docs: reconcile onboarding install command and desktop-signing scope (DA-06) - #519
Conversation
…(DA-06) Bare `pnpm install` in README/CONTRIBUTING onboarding paths silently rewrites pnpm-lock.yaml on drift instead of failing loudly, and skips this repo's dependency fingerprint that ci:prepush/pre-commit check — point every onboarding path at `node scripts/dependency-state.mjs reconcile` instead. Also narrow README's desktop-installer language: only the latest.json update manifest is Minisign-signed today; OS-level code signing (Authenticode, notarization) is opt-in via CI secrets, not on by default. Reconcile .github/CONTRIBUTING.md's stale local-CI recipe with root CONTRIBUTING.md's ci:prepush teaching.
🤖 CodeAnt AI — Review Status
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. |
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis docs-only change reconciles all onboarding instructions with the repository’s dependency-state/frozen-lockfile workflow, updates the GitHub contributor guide to use the canonical File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
There was a problem hiding this comment.
This PR successfully reconciles documentation truth across onboarding paths and clarifies the desktop signing scope. All changes are documentation-only as described and correctly implement:
- Frozen-lockfile discipline: Replaces all bare
pnpm installreferences withnode scripts/dependency-state.mjs reconcile, ensuring consistent installation behavior and dependency fingerprint tracking - Local CI recipe update:
.github/CONTRIBUTING.mdnow references the correctpnpm run ci:prepushcommand with proper cross-reference - Signing scope accuracy: README clarifies that Minisign signs the update manifest only, with OS-level signing (Authenticode/notarization) being opt-in
The changes maintain consistency across .github/CONTRIBUTING.md, CONTRIBUTING.md, and README.md without introducing any defects. No code changes were made, confirming the DOCS_ONLY classification.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
Warning Review limit reachedNext included review available in 33 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 105 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe documentation updates standardize dependency reconciliation and local validation commands. The README also clarifies Minisign update-manifest signing and optional operating-system code signing. ChangesDocumentation workflows
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk:⚪ Minimal · up to This localized documentation update aligns onboarding commands and desktop-signing guidance with repository behavior; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Your free Security trial is over. An organization admin can activate billing to continue. Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:cc3c38eed9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…e bootstrap Address chatgpt-codex-connector review of #519: - README: latest.json isn't itself Minisign-signed — it's a manifest containing per-platform Minisign signatures for the updater bundles (tauri-build.yml generates it via jq, no signature sidecar for the file itself). Also, OS-level code signing has no workflow steps at all yet (tauri-build.yml only omits the Apple/Windows secrets, per its own comments and docs/TAURI-UPDATER.md) — describe it as not currently configured rather than "opt-in via CI secrets." - CONTRIBUTING.md: the `pnpm run deps:reconcile` fresh-clone alternative can't actually start on a truly fresh clone — pnpm-workspace.yaml's verifyDepsBeforeRun: error blocks any `pnpm run` script before node_modules exists. Reserve that wrapper for re-syncing an already-installed tree; document the node form as the only fresh- bootstrap path. - scripts/dependency-state.mjs: reconcile()'s spawnSync('pnpm', ...) lacked shell: process.platform === 'win32', so the Windows onboarding path this PR now documents would fail to launch pnpm's .cmd shim. Matches the existing convention in scripts/graphify-cli.mjs.
qnbs
commented
Aug 27, 2026
@codex review |
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
User description
Summary
Small, mechanical docs-truth fix (plan §D.3 / DA-06 — no code changes,
DOCS_ONLYlocal-admission classification).pnpm install→ frozen-lockfile reconcile. Onboarding paths inREADME.md(Quick Start one-liner + Local Development block) andCONTRIBUTING.md(Windows section + Installation section) used a barepnpm install. The bare form omits--frozen-lockfile, so on any manifest/lockfile drift it silently rewritespnpm-lock.yamlinstead of failing loudly — and it never writes this repo's own dependency fingerprint thatci:prepushand the pre-commit hook check. Replaced withnode scripts/dependency-state.mjs reconcileeverywhere, with a short explanatory paragraph added toCONTRIBUTING.md's Installation section..github/CONTRIBUTING.mdstale local-CI recipe. Taughtpnpm run lint && pnpm run typecheck && pnpm run i18n:check, which conflicts with rootCONTRIBUTING.md's correct, currentpnpm run ci:prepushteaching. Replaced with the correct command plus a cross-reference to the full contributor guide..appimage,.msi, and.dmg" with no caveat. Verified againstdocs/TAURI-CI.md§ Auto-update & signing anddocs/TAURI-UPDATER.md§ Code signing: only thelatest.jsonupdate manifest is Minisign-signed by default; Windows Authenticode and macOS notarization are both opt-in via CI secrets, not enabled by default. Narrowed the claim and linked both docs.Test plan
node scripts/dependency-state.mjs reconcile— frozen-lockfile bootstrap in a fresh worktree off currentmainpnpm run ci:prepush— classifiedDOCS_ONLY, all local checks (dependency state, toolchain, docs/release truth, CSP, desktop-import boundary, native-readiness)PASS; TypeScript correctlyDEFERRED_TO_REQUIRED_CI(no TS-impacting changes)grep -n "pnpm install" README.md CONTRIBUTING.md .github/CONTRIBUTING.md— 0 remaining bare invocations (only the explanatory "never a barepnpm install" phrasing)docs/CI.md,docs/TAURI-CI.md,docs/TAURI-UPDATER.mdall exist and support the claims madeSummary by Sourcery
Align onboarding, contributor checks, and desktop release documentation with the repository’s current dependency and signing behavior.
Enhancements:
Documentation:
Chores:
CodeAnt-AI Description
Align contributor setup instructions with the repository’s dependency checks and signing behavior
What Changed
pnpm install, so lockfile drift fails visibly and the required dependency state is recorded.ci:prepushlocal gate instead of a partial set of checks.Impact
✅ Fewer accidental lockfile changes during setup✅ Consistent local checks before submitting changes✅ Clearer desktop signing expectations💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit