Repository navigation
fix(plugin): bind component cleanup to the exact package manifest - #2107
Conversation
Fixes #2106. Preserve components when multiple active package manifests make cleanup ambiguous.
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (2)
Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review. WalkthroughThe TXZ builder now records the package identity. Install cleanup validates that identity and selects an exact matching package manifest before removing stale component files. Tests cover manifest selection and built archive installation, and the build workflow runs the integration test for generated archives. ChangesTXZ package installation
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix · Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to No actionable merge-blocking issue is established in the reviewed changes; normal checks remain appropriate. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to The change protects current components without adding a production entrypoint or broader deletion authority. No security regression is demonstrated, but stale-component loading and real installation ordering remain incompletely established. Retained concerns Security review detailsSecurity Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. I’m a rabbit with a package to inspect, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2107 +/- ##
==========================================
+ Coverage 53.39% 53.43% +0.03%
==========================================
Files 1044 1044
Lines 72705 72705
Branches 8396 8416 +20
==========================================
+ Hits 38821 38850 +29
+ Misses 33757 33728 -29
Partials 127 127 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
This plugin has been deployed to Cloudflare R2 and is available for testing. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Eli Bosley (elibosley)
changed the title
🔄 PR Merged - Plugin Redirected to StagingThis PR has been merged and the preview plugin has been updated to redirect to the staging version. For users testing this PR:
Staging URL: Thank you for testing! 🚀 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8e6f9f2a2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| curl --fail --silent --show-error --location --max-time 60 \ | ||
| "https://mirrors.slackware.com/slackware/slackware64-current/source/a/pkgtools/scripts/$script" \ | ||
| --output "$pkgtools_dir/$script" |
There was a problem hiding this comment.
When Slackware updates any script under the rolling slackware64-current URL, the downloaded content will no longer match the hard-coded hashes on lines 142–144, so every invocation of the inspected build-plugin.yml workflow will fail at sha256sum --check and block plugin artifacts and releases. Fetch these scripts from an immutable release or source revision while retaining checksum verification.
Useful? React with 👍 / 👎.
🤖 I have created a release *beep* *boop* --- ## [4.37.6](v4.37.5...v4.37.6) (2026-10-20) ### Bug Fixes * **api:** stop temperature metrics from spinning up array disks ([#2091](#2091)) ([b15af83](b15af83)) * **callback:** validate callback requests ([#2097](#2097)) ([1bda4d2](1bda4d2)) * **connect:** avoid restarting active static remote access ([#2110](#2110)) ([d19a6f4](d19a6f4)) * **deps:** refresh vulnerable API and web packages ([#2098](#2098)) ([64eac12](64eac12)) * **plugin:** bind component cleanup to the exact package manifest ([#2107](#2107)) ([89b1395](89b1395)) * **web:** align mobile header identity and update actions ([#2111](#2111)) ([6582cc1](6582cc1)) * **web:** align registration license action buttons ([#2101](#2101)) ([b638d29](b638d29)) * **web:** polish combined header on mobile and desktop ([#2109](#2109)) ([64f1e81](64f1e81)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 participant
Prevent Connect TXZ upgrades from deleting current WebGUI components by selecting the exact package manifest for the version, architecture, and build being installed.
The first wildcard match can select an old
-upgraded-manifest. Excluding archived entries alone also leaves a latent failure when a lone outdated active manifest remains. The TXZ builder now packages its exact filename identity, and doinst.sh uses only that identity in the primary or legacy package database. Missing or invalid identity, or a missing exact manifest, preserves components.The plugin build workflow now validates the final TXZ using checksum-pinned Slackware installpkg/upgradepkg/removepkg scripts. It exercises upgrade and reinstall with an old upgraded manifest, compares every current component byte-for-byte, and checks the installed API entrypoints, environment, CLI links, and packaged API CLI execution.
The date/time coverage tests now use a fixed clock and unmount components to stop intervals. Regression assertions cover interval updates and calendar boundaries, addressing clock-dependent coverage variation without changing coverage thresholds.
Validation:
c8e6f9f2a2c3e7326f66f3a7bfb26343e1378938: API tests, API/Web/UI/plugin builds, final-TXZ pkgtools validation, CodeQL, and Codecov project/patch passed. Dependency audit remains advisory; findings were not suppressed.afda743519e6da3732213cdb9e5d1fb7978fe4c2246fcf06b395b0b48fa43bd9): all 150 components were byte-identical after install and reinstall, stale files were removed, API restart and temporary VIEWER API-key creation passed, authenticated GraphQL worked through the Unix socket and nginx, the internal CLI report succeeded, and a served WebGUI component matched the archive byte-for-byte. Managed QA restored and released the guest.Fixes #2106.
Summary by CodeRabbit