Uh oh!
There was an error while loading. Please reload this page.
ci(expo): Switch to maestro runner - #9264
Conversation
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: 419fbc6 The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@clerk/astro@clerk/backend@clerk/chrome-extension@clerk/clerk-js@clerk/electron@clerk/electron-passkeys@clerk/eslint-plugin@clerk/expo@clerk/expo-google-signin@clerk/expo-passkeys@clerk/express@clerk/fastify@clerk/hono@clerk/localizations@clerk/nextjs@clerk/nuxt@clerk/react@clerk/react-router@clerk/shared@clerk/tanstack-react-start@clerk/testing@clerk/ui@clerk/upgrade@clerk/vuecommit: |
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
📝 WalkthroughWalkthroughThe Expo native CI workflow provisions and caches Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/expo-native-build.yml:
- Around line 217-243: The Install maestro-runner step must stop piping the
mutable remote installer directly into bash. Replace that flow with downloading
a pinned installer or artifact plus its required integrity metadata, fail if the
checksum file is unavailable, verify the downloaded content before execution,
and retain the existing retry and cached-binary behavior around the verified
installation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 817438b2-bf9c-49b0-8879-a03d2eb7610d
📒 Files selected for processing (2)
.github/workflows/expo-native-build.ymlintegration/tests/expo-native/run-flows.sh
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual)clerk/clerk-docs(manual)clerk/cloudflare-workers(manual)clerk/cli(auto-detected)clerk/clerk-ios(auto-detected)clerk/clerk-android(auto-detected)
| - name: Cache maestro-runner | ||
| if: steps.keys.outputs.pk != '' | ||
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | ||
| with: | ||
| path: ~/.maestro | ||
| key: maestro-${{ runner.os }}-${{ env.MAESTRO_VERSION }} | ||
| path: ~/.maestro-runner | ||
| key: maestro-runner-${{ runner.os }}-${{ runner.arch }}-${{ env.MAESTRO_RUNNER_VERSION }} | ||
| - name: Install Maestro | ||
| - name: Install maestro-runner | ||
| if: steps.keys.outputs.pk != '' | ||
| # pipefail + binary check so a curl flake doesn't leave a missing | ||
| # binary that only surfaces later as exit-code-127. | ||
| run: | | ||
| set -o pipefail | ||
| if [ -x "$HOME/.maestro/bin/maestro" ]; then | ||
| echo "Using cached Maestro" | ||
| if [ -x "$HOME/.maestro-runner/bin/maestro-runner" ]; then | ||
| echo "Using cached maestro-runner" | ||
| else | ||
| installed=0 | ||
| for i in 1 2 3; do | ||
| if curl -fLs --retry 3 --retry-delay 5 "https://get.maestro.mobile.dev" | MAESTRO_VERSION="$MAESTRO_VERSION" bash; then | ||
| if [ -x "$HOME/.maestro/bin/maestro" ]; then installed=1; break; fi | ||
| if curl -fsSL --retry 3 --retry-delay 5 "https://open.devicelab.dev/install/maestro-runner" | | ||
| bash -s -- --version "$MAESTRO_RUNNER_VERSION"; then | ||
| if [ -x "$HOME/.maestro-runner/bin/maestro-runner" ]; then installed=1; break; fi | ||
| fi | ||
| echo "Maestro install attempt $i failed (or binary missing); retrying" | ||
| echo "maestro-runner install attempt $i failed (or binary missing); retrying" | ||
| sleep 5 | ||
| done | ||
| [ "$installed" = 1 ] || { echo "::error::Maestro install failed after 3 attempts"; exit 1; } | ||
| [ "$installed" = 1 ] || { echo "::error::maestro-runner install failed after 3 attempts"; exit 1; } | ||
| fi | ||
| echo "$HOME/.maestro/bin" >> "$GITHUB_PATH" | ||
| "$HOME/.maestro/bin/maestro" --version | ||
| echo "$HOME/.maestro-runner/bin" >> "$GITHUB_PATH" | ||
| "$HOME/.maestro-runner/bin/maestro-runner" --version |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bashset -euo pipefail
installer="$(mktemp)"trap'rm -f "$installer"' EXIT
curl --proto '=https' --tlsv1.2 -fsSL \
'https://open.devicelab.dev/install/maestro-runner' \
-o "$installer"
grep -nE 'sha256|sha512|checksum|signature|version|download'"$installer"||trueRepository: clerk/javascript
Length of output: 1003
🏁 Script executed:
#!/usr/bin/env bashset -euo pipefail
file=".github/workflows/expo-native-build.yml"
sed -n '200,250p'"$file"printf'\n--- installer excerpt ---\n'
curl --proto '=https' --tlsv1.2 -fsSL 'https://open.devicelab.dev/install/maestro-runner'| sed -n '1,180p'Repository: clerk/javascript
Length of output: 7243
Avoid piping the Maestro installer into bash The workflow still executes mutable remote code here, and the installer skips integrity checking when the .sha256 file is missing. Fetch a pinned artifact/installer and fail closed unless integrity metadata is present.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/expo-native-build.yml around lines 217 - 243, The Install
maestro-runner step must stop piping the mutable remote installer directly into
bash. Replace that flow with downloading a pinned installer or artifact plus its
required integrity metadata, fail if the checksum file is unavailable, verify
the downloaded content before execution, and retain the existing retry and
cached-binary behavior around the verified installation.
Description
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change