IEP-1475: Signing Windows Executable #1228
Conversation
WalkthroughThe GitHub Actions release workflow was renamed and restructured to use three distinct jobs: Changes
Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant macos-build
participant windows-sign
participant upload-aws
participant AWS_S3
GitHubActions->>macos-build: Start build (macOS, Linux, Windows)
macos-build->>macos-build: Build, sign (macOS), create artifacts
macos-build->>windows-sign: Provide Windows artifact
windows-sign->>windows-sign: Sign Windows executable
windows-sign->>upload-aws: Provide all signed artifacts
upload-aws->>AWS_S3: Upload artifacts, set redirects, invalidate CloudFront
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (4)
.github/workflows/win_exe_sign_test.yml (4)
1-1: Refine workflow name & formatting
- The workflow is named
Java CI with Maven, which doesn’t reflect its purpose of signing Windows executables. Consider renaming it, e.g.:name: Windows Executable Signing- Remove the trailing whitespace on this line to satisfy YAML linting rules.
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 1-1: trailing spaces
(trailing-spaces)
17-17: Remove trailing whitespace
Lines 17 and 21 contain trailing spaces and will fail YAML linting (YAMLlinterrors). Please delete any extra spaces on these blank lines.Also applies to: 21-21
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 17-17: trailing spaces
(trailing-spaces)
22-27: Explicitly declare PowerShell shell
The decode step uses PowerShell cmdlets (Out-File) but doesn’t specifyshell: pwsh. To make the intent explicit and avoid ambiguity if defaults change, add:- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: | echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64
44-44: Use HTTPS for timestamp server
Switch the timestamp URL to HTTPS to ensure the timestamp request is sent securely:-/tr http://timestamp.digicert.com +/tr https://timestamp.digicert.com
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
⛔ Files ignored due to path filters (1)
releng/espressif-ide.exeis excluded by!**/*.exe
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 1-1: trailing spaces
(trailing-spaces)
[error] 17-17: trailing spaces
(trailing-spaces)
[error] 21-21: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build_macos
🔇 Additional comments (1)
.github/workflows/win_exe_sign_test.yml (1)
3-7: Validateontriggers
This workflow only runs on pushes and PRs targetingmaster.
- If your default branch is
main, or you want to sign release tags, update these triggers.- Otherwise, confirm that
masteris indeed your intended branch.
| PFX_PASS: ${{ secrets.WIN_CERTIFICATE_PWD }} | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Update checkout action version
Actionlint flags actions/checkout@v3 as outdated. Bump to the latest major version:
- uses: actions/checkout@v3
+ uses: actions/checkout@v4This ensures you get the newest bug fixes and performance improvements.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v3 | |
| - uses: actions/checkout@v4 |
🧰 Tools
🪛 actionlint (1.7.7)
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at line 19, the checkout action
version is outdated. Update the version from actions/checkout@v3 to the latest
major version, such as actions/checkout@v4, to incorporate the newest bug fixes
and performance improvements.
| - name: Convert JKS to PFX | ||
| shell: pwsh | ||
| run: | | ||
| & "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore ` | ||
| -srckeystore mykeystore.jks ` | ||
| -srcstorepass $env:JKS_PASS ` | ||
| -srcalias $env:ALIAS ` | ||
| -destkeystore cert.pfx ` | ||
| -deststoretype PKCS12 ` | ||
| -deststorepass $env:PFX_PASS |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Secure handling of keystore & error checking
- After conversion,
mykeystore.jksremains on the runner. Remove it to avoid leaking secrets:& "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore ` -srckeystore mykeystore.jks ` … ` -deststorepass $env:PFX_PASS
- Remove-Item mykeystore.jks
- If the key entry has a separate password, add `-srckeypass $env:KEY_PASS`.
- Consider breaking out each step or enabling `fail-fast` / `set -e` style behavior so the job fails immediately on errors.
<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>
> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
```suggestion
- name: Convert JKS to PFX
shell: pwsh
run: |
& "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore `
-srckeystore mykeystore.jks `
-srcstorepass $env:JKS_PASS `
-srcalias $env:ALIAS `
-destkeystore cert.pfx `
-deststoretype PKCS12 `
-deststorepass $env:PFX_PASS
Remove-Item mykeystore.jks
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 28 to 37, improve
security and robustness by deleting the mykeystore.jks file after conversion to
prevent secret leakage, add the -srckeypass $env:KEY_PASS option if the key
entry uses a separate password, and modify the script to enable fail-fast
behavior so the job stops immediately on errors, either by breaking the command
into steps or using error handling features like set -e or equivalent in
PowerShell.
| - name: Sign Windows Executable | ||
| run: | | ||
| & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` | ||
| /f cert.pfx ` | ||
| /p $env:PFX_PASS ` | ||
| /tr http://timestamp.digicert.com ` | ||
| /td sha256 ` | ||
| /fd sha256 ` | ||
| releng/espressif-ide.exe |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Specify shell & avoid hardcoded SDK path
- The signing commands use PowerShell syntax (
&and backticks) but don’t declareshell: pwsh; add it for clarity. - Hardcoding
10.0.17763.0may not match the runner’s installed Windows SDK. Instead, rely onsigntool.exeinPATHor dynamically locate the correct SDK version: -
- name: Sign Windows Executable
-
run: |
-
- name: Sign Windows Executable
-
shell: pwsh -
run: | signtool sign ` /f cert.pfx ` /p $env:PFX_PASS ` /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` releng/espressif-ide.exe
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 39 to 47, the signing
step uses PowerShell syntax but does not specify 'shell: pwsh', so add 'shell:
pwsh' to ensure the commands run in PowerShell. Also, remove the hardcoded
Windows SDK path '10.0.17763.0' and instead call 'signtool.exe' directly
assuming it is in the system PATH or implement a method to dynamically locate
the correct SDK version to avoid path mismatches.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (3)
.github/workflows/win_exe_sign_test.yml (3)
19-19: Update checkout action version
Actionlint flagsactions/checkout@v3as outdated. Bump to the latest major version to ensure you get the newest bug fixes and performance improvements.Apply this diff:
- - uses: actions/checkout@v3 + - uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
28-38: Secure handling of keystore & error checking
After converting the JKS to PFX, the originalmykeystore.jksremains on the runner, risking secret leakage. Also consider adding-srckeypass $env:KEY_PASSif the keystore entry has a separate password and enabling fail-fast behavior (e.g., splitting into steps or usingset -e).Apply this diff:
- name: Convert JKS to PFX shell: pwsh run: | & "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore ` -srckeystore mykeystore.jks ` -srcstorepass $env:JKS_PASS ` -srcalias $env:ALIAS ` -destkeystore cert.pfx ` -deststoretype PKCS12 ` -deststorepass $env:PFX_PASS + # Remove the intermediate JKS to avoid leaking secrets + Remove-Item mykeystore.jks
39-47: Specify shell and avoid hardcoded SDK path
PowerShell syntax (&and backticks) is used but no shell is specified. Also, hardcoding the Windows SDK path may fail if the runner's SDK version differs. Usesigntool.exefromPATHor dynamically locate it.Apply this diff:
- - name: Sign Windows Executable - run: | + - name: Sign Windows Executable + shell: pwsh + run: | - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + signtool.exe sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` releng/espressif-ide.exeAdditionally, switching to HTTPS for the timestamp URL improves security.
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
17-21: Remove trailing whitespace
Lines 17 and 21 contain unnecessary trailing spaces, causing YAML lint errors. Remove the trailing spaces to comply with YAML formatting.Apply this diff:
- # line 17 (contains trailing spaces) + # line 17 (no trailing spaces) - # line 21 (contains trailing spaces) + # line 21 (no trailing spaces)(Replace each blank line’s trailing spaces with a clean empty line.)
🧰 Tools
🪛 actionlint (1.7.7)
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[error] 17-17: trailing spaces
(trailing-spaces)
[error] 21-21: trailing spaces
(trailing-spaces)
22-27: Specify shell for PowerShell commands
Therunblock relies on PowerShell-specific cmdlets (Out-File,certutil). On Windows runners, the default shell may vary. Explicitly setshell: pwsh(orpowershell) to ensure consistent execution.Apply this diff:
- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: | echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 17-17: trailing spaces
(trailing-spaces)
[error] 21-21: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build_macos
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (3)
.github/workflows/win_exe_sign_test.yml (3)
19-19: Update checkout action to latest version
Actionlint flagsactions/checkout@v3as outdated. Bump to the latest major version to get bug fixes and performance improvements. Apply this diff:- - uses: actions/checkout@v3 + - uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
28-38: Secure keystore conversion & cleanup
Post-conversion,mykeystore.jksremains on the runner—remove it to prevent secret leakage. If the key alias has a separate password, include-srckeypass. Also, enable fail-fast behavior with$ErrorActionPreference = 'Stop'. Example:- name: Convert JKS to PFX shell: pwsh run: | + $ErrorActionPreference = 'Stop' & "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore ` -srckeystore mykeystore.jks ` -srcstorepass $env:JKS_PASS ` -srcalias $env:ALIAS ` + -srckeypass $env:KEY_PASS ` -destkeystore cert.pfx ` -deststoretype PKCS12 ` -deststorepass $env:PFX_PASS + Remove-Item mykeystore.jks -Force
39-47: Specify shell and avoid hardcoded signtool path
This step uses PowerShell syntax but doesn’t declareshell: pwsh. Hardcoding the Windows Kits path can break if the SDK version changes; instead, dynamically locatesigntool.exefromPATHand switch the timestamp URL to HTTPS:- name: Sign Windows Executable - run: | - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + shell: pwsh + run: | + $signtool = (Get-Command signtool.exe).Source + & $signtool sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` releng/espressif-ide.exe
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
17-17: Remove trailing whitespace
Lines 17, 21, and 56 contain trailing spaces, which trigger YAMLlint errors. Please remove them.Also applies to: 21-21, 56-56
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 17-17: trailing spaces
(trailing-spaces)
22-27: Explicitly specify PowerShell shell and refine base64 decode
Even though Windows runners default to PowerShell, declaringshell: pwshimproves clarity. Also, usingOut-File -Encoding ASCIImay introduce a BOM; preferSet-Contentwith-Encoding ASCII. For example:- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: | Set-Content -Path encoded.b64 -Value $env:JKS_B64 -Encoding ASCII certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 17-17: trailing spaces
(trailing-spaces)
[error] 21-21: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build_macos
| steps: | ||
| - uses: actions/checkout@v3 | ||
|
|
||
|
|
||
| - name: Decode base64-encoded JKS | ||
| run: | | ||
| echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII | ||
| certutil -decode encoded.b64 mykeystore.jks | ||
| Remove-Item encoded.b64 | ||
|
|
||
| - name: Convert JKS to PFX |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add Java setup action
The workflow invokes keytool.exe but doesn't ensure a JDK is installed or JAVA_HOME is set. Insert the official setup action before converting the keystore:
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v4
+ - name: Set up Java
+ uses: actions/setup-java@v3
+ with:
+ distribution: 'temurin'
+ java-version: '11'Committable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 actionlint (1.7.7)
19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[error] 21-21: trailing spaces
(trailing-spaces)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 18 to 28, the workflow
uses keytool.exe without ensuring a JDK is installed or JAVA_HOME is set. Fix
this by adding the official Java setup action (actions/setup-java) before the
step that converts the keystore. Configure it to install the required JDK
version and set JAVA_HOME properly to enable keytool.exe usage.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (4)
.github/workflows/win_exe_sign_test.yml (4)
22-22: Update checkout action to the latest major version
Actionlint flagsactions/checkout@v3as outdated. Bump toactions/checkout@v4to leverage the newest fixes and performance improvements.🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
106-106: Update checkout action to the latest major version (duplicate)
As noted above, bumpactions/checkout@v3toactions/checkout@v4.🧰 Tools
🪛 actionlint (1.7.7)
106-106: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
125-134: 🛠️ Refactor suggestionSecure cleanup & optional key-pass handling
- Remove
mykeystore.jksafter conversion so the raw keystore isn’t left on the runner.- If the key entry uses a separate password, add
-srckeypass $env:KEY_PASSto avoid interactive prompts.certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64 + & "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore ` + -srckeystore mykeystore.jks ` + -srcstorepass $env:JKS_PASS ` + -srckeypass $env:KEY_PASS ` # optional: only if the key alias has its own password + -destkeystore cert.pfx ` + -deststoretype PKCS12 ` + -deststorepass $env:PFX_PASS + Remove-Item mykeystore.jks
136-145: 🛠️ Refactor suggestionAvoid hardcoded SDK paths & enforce PowerShell
Specifyshell: pwshand invokesigntool.exefrom the PATH to prevent mismatches. Also switch to HTTPS for timestamping.- - name: Sign Windows Executable - run: | + - name: Sign Windows Executable + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\*.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & "signtool.exe" sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
52-58: Remove temporary certificate after import
To avoid leaving sensitive files on the runner, deletecertificate.p12once it’s imported into the keychain.security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign + rm certificate.p12
157-202: Clean up commented-out deploy job
The large commented block adds noise. If this deploy job isn’t ready, consider moving it to a dedicated WIP branch or removing it until it’s complete.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
106-106: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: build
🔇 Additional comments (5)
.github/workflows/win_exe_sign_test.yml (5)
62-66: Approve: Architecture-specific codesigning loop
The loop correctly signs each architecture’s.appand immediately verifies withcodesign -v --deep.
72-76: Approve: DMG codesigning loop
Consistent with the app signing above, these commands sign and verify each DMG.
92-101: Approve: Artifact upload configuration
Uploading all build outputs under a singlerelease-artifactsbundle ensures downstream jobs can retrieve everything required.
109-113: Approve: Downloading release artifacts
actions/download-artifact@v4correctly retrieves the macOS outputs for Windows signing.
151-156: Approve: Uploading signed Windows ZIP
Re-uploading the single signed ZIP under the same artifact name keeps the workflow consistent.
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (5)
.github/workflows/win_exe_sign_test.yml (5)
22-22: Update checkout action version
Actionlint flagsactions/checkout@v3as outdated. Bump toactions/checkout@v4.🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: Update setup-java action version
Actionlint flagsactions/setup-java@v3as outdated. Upgrade toactions/setup-java@v4.🧰 Tools
🪛 actionlint (1.7.7)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
108-108: Update checkout action in windows-sign
The Windows job still usesactions/checkout@v3. Please bump toactions/checkout@v4here as well.🧰 Tools
🪛 actionlint (1.7.7)
108-108: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
140-147: 🛠️ Refactor suggestionAvoid hardcoded signtool path and use HTTPS timestamping
Hardcoding the Windows SDK version can break on runner updates. Instead callsigntool.exedirectly (it’s on the PATH) and switch to HTTPS for timestamping:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool.exe sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
127-136: 🛠️ Refactor suggestionRemove the decoded JKS after conversion
Right nowmykeystore.jkspersists after creatingcert.pfx. Delete it to prevent leaking the raw keystore:certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64 + Remove-Item mykeystore.jks & "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore ` -srckeystore mykeystore.jks ` -srcstorepass $env:JKS_PASS `
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
54-61: Clean up macOS signing artifacts
After importing the cert,certificate.p12and the temporary keychains remain on the runner. Remove them to avoid leaking secrets:echo "$MACOS_CERTIFICATE" | base64 -d > certificate.p12 + rm -v certificate.p12 # Set up keychain security create-keychain -p espressif build.keychain … + security delete-keychain build.keychainOptionally also delete
notary.keychainafter notarization.
153-158: Use a distinct artifact name for the signed Windows ZIP
Uploading another artifact namedrelease-artifactsoverwrites or clobbers the macOS bundle. Give the Windows ZIP a unique name:- - name: Upload Signed Windows ZIP + - name: Upload Signed Windows ZIP (Windows-only) uses: actions/upload-artifact@v4 with: - name: release-artifacts + name: windows-signed-artifact path: artifacts/Espressif-IDE-win32.win32.x86_64.zip
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
108-108: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build
- GitHub Check: macos-build
- GitHub Check: build_macos
| run: | | ||
| KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" | ||
| echo "${KEYSTORE_FILE}" | ||
| printf "%s" "${JARSIGNER_KEYSTORE_B64}" | base64 -d > "${KEYSTORE_FILE}" | ||
| mvn -e -X clean install -Djarsigner.keystore="${KEYSTORE_FILE}" -Djarsigner.alias="${JARSIGNER_ALIAS}" -Djarsigner.storepass="${JARSIGNER_STOREPASS}" -DskipTests=true | ||
| rm -v "${KEYSTORE_FILE}" |
There was a problem hiding this comment.
Fix unresolved placeholder in KEYSTORE_FILE path
The line
KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}"contains a literal placeholder instead of a real filename. Define a concrete keystore filename (or introduce an env var) before decoding:
- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}"
+ KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 39 to 44, the
KEYSTORE_FILE path uses a literal placeholder {{secrets.JARSIGNER_KEYSTORE}}
instead of an actual filename. Replace this placeholder with a concrete filename
or an environment variable that holds the keystore filename before decoding. For
example, define KEYSTORE_FILE as a fixed filename in the current directory or
use an existing environment variable that contains the keystore filename,
ensuring the base64 decoding writes to a valid file path.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (4)
.github/workflows/win_exe_sign_test.yml (4)
22-22: Bumpactions/checkoutto v4
actions/checkout@v3is flagged as outdated by actionlint. Upgrade both checkout steps toactions/checkout@v4to ensure you’re running the latest, supported version.- uses: actions/checkout@v3 + uses: actions/checkout@v4Also applies to: 141-141
🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-26: Upgradeactions/setup-javato v4
actionlint flagsactions/setup-java@v3as too old. Please update toactions/setup-java@v4for improved compatibility and bug fixes.- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
40-43:⚠️ Potential issueFix unresolved keystore filename placeholder
The line uses a literal{{secrets.JARSIGNER_KEYSTORE}}placeholder instead of a valid filename. This will causebase64 -dto fail. Define a concrete filename or reference a proper variable, for example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-rel-keystore.jks"
6-7: 🛠️ Refactor suggestionUse shell-style glob for tag filters
GitHub Actions does not support regex in thetagsfilter. Replace the regex pattern with a shell-style glob to correctly match semantic version tags.-on: - push: - branches: [master] - tags: - - "v[0-9]+.[0-9]+.[0-9]+" +on: + push: + branches: [master] + tags: + - 'v*.*.*'
🧹 Nitpick comments (3)
.github/workflows/win_exe_sign_test.yml (3)
46-75: Remove trailing whitespace in codesign step
YAML lint reports trailing spaces on multiple lines within theCodesign Espressif-IDEstep (e.g., lines 47, 57, 61, 65). Please clean up any trailing spaces to satisfy lint rules.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
108-114: Fix indentation for upload-artifact step
YAML lint flagged wrong indentation at line 112 in the “Upload Espressif-IDE-macosx-cocoa-aarch64” block. Alignname:andpath:underwith:by removing the extra space.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
173-180: Avoid hardcoding signtool SDK path
Hardcoding"C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe"can break on runners with a different SDK version. Instead rely onsigntool.exebeing inPATH:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & "signtool.exe" sign `
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
141-141: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
| - name: Decode JKS and convert to PFX | ||
| env: | ||
| JKS_B64: ${{ secrets.JARSIGNER_REL_KEYSTORE_B64 }} | ||
| JKS_PASS: ${{ secrets.JARSIGNER_REL_STOREPASS }} | ||
| ALIAS: ${{ secrets.JARSIGNER_REL_ALIAS }} | ||
| PFX_PASS: ${{ secrets.JARSIGNER_REL_STOREPASS }} | ||
| run: | |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Install and configure Java on Windows runner
You invoke keytool.exe via $env:JAVA_HOME, but no JDK is installed or JAVA_HOME set on the Windows runner. Add a setup step before this block:
- name: Set up Java
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '11'🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 153 to 159, the workflow
uses keytool.exe via $env:JAVA_HOME but does not install Java or set JAVA_HOME
on the Windows runner. To fix this, add a step before this block that uses
actions/setup-java@v4 to install Java 11 from the Temurin distribution and set
JAVA_HOME properly.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (7)
.github/workflows/win_exe_sign_test.yml (7)
22-22: Update checkout action to latest version
actions/checkout@v3is flagged as outdated by actionlint. Bump to the latest major version to get bug fixes and performance improvements.- - uses: actions/checkout@v3 + - uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: Bump setup-java action to v4
Similarly,actions/setup-java@v3is outdated. Please upgrade toactions/setup-java@v4for improved stability and support.- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
153-159: Ensure JDK is installed on Windows runner
The Windows job invokeskeytool.exevia$env:JAVA_HOMEbut never installs Java or setsJAVA_HOME. Add a setup step before conversion:windows-sign: runs-on: windows-latest + steps: + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'
160-163: Remove temporary JKS file after conversion
After decoding and convertingmykeystore.jkstocert.pfx, the original JKS file remains on the runner, risking secret exposure. Add:certutil -decode encoded.b64 mykeystore.jks + Remove-Item mykeystore.jks
171-180: Avoid hardcoded signtool path & declare shell
The signing step hardcodes the Windows SDK path and doesn’t specify thepwshshell. Prefer callingsigntool.exedirectly from the PATH and set the shell explicitly:- - name: Sign Windows Executable - run: | + - name: Sign Windows Executable + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\*.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool sign ` /f cert.pfx `
40-44:⚠️ Potential issueFix unresolved keystore filename placeholder
The placeholder{{secrets.JARSIGNER_KEYSTORE}}is not evaluated and leads to an invalid path. Use a fixed filename or environment variable, for example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"Ensure this name is used consistently when importing and removing the file.
6-7:⚠️ Potential issueTag filter uses unsupported regex syntax
GitHub Actions tag filters expect shell-style globs, not regular expressions. The pattern"v[0-9]+.[0-9]+.[0-9]+"will not match version tags as intended.
Apply this diff:on: push: tags: - - "v[0-9]+.[0-9]+.[0-9]+" + - 'v*.*.*'
🧹 Nitpick comments (1)
.github/workflows/win_exe_sign_test.yml (1)
46-135: Remove trailing whitespace
YAMLlint has flagged trailing spaces on many lines (e.g., 47, 57, 61, etc.). Please trim all trailing whitespace to avoid lint errors.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
141-141: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
| - name: Repack signed Windows ZIP | ||
| run: | | ||
| Compress-Archive -Path extracted\* -DestinationPath artifacts/Espressif-IDE-win32.win32.x86_64.zip -Force | ||
|
|
||
| - name: Upload Signed Windows ZIP | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: release-artifacts | ||
| path: artifacts/Espressif-IDE-win32.win32.x86_64.zip | ||
|
|
There was a problem hiding this comment.
Consistent artifact naming for Windows ZIP upload
The step repacks and uploads the signed Windows ZIP under release-artifacts, which conflicts with the original upload naming. Unify artifact names across jobs. For instance, to continue using espressif-ide-win32:
- - name: Upload Signed Windows ZIP
- uses: actions/upload-artifact@v4
+ - name: Upload Signed Windows ZIP
+ uses: actions/upload-artifact@v4
with:
- name: release-artifacts
+ name: espressif-ide-win32
path: artifacts/Espressif-IDE-win32.win32.x86_64.zip📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Repack signed Windows ZIP | |
| run: | | |
| Compress-Archive -Path extracted\* -DestinationPath artifacts/Espressif-IDE-win32.win32.x86_64.zip -Force | |
| - name: Upload Signed Windows ZIP | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: release-artifacts | |
| path: artifacts/Espressif-IDE-win32.win32.x86_64.zip | |
| - name: Repack signed Windows ZIP | |
| run: | | |
| Compress-Archive -Path extracted\* -DestinationPath artifacts/Espressif-IDE-win32.win32.x86_64.zip -Force | |
| - name: Upload Signed Windows ZIP | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: espressif-ide-win32 | |
| path: artifacts/Espressif-IDE-win32.win32.x86_64.zip |
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 182 to 191, the artifact
name used for uploading the signed Windows ZIP is set to "release-artifacts,"
which is inconsistent with the original artifact naming convention. To fix this,
change the artifact name in the upload step to match the original naming, such
as "espressif-ide-win32," ensuring consistent artifact names across all jobs.
| - name: Download built artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: release-artifacts | ||
| path: artifacts | ||
|
|
There was a problem hiding this comment.
Download artifact name mismatch
The windows-sign job downloads an artifact named release-artifacts, but the macOS build uploads the Windows ZIP under espressif-ide-win32. This will cause the download step to fail.
Choose one of the following fixes:
- Change the upload name in
macos-buildtorelease-artifacts. - Update this download step to:
- - uses: actions/download-artifact@v4
- with:
- name: release-artifacts
+ - uses: actions/download-artifact@v4
+ with:
+ name: espressif-ide-win32
path: artifacts📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Download built artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: release-artifacts | |
| path: artifacts | |
| - name: Download built artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: espressif-ide-win32 | |
| path: artifacts |
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 143 to 148, the download
step uses the artifact name 'release-artifacts', but the macOS build uploads the
Windows ZIP artifact under the name 'espressif-ide-win32'. To fix this, either
change the upload artifact name in the macOS build job to 'release-artifacts' to
match this download step, or update the download step here to use the artifact
name 'espressif-ide-win32' so it correctly downloads the uploaded artifact.
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (7)
.github/workflows/win_exe_sign_test.yml (7)
22-22: Bump actions/checkout to v4
Theactions/checkoutaction is on v3, which is outdated. Update both occurrences to v4:- uses: actions/checkout@v3 + uses: actions/checkout@v4Also applies to: 141-141
🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: Bump actions/setup-java to v4
Theactions/setup-javaaction uses v3, but v4 is available with improvements:- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
40-44:⚠️ Potential issueFix unresolved placeholder in keystore path
TheKEYSTORE_FILEvariable uses a literal{{secrets.JARSIGNER_KEYSTORE}}placeholder, which is invalid. Define a concrete filename or use an env var, e.g.:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"This ensures the base64 decoding writes to a valid path.
160-169:⚠️ Potential issueRemove JKS file after converting to PFX
The script decodesmykeystore.jksbut never deletes it, risking secret leakage. After thekeytool.execommand, add:-deststorepass $env:PFX_PASS + Remove-Item mykeystore.jksto clean up the JKS file.
186-191:⚠️ Potential issueUse consistent artifact naming
Thewindows-signjob uploads the signed ZIP underrelease-artifacts, but themacos-buildjob names itespressif-ide-win32. Align them:- - name: Upload Signed Windows ZIP - uses: actions/upload-artifact@v4 - with: - name: release-artifacts + - name: Upload Signed Windows ZIP + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-win32 path: artifacts/Espressif-IDE-win32.win32.x86_64.zip
171-180:⚠️ Potential issueSpecify PowerShell shell & avoid hardcoded
signtool.exepath
The signing step uses PowerShell syntax withoutshell: pwsh, and hardcodes a Windows SDK path. Update:- - name: Sign Windows Executable - run: | + - name: Sign Windows Executable + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\*.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool sign ` /f cert.pfx `This ensures the runner locates
signtool.exefrom PATH or installed Windows SDK.
153-159:⚠️ Potential issueInstall Java on Windows runner
The Windows job invokeskeytool.exevia$env:JAVA_HOMEbut never sets up a JDK. Add before converting the keystore:+ - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'This ensures
JAVA_HOMEis defined.
🧹 Nitpick comments (1)
.github/workflows/win_exe_sign_test.yml (1)
47-128: Remove trailing whitespace
Multiple lines contain trailing spaces, causing YAML lint errors. Please remove any trailing spaces across the file to satisfy linter rules.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
141-141: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
| - name: Download built artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: espressif-ide-win32 | ||
| path: releng/com.espressif.idf.product/target/products/Espressif-IDE-*-win32.win32.x86_64.zip | ||
|
|
||
| - name: Extract Windows ZIP | ||
| run: | | ||
| Expand-Archive -Path (Get-ChildItem -Path artifacts -Filter "*win32.win32.x86_64.zip").FullName -DestinationPath extracted |
There was a problem hiding this comment.
Align download path with Expand-Archive usage
The download step writes artifacts to releng/..., but the extract step looks in artifacts. Either change the download path to artifacts:
- - name: Download built artifacts
- uses: actions/download-artifact@v4
- with:
- name: espressif-ide-win32
- path: releng/com.espressif.idf.product/target/products/Espressif-IDE-*-win32.win32.x86_64.zip
+ - name: Download built artifacts
+ uses: actions/download-artifact@v4
+ with:
+ name: espressif-ide-win32
+ path: artifactsor update Expand-Archive to use the releng/... path.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 143 to 151, the download
step saves artifacts to the releng/com.espressif.idf.product/target/products
directory, but the extract step looks for ZIP files in the artifacts directory,
causing a path mismatch. Fix this by either changing the download path to
artifacts to match the extract step or update the Expand-Archive command to use
the releng/com.espressif.idf.product/target/products path where the ZIP files
are actually downloaded.
| if: ${{ !cancelled() }} | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: espressif-ide-macosx.cocoa.aarch64 |
There was a problem hiding this comment.
Fix indentation for with block
Line 112 is over-indented, causing a YAML lint warning. Adjust to match the other artifact upload steps:
- name: espressif-ide.cocoa.aarch64
+ name: espressif-ide.cocoa.aarch64Committable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at line 112, the indentation of the
line "name: espressif-ide-macosx.cocoa.aarch64" is too deep, causing a YAML lint
warning. Adjust the indentation to align with the other artifact upload steps by
reducing the leading spaces so it matches the expected YAML structure.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (5)
.github/workflows/win_exe_sign_test.yml (5)
40-42:⚠️ Potential issueFix unresolved placeholder in keystore filename
TheKEYSTORE_FILEpath uses a literal{{secrets.JARSIGNER_KEYSTORE}}placeholder instead of a real filename. Define a concrete.jksfilename or reference a proper secret. For example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
22-22: 🛠️ Refactor suggestionUpdate checkout action to latest major version
actionlint flagsactions/checkout@v3as too old. Bump toactions/checkout@v4for improved performance and bug fixes.- uses: actions/checkout@v3 + uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
187-191:⚠️ Potential issueUnify artifact upload name for Windows ZIP
The signed Windows ZIP is uploaded underrelease-artifacts, but the original upload usedespressif-ide-win32. Use a consistent name to avoid confusion:- - name: Upload Signed Windows ZIP - uses: actions/upload-artifact@v4 - with: - name: release-artifacts + - name: Upload Signed Windows ZIP + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-win32 path: artifacts/Espressif-IDE-win32.win32.x86_64.zip
171-179: 🛠️ Refactor suggestionAvoid hardcoded Windows SDK path & specify shell
Hardcoding the SDK path can break on runner updates. Usesigntool.exefromPATHand declare PowerShell shell:- - name: Sign Windows Executable - run: | + - name: Sign Windows Executable + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\*.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool.exe sign `
137-141:⚠️ Potential issueEnsure Java is installed on Windows runner
The Windows job callskeytool.exebut doesn’t install a JDK. Add a Java setup step after checkout:- steps: - - uses: actions/checkout@v3 + steps: + - uses: actions/checkout@v4 + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'🧰 Tools
🪛 actionlint (1.7.7)
141-141: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🧹 Nitpick comments (4)
.github/workflows/win_exe_sign_test.yml (4)
47-128: Remove trailing whitespace
Multiple lines contain trailing spaces flagged by YAMLlint. Clean up trailing whitespace to satisfy lint rules, e.g.:sed -i 's/[[:space:]]\+$//' .github/workflows/win_exe_sign_test.yml🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
112-112: Fix indentation for upload artifact name
Thenameline is over-indented, causing a YAML warning. Align it with other steps:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx.cocoa.aarch64🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
161-162: Remove intermediate JKS file after conversion
After convertingencoded.b64tomykeystore.jks, the JKS remains on disk. Delete it post-import to avoid leaking secrets:certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64 + Remove-Item mykeystore.jks -Force
192-237: Remove or complete commented-out deploy job
A large block of commented-outdeploysteps clutters the workflow. Remove it or provide a working implementation before merging.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
141-141: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (4)
.github/workflows/win_exe_sign_test.yml (4)
25-29: 🛠️ Refactor suggestionUpgrade
actions/setup-javato v4
actionlint flagsactions/setup-java@v3as outdated. Switch toactions/setup-java@v4:- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
175-183: 🛠️ Refactor suggestionSpecify PowerShell and avoid hardcoded SDK path
The signing step uses PowerShell syntax but doesn't declareshell: pwshand hardcodes a Windows SDK version, which may vary. Update to usesigntool.exefromPATHand specify the shell:- - name: Sign Windows Executable - run: | + - name: Sign Windows Executable + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\*.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & "signtool.exe" sign ` /f cert.pfx ` /p $env:PFX_PASS ` /tr http://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
112-112: 🛠️ Refactor suggestionFix indentation in artifact upload step
Line 112 is over-indented, causing a YAML lint warning. Align with otherupload-artifactsteps:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx.cocoa.aarch64🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
40-43: 🛠️ Refactor suggestionFix keystore filename placeholder
TheKEYSTORE_FILEpath uses a literal placeholder{{secrets.JARSIGNER_KEYSTORE}}, which isn't a valid filename. Define an actual filename or env var. For example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
🧹 Nitpick comments (4)
.github/workflows/win_exe_sign_test.yml (4)
47-47: Remove trailing whitespace
YAMLlint reports trailing spaces on multiple lines. Please remove trailing spaces at the flagged lines to pass lint checks.Also applies to: 57-57, 61-61, 65-65, 70-70, 77-77, 86-86, 90-90, 93-93, 96-96, 100-100, 107-107, 114-114, 121-121, 128-128
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 47-47: trailing spaces
(trailing-spaces)
161-163: Clean up JKS file after conversion
After convertingmykeystore.jkstocert.pfx, the legacy JKS file remains on the runner. Remove it to avoid leaking secrets:- certutil -decode encoded.b64 mykeystore.jks - Remove-Item encoded.b64 + certutil -decode encoded.b64 mykeystore.jks + Remove-Item encoded.b64 + Remove-Item mykeystore.jks
191-193: Unify upload artifact naming
The finalupload-artifactstep names the artifactrelease-artifacts, which is inconsistent with previous steps. Consider reusingespressif-ide-win32for clarity:- name: release-artifacts + name: espressif-ide-win32
195-236: Remove or enable commented-out deploy job
Thedeployjob is fully commented out, which adds noise. If it's WIP, consider extracting it to a separate file or enabling it when ready. Otherwise, remove the block to keep the workflow focused.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
141-141: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: macos-build
- GitHub Check: build_macos
| - uses: actions/checkout@v3 | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Bump actions/checkout to latest version
actions/checkout@v3 is outdated per actionlint. Upgrade to actions/checkout@v4:
- uses: actions/checkout@v3
+ uses: actions/checkout@v4Also applies to: 141-142
🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at lines 22-23 and also lines
141-142, the usage of actions/checkout is outdated at version v3. Update the
version from actions/checkout@v3 to actions/checkout@v4 to comply with the
latest recommended version by actionlint.
| windows-sign: | ||
| runs-on: windows-latest | ||
| needs: macos-build | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Install Java on Windows runner
The windows-sign job invokes keytool.exe but doesn't install Java or set JAVA_HOME. Add a setup step:
- name: Set up Java
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '11'🧰 Tools
🪛 actionlint (1.7.7)
141-141: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 137 to 142, the
windows-sign job uses keytool.exe but does not install Java or set JAVA_HOME.
Add a step before running keytool.exe to install Java by using the
actions/setup-java@v4 action with distribution set to 'temurin' and java-version
set to '11' to ensure Java is available on the Windows runner.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (8)
.github/workflows/win_exe_sign_test.yml (8)
6-7: Use shell-style glob for tag filters
GitHub Actions uses shell-style glob patterns for tag filters, not regex. The current pattern"v[0-9]+.[0-9]+.[0-9]+"will not match as intended. Update to:on: push: tags: - - "v[0-9]+.[0-9]+.[0-9]+" + - 'v*.*.*'
22-23: Bumpactions/checkoutto v4
actions/checkout@v3is flagged by actionlint as outdated. Upgrade both occurrences toactions/checkout@v4in themacos-build(line 22) andwindows-sign(line 146) jobs:- uses: actions/checkout@v3 + uses: actions/checkout@v4Also applies to: 146-147
🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-28: Upgradeactions/setup-javato v4
Similarly, bumpactions/setup-java@v3toactions/setup-java@v4for the macOS job:- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
40-45:⚠️ Potential issueResolve placeholder in
KEYSTORE_FILEpath
The keystore is currently written to"${PWD}/{{secrets.JARSIGNER_KEYSTORE}}", which is a literal placeholder. Replace it with a concrete filename (or valid env var):- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"Ensure this matches how you reference the file in subsequent steps.
112-114: 🛠️ Refactor suggestionFix indentation and normalize macOS aarch64 artifact name
Theupload-artifactstep for aarch64 is mis-indented (11 spaces) and uses dots instead of dashes in the name. Adjust to:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
154-162: 🛠️ Refactor suggestionInstall Java on Windows runner before keytool
Thewindows-signjob invokeskeytool.exebut never installs Java or setsJAVA_HOME. Add before decoding the JKS:- name: Set up Java uses: actions/setup-java@v4 with: distribution: 'temurin' java-version: '11'This is required for
keytool.exeto be available.
174-183:⚠️ Potential issueAvoid hardcoded Windows SDK path for
signtool.exe
Referencing a fixed SDK path (10.0.17763.0) will break if the runner’s SDK changes. Instead invokesigntoolfromPATH:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool sign `Or implement logic to dynamically locate the installed SDK.
189-194: 🛠️ Refactor suggestionUnify artifact naming for signed Windows ZIP
The macOS job uploads the Windows ZIP asespressif-ide-win32, but the Windows-sign job re-uploads it underrelease-artifacts. This mismatch can break downstream jobs. Rename the upload to match:- name: release-artifacts + name: espressif-ide-win32Alternatively, choose a clear distinct name like
espressif-ide-win32-signed.
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
46-75: Strip trailing whitespace in codesign blocks
YAML lint reports trailing spaces on multiple lines within theCodesign Espressif-IDEstep (e.g., lines 47, 57, 61, 65, 70, 77). Please remove all trailing spaces or run a formatting tool over lines 46–75.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
155-183: Specifyshell: pwshfor PowerShell steps
Several Windows steps (Extract Windows ZIP,Decode JKS and convert to PFX,Sign Windows Executable) use PowerShell syntax but lack an explicit shell declaration. For clarity and consistency, addshell: pwshto each:- name: Sign Windows Executable shell: pwsh run: | # ...
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
146-146: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (5)
.github/workflows/win_exe_sign_test.yml (5)
22-23: Updateactions/checkoutto the latest major version
Actionlint flaggedactions/checkout@v3as outdated. Please bump toactions/checkout@v4to receive the latest fixes and performance improvements.- uses: actions/checkout@v3 + uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-28: Bumpactions/setup-javato v4
You’re currently pinningactions/setup-java@v3, which is outdated. Upgrade toactions/setup-java@v4.- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
40-40:⚠️ Potential issueFix unresolved placeholder in keystore filename
The line uses a literal placeholder{{secrets.JARSIGNER_KEYSTORE}}instead of a concrete filename. Define an explicit filename for the keystore (or use an environment variable) before decoding:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
165-173:⚠️ Potential issueInstall Java on the Windows runner before keytool usage
You reference${env:JAVA_HOME}\bin\keytool.exebut haven’t installed or configured Java on the Windows runner. Insert a setup step before conversion:- - name: Decode base64-encoded JKS + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11' + - name: Decode base64-encoded JKSThis ensures
JAVA_HOMEis available forkeytool.exe.
176-185: 🛠️ Refactor suggestionAvoid hardcoded signtool path
HardcodingC:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exemay break on different runners. Instead, assumesigntool.exeis inPATHor discover it dynamically:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool sign `Or use
Get-Command signtool | Select-Object -ExpandProperty Sourcefor dynamic resolution.
🧹 Nitpick comments (4)
.github/workflows/win_exe_sign_test.yml (4)
11-14: Remove or utilize the unusedARCHIVE_SUFFIXvariable
ARCHIVE_SUFFIXis defined as-SNAPSHOT.zipbut isn’t referenced in any active steps. Either remove it to reduce confusion or integrate it into artifact upload/download paths.
47-128: Remove trailing spaces
Multiple lines contain trailing whitespace, triggering YAML lint errors. Please remove these trailing spaces to ensure a clean workflow file.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
158-163: UseSet-Content -NoNewlineto avoid extra newline in base64 decoding
PowerShell’sOut-Fileappends a newline, which can corrupt the JKS. Instead, use:- echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII + echo "$env:JKS_B64" | Set-Content -NoNewline encoded.b64 -Encoding ASCII
191-196: Consider aligning artifact names with defined environment variables
You upload the final Windows ZIP asrelease-artifacts, but you’ve definedARCHIVE_PREFIXandARCHIVE_SUFFIXat the top. Consider using these to standardize naming across platforms:- name: release-artifacts + name: ${{ env.ARCHIVE_PREFIX }}${{ needs.macos-build.outputs.version }}${{ env.ARCHIVE_SUFFIX }}This improves consistency and avoids hardcoded strings.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
22-22: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
146-146: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 47-47: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 90-90: trailing spaces
(trailing-spaces)
[error] 93-93: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 100-100: trailing spaces
(trailing-spaces)
[error] 107-107: trailing spaces
(trailing-spaces)
[warning] 112-112: wrong indentation: expected 10 but found 11
(indentation)
[error] 114-114: trailing spaces
(trailing-spaces)
[error] 121-121: trailing spaces
(trailing-spaces)
[error] 128-128: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build
- GitHub Check: macos-build
🔇 Additional comments (1)
.github/workflows/win_exe_sign_test.yml (1)
197-242: Skip reviewing commented-outdeployjob
These lines are part of an inactive (commented)deployjob. No review comments needed until the job is enabled.
| push: | ||
| branches: [master] | ||
| tags: | ||
| - "v[0-9]+.[0-9]+.[0-9]+" |
There was a problem hiding this comment.
Replace regex tag filter with glob pattern
GitHub Actions tag filters do not support regex syntax. Update the pattern from:
- tags:
- - "v[0-9]+.[0-9]+.[0-9]+"to a shell-style glob, for example:
+ tags:
+ - 'v*.*.*'This ensures your workflow triggers correctly on version tags.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at line 7, the tag filter uses a
regex pattern which is unsupported by GitHub Actions. Replace the regex
"v[0-9]+.[0-9]+.[0-9]+" with a glob pattern like 'v*.*.*' to correctly match
version tags and ensure the workflow triggers as expected.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (8)
.github/workflows/win_exe_sign_test.yml (8)
21-22: Upgradeactions/checkoutto v4.
Actionlint flagsactions/checkout@v3as outdated. Bump to the latest major version:- uses: actions/checkout@v3 + uses: actions/checkout@v4Also applies to: 145-146
🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-28: Upgradeactions/setup-javato v4.
Actionlint indicatesactions/setup-java@v3is too old. Update to:- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
165-174: Delete JKS after converting to PFX.
You removeencoded.b64but retainmykeystore.jks. To prevent leaking secrets, remove the JKS file:& "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore ` -srckeystore mykeystore.jks ` ... -deststorepass $env:PFX_PASS + Remove-Item mykeystore.jks
193-197: Consistent artifact naming for Windows ZIP.
The job downloadsespressif-ide-win32but uploads the signed ZIP asrelease-artifacts. This mismatch will break the deploy pipeline. Align names:- name: Upload Signed Windows ZIP - uses: actions/upload-artifact@v4 - with: - name: release-artifacts + name: Upload Signed Windows ZIP + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-win32
6-7:⚠️ Potential issueWorkflow tag filter uses unsupported regex.
GitHub Actions tag filters don’t support regex; use a shell-style glob to trigger on version tags.
For example:- tags: - - "v[0-9]+.[0-9]+.[0-9]+" + tags: + - 'v*.*.*'
145-151:⚠️ Potential issueInstall Java on the Windows runner before using
keytool.
The Windows signing job invokeskeytool.exebut doesn’t install Java or setJAVA_HOME. Add a setup step after checkout:- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
39-43:⚠️ Potential issueFix unresolved keystore filename placeholder.
KEYSTORE_FILEis currently set to a literal{{secrets.JARSIGNER_KEYSTORE}}, causing the base64 decode to write to an invalid path. Define a concrete filename or use an env var, e.g.:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-rel-keystore.jks"
180-186: 🛠️ Refactor suggestionAvoid hardcoded signtool path.
Rely onsigntool.exeinPATHor dynamically locate it instead of using a fixed SDK version path:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & "signtool.exe" sign `
🧹 Nitpick comments (1)
.github/workflows/win_exe_sign_test.yml (1)
46-46: Remove trailing spaces and fix indentation.
YAMLlint flagged multiple trailing spaces and an indentation mismatch at line 111. Please clean up trailing whitespace and adjust thewithblock indentation to match surrounding steps.Also applies to: 56-56, 60-60, 64-64, 69-69, 76-76, 85-85, 89-89, 92-92, 95-95, 99-99, 106-106, 113-113, 120-120, 127-127
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (7)
.github/workflows/win_exe_sign_test.yml (7)
6-7: 🛠️ Refactor suggestionUse a valid glob pattern for tag filter
GitHub Actions doesn’t support regex in tag filters. Changetags: - "v[0-9]+.[0-9]+.[0-9]+"to a glob-style pattern, for example:
tags: - 'v*.*.*'
21-22: 🛠️ Refactor suggestionBump
actions/checkoutto latest major version
actionlint flagsactions/checkout@v3as outdated. Upgrade toactions/checkout@v4to pull in the latest bug fixes and performance improvements.- uses: actions/checkout@v3 + uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
23-27: 🛠️ Refactor suggestionUpgrade
actions/setup-javato v4
Similarly, bumpactions/setup-java@v3toactions/setup-java@v4per actionlint to ensure compatibility with the latest runners.- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
39-43: 🛠️ Refactor suggestionFix unresolved keystore filename placeholder
TheKEYSTORE_FILEpath uses{{secrets.JARSIGNER_KEYSTORE}}, which won’t resolve to a valid filename. Define a concrete filename or environment variable, e.g.:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"Ensure the base64 decode writes to a real
.jksfile and that it’s removed after use.
145-146: 🛠️ Refactor suggestionBump
actions/checkoutin Windows job
Just like in the macOS job, update:- uses: actions/checkout@v3 + uses: actions/checkout@v4to avoid running an outdated checkout action on Windows.
🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
182-192: 🛠️ Refactor suggestionAvoid hardcoded
signtool.exepath & use HTTPS timestamp
Hardcoding the Windows SDK path risks breakage on SDK upgrades, and the timestamp URL should use HTTPS. Replace with:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` - /f cert.pfx ` - /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + & signtool sign ` + /f cert.pfx ` + /p $env:PFX_PASS ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
106-113: 🛠️ Refactor suggestionCorrect artifact name and indentation for aarch64 DMG
The artifact name and indentation are inconsistent with the x86_64 step and use a dot instead of hyphens. Update to:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64This ensures consistent naming and passes YAML lint.
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
1-252: Remove trailing whitespace across the workflow
YAMLlint reports multiple trailing-space errors throughout the file. It’s best to trim all trailing spaces to prevent lint failures. You can run:sed -i '' -e 's/[[:space:]]\+$//' .github/workflows/win_exe_sign_test.yml🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
213-252: Clean up or remove commented-out deploy job
The entiredeployjob is commented out. If this is temporary, consider adding a TODO explaining when it should be enabled, or remove it to reduce noise.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: macos-build
- GitHub Check: build_macos
- GitHub Check: build
| - name: Download built artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: espressif-ide-win32 | ||
| path: artifacts |
There was a problem hiding this comment.
Fix upload path mismatch for the signed ZIP
You download into artifacts and expand into extracted, but then upload from artifacts/extracted/*, which doesn’t exist. Either change the upload path to extracted/* or expand into artifacts/extracted. For example:
- path: artifacts/extracted/*
+ path: extracted/*Also applies to: 205-210
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 147 to 151 and also
lines 205 to 210, the download path is set to 'artifacts' but the upload step
tries to upload from 'artifacts/extracted/*', which does not exist. To fix this,
either change the extraction path to 'artifacts/extracted' so the upload path is
correct, or adjust the upload path to 'extracted/*' if extraction remains
outside 'artifacts'. Ensure the download, extraction, and upload paths are
consistent to avoid path mismatches.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (8)
.github/workflows/win_exe_sign_test.yml (8)
21-21:⚠️ Potential issueBump
actions/checkoutto latest version
actionlint flagsactions/checkout@v3as outdated. Upgrade toactions/checkout@v4to ensure compatibility and receive the latest fixes.- - uses: actions/checkout@v3 + - uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24:⚠️ Potential issueUpgrade
actions/setup-javato v4
actionlint reports thatactions/setup-java@v3is too old. Use v4 for better support and bug fixes:- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
165-170:⚠️ Potential issueSpecify PowerShell shell for JKS decode step
On Windows runners the default shell iscmd.exe, so$env:JKS_B64won’t expand. Addshell: pwshto this step:- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: | echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64
39-42:⚠️ Potential issueFix unresolved keystore filename placeholder
The line uses a literal placeholder{{secrets.JARSIGNER_KEYSTORE}}, which won’t resolve. Define a concrete filename before decoding. For example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks" echo "${KEYSTORE_FILE}" printf "%s" "${JARSIGNER_KEYSTORE_B64}" | base64 -d > "${KEYSTORE_FILE}"This ensures the keystore file is written correctly and can be cleaned up.
182-192: 🛠️ Refactor suggestionAvoid hardcoded signtool path & use HTTPS timestamp
Hardcoding the Windows SDK path can break on version upgrades. Instead callsigntool.exefromPATHand secure the timestamp URL:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` - /f cert.pfx ` - /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` - /td sha256 ` - /fd sha256 ` - $exe.FullName + & signtool sign ` + /f cert.pfx ` + /p $env:PFX_PASS ` + /tr https://timestamp.digicert.com ` + /td sha256 ` + /fd sha256 ` + $exe.FullNameThis makes your workflow more robust and secure.
6-7:⚠️ Potential issueReplace unsupported regex tag filter with glob pattern
GitHub Actions doesn’t support regex in thetagsfilter. This will prevent your workflow from triggering on version tags.
Apply this diff:-on: - push: - branches: [master] - tags: - - "v[0-9]+.[0-9]+.[0-9]+" +on: + push: + branches: [master] + tags: + - 'v*.*.*'
111-112:⚠️ Potential issueCorrect DMG artifact name and indentation
The artifact name uses a dot and improper indentation, leading to inconsistent naming and potential upload failures. Change to hyphens and align indent with other steps:- - name: Upload Espressif-IDE-macosx-cocoa-aarch64.dmg - if: ${{ !cancelled() }} - uses: actions/upload-artifact@v4 - with: - name: espressif-ide-macosx.cocoa.aarch64 - path: releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg + - name: Upload Espressif-IDE-macosx-cocoa-aarch64.dmg + if: ${{ !cancelled() }} + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-macosx-cocoa-aarch64 + path: releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
207-210:⚠️ Potential issueFix upload path mismatch for signed ZIP
You extract the archive intoextracted, yet the upload step points toartifacts/extracted. This will fail to find any files. Update the path or extraction target for consistency. For example:- - name: Upload Signed Windows ZIP - uses: actions/upload-artifact@v4 - with: - name: Espressif-IDE-win32-Signed - path: artifacts/extracted/ + - name: Upload Signed Windows ZIP + uses: actions/upload-artifact@v4 + with: + name: Espressif-IDE-win32-Signed + path: extracted/ overwrite: true if-no-files-found: error
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
🔇 Additional comments (1)
.github/workflows/win_exe_sign_test.yml (1)
46-46: Remove trailing spaces
YAMLlint reports trailing spaces on these lines. Removing them will eliminate lint errors and improve readability.
[ suggest_nitpick ]Also applies to: 56-56, 60-60, 64-64, 69-69, 76-76, 85-85, 89-89, 92-92, 95-95, 99-99, 106-106, 113-113, 120-120, 127-127
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
|
|
||
| - name: Download built artifacts |
There was a problem hiding this comment.
Add Java setup action to Windows job
The Windows runner invokes keytool.exe but no JDK is installed nor JAVA_HOME set. Insert before JKS decoding:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@v4
+ - name: Set up Java
+ uses: actions/setup-java@v4
+ with:
+ distribution: 'temurin'
+ java-version: '11'This ensures keytool.exe is available.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 146 to 147, the Windows
job uses keytool.exe without installing a JDK or setting JAVA_HOME. Fix this by
adding a Java setup step before the JKS decoding step: update the checkout
action to v4, then add a step using actions/setup-java@v4 with distribution
'temurin' and java-version '11' to ensure keytool.exe is available.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (7)
.github/workflows/win_exe_sign_test.yml (7)
21-21: Upgrade checkout action to latest version
Per actionlint, bumpactions/checkout@v3toactions/checkout@v4to leverage recent bug fixes and runner improvements.🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
23-24: Bump setup-java action to latest major version
The step usesactions/setup-java@v3, which is outdated. Upgrade toactions/setup-java@v4to comply with current runner requirements.🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: Upgrade checkout action in Windows job
Also bump the Windows job’sactions/checkout@v3toactions/checkout@v4per actionlint.🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
165-170: Specify PowerShell shell for JKS decoding
The decode step uses PowerShell syntax but does not declareshell: pwsh. Without it,$env:JKS_B64won’t expand under the defaultcmd.exe. Addshell: pwshto this step.
194-200: Specify shell and simplify signature verification
The signature verification step uses PowerShell syntax withoutshell: pwshand hardcodes thesigntoolpath. Update to:- name: Verify Signature shell: pwsh run: | $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 & signtool verify /pa $exe.FullName
39-43:⚠️ Potential issueResolve placeholder in KEYSTORE_FILE path
The lineKEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}"uses an unresolved template. Use a concrete filename or an environment variable, e.g.:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
185-192: 🛠️ Refactor suggestionUse signtool from PATH and HTTPS timestamp
Avoid hardcoding the Windows SDK path and use a secure timestamp URL. For example:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
🧹 Nitpick comments (3)
.github/workflows/win_exe_sign_test.yml (3)
46-134: Remove trailing whitespace
Multiple lines contain trailing spaces, which cause YAML lint errors. Please remove trailing spaces throughout the steps (e.g., lines 46, 56, 60, 64, 69, 76, 85, 89, 92, 95, 99, 106, 113, 120, 127) to satisfy the linter.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
110-112: Fix artifact name and indentation for aarch64 DMG
Thenamefield uses a dot and is over-indented. It should use hyphens and match other steps:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64Adjust indentation to align with line 104.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
168-181: Clean up JKS file after conversion
After importing the JKS into a PFX, themykeystore.jksfile remains on the runner, risking secret leakage. Add a removal command immediately after conversion:Remove-Item mykeystore.jks
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
|
|
||
| - name: Download built artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: espressif-ide-win32 | ||
| path: artifacts | ||
|
|
There was a problem hiding this comment.
Install Java before using keytool
The Windows job invokes keytool.exe without installing a JDK or setting JAVA_HOME. Add a step after checkout, e.g.:
- name: Set up Java
uses: actions/setup-java@v4
with:
distribution: temurin
java-version: '11'🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 146 to 152, the workflow
uses keytool.exe without installing a JDK or setting JAVA_HOME, which will cause
failures. Add a step immediately after the checkout step to install Java by
using the actions/setup-java@v4 action with distribution set to temurin and
java-version set to '11'. This ensures keytool.exe can run properly during the
job.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (7)
.github/workflows/win_exe_sign_test.yml (7)
21-22: Update checkout action to latest version
actions/checkout@v3is flagged as outdated by actionlint. Please bump both occurrences toactions/checkout@v4for the newest fixes and performance improvements.Also applies to: 145-146
🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: Update setup-java action to latest version
actions/setup-java@v3is flagged as outdated. Please upgrade toactions/setup-java@v4to comply with actionlint recommendations.🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
39-42:⚠️ Potential issueFix unresolved keystore filename placeholder
The line uses a literal placeholder instead of a real filename, so the base64 decode will fail. Replace with a concrete path:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
107-112:⚠️ Potential issueFix indentation and artifact name for aarch64 DMG upload
Thename:field is mis-indented and uses a dot instead of hyphens. It should match the x86_64 step for consistency:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64Also ensure indentation aligns with other upload-artifact steps (10 spaces before
name:).🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
6-7:⚠️ Potential issueFix unsupported tag filter pattern
GitHub Actions tag filters use glob patterns, not regex. The current"v[0-9]+.[0-9]+.[0-9]+"will not trigger correctly.- tags: - - "v[0-9]+.[0-9]+.[0-9]+" + tags: + - 'v*.*.*'
171-180:⚠️ Potential issueInstall Java before converting JKS to PFX
The Windows job callskeytool.exevia$env:JAVA_HOMEbut never installs Java or setsJAVA_HOME. Add a setup step immediately before the conversion:+ - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'This ensures
keytool.exeis available.
165-170:⚠️ Potential issueSpecify PowerShell shell for JKS decode and cleanup keystore file
On Windows runners the default shell iscmd.exe, so$env:JKS_B64won’t expand. Also, after decoding you should remove the JKS to avoid leaking secrets:- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: | echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII certutil -decode encoded.b64 mykeystore.jks - Remove-Item encoded.b64 + Remove-Item encoded.b64 + Remove-Item mykeystore.jks -Force
🧹 Nitpick comments (4)
.github/workflows/win_exe_sign_test.yml (4)
46-46: Remove trailing whitespace
Multiple lines contain trailing spaces, causing YAML lint errors. Please remove these extra spaces or run a formatter to clear them.Also applies to: 56-56, 60-60, 64-64, 69-69, 76-76, 85-85, 89-89, 92-92, 95-95, 99-99, 106-106, 113-113, 120-120, 127-127
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
182-192: Use secure timestamp URL and remove hardcoded signtool path
Hardcoding the Windows SDK path can break on updates, and the timestamp URL should use HTTPS. Update as follows:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` - /f cert.pfx ` - /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + & signtool.exe sign ` + /f cert.pfx ` + /p $env:PFX_PASS ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
194-200: Specify PowerShell shell for signature verification and simplify signtool invocation
The verification step lacksshell: pwshand uses a hardcoded SDK path. It should rely onsigntool.exeinPATH:- - name: Verify Signature - run: | + - name: Verify Signature + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` + & signtool.exe verify ` /pa ` $exe.FullName
213-258: Cleanup commented-out deploy job
This large commented block clutters the workflow. Since it’s inactive and slated for removal later, consider deleting it now or moving it into a separate workflow for clarity.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: macos-build
- GitHub Check: build_macos
| with: | ||
| name: Espressif-IDE-win32-Signed | ||
| path: extracted/ | ||
| overwrite: true |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Verify artifact upload path for signed Windows ZIP
The upload-artifact step uploads the entire extracted/ folder. Confirm that this includes the signed .zip and no extraneous files. Alternatively, narrow the path to extracted/*.zip to avoid unexpected content.
🏁 Script executed:
#!/bin/bash
# Verify contents of the extracted directory
ls -R extractedLength of output: 74
We can’t verify extracted/ contents via ls in this clone (it’s only created at runtime). Let’s inspect the workflow around the upload step to confirm where and how extracted/ is produced:
🏁 Script executed:
#!/bin/bash
# Show the upload-artifact step with surrounding context
rg -n "upload-artifact" -C5 .github/workflows/win_exe_sign_test.yml
# Show all references to "extracted" to find its creation/extraction step
rg -n "extracted" -C5 .github/workflows/win_exe_sign_test.ymlLength of output: 3880
Package and upload a signed Windows ZIP
The current upload-artifact step is pointing at the unzipped extracted/ directory (raw binaries), not a standalone signed ZIP. To produce a proper signed Windows ZIP and avoid unexpected files:
- After the signing step, add a re-zip action, for example:
- name: Create Signed Windows ZIP shell: pwsh run: Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force
- Update the upload-artifact step (lines 205–211) to reference that ZIP:
- path: extracted/ + path: signed-win32.zip
This ensures only the signed distribution archive is published as the artifact.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 207 to 210, the
upload-artifact step currently uploads the entire extracted/ directory, which
may include unwanted files. To fix this, add a step after signing that creates a
new ZIP archive containing only the signed files (e.g., using Compress-Archive
in PowerShell to zip extracted/* into signed-win32.zip). Then update the
upload-artifact step to upload this signed-win32.zip file instead of the whole
extracted/ folder, ensuring only the signed Windows ZIP is published.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (9)
.github/workflows/win_exe_sign_test.yml (9)
6-7: 🛠️ Refactor suggestionUse glob pattern for tag filter instead of regex
GitHub Actions tag filters do not support regex. Replace"v[0-9]+.[0-9]+.[0-9]+"with a glob pattern like'v*.*.*'to ensure proper triggering on version tags.
21-22: 🛠️ Refactor suggestionUpdate checkout action to the latest major version
actions/checkout@v3is flagged as outdated byactionlint. Bump toactions/checkout@v4to leverage the latest improvements and security fixes.🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
23-28: 🛠️ Refactor suggestionUpgrade
actions/setup-javato the latest major version
actions/setup-java@v3is outdated peractionlint. Update toactions/setup-java@v4to ensure compatibility and receive the latest bug fixes.🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
111-112: 🛠️ Refactor suggestionCorrect artifact name and indentation for macOS aarch64 upload
Thenamefield is over-indented and uses a dot instead of hyphens. It should align with other steps and use hyphens:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
39-42:⚠️ Potential issueFix unresolved keystore filename placeholder
KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}"uses a literal placeholder rather than a valid file path. Update to a concrete filename or env var, for example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"This change ensures the keystore file is correctly created and referenced.
145-147: 🛠️ Refactor suggestionInstall Java and update checkout action for Windows job
Thewindows-signjob still usesactions/checkout@v3and invokeskeytool.exewithout ensuring a JDK orJAVA_HOMEis set. Apply this diff:- - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'This ensures
signtool.exeandkeytool.exerun reliably on the Windows runner.🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
165-170: 🛠️ Refactor suggestionSpecify PowerShell shell for JKS decoding step
TheDecode base64-encoded JKSstep uses PowerShell syntax ($env:JKS_B64) but lacksshell: pwsh, defaulting tocmd.exewhere the env var won’t expand. Add:- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: |This change allows correct base64 decoding on the Windows runner.
182-192: 🛠️ Refactor suggestionUse portable
signtoolinvocation and secure timestamp URL
Avoid hardcoding the Windows SDK path and using HTTP for timestamping. Update to:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` - /f cert.pfx ` - /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + & signtool.exe sign ` + /f cert.pfx ` + /p $env:PFX_PASS ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullNameThis makes the step more portable and secures the timestamp server connection.
194-200: 🛠️ Refactor suggestionSpecify
pwshshell and usesigntool.exefrom PATH in verification step
TheVerify Signaturestep defaults tocmd.exeand hardcodes the SDK path. Change to:- - name: Verify Signature - run: | + - name: Verify Signature + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` + & signtool.exe verify ` /pa ` $exe.FullNameThis ensures PowerShell syntax runs correctly and improves maintainability.
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
46-106: Remove trailing spaces
Multiple lines (e.g., 46, 56, 60, 64, 69, 76, 85, 89, 92, 95, 99, 106) contain trailing spaces, causing YAML lint errors. Please remove these trailing spaces to comply with YAML formatting standards.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
205-210: Standardize artifact naming and upload only the signed ZIP
- The artifact name
Espressif-IDE-win32-Signeduses mixed case and deviates from other jobs. Prefer lowercase with hyphens (e.g.,espressif-ide-win32-signed).- Instead of uploading the entire
extracted/folder, compress it into a single ZIP to avoid unintended files. For example:- name: Create Signed Windows ZIP shell: pwsh run: Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force - name: Upload Signed Windows ZIP uses: actions/upload-artifact@v4 with: name: espressif-ide-win32-signed path: signed-win32.zip overwrite: trueThis change aligns naming conventions and guarantees only the intended archive is published.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (8)
.github/workflows/win_exe_sign_test.yml (8)
21-21: Bump actions/checkout to latest version
actions/checkout@v3is outdated per actionlint. Upgrade all usages to@v4to pick up bug fixes and performance improvements.- - uses: actions/checkout@v3 + - uses: actions/checkout@v4Also applies to: 145-145, 227-227
🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
23-27: Upgrade actions/setup-java to latest major version
actions/setup-java@v3is flagged as too old. Move toactions/setup-java@v4for compatibility and security updates.- - name: Set up JDK 17 - uses: actions/setup-java@v3 + - name: Set up JDK 17 + uses: actions/setup-java@v4 with: java-version: '17' distribution: 'temurin'🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
6-7:⚠️ Potential issueFix unsupported tag filter pattern
GitHub Actions tag filters use glob patterns, not regex. Update the tag filter to a shell-style glob to ensure the workflow triggers correctly on version tags.on: push: tags: - - "v[0-9]+.[0-9]+.[0-9]+" + - 'v*.*.*'
182-192: 🛠️ Refactor suggestionUse
signtoolfrom PATH and secure timestamp URL
Hardcoding the SDK path can break on upgrades, and HTTP timestamping is insecure. Rely on the runner’ssigntool.exeinPATHand switch to HTTPS:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
145-147:⚠️ Potential issueInstall Java before using keytool on Windows
The Windows job invokeskeytool.exebut never installs a JDK or setsJAVA_HOME. Add a setup step immediately after checkout:- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
111-112:⚠️ Potential issueNormalize DMG artifact naming for aarch64
The artifact name and indentation are inconsistent. Use hyphens instead of dots and align with the x86_64 step:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
39-43:⚠️ Potential issueResolve keystore file path placeholder
The placeholder{{secrets.JARSIGNER_KEYSTORE}}will not resolve at runtime. Use a fixed filename or reference a real environment variable. For example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
211-217: 🛠️ Refactor suggestionUpload a standalone signed Windows ZIP
Currently the entireextracted/folder is uploaded. Instead create a compressed ZIP of the signed binaries and upload that single file:+ - name: Create Signed Windows ZIP + shell: pwsh + run: | + Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force - - name: Upload Signed Windows ZIP + - name: Upload Signed Windows ZIP uses: actions/upload-artifact@v4 with: name: espressif-ide-win32 - path: extracted/ + path: signed-win32.zip
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
46-106: Remove trailing spaces
YAMLlint reports trailing spaces on multiple lines (46, 56, 60, 64, 69, 76, 85, 89, 92, 95, 99, 106). These will fail linting—please strip trailing whitespace from all lines.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
220-223: Fix indentation inupload-awsjob
YAMLlint reports incorrect indentation here. Alignruns-on,needs, andenvunder the job key by adding one space:- upload-aws: - runs-on: macos-latest - needs: windows-sign - env: + upload-aws: + runs-on: macos-latest + needs: windows-sign + env:🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build
- GitHub Check: macos-build
- GitHub Check: build_macos
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-win32.win32.x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-${VERSION}-win32.win32.x86_64.zip" | ||
|
|
||
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-x86_64-v${VERSION}.dmg" | ||
|
|
||
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-aarch64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-aarch64-v${VERSION}.dmg" | ||
|
|
||
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-linux.gtk.x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-${VERSION}-linux.gtk.x86_64.tar.gz" |
There was a problem hiding this comment.
Use consistent S3 bucket for redirects
The s3api put-object commands reference a hardcoded espdldata bucket instead of ${{ secrets.DL_BUCKET }}. Update to use the same secret:
- aws s3api put-object --acl=public-read --bucket espdldata ...
+ aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} ...📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-win32.win32.x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-${VERSION}-win32.win32.x86_64.zip" | |
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-x86_64-v${VERSION}.dmg" | |
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-aarch64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-aarch64-v${VERSION}.dmg" | |
| aws s3api put-object --acl=public-read --bucket espdldata --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-linux.gtk.x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-${VERSION}-linux.gtk.x86_64.tar.gz" | |
| aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-win32.win32.x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-${VERSION}-win32.win32.x86_64.zip" | |
| aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-x86_64-v${VERSION}.dmg" | |
| aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-aarch64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-macosx-cocoa-aarch64-v${VERSION}.dmg" | |
| aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} --key "dl/idf-eclipse-plugin-test/ide/Espressif-IDE-linux.gtk.x86_64/latest" --website-redirect-location "/dl/idf-eclipse-plugin-test/ide/Espressif-IDE-${VERSION}-linux.gtk.x86_64.tar.gz" |
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 300 to 306, the aws
s3api put-object commands use a hardcoded bucket name "espdldata" instead of the
secret variable ${{ secrets.DL_BUCKET }}. Replace all instances of the bucket
name "espdldata" with ${{ secrets.DL_BUCKET }} to ensure consistent use of the
configured S3 bucket for redirects.
| - name: Download macOS aarch64 dmg zip | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: espressif-ide-macosx.cocoa.aarch64 | ||
| path: artifacts/macos_arm | ||
|
|
There was a problem hiding this comment.
Fix artifact name for macOS aarch64 download
The download step refers to the old dot-style name; it must match the renamed upload:
- - name: Download macOS aarch64 dmg zip
+ - name: Download macOS aarch64 dmg
uses: actions/download-artifact@v4
with:
- name: espressif-ide-macosx.cocoa.aarch64
+ name: espressif-ide-macosx-cocoa-aarch64
path: artifacts/macos_arm📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Download macOS aarch64 dmg zip | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: espressif-ide-macosx.cocoa.aarch64 | |
| path: artifacts/macos_arm | |
| - name: Download macOS aarch64 dmg | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: espressif-ide-macosx-cocoa-aarch64 | |
| path: artifacts/macos_arm |
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 247 to 252, the artifact
name used in the download step for macOS aarch64 is outdated and does not match
the renamed upload artifact. Update the 'name' field in the download-artifact
action to the new correct artifact name that matches the upload step to ensure
the artifact is downloaded properly.
| - name: Extract macOS x86_64 dmg | ||
| run: unzip -q artifacts/macos_x86/*.zip -d artifacts/macos_x86 | ||
|
|
||
| - name: Extract macOS aarch64 dmg | ||
| run: unzip -q artifacts/macos_arm/*.zip -d artifacts/macos_arm | ||
|
|
There was a problem hiding this comment.
Remove unzip step for DMG artifacts
DMG files are not ZIP archives. The extract steps will fail. Either download the DMGs directly (no unzip) or use hdiutil if you need to mount them. For example:
- - name: Extract macOS x86_64 dmg
- run: unzip -q artifacts/macos_x86/*.zip -d artifacts/macos_x86
+ # DMG artifacts are binary images; no unzip requiredRepeat for the aarch64 block.
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 259 to 264, the unzip
commands are incorrectly used on DMG files, which are not ZIP archives and will
cause failures. Remove the unzip steps for both macOS x86_64 and aarch64 DMG
artifacts. Instead, either download the DMG files directly without extraction or
use the macOS-specific `hdiutil` command to mount the DMG files if needed.
There was a problem hiding this comment.
Actionable comments posted: 9
♻️ Duplicate comments (5)
.github/workflows/win_exe_sign_test.yml (5)
250-252: Update artifact name for macOS aarch64 download
The download step’snamemust match the upload. Change:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64
39-39:⚠️ Potential issueResolve keystore filename placeholder
The path uses a literal placeholder{{secrets.JARSIGNER_KEYSTORE}}, which won’t resolve. Replace it with a concrete filename or environment variable, for example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
185-192: 🛠️ Refactor suggestionAvoid hardcoded
signtool.exepath & use HTTPS timestamp
Hardcoding the SDK path can break on upgrades. Also switch to HTTPS for the timestamp. For example:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 `
309-315: 🛠️ Refactor suggestionUse consistent S3 bucket for redirects
Theseaws s3api put-objectcalls hardcode--bucket espdldata. Switch to${{ secrets.DL_BUCKET }}:- aws s3api put-object --acl=public-read --bucket espdldata ... + aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} ...
194-200: 🛠️ Refactor suggestionSpecify
pwshshell for signature verification
The signature verification step uses PowerShell commands but lacksshell: pwsh. Also remove the full path tosigntool.exe:- - name: Verify Signature - run: | + - name: Verify Signature + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` + & signtool verify ` /pa ` $exe.FullName
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
46-127: Remove trailing whitespace
Multiple steps contain trailing spaces, which cause YAML lint errors (lines 46,56,60,64,69,76,85,89,92,95,99,106,113,120,127). Please clean up trailing spaces across the file for consistency.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
174-180: Include-srckeypassif alias password differs
If your key entry uses a separate password, add-srckeypass $env:KEY_PASSto thekeytoolinvocation for completeness:- -srcstorepass $env:JKS_PASS ` + -srcstorepass $env:JKS_PASS ` + -srckeypass $env:KEY_PASS `
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build
- GitHub Check: macos-build
- GitHub Check: build_macos
| outputs: | ||
| version: ${{ steps.get_version.outputs.version }} | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Upgrade actions/checkout to v4
The workflow uses an outdated checkout action (actions/checkout@v3), which may not be supported on newer runners. Bump all instances to actions/checkout@v4.
Also applies to: 145-145, 227-227
🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at lines 21, 145, and 227, the
workflow uses the outdated action version actions/checkout@v3. Update all these
instances to actions/checkout@v4 to ensure compatibility with newer runners and
maintain support.
| - name: Extract macOS x86_64 dmg | ||
| run: | | ||
| ls -altr artifacts | ||
| ls -altr artifacts/macos_x86 | ||
| unzip -q artifacts/macos_x86/*.zip -d artifacts/macos_x86 | ||
|
|
||
| - name: Extract macOS aarch64 dmg | ||
| run: | | ||
| ls -altr artifacts | ||
| ls -altr artifacts/macos_arm | ||
| unzip -q artifacts/macos_arm/*.zip -d artifacts/macos_arm |
There was a problem hiding this comment.
Remove unzip for DMG files
DMG artifacts aren’t ZIPs, so unzip -q .../*.zip will fail. Either download DMGs directly or use hdiutil. For example, remove these steps altogether if no extraction is needed.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 259 to 269, the workflow
incorrectly uses unzip commands to extract DMG files, which are not ZIP archives
and will cause failures. Remove the unzip commands for the macOS x86_64 and
aarch64 DMG extraction steps, and either download the DMG files directly or use
the appropriate tool like hdiutil if mounting or extraction is necessary. If no
extraction is required, simply omit these steps.
| name: espressif-ide-macosx.cocoa.aarch64 | ||
| path: releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg |
There was a problem hiding this comment.
Fix artifact name and indentation for aarch64 DMG
The name field uses a dot and is over-indented:
- name: espressif-ide-macosx.cocoa.aarch64
+ name: espressif-ide-macosx-cocoa-aarch64Adjust indentation to match other upload steps.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 111 to 112, the artifact
name uses dots instead of dashes and is over-indented. Rename the artifact from
"espressif-ide-macosx.cocoa.aarch64" to "espressif-ide-macosx-cocoa-aarch64" and
adjust the indentation to align with other upload steps for consistency.
|
|
||
| aws s3 cp --acl=public-read artifacts/macos_x86/Espressif-IDE-macosx-cocoa-x86_64-v${VERSION}.dmg s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin-test/ide/ | ||
| aws s3 cp --acl=public-read artifacts/macos_arm/Espressif-IDE-macosx-cocoa-aarch64-v${VERSION}.dmg s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin-test/ide/ | ||
| aws s3 cp --acl=public-read artifacts/Espressif-IDE-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/ide/ |
There was a problem hiding this comment.
Correct S3 upload path for Windows ZIP
The path artifacts/Espressif-IDE-win32.win32.x86_64.zip doesn’t exist; you downloaded and extracted files instead. Update this to use your newly created signed-win32.zip or point to the correct artifact location.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at line 305, the S3 upload command
references a non-existent file path
artifacts/Espressif-IDE-win32.win32.x86_64.zip. Update this path to point to the
correct artifact, such as the newly created signed-win32.zip file or the actual
location of the signed Windows ZIP artifact, ensuring the upload command uses
the valid file path.
| - uses: actions/checkout@v3 | ||
|
|
||
| - name: Set up JDK 17 | ||
| uses: actions/setup-java@v3 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Bump actions/setup-java to v4
actions/setup-java@v3 is flagged as outdated by actionlint. Update to actions/setup-java@v4 to ensure compatibility with the current runner.
🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at line 24, the action
'actions/setup-java' is using version v3, which is outdated. Update the version
from v3 to v4 by changing the line to 'uses: actions/setup-java@v4' to ensure
compatibility with the current runner and resolve the actionlint warning.
| - name: Extract linux zip (keep internal .tar.gz intact) | ||
| run: | | ||
| ls -altr artifacts | ||
| unzip -q artifacts/*.zip -d artifacts/linux | ||
| ls -altr artifacts/linux/ | ||
|
|
There was a problem hiding this comment.
Fix Linux artifact extraction
You uploaded .tar.gz, not a ZIP, yet you’re running unzip. Replace with:
- run: unzip -q artifacts/*.zip -d artifacts/linux
+ run: mkdir -p artifacts/linux && tar -xzf artifacts/*.tar.gz -C artifacts/linux🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 271 to 276, the
extraction step incorrectly uses unzip on a .tar.gz file. Replace the unzip
command with a mkdir command to create the target directory if it doesn't exist,
followed by a tar command to extract the .tar.gz archive into the
artifacts/linux directory.
There was a problem hiding this comment.
Actionable comments posted: 7
♻️ Duplicate comments (7)
.github/workflows/win_exe_sign_test.yml (7)
21-22: Updateactions/checkoutto v4
Actionlint reportsactions/checkout@v3is outdated. Bump toactions/checkout@v4for compatibility with newer runners.🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-146: Updateactions/checkoutto v4 inwindows-signjob
Please bumpactions/checkout@v3toactions/checkout@v4here as well.🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-228: Updateactions/checkoutto v4 inupload-awsjob
Please bumpactions/checkout@v3toactions/checkout@v4here as well.🧰 Tools
🪛 actionlint (1.7.7)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
39-43:⚠️ Potential issueFix unresolved keystore filename placeholder
The placeholder{{secrets.JARSIGNER_KEYSTORE}}will not resolve. Use a concrete filename or env var, e.g.:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
110-112:⚠️ Potential issueFix artifact name and indentation
The artifact name uses a dot and is over-indented:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64Adjust indentation to match other
upload-artifactsteps.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
185-192:⚠️ Potential issueUse HTTPS timestamp and PATH for
signtool
- Switch to
https://timestamp.digicert.comfor secure timestamping.- Avoid hardcoded Windows Kits path; invoke
signtool.exedirectly fromPATH.- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` - /tr http://timestamp.digicert.com ` + & signtool.exe sign ` + /tr https://timestamp.digicert.com `
298-304:⚠️ Potential issueUse configured S3 bucket secret for redirects
Theaws s3api put-objectcommands reference a hardcoded bucketespdldata. Replace with the secret${{ secrets.DL_BUCKET }}to maintain consistency:- --bucket espdldata + --bucket ${{ secrets.DL_BUCKET }}
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
46-99: Remove trailing spaces
YAMLlint reports multiple trailing-space errors in this block (lines 46, 56, 60, 64, 69, 76, 85, 89, 92, 95, 99). Clean up these trailing spaces to satisfy lint checks and keep formatting consistent.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
219-227: Fix indentation inupload-awsjob
YAMLlint warns about inconsistent indentation (lines 220–227). Standardize to 4 spaces underupload-awsfor keys:runs-on,needs,env,steps, and list items. For example:- runs-on: macos-latest + runs-on: macos-latest🧰 Tools
🪛 actionlint (1.7.7)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build_macos
- GitHub Check: macos-build
| tags: | ||
| - "v[0-9]+.[0-9]+.[0-9]+" |
There was a problem hiding this comment.
Unsupported regex in tag filter
GitHub Actions tag filters use shell-style glob patterns, not regular expressions. Replace:
- tags:
- - "v[0-9]+.[0-9]+.[0-9]+"with:
tags:
- 'v*.*.*'🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at lines 6 to 7, the tag filter uses
an unsupported regular expression pattern "v[0-9]+.[0-9]+.[0-9]+". Replace this
regex with a shell-style glob pattern by changing the tag filter to 'v*.*.*' to
comply with GitHub Actions syntax.
| - name: Set up JDK 17 | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| java-version: '17' | ||
| distribution: 'temurin' | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Upgrade actions/setup-java to v4
Actionlint flags actions/setup-java@v3 as too old. Update to actions/setup-java@v4 to ensure Java setup on the runner.
🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml between lines 23 and 28, the GitHub
action uses an outdated version v3 of actions/setup-java. Update the version
from v3 to v4 by changing the uses line to actions/setup-java@v4 to comply with
actionlint and ensure proper Java setup on the runner.
| - name: Upload Signed Windows ZIP | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: espressif-ide-win32 | ||
| path: extracted/ | ||
| overwrite: true | ||
| if-no-files-found: error | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Repackage and upload a signed Windows ZIP
Currently the step uploads the raw extracted/ directory. To publish a proper signed archive:
- Compress the signed files:
- name: Create Signed Windows ZIP shell: pwsh run: Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force
- Upload only the ZIP:
- name: Upload Signed Windows ZIP uses: actions/upload-artifact@v4 with: name: espressif-ide-win32 path: signed-win32.zip overwrite: true
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 211 to 218, the current
step uploads the entire extracted/ directory instead of a compressed archive. To
fix this, add a step before uploading that compresses the contents of extracted/
into a signed-win32.zip file using Compress-Archive in PowerShell. Then modify
the upload step to upload only the signed-win32.zip file instead of the raw
directory.
| - name: Download macOS aarch64 dmg zip | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: espressif-ide-macosx.cocoa.aarch64 | ||
| path: artifacts/macos_arm |
There was a problem hiding this comment.
Fix artifact name in aarch64 download step
The download step refers to espressif-ide-macosx.cocoa.aarch64, but the artifact is named espressif-ide-macosx-cocoa-aarch64. Update to:
name: espressif-ide-macosx-cocoa-aarch64🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 247 to 251, the artifact
name in the download step is incorrect; it uses
'espressif-ide-macosx.cocoa.aarch64' instead of the correct
'espressif-ide-macosx-cocoa-aarch64'. Update the 'name' field in the
download-artifact action to 'espressif-ide-macosx-cocoa-aarch64' to match the
actual artifact name.
| - name: Verify Signature | ||
| run: | | ||
| $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 | ||
| & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` | ||
| /pa ` | ||
| $exe.FullName | ||
|
|
There was a problem hiding this comment.
Specify shell: pwsh and use signtool from PATH for verification
The Verify Signature step invokes PowerShell syntax with the default shell and a hardcoded path. Update to:
- name: Verify Signature
- run: |
+ name: Verify Signature
+ shell: pwsh
+ run: |
$exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1
- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify `
+ & signtool.exe verify `
/pa `
$exe.FullName🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 194 to 200, the Verify
Signature step uses PowerShell syntax but does not specify the shell, and it
calls signtool.exe using a hardcoded path. To fix this, add "shell: pwsh" to
explicitly use PowerShell Core, and replace the hardcoded signtool.exe path with
just "signtool.exe" to use the version available in the system PATH.
| run: | | ||
| zip -r artifacts/update/* com.espressif.idf.update-v${VERSION}.zip | ||
| zip -r artifacts/win32/* Espressif-IDE-${VERSION}-win32.win32.x86_64.zip | ||
|
|
There was a problem hiding this comment.
Correct zip command arguments
The zip -r invocation has the zipfile path and source files reversed. It should be:
- zip -r artifacts/update/* com.espressif.idf.update-v${VERSION}.zip
+ zip -r artifacts/update/com.espressif.idf.update-v${VERSION}.zip artifacts/update/*
- zip -r artifacts/win32/* Espressif-IDE-${VERSION}-win32.win32.x86_64.zip
+ zip -r artifacts/win32/Espressif-IDE-${VERSION}-win32.win32.x86_64.zip artifacts/win32/*This ensures the archives are created correctly.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 277 to 280, the zip
command arguments are reversed; the zipfile path should come immediately after
the zip command followed by the source files. Fix this by placing the archive
file path first, then the files or directories to be zipped, ensuring the
archives are created correctly.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (13)
.github/workflows/win_exe_sign_test.yml (13)
21-22: Upgradeactions/checkoutto v4
Actionlint flagsactions/checkout@v3as outdated. Bump all instances to@v4to ensure compatibility with current runners and receive the latest fixes.- - uses: actions/checkout@v3 + - uses: actions/checkout@v4Also applies to: 145-146, 227-228
🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
23-27: Upgradeactions/setup-javato v4
Actionlint reportsactions/setup-java@v3is too old. Update to@v4for proper runner support.- - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
39-43:⚠️ Potential issueFix unresolved keystore filename placeholder
The step decodes the keystore into{{secrets.JARSIGNER_KEYSTORE}}, which is a literal placeholder. Replace with a concrete filename or env var:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
247-251:⚠️ Potential issueCorrect download artifact name for macOS aarch64
The download step refers to the old dot-based name. Use the updated dash-based artifact:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64
194-200:⚠️ Potential issueSpecify
shell: pwshand use genericsigntool.exefor verification
TheVerify Signaturestep defaults to cmd.exe and uses a hardcoded path. Change to:- - name: Verify Signature - run: | + - name: Verify Signature + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` + & signtool.exe verify ` /pa ` $exe.FullName
111-112:⚠️ Potential issueFix indentation and artifact name for macOS aarch64
Indentation is incorrect and the artifact name uses dots instead of dashes. Update to:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64Ensure the line is indented to 10 spaces under
with:.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
276-280:⚠️ Potential issueCorrect
zipcommand argument order
Thezipinvocations have reversed arguments; the archive path must come first:- zip -r artifacts/update/* com.espressif.idf.update-v${VERSION}.zip + zip -r artifacts/update/com.espressif.idf.update-v${VERSION}.zip artifacts/update/* - zip -r artifacts/win32/* Espressif-IDE-${VERSION}-win32.win32.x86_64.zip + zip -r artifacts/win32/Espressif-IDE-${VERSION}-win32.win32.x86_64.zip artifacts/win32/*
6-7: 🛠️ Refactor suggestionInvalid tag filter syntax: Use glob instead of regex
GitHub Actions tag filters don’t support regular expressions. Switch to a shell-style glob to correctly match semantic version tags.
Apply this diff:
- tags: - - "v[0-9]+.[0-9]+.[0-9]+" + tags: + - 'v*.*.*'
185-192: 🛠️ Refactor suggestionUse generic
signtool.exeand HTTPS timestamp
Hardcoding the Windows SDK path can break on upgrades; usesigntool.exefrom PATH. Switch to an HTTPS timestamp server:- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` + & signtool.exe sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 ` $exe.FullName
297-303:⚠️ Potential issueUse configured S3 bucket secret instead of hardcoded name
Theput-objectsteps reference the static bucketespdldata. Replace with the secret:- aws s3api put-object --acl=public-read --bucket espdldata ... + aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} ...
147-152:⚠️ Potential issueInstall Java on Windows runner before using
keytool.exe
Thewindows-signjob invokeskeytool.exeviaJAVA_HOMEbut no JDK is installed norJAVA_HOMEset. Add a setup step:- uses: actions/checkout@v4 + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'
165-170:⚠️ Potential issueDecode JKS with PowerShell and clean up keystore
The JKS decode step runs under cmd and leavesmykeystore.jkson disk. Update to:- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: | echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII certutil -decode encoded.b64 mykeystore.jks Remove-Item encoded.b64 + Remove-Item mykeystore.jks
211-218: 🛠️ Refactor suggestionPackage and upload a signed Windows ZIP
Uploading the rawextracted/directory can include unintended files. Instead, compress the signed files into a standalone ZIP and upload that:- name: Upload Signed Windows ZIP - uses: actions/upload-artifact@v4 - with: - name: espressif-ide-win32 - path: extracted/ - overwrite: true + name: Create Signed Windows ZIP + shell: pwsh + run: | + Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force + - name: Upload Signed Windows ZIP + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-win32 + path: signed-win32.zip + overwrite: true
🧹 Nitpick comments (2)
.github/workflows/win_exe_sign_test.yml (2)
46-46: Remove trailing spaces
YAMLlint reports trailing spaces at multiple lines. Clean these up to satisfy lint rules.Also applies to: 56-56, 60-60, 64-64, 69-69, 76-76, 85-85, 89-89, 92-92, 95-95, 99-99, 106-106, 113-113, 120-120, 127-127
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
220-223: Fix indentation forupload-awsjob
YAMLlint flags incorrect indentation in theupload-awsjob block. Ensureruns-on:,env:, andsteps:are indented consistently underupload-aws.Also applies to: 227-227
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build_macos
- GitHub Check: build
- GitHub Check: macos-build
| aws s3 cp --acl=public-read artifacts/macos_arm/Espressif-IDE-macosx-cocoa-aarch64-v${VERSION}.dmg s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin-test/ide/ | ||
| aws s3 cp --acl=public-read Espressif-IDE-${VERSION}-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/ide/ | ||
|
|
There was a problem hiding this comment.
Inconsistent S3 upload paths for Windows ZIP
Most upload commands target dl/idf-eclipse-plugin-test, but the Windows ZIP is sent to dl/idf-eclipse-plugin. This will mix test and prod artifacts—align all paths to the same prefix.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 292 to 294, the S3
upload path for the Windows ZIP file differs from the others, causing test and
production artifacts to mix. Update the Windows ZIP upload command to use the
same S3 path prefix as the other uploads, specifically changing the path from
dl/idf-eclipse-plugin to dl/idf-eclipse-plugin-test to maintain consistency.
| KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" | ||
| echo "${KEYSTORE_FILE}" | ||
| printf "%s" "${JARSIGNER_KEYSTORE_B64}" | base64 -d > "${KEYSTORE_FILE}" | ||
| mvn -e -X clean install -Djarsigner.keystore="${KEYSTORE_FILE}" -Djarsigner.alias="${JARSIGNER_ALIAS}" -Djarsigner.storepass="${JARSIGNER_STOREPASS}" -DskipTests=true |
There was a problem hiding this comment.
Avoid verbose/debug flags to prevent leaking secrets
Running mvn -e -X generates detailed logs (including env vars), which can expose sensitive data. Remove -X (and consider dropping -e) to limit verbosity:
- mvn -e -X clean install \
+ mvn clean install \Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at line 42, remove the `-X` flag from
the `mvn` command to prevent verbose debug output that may leak sensitive
environment variables. Optionally, also remove the `-e` flag to further reduce
log verbosity. This will limit the exposure of secrets in the build logs.
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (9)
.github/workflows/win_exe_sign_test.yml (9)
21-21: Update checkout action to v4
Actionlint flagsactions/checkout@v3as too old to run on current GitHub runners. Bump toactions/checkout@v4.🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: Update setup-java action to v4
Actionlint flagsactions/setup-java@v3as outdated. Upgrade toactions/setup-java@v4to ensure compatibility.🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: Update checkout action to v4 (Windows job)
Actionlint flagsactions/checkout@v3as outdated. Bump toactions/checkout@v4.🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
277-280:⚠️ Potential issueCorrect
zipcommand argument order
Thezip -rinvocations have their arguments reversed. The archive path must come first, then the source:- zip -r artifacts/update/* com.espressif.idf.update-v${VERSION}.zip + zip -r artifacts/update/com.espressif.idf.update-v${VERSION}.zip artifacts/update/* - zip -r artifacts/win32/* Espressif-IDE-${VERSION}-win32.win32.x86_64.zip + zip -r artifacts/win32/Espressif-IDE-${VERSION}-win32.win32.x86_64.zip artifacts/win32/*
7-7:⚠️ Potential issueUnsupported regex in tag filter
GitHub Actions does not support regular expressions in tag filters. Replace the regex pattern with a shell-style glob, for example:- tags: - - "v[0-9]+.[0-9]+.[0-9]+" + tags: + - 'v*.*.*'
297-303:⚠️ Potential issueUse configured S3 bucket for redirects
Theaws s3api put-objectsteps hardcodeespdldata. Switch to${{ secrets.DL_BUCKET }}:- aws s3api put-object --acl=public-read --bucket espdldata ... + aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} ...
247-251:⚠️ Potential issueFix artifact name in download step
The download action referencesespressif-ide-macosx.cocoa.aarch64but the artifact is named with dashes. Update it:- name: Download macOS aarch64 dmg zip - uses: actions/download-artifact@v4 - with: - name: espressif-ide-macosx.cocoa.aarch64 + name: Download macOS aarch64 dmg + uses: actions/download-artifact@v4 + with: + name: espressif-ide-macosx-cocoa-aarch64
111-113:⚠️ Potential issueCorrect artifact naming and indentation
Thenamefield is over-indented and uses dots instead of dashes:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64Adjust indentation to align with other upload steps.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
293-293:⚠️ Potential issueFix Windows S3 upload path and prefix
Thisaws s3 cpuses the wrong file path and the production prefix:- aws s3 cp --acl=public-read Espressif-IDE-${VERSION}-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/ide/ + aws s3 cp --acl=public-read artifacts/win32/Espressif-IDE-${VERSION}-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin-test/ide/
🧹 Nitpick comments (1)
.github/workflows/win_exe_sign_test.yml (1)
194-200: Specify PowerShell shell & avoid hardcoded path for verification
Addshell: pwshand usesigntool.exefromPATHin the Verify Signature step:- name: Verify Signature + name: Verify Signature + shell: pwsh run: | $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` + & signtool.exe verify ` /pa ` $exe.FullName
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build_macos
- GitHub Check: build
- GitHub Check: macos-build
| - name: Decode base64-encoded JKS | ||
| run: | | ||
| echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII | ||
| certutil -decode encoded.b64 mykeystore.jks | ||
| Remove-Item encoded.b64 | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Specify PowerShell shell for JKS decoding
The Decode base64-encoded JKS step uses PowerShell commands but lacks shell: pwsh. Add it to ensure correct execution:
- name: Decode base64-encoded JKS
+ name: Decode base64-encoded JKS
+ shell: pwsh
run: |
echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII
certutil -decode encoded.b64 mykeystore.jks
Remove-Item encoded.b64🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 165 to 170, the step
decoding the base64-encoded JKS uses PowerShell commands but does not specify
the shell, which can cause execution issues. Fix this by adding "shell: pwsh" to
the step definition to explicitly run the commands in PowerShell.
| - name: Upload Signed Windows ZIP | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: espressif-ide-win32 | ||
| path: extracted/ | ||
| overwrite: true |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Repackage and upload a signed Windows ZIP
Uploading the raw extracted/ directory may include unwanted files. Instead, compress the signed binaries into a ZIP and upload that archive:
- name: Upload Signed Windows ZIP
uses: actions/upload-artifact@v4
with:
name: espressif-ide-win32
path: extracted/
+ name: Create Signed Windows ZIP
+ shell: pwsh
+ run: Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force
+ - name: Upload Signed Windows ZIP
+ uses: actions/upload-artifact@v4
+ with:
+ name: espressif-ide-win32
+ path: signed-win32.zip🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 211 to 216, the current
step uploads the entire extracted/ directory which may contain unwanted files.
To fix this, add a step before uploading that compresses the contents of
extracted/ into a signed-win32.zip archive using Compress-Archive in PowerShell.
Then update the upload step to upload the signed-win32.zip file instead of the
raw directory.
| $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 | ||
| & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` | ||
| /f cert.pfx ` | ||
| /p $env:PFX_PASS ` | ||
| /tr http://timestamp.digicert.com ` | ||
| /td sha256 ` | ||
| /fd sha256 ` | ||
| $exe.FullName |
There was a problem hiding this comment.
Remove hardcoded SDK path and secure timestamp URL
The signtool.exe call hardcodes the Windows SDK version and uses an insecure HTTP timestamp. Switch to the PATH-provided tool and HTTPS:
- & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign `
+ & signtool.exe sign `
/f cert.pfx `
/p $env:PFX_PASS `
- /tr http://timestamp.digicert.com `
+ /tr https://timestamp.digicert.com `
/td sha256 `
/fd sha256 `
$exe.FullName🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml around lines 185 to 192, the
signtool.exe path is hardcoded with a specific Windows SDK version and the
timestamp URL uses insecure HTTP. Update the script to call signtool.exe
directly from the system PATH instead of the hardcoded path, and change the
timestamp URL from "http://timestamp.digicert.com" to the secure
"https://timestamp.digicert.com" to improve security and maintainability.
| KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" | ||
| echo "${KEYSTORE_FILE}" |
There was a problem hiding this comment.
Fix unresolved keystore filename placeholder
The line
KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}"uses a literal placeholder. Replace it with a concrete filename or an env var, for example:
KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"🤖 Prompt for AI Agents
In .github/workflows/win_exe_sign_test.yml at lines 39-40, the KEYSTORE_FILE
variable uses a literal placeholder {{secrets.JARSIGNER_KEYSTORE}} which is
unresolved. Replace this placeholder with the actual keystore filename or a
valid environment variable reference, for example, set
KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks" to ensure the path points to a
real file.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (10)
.github/workflows/win_exe_sign_test.yml (10)
6-7: Regex tag filter is unsupported by GitHub Actions
GitHub Actions only accepts shell-style glob patterns for tag filters. Update:-on: - tags: - - "v[0-9]+.[0-9]+.[0-9]+" + on: + tags: + - 'v*.*.*'
21-22: Upgradeactions/checkoutto v4
Per actionlint,actions/checkout@v3is outdated. Bump all instances to@v4.- uses: actions/checkout@v3 + uses: actions/checkout@v4Also applies to: 145-145, 227-227
🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: Upgradeactions/setup-javato v4
actionlint flagsactions/setup-java@v3as too old. Change to:- uses: actions/setup-java@v3 + uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
39-40: Fix unresolved keystore filename placeholder
TheKEYSTORE_FILEpath uses a literal{{secrets.JARSIGNER_KEYSTORE}}placeholder. Replace with a concrete filename or environment variable. For example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
111-112: Correct artifact name format and indentation
Thenamefield uses dots and is over-indented. Rename and align with other steps:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
185-192: Remove hardcoded SDK path & secure timestamp URL
Usesigntool.exefrom PATH and switch to HTTPS:-& "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` +& signtool.exe sign ` /f cert.pfx /p $env:PFX_PASS -/tr http://timestamp.digicert.com +/tr https://timestamp.digicert.com /td sha256 /fd sha256 $exe.FullName
194-200: Specifyshell: pwshand usesigntoolfrom PATH for verification
Addshell: pwshand drop the hardcoded path:- name: Verify Signature - run: | + name: Verify Signature + shell: pwsh + run: | $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 - & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` + & signtool.exe verify ` /pa $exe.FullName
211-216: Repackage & upload a signed Windows ZIP instead of raw folder
Compress the signed binaries into a ZIP and upload that single file:- name: Upload Signed Windows ZIP - uses: actions/upload-artifact@v4 - with: - name: espressif-ide-win32 - path: extracted/ + - name: Create Signed Windows ZIP + shell: pwsh + run: Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force + - name: Upload Signed Windows ZIP + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-win32 + path: signed-win32.zip overwrite: true if-no-files-found: error
271-280: Fixzipcommand argument order
The archive path must come before the source files:- zip -r artifacts/update/* com.espressif.idf.update-v${{ env.VERSION }}.zip - zip -r artifacts/win32/* Espressif-IDE-${{ env.VERSION }}-win32.win32.x86_64.zip + zip -r artifacts/update/com.espressif.idf.update-v${{ env.VERSION }}.zip artifacts/update/* + zip -r artifacts/win32/Espressif-IDE-${{ env.VERSION }}-win32.win32.x86_64.zip artifacts/win32/*
292-294: Use consistent S3 bucket and paths
Avoid hardcodedespdldataand align all uploads to${{ secrets.DL_BUCKET }}:- aws s3 cp ... Espressif-IDE-${{ env.VERSION }}-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/ide/ + aws s3 cp ... Espressif-IDE-${{ env.VERSION }}-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin-test/ide/ - aws s3api put-object --bucket espdldata ... + aws s3api put-object --bucket ${{ secrets.DL_BUCKET }} ...Also applies to: 297-304
🧹 Nitpick comments (1)
.github/workflows/win_exe_sign_test.yml (1)
46-46: Remove trailing whitespace
Several lines contain trailing spaces, which trigger YAML lint errors. Please strip trailing spaces across the file.Also applies to: 56-56, 60-60, 64-64, 69-69, 76-76, 85-85, 89-89, 92-92, 95-95, 99-99, 106-106, 113-113, 120-120, 127-127
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build_macos
- GitHub Check: build
- GitHub Check: macos-build
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (9)
.github/workflows/win_exe_sign_test.yml (9)
6-7: 🛠️ Refactor suggestionFix unsupported regex tag filter
GitHub Actions tag filters use glob patterns, not regex. Update thetagsentry to a shell-style glob:- tags: - - "v[0-9]+.[0-9]+.[0-9]+" + tags: + - 'v*.*.*'
39-41:⚠️ Potential issueResolve keystore filename placeholder
KEYSTORE_FILEuses a literal placeholder{{secrets.JARSIGNER_KEYSTORE}}. Define a concrete filename (or env var) instead, for example:- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" + KEYSTORE_FILE="${PWD}/jarsigner-keystore.jks"
165-170:⚠️ Potential issueSpecify PowerShell shell for JKS decoding
The base64 decode step runs PowerShell commands but lacks an explicit shell declaration—this can fail on Windows runners. Addshell: pwsh:- - name: Decode base64-encoded JKS - run: | + - name: Decode base64-encoded JKS + shell: pwsh + run: |
145-153:⚠️ Potential issueInstall Java on Windows runner before keytool usage
keytool.exerequires a JDK andJAVA_HOME. Add a Java setup step immediately after checkout:- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + - name: Set up Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11'🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
211-216: 🛠️ Refactor suggestionRepackage and upload a signed ZIP
Uploading the rawextracted/directory is error-prone. Compress the signed binaries and upload the archive instead:- - name: Upload Signed Windows ZIP - uses: actions/upload-artifact@v4 - with: - name: espressif-ide-win32 - path: extracted/ + - name: Create Signed Windows ZIP + shell: pwsh + run: Compress-Archive -Path extracted/* -DestinationPath signed-win32.zip -Force + + - name: Upload Signed Windows ZIP + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-win32 + path: signed-win32.zip
182-192:⚠️ Potential issueUse
signtool.exefrom PATH and secure timestamp URL
Avoid hardcoded SDK paths and switch to HTTPS timestamping:- & "C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.17763.0\\x86\\signtool.exe" sign ` + & signtool.exe sign ` /f cert.pfx ` /p $env:PFX_PASS ` - /tr http://timestamp.digicert.com ` + /tr https://timestamp.digicert.com ` /td sha256 ` /fd sha256 `
297-302:⚠️ Potential issueUse the configured S3 bucket for website redirects
Replace hardcodedespdldatawith${{ secrets.DL_BUCKET }}in thes3api put-objectcommands:- aws s3api put-object --acl=public-read --bucket espdldata --key ... + aws s3api put-object --acl=public-read --bucket ${{ secrets.DL_BUCKET }} --key ...
194-200:⚠️ Potential issueSpecify PowerShell shell and use PATH for signature verification
Declareshell: pwshand callsigntool.exewithout a hardcoded path:- - name: Verify Signature - run: | + - name: Verify Signature + shell: pwsh + run: | $exe = ... - & "C:\\Program Files ..." verify ` + & signtool.exe verify `
291-294: 🛠️ Refactor suggestionAlign S3 paths for Windows uploads
The Windows artifact is uploaded underdl/idf-eclipse-plugin/ide/, while others use the-testprefix. Update to maintain consistency:- aws s3 cp --acl=public-read Espressif-IDE-${{ env.VERSION }}-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/ide/ + aws s3 cp --acl=public-read Espressif-IDE-${{ env.VERSION }}-win32.win32.x86_64.zip s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin-test/ide/
🧹 Nitpick comments (7)
.github/workflows/win_exe_sign_test.yml (7)
21-24: Upgrade checkout and Java setup actions
Actionlint flagsactions/checkout@v3andactions/setup-java@v3as outdated. Bump both to their latest major versions:- - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - - uses: actions/setup-java@v3 + - uses: actions/setup-java@v4🧰 Tools
🪛 actionlint (1.7.7)
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
42-42: Remove verbose debug flags from Maven build
Avoid-X(and consider dropping-e) to reduce log verbosity and prevent leaking sensitive data:- mvn -e -X clean install -Djarsigner.keystore=... -DskipTests=true + mvn clean install -Djarsigner.keystore=... -DskipTests=true
109-112: Normalize artifact name for macOS aarch64
Inconsistent naming and indentation—use hyphens to match other artifacts:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
145-146: Upgradeactions/checkoutin windows-sign job
Bump toactions/checkout@v4for compatibility with current runners:- - uses: actions/checkout@v3 + - uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
171-181: Clean up keystore after conversion
Remove the intermediate JKS file post-conversion to avoid leaving secrets on the runner:& "${env:JAVA_HOME}\\bin\\keytool.exe" -importkeystore ` -srckeystore mykeystore.jks ` -srcstorepass $env:JKS_PASS ` ... +Remove-Item mykeystore.jks
227-228: Upgrade checkout in upload-aws job
Bumpactions/checkout@v3toactions/checkout@v4here as well:- - uses: actions/checkout@v3 + - uses: actions/checkout@v4🧰 Tools
🪛 actionlint (1.7.7)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
247-251: Normalize artifact download name for macOS aarch64
Ensure the download step matches the corrected hyphenated artifact:- name: espressif-ide-macosx.cocoa.aarch64 + name: espressif-ide-macosx-cocoa-aarch64
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/win_exe_sign_test.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/win_exe_sign_test.yml
21-21: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
145-145: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
227-227: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/win_exe_sign_test.yml
[error] 46-46: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 85-85: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 95-95: trailing spaces
(trailing-spaces)
[error] 99-99: trailing spaces
(trailing-spaces)
[error] 106-106: trailing spaces
(trailing-spaces)
[warning] 111-111: wrong indentation: expected 10 but found 11
(indentation)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
[error] 127-127: trailing spaces
(trailing-spaces)
[warning] 220-220: wrong indentation: expected 4 but found 3
(indentation)
[warning] 223-223: wrong indentation: expected 5 but found 4
(indentation)
[warning] 227-227: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build
removed temporary workflow and moved it into the original file
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
.github/workflows/ci_release.yml (3)
97-110: Fix YAML indentation and naming consistency for macOS artifact upload
- Line 108 has one extra space in indentation under
with:which could break the step.- The artifact name uses dots (
espressif-ide-macosx.cocoa.aarch64) unlike the x86 step’s dashes; unify toespressif-ide-macosx-cocoa-aarch64.Suggested diff:
- - name: Upload Espressif-IDE-macosx.cocoa.aarch64 - if: ${{ !cancelled() }} - uses: actions/upload-artifact@v4 - with: - name: espressif-ide-macosx.cocoa.aarch64 - path: releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg + - name: Upload Espressif-IDE-macosx-cocoa-aarch64 + if: ${{ !cancelled() }} + uses: actions/upload-artifact@v4 + with: + name: espressif-ide-macosx-cocoa-aarch64 + path: releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 103-103: trailing spaces
(trailing-spaces)
[warning] 108-108: wrong indentation: expected 10 but found 11
(indentation)
[error] 110-110: trailing spaces
(trailing-spaces)
216-223: Fix indentation inupload-awsjob header
Theupload-awsjob’sruns-on,needs, andenvkeys are misindented by one space. This can invalidate the YAML. Please align them under theupload-aws:key:- upload-aws: - runs-on: macos-latest - needs: windows-sign - env: + upload-aws: + runs-on: macos-latest + needs: windows-sign + env:🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 217-217: wrong indentation: expected 4 but found 3
(indentation)
[warning] 220-220: wrong indentation: expected 5 but found 4
(indentation)
278-301: Consider usingaws s3 syncto simplify uploads
Instead of multipleaws s3 cpcalls, a single sync can reduce boilerplate and prevent omissions:aws s3 sync artifacts/linux/ s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/updates/latest --acl public-readRepeat for other directories (macos_x86, macos_arm, win32).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/ci_release.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/ci_release.yml
18-18: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
21-21: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
142-142: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
224-224: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/ci_release.yml
[error] 43-43: trailing spaces
(trailing-spaces)
[error] 53-53: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 66-66: trailing spaces
(trailing-spaces)
[error] 73-73: trailing spaces
(trailing-spaces)
[error] 82-82: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
[error] 103-103: trailing spaces
(trailing-spaces)
[warning] 108-108: wrong indentation: expected 10 but found 11
(indentation)
[error] 110-110: trailing spaces
(trailing-spaces)
[error] 117-117: trailing spaces
(trailing-spaces)
[error] 124-124: trailing spaces
(trailing-spaces)
[warning] 217-217: wrong indentation: expected 4 but found 3
(indentation)
[warning] 220-220: wrong indentation: expected 5 but found 4
(indentation)
[warning] 224-224: wrong indentation: expected 5 but found 4
(indentation)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build
- GitHub Check: build_macos
🔇 Additional comments (11)
.github/workflows/ci_release.yml (11)
8-11: ARCHIVE_PREFIX/SUFFIX environment variables look good
DefiningARCHIVE_PREFIXandARCHIVE_SUFFIXat the top-level is clear and will make naming consistent across jobs.
13-16: Version extraction and workflow outputs are correct
Theget_versionstep cleanly strips the leadingvfrom the tag and passes it to downstream jobs viaoutputs. This will ensure all artifacts are consistently versioned.Also applies to: 26-29
42-71: macOS codesign steps are solid
The two-step signing of both x86_64 and aarch64 binaries (and DMGs) with the correct entitlements and runtime options follows best practices.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 43-43: trailing spaces
(trailing-spaces)
[error] 53-53: trailing spaces
(trailing-spaces)
[error] 57-57: trailing spaces
(trailing-spaces)
[error] 61-61: trailing spaces
(trailing-spaces)
[error] 66-66: trailing spaces
(trailing-spaces)
72-96: Notarization block is implemented correctly
Keychain creation, profile storage, submission, and staple attachment for both architectures are all present. This ensures distributed.dmgfiles will be trusted by Gatekeeper.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 73-73: trailing spaces
(trailing-spaces)
[error] 82-82: trailing spaces
(trailing-spaces)
[error] 86-86: trailing spaces
(trailing-spaces)
[error] 89-89: trailing spaces
(trailing-spaces)
[error] 92-92: trailing spaces
(trailing-spaces)
[error] 96-96: trailing spaces
(trailing-spaces)
111-131: Upload of update site, Windows, and Linux artifacts is correct
The glob patterns and separate artifact names will make downstream retrieval straightforward.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 117-117: trailing spaces
(trailing-spaces)
[error] 124-124: trailing spaces
(trailing-spaces)
133-142: windows-sign job definition is solid
Theneeds: macos-builddependency and environment variable setup ensure the job only runs when macOS artifacts are ready.🧰 Tools
🪛 actionlint (1.7.7)
142-142: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
144-167: Artifact download and keystore decoding are correct
Usingactions/download-artifactfollowed byExpand-Archiveandcertutilto decode the JKS is a practical PowerShell approach.
168-178: Keytool conversion to PFX is implemented correctly
The use of-importkeystorewith proper alias and password variables will produce a validcert.pfxfor signing.
202-214: Deleting unsigned binary and uploading signed ZIP look good
Thedelete-artifactaction and the finalupload-artifactstep will correctly replace the unsigned artifact with the signed version.
224-267: Download artifacts and version extraction are correct
Reusingactions/download-artifactfor each platform and re-parsing the tag intoVERSION/FOLDERwill maintain consistency across platforms.🧰 Tools
🪛 actionlint (1.7.7)
224-224: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[warning] 224-224: wrong indentation: expected 5 but found 4
(indentation)
268-278: DMG renaming and archive compression steps look solid
Themvcommands andzip -rinvocation will produce versioned.dmgand.zipartifacts for upload.
| - name: Verify Signature | ||
| run: | | ||
| $exe = Get-ChildItem -Recurse extracted\Espressif-IDE\espressif-ide.exe | Select-Object -First 1 | ||
| & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" verify ` | ||
| /pa ` | ||
| $exe.FullName | ||
| - name: Removing original ZIP from extracted folder | ||
| run: | | ||
| Remove-Item -Force artifacts\*.zip |
There was a problem hiding this comment.
Critical: Missing shell: pwsh on PowerShell steps
Both the Verify Signature and Removing original ZIP steps use PowerShell commands (Get-ChildItem, Remove-Item) but omit shell: pwsh. They will fail under the default Bash shell. Please add shell: pwsh to these steps.
🤖 Prompt for AI Agents
In .github/workflows/ci_release.yml around lines 191 to 200, the steps "Verify
Signature" and "Removing original ZIP from extracted folder" use PowerShell
commands but lack the required "shell: pwsh" declaration. Add "shell: pwsh" to
both steps to ensure they run with the PowerShell shell instead of the default
Bash shell, preventing execution errors.
| - name: Decode keystore and build with Maven | ||
| env: | ||
| JARSIGNER_KEYSTORE_B64: ${{ secrets.JARSIGNER_REL_KEYSTORE_B64 }} | ||
| JARSIGNER_STOREPASS: ${{ secrets.JARSIGNER_REL_STOREPASS }} | ||
| JARSIGNER_ALIAS: ${{ secrets.JARSIGNER_REL_ALIAS }} | ||
| run: | | ||
| KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}" | ||
| echo "${KEYSTORE_FILE}" | ||
| printf "%s" "${JARSIGNER_KEYSTORE_B64}" | base64 -d > "${KEYSTORE_FILE}" | ||
| mvn -e -X clean install -Djarsigner.keystore="${KEYSTORE_FILE}" -Djarsigner.alias="${JARSIGNER_ALIAS}" -Djarsigner.storepass="${JARSIGNER_STOREPASS}" -DskipTests=true | ||
| rm -v "${KEYSTORE_FILE}" | ||
There was a problem hiding this comment.
Critical: Incorrect placeholder for keystore file path
The line
KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}"uses an undefined JARSIGNER_KEYSTORE placeholder. This will write the keystore to a non‐existent path and cause the Maven build to fail.
Please replace with a concrete filename or an environment variable. For example:
- KEYSTORE_FILE="${PWD}/{{secrets.JARSIGNER_KEYSTORE}}"
+ KEYSTORE_FILE="${PWD}/release.keystore.jks"and ensure you update the env: block or rename the file accordingly.
🤖 Prompt for AI Agents
In .github/workflows/ci_release.yml around lines 30 to 41, the KEYSTORE_FILE
path uses an incorrect placeholder {{secrets.JARSIGNER_KEYSTORE}} which is
undefined. Replace this with a concrete filename or an environment variable
defined in the env block, such as using a fixed filename like "keystore.jks" or
referencing a new env variable (e.g., JARSIGNER_KEYSTORE_FILENAME) that you add
to the env section. Update the KEYSTORE_FILE assignment accordingly to use this
valid filename for storing the decoded keystore.
| & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign ` | ||
| /f cert.pfx ` | ||
| /p $env:PFX_PASS ` | ||
| /tr http://timestamp.digicert.com ` | ||
| /td sha256 ` | ||
| /fd sha256 ` | ||
| $exe.FullName |
There was a problem hiding this comment.
Critical: Use HTTPS for timestamp server
The /tr flag currently points to an unsecured HTTP endpoint. This can be intercepted and break your signature verification.
Please switch to HTTPS:
-& /tr http://timestamp.digicert.com \
+& /tr https://timestamp.digicert.com \
/td sha256 \
/fd sha256 \Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In .github/workflows/ci_release.yml around lines 183 to 189, the timestamp
server URL used with the /tr flag is using HTTP, which is insecure. Update the
URL to use HTTPS instead by changing "http://timestamp.digicert.com" to
"https://timestamp.digicert.com" to ensure secure and reliable timestamping of
the signature.
|
Hi @alirana01 General suggestion -please keep the changes minimal and only include what’s necessary for Windows signing? Including refactoring and formatting changes in the same PR increases the overall complexity for review. If needed, you can split them into two commits — one for the actual changes and another for the refactoring/formatting. |
Description
Signing windows binary.
Fixes # (IEP-1475)
Type of change
Please delete options that are not relevant.
How has this been tested?
Running workflow
Checklist
Summary by CodeRabbit