branch of the release workflow’s gh-pages clone logic to remove the failed clone destination at $work before running the bootstrap git clone. Preserve the existing orphan-branch checkout and cleanup steps after the fallback clone.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 221-226: Update the fallback branch of the release workflow’s
gh-pages clone logic to remove the failed clone destination at $work before
running the bootstrap git clone. Preserve the existing orphan-branch checkout
and cleanup steps after the fallback clone.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 33d31bd5-01e0-45c2-b270-ee4b79df7f94
📒 Files selected for processing (1)
.github/workflows/release.yml
A failed --branch gh-pages clone can leave $work behind; remove it before the fallback clone so orphan-branch bootstrap can proceed.
This was referenced Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Split release artifacts so installers stay on Thaw and Sparkle update payloads live on the dedicated
thaw-app/updatesfeed host. Pinssparkle-releaseto the org-ci SHA that supportsupdates-repository(thaw-app/org-ci#2) and pointsSUFeedURLat the new Pages URL.Scope: Release pipeline + feed URL only. No product UI changes.
Closes: N/A
PR Type
Describe what this change does (not the linked issue’s request kind). Bug reports use
bugon issues; bug fixes usefixon PRs.If you tick Feature or Refactor and touch more than ~20 files, please mention why this can’t be split.
Area
Product surfaces (optional when the change is not about the app UI). Path-based labeling also applies.
Use PR Type for what changed (
CI/CD,Documentation,Other/ chore, etc.).Use
opsfor where when it is repo operations: CI, release, GitHub hygiene, scripts, lint/sonar config — not a product surface.menubar
icebar
layout
appearance
settings
onboarding
permissions
profiles
hotkeys
updates
ops
Does this PR introduce a breaking change?
New builds poll
https://thaw-app.github.io/updates/appcast.xml. Existing installs keep the baked-in legacySUFeedURL(stonerl.github.io/Thaw) until that host redirects (or users update via the old feed once it is back). Historical enclosure URLs in the seeded appcast are left unchanged.What is the new behavior?
thaw-app/updatesreleases: Sparkle ZIP + deltasthaw-app/updatesgh-pagesSUFeedURL:https://thaw-app.github.io/updates/appcast.xmlUPDATES_GITHUB_TOKEN(contents: writeonthaw-app/updates)PR Checklist
swiftformat .to keep the code style consistent.xcodebuild test …orswift test --package-path MenuBarModel.developmentbranch.Test commands run:
Known limitations / follow-ups
UPDATES_GITHUB_TOKENon Thaw (repo or org secret)thaw-app/updates(gh-pages) and seed currentappcast.xmlstonerl.github.io/Thawback with an HTTP redirect to the new feedOther information
Manual verification:
publish_releaseunchecked): DMG draft on Thaw, ZIP/deltas draft onupdates, no appcast pushpublish_appcast: enclosure URLs undergithub.com/thaw-app/updates/releases/download/...https://thaw-app.github.io/updates/appcast.xmlSummary by CodeRabbit
New Features
https://thaw-app.github.io/updates/appcast.xml.Bug Fixes
appcast.xmlupdates.Documentation