docs: post-release v1.28.2 sync (README/CHANGELOG/AUDIT) - #528
Conversation
… AUDIT.md v1.28.2 entry v1.28.2 is now genuinely tagged and published; remove the now-stale release-candidate markers from README.md and CHANGELOG.md (their only purpose was permitting an advertised-but-untagged version during the release-prep window). Add a Release gate entry to AUDIT.md documenting real CI/CD evidence for the published release: main CI/CD run, Codecov coverage, the Tauri multi-platform build + GitHub Release artifacts, and the Docker/ GHCR publish. Also documents a separately-investigated, non-blocking finding from the tag-triggered CI run's flaky E2E failure (issue #527) — traced to a plausible pre-existing onboarding effect-ordering race, not a v1.28.2 regression and not affecting the published release.
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🤖 CodeAnt AI — Review Status
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideSynchronizes release documentation for the published v1.28.2 by removing obsolete candidate markers, adding evidence-backed release-gate and artifact details to AUDIT.md, and documenting the separately investigated non-blocking E2E flake. Sequence diagram for v1.28.2 release-gate verificationsequenceDiagram
participant MainCI
participant Pages
participant Codecov
participant TauriCI
participant GitHub
participant Docker
participant GHCR
MainCI->>Pages: Deploy to GitHub Pages
Pages-->>MainCI: Deployment record verified
MainCI->>Codecov: Publish project coverage
Codecov-->>MainCI: 74.22% coverage
TauriCI->>GitHub: Build and publish release artifacts
GitHub-->>TauriCI: Release and latest.json generated
Docker->>GHCR: Push container image
GHCR-->>Docker: Image published
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
This PR adds comprehensive security audit documentation without any blocking issues. The AUDIT.md file provides clear security practices, threat model, and audit procedures. All changes are documentation-only with proper formatting and structure.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
Warning Review limit reachedNext included review available in 11 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 103 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
💤 Files with no reviewable changes (2)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe release documentation now records v1.28.2 details. Obsolete v1.28.2 release-candidate markers were removed from the changelog and README badge block. ChangesVersion 1.28.2 release documentation
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk:⚪ Minimal · up to This PR only synchronizes release documentation for v1.28.2, with no actionable merge-blocking risk remaining after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:86db2c18ed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…relevance) Two overclaims caught before merge: the macOS release artifacts don't each get a Minisign .sig (only .app.tar.gz does — the .dmg has no separate .dmg.sig), and "does not affect the already-published release" overstated what's actually known about issue #527 — App.tsx/hooks/useApp.ts as released in v1.28.2 do contain the timing-sensitive path, it just didn't trigger on that release's own verification CI run. Corrected to state precisely what's true: pre-existing, not introduced by v1.28.2, published artifacts remain valid and unamended, fix targeted at v1.28.3.
…ctions docs:check correctly flagged commits existing after the latest release tag with an empty [Unreleased] section — document the two wording corrections this PR makes.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:268ddd5dee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…note "that release's own CI run didn't trigger it" was genuinely ambiguous next to AUDIT.md's own entry saying the tag-triggered run DID hit the failure — name the specific main-push verification run (33064552219) that actually gated this release, and explicitly distinguish it from the separate, later, tag-triggered run that failed.
qnbs
commented
Aug 27, 2026
@codex review |
qnbs
commented
Aug 27, 2026
@coderabbitai review |
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
docs:check correctly flagged a commit existing after the latest release tag with an empty [Unreleased] section — this is exactly the same gate PR #528 hit, just on a different branch. Document the fix.
Uh oh!
There was an error while loading. Please reload this page.
docs:check correctly flagged a commit existing after the latest release tag with an empty [Unreleased] section — this is exactly the same gate PR #528 hit, just on a different branch. Document the fix.
…530) * fix: close a bootstrap-effect race that can skip the welcome portal hooks/useApp.ts initialized isPortalActive to false and only flipped it true via a mount effect — but isNewUser (the value that decides this) is already resolved synchronously before <App> mounts, so there's no reason to start with a known-wrong transient value. Initialize it from isNewUser directly instead. Defense in depth: the separate project-bootstrap effect (repairs raw-i18n- key project fields, or seeds a fresh blank project) only guarded on isPortalActive/isI18nReady/project, not isInitialLoad — a sibling effect in the same file already uses this exact isInitialLoad guard pattern, this one was just missing it. Without it, both effects firing in the same React commit could read isPortalActive's stale pre-update value and let the seed/repair effect fire before the portal-activation state change landed, occasionally skipping the welcome portal for a new user and auto-creating a default project instead. Extracted the effect into hooks/useProjectBootstrapEffect.ts (moved out of App.tsx, which had no prior component-level test coverage) so the new isInitialLoad guard is directly unit-testable: a pure shouldRunProjectBootstrap predicate plus targeted tests lock in the guard invariant across the race window and the legitimate ready state. These tests prove the new guard logic, not a live reproduction of the React effect-ordering timing itself — that evidence is the CI runs documented in the tracking issue. Found while investigating a flaky Mobile Chrome E2E failure on the v1.28.2 tag-triggered CI run (main's own push-triggered run passed cleanly on the identical commit). Pre-existing, not introduced by v1.28.2's own changes; targets the next release rather than amending the already-published v1.28.2 tag. * docs: add CHANGELOG entry for the onboarding bootstrap-effect race fix docs:check correctly flagged a commit existing after the latest release tag with an empty [Unreleased] section — this is exactly the same gate PR #528 hit, just on a different branch. Document the fix. * fix: remove unreachable resetProject dead code, add missing coverage codecov/patch failed on the new hooks/useProjectBootstrapEffect.ts — repairProjectI18nFields already treats any blank title/logline/manuscript as needing repair (each condition independently triggers its own repair branch), so the separate resetProject dispatch guarded by the identical blank-project condition was unreachable in practice. Confirmed via coverage report (line was genuinely never hit, not just under-tested) rather than writing a contrived test to game coverage on dead code. Removed it. Also added a project:null hook-level test that was missing (only the pure predicate had that case covered before). * docs+chore: add missing QNBS-v3 comment, drop the inert release-candidate marker App.tsx's useProjectBootstrapEffect call site was missing the required one-line rationale comment. CHANGELOG's release-candidate: v1.28.2 marker was already fully inert on this branch (v1.28.2 is tagged, and this Unreleased entry doesn't reference any specific version) — removed rather than bumped to v1.28.3, since no v1.28.3 release-prep is in flight yet. * fix: close remaining branch-coverage gaps that were still failing codecov/patch Two more issues codecov's line-level report surfaced beyond the first dead-code fix: (1) the guard's separate `if (!project) return;` was itself now dead code too — shouldRunProjectBootstrap's own predicate already guarantees project !== null by the time execution reaches it, so it could never be true. Consolidated into a single combined condition that narrows project directly (no redundant runtime check, no non-null assertion needed). (2) the three repair-field `if`s (title/logline/manuscript) only ever had their "needs repair" branch exercised together (the all-blank case) — added two more targeted tests exercising partial-repair combinations (title-only, logline-only) to close the remaining branch gaps. hooks/useProjectBootstrapEffect.ts is now 100% statement/branch/line/ function covered.
User description
Summary
<!-- release-candidate: v1.28.2 -->markers from README.md and CHANGELOG.md — v1.28.2 is genuinely tagged and published now, so the marker's only purpose (permitting an advertised-but-untagged version during the release-prep window) no longer applies.Release gate (2026-08-27 — v1.28.2)entry to AUDIT.md with real, verified evidence: main CI/CD run33064552219(all required + advisory jobs green, including a realDeploy to GitHub Pagesexecution and a genuine Deployments API record), Codecov project coverage, the Tauri multi-platform release build (33066539094) and its published GitHub Release artifacts, and the Docker/GHCR publish.tests/e2e/export.spec.tsfailure on the identical already-verified commit. Investigation ruled out cross-test/cross-run state persistence and traced it to a plausible pre-existing effect-ordering race in the onboarding flow (hooks/useApp.ts/App.tsx), not a v1.28.2 regression and not affecting the published release.Test plan
node scripts/check-doc-metrics.mjs— clean,latest v1.28.2pnpm run ci:prepush—DOCS_ONLY, all local checks passSummary by Sourcery
Synchronize the repository documentation with the published v1.28.2 release and its verified release-gate evidence.
Enhancements:
Documentation:
CodeAnt-AI Description
Finalize documentation for the published v1.28.2 release
What Changed
Impact
✅ Accurate v1.28.2 release documentation✅ Verifiable release and deployment evidence✅ Clearer explanation of the isolated flaky test💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit