chore(release): prepare v0.3.0-beta.1 (MAT-137)#176
Merged
Conversation
Bump every version declaration to 0.3.0-beta.1 (package.json, Cargo.toml, tauri.conf.json app + wix, lockfiles) and add scripts/check-release-versions.sh so local pre-tag checks and the CI verify-tag job run the same coherence check, now covering tauri.conf.json and the wix version which CI never verified before. release.yml: pin all actions by commit SHA, replace the three inline version checks with the shared script (version passed via env, not inline interpolation), and add a checksums job that publishes SHA256SUMS and PROVENANCE.txt (tagged commit + workflow run URL) on every release. Cut the CHANGELOG 0.3.0-beta.1 section with honest known limitations (no CAPTCHA, MEGA refused, no remote access) and upgrade notes, update README to the new version, and document the whole flow in RELEASING.md. Pushing the tag stays a manual decision, per the ticket.
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
github-actions
Bot
added
documentation
📝 WalkthroughWalkthroughThe release is bumped to ChangesRelease 0.3.0-beta.1
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Tag as Release tag
participant Verify as verify-tag
participant Gate as check-release-versions.sh
participant Build as Platform build jobs
participant Release as GitHub Release
participant Checksums as checksums job
Tag->>Verify: Trigger release workflow
Verify->>Gate: Validate release version
Gate-->>Verify: Return pass or failure
Verify->>Build: Start artifact builds
Build->>Release: Upload release assets
Release->>Checksums: Expose release assets
Checksums->>Release: Upload SHA256SUMS and PROVENANCE.txt
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 40-47: Add a job-level permissions declaration for the verify-tag
job granting only contents: read access. Keep the existing release-version
verification step unchanged and ensure no broader repository permissions are
inherited.
- Line 103: Disable persisted checkout credentials on every actions/checkout
step in .github/workflows/release.yml at lines 103, 20, 59, 178, 256, 313, 341,
and 409 by setting persist-credentials to false; leave the existing checkout
revisions and job behavior unchanged.
In `@README.md`:
- Around line 147-148: Update the Discussions entry in README.md to either link
directly to the actual v0.3.0-beta.1 feedback thread or change its label to
simply “Discussions” while retaining the generic discussions URL; do not
describe the landing page as a specific feedback thread.
- Line 24: Update the Portable AppImage command in the README to launch the
exact downloaded filename Vortex_0.3.0-beta.1_amd64.AppImage instead of the
wildcard, while keeping the download and executable permission steps unchanged.
In `@RELEASING.md`:
- Around line 77-80: The documented release flow in RELEASING.md conflicts with
the manual GitHub Release requirement. Update the release-creation description
to state that release creation is a manual post-merge approval step, and ensure
the referenced release.yml flow does not imply or automatically create the
GitHub Release when a tag is pushed.
- Around line 35-36: Update the CHANGELOG.md release-heading guidance in
RELEASING.md to preserve prerelease identifiers, using the full release version
such as 0.3.0-beta.1 rather than reducing it to X.Y.Z. Keep the existing date
and required section guidance unchanged.
In `@scripts/check-release-versions.sh`:
- Around line 27-33: Update the wix_version validation in
scripts/check-release-versions.sh to require exactly four numeric dot-separated
components, while preserving the existing check that the first three components
match core. Reject nonnumeric fourth components and any prerelease or extra
suffixes before platform builds proceed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 37f29ef7-2b8b-47cd-b566-d31d37d3febc
⛔ Files ignored due to path filters (2)
package-lock.jsonis excluded by!**/package-lock.jsonsrc-tauri/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (8)
.github/workflows/release.ymlCHANGELOG.mdREADME.mdRELEASING.mdpackage.jsonscripts/check-release-versions.shsrc-tauri/Cargo.tomlsrc-tauri/tauri.conf.json
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
cubic analysis
All reported issues were addressed across 10 files
Linked issue analysis
Linked issue: MAT-137: [Lot 3] Préparer la release v0.3.0-beta.1
| Status | Acceptance criteria | Notes |
|---|---|---|
| R-01 — All mandatory checks, audits, tests and the smoke E2E are green on the commit that will be tagged | The PR runs the full local suite and pre-push hooks (reports show clippy, cargo test, vitest, oxlint, pre-push hooks green). However the acceptance criterion is specifically about the tagged commit running through the release CI (merge/tag gate) — the tag build has not been pushed/executed yet. | |
| ✅ | R-02 — Application, manifests and registry versions are coherent and verified by script | The PR bumps versions consistently across package.json, Cargo.toml, tauri.conf.json and lockfiles and adds scripts/check-release-versions.sh which is run locally in validation and wired into release.yml. |
| R-03 — CI produces bundles for Linux/Windows/macOS with SHA-256 and provenance tied to the tagged commit | The workflow now includes jobs to build platform bundles and a checksums/provenance job that uploads SHA256SUMS and PROVENANCE.txt. Those CI artifacts and published checksums/provenance require the tag build to run to be observed. | |
| R-04 — A clean install boots; upgrading preserves config, DB and downloads | CHANGELOG and RELEASING.md include upgrade notes and explicit post-build verification steps. The PR does not include evidence of a clean install / upgrade run from a tagged CI artifact — that verification is deferred to post-tag checks in the releasing checklist. | |
| ❌ | R-05 — Announced plugins build WASM and pass ABI smoke tests against the release host | The PR documents plugin verification steps in RELEASING.md and references registry_coherence tests, but it does not include plugin CI results or published plugin SHA256SUMS proving the plugins passed their own CI against this release candidate. |
| ✅ | R-06 — Release notes do not claim unimplemented features (e.g., CAPTCHA, MEGA decryption, remote access) | CHANGELOG and README explicitly list known limitations (no CAPTCHA, MEGA refused until host-side decryption, no remote access) so release notes avoid claiming unimplemented features. |
| R-07 — No secret, stale local artifact or specs/ files are included in the tag | The PR adds explicit pre-tag audit steps in RELEASING.md and the validation run includes audits/pre-push hooks. The final guarantee that a tag contains no secrets or stale artifacts requires the actual tagged commit and CI verification. |
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
verify-tag gets contents: read, every checkout stops persisting the workflow token (nothing in the pipeline pushes via git), and the action-gh-release pins move from v2.6.2 to v3.0.2. The wix version check now requires strictly numeric x.y.z.w instead of a prefix match, README launches the AppImage by exact filename and links Discussions without promising a thread that doesn't exist yet, and RELEASING.md spells out that the changelog heading keeps the prerelease suffix.
Contributor
This was referenced Jul 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes MAT-137 ([Lot 3] Préparer la release
v0.3.0-beta.1).Prepares the release candidate without publishing it: pushing the tag stays a manual decision after review, as the ticket requires.
What's in here
0.3.0-beta.1everywhere:package.json,src-tauri/Cargo.toml,tauri.conf.json(app version + wix0.3.0.1), both lockfiles.scripts/check-release-versions.sh: one script for the pre-tag check and for CI. It also coverstauri.conf.jsonand the wix version, which the old inline verify-tag steps never checked (R-02).release.yml: all actions pinned by commit SHA (they weren't, unlikeci.yml); the three inline version checks replaced by the shared script, with the version passed throughenvso tag names can't inject into the shell; newchecksumsjob that publishesSHA256SUMSandPROVENANCE.txt(tagged commit viagit rev-list, workflow run URL) on every release (R-03).CHANGELOG.md:[0.3.0-beta.1] - 2026-07-19section cut from Unreleased, with highlights, known limitations (no CAPTCHA, MEGA refused until host-side decryption, no remote access) and upgrade notes from v0.2.0-beta (R-04, R-06).README.md: status line, install URLs, features, roadmap row and feedback links moved to v0.3.0-beta.1. Asset filenames are predictions until CI builds them; RELEASING.md has a post-build re-check step.RELEASING.md: the release checklist mapped to R-01 → R-07, ending on the manual tag push.Validation
scripts/check-release-versions.sh 0.3.0-beta.1→ OK (and fails correctly when a version is off)cargo clippy --workspace -- -D warnings→ cleancargo test --workspace→ 1709 passed, 7 ignorednpx vitest run→ 729 passednpx oxlint .→ cleanNot in this PR
No tag is pushed. The tag push is the explicit human decision, taken after merge once the RELEASING.md checklist is walked through. From there
release.ymlbuilds and publishes the GitHub Release automatically — that automation is existing behavior, unchanged by this PR.Summary by cubic
Prepares the v0.3.0-beta.1 release candidate: bumps versions, unifies release checks, and hardens CI with pinned actions, least-privilege checkout, and checksum/provenance publishing. No tag is pushed; publication remains manual per MAT-137.
Release Pipeline
package.json,src-tauri/Cargo.toml,src-tauri/tauri.conf.json(app + wix), and lockfiles.scripts/check-release-versions.shused locally and in CI to verifypackage.json,Cargo.toml,tauri.conf.json(app + wix numeric x.y.z.w), andCHANGELOG.mdagainst the tag (version passed via env).release.ymlverify-tag now has contents:read and all checkouts don’t persist credentials; release action pinned to the latest major.checksumsjob publishesSHA256SUMSandPROVENANCE.txt(tagged commit + workflow run URL) for every release.Changelog & Docs
CHANGELOG.md: add 0.3.0-beta.1 with highlights, known limits (no CAPTCHA, MEGA refused, no remote access), and upgrade notes; heading keeps the prerelease suffix.README.md: update status, install URLs, features, roadmap, and feedback links to v0.3.0-beta.1; AppImage command uses the exact filename.RELEASING.md: end-to-end checklist mapped to R-01 → R-07; tag push stays a human decision.Written for commit d87537e. Summary will update on new commits.
Summary by CodeRabbit
New Features
Documentation
Release Improvements