feat(build): support Linux ARM64 - #2006
Merged
Merged
Conversation
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
zerob13
marked this pull request as ready for review
July 22, 2026 17:17
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Around line 119-121: Add job-level permissions to the build-linux job, and any
equivalent build jobs in the workflow, granting only contents: read. Place the
permissions configuration alongside the job’s name, condition, and runner
settings; preserve existing checkout and install behavior, using a separately
scoped token only if runtime installation requires it.
In `@test/main/build/electronBuilderConfig.test.ts`:
- Around line 152-161: Extend the ARM64 release asset test in “collects Linux
ARM64 packages and update metadata for releases” to assert that prepareAssets
includes both artifacts/deepchat-linux-arm64/*.deb and
artifacts/deepchat-linux-arm64/*.rpm, alongside the existing package checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 518dc6a9-a77d-492a-b741-155138958712
📒 Files selected for processing (7)
.github/workflows/build.yml.github/workflows/release.ymldocs/features/linux-arm64-support/plan.mddocs/features/linux-arm64-support/spec.mddocs/features/linux-arm64-support/tasks.mdtest/main/build/electronBuilderConfig.test.tstest/main/plugin/pluginService.test.ts
Comment on lines
+119
to
+121
| name: build-linux(${{ matrix.arch }}) | ||
| if: github.event.inputs.platform == 'all' || contains(github.event.inputs.platform, 'linux') | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ${{ matrix.runner }} |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow existence and relevant section =="
if [ -f .github/workflows/build.yml ]; then
nl -ba .github/workflows/build.yml | sed -n '1,180p'
else
echo ".github/workflows/build.yml not found"
git ls-files .github/workflows
fi
echo
echo "== explicit permissions blocks in workflow =="
rg -n '^\s*permissions:\s*$|permissions:' .github/workflows/build.yml || true
echo
echo "== github_token usage in workflow =="
rg -n 'GITHUB_TOKEN|uses: .*\.token|with:.*token' .github/workflows/build.yml || true
echo
echo "== workflow trigger =="
sed -n '1,80p' .github/workflows/build.yml 2>/dev/null || trueRepository: ThinkInAIXYZ/deepchat
Length of output: 245
🏁 Script executed:
#!/bin/bash
set -u
echo "== workflow existence and relevant section =="
if [ -f .github/workflows/build.yml ]; then
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/build.yml | sed -n '1,180p'
else
echo ".github/workflows/build.yml not found"
git ls-files .github/workflows || true
fi
echo
echo "== explicit permissions blocks in workflow =="
grep -En '^\s*permissions:\s*$|permissions:' .github/workflows/build.yml || true
echo
echo "== github_token usage in workflow =="
grep -En 'GITHUB_TOKEN|uses: .*\.token|with:.*token' .github/workflows/build.yml || true
echo
echo "== workflow trigger and checkout/install actions =="
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/build.yml | sed -n '1,120p' 2>/dev/null || true
echo
echo "== all job names and install/build dependency actions =="
grep -E '^\s*[a-zA-Z0-9_-]+:\s*$|uses: (actions/checkout|pnpm/action-setup|actions/cache|softprops/action-gh-release|actions/github-script|github-script|peter-evans/create-issue|npm)' .github/workflows/build.yml || trueRepository: ThinkInAIXYZ/deepchat
Length of output: 14859
🏁 Script executed:
#!/bin/bash
set -u
echo "== build-linux tail =="
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/build.yml | sed -n '175,240p'
echo
echo "== build-mac section =="
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/build.yml | sed -n '230,340p'
echo
echo "== workflow-wide permission/token patterns =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/build.yml')
text=p.read_text()
for i,line in enumerate(text.splitlines(),1):
if 'permissions:' in line or 'GITHUB_TOKEN' in line or 'RTK_GITHUB_TOKEN' in line or line.strip().startswith('secrets.'):
print(f'{i}: {line}')
PYRepository: ThinkInAIXYZ/deepchat
Length of output: 8471
Set least-privilege permissions on the build jobs.
build-linux has no explicit permissions, so its actions/checkout and pnpm install scripts run under the repository-default GITHUB_TOKEN scopes despite not writing back. Add permissions: { contents: read } to the build job(s); use a scoped token only during runtime install steps if needed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build.yml around lines 119 - 121, Add job-level
permissions to the build-linux job, and any equivalent build jobs in the
workflow, granting only contents: read. Place the permissions configuration
alongside the job’s name, condition, and runner settings; preserve existing
checkout and install behavior, using a separately scoped token only if runtime
installation requires it.
Source: Linters/SAST tools
Comment on lines
+152
to
+161
| it('collects Linux ARM64 packages and update metadata for releases', async () => { | ||
| const workflow = await readWorkflow('release.yml') | ||
| const prepareAssets = workflow.jobs?.release?.steps?.find( | ||
| (step) => step.name === 'Prepare release assets' | ||
| )?.run | ||
|
|
||
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.AppImage') | ||
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.tar.gz') | ||
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.yml') | ||
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.blockmap') |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Cover ARM64 .deb and .rpm release assets.
The workflow collects both formats, but this regression test only checks AppImage and tar.gz. Add assertions so either installer cannot be silently dropped later.
Proposed fix
expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.AppImage')
+ expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.deb')
+ expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.rpm')
expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.tar.gz')📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| it('collects Linux ARM64 packages and update metadata for releases', async () => { | |
| const workflow = await readWorkflow('release.yml') | |
| const prepareAssets = workflow.jobs?.release?.steps?.find( | |
| (step) => step.name === 'Prepare release assets' | |
| )?.run | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.AppImage') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.tar.gz') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.yml') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.blockmap') | |
| it('collects Linux ARM64 packages and update metadata for releases', async () => { | |
| const workflow = await readWorkflow('release.yml') | |
| const prepareAssets = workflow.jobs?.release?.steps?.find( | |
| (step) => step.name === 'Prepare release assets' | |
| )?.run | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.AppImage') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.deb') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.rpm') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.tar.gz') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.yml') | |
| expect(prepareAssets).toContain('artifacts/deepchat-linux-arm64/*.blockmap') |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/main/build/electronBuilderConfig.test.ts` around lines 152 - 161, Extend
the ARM64 release asset test in “collects Linux ARM64 packages and update
metadata for releases” to assert that prepareAssets includes both
artifacts/deepchat-linux-arm64/*.deb and artifacts/deepchat-linux-arm64/*.rpm,
alongside the existing package checks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
pnpm run formatpnpm run i18npnpm run lintpnpm run typecheckpnpm exec vitest run test/main/build/electronBuilderConfig.test.ts test/main/plugin/pluginService.test.ts test/main/scripts/packagePlugin.test.ts test/main/shared/settingsNavigation.test.ts— 55 tests passedHandoff
The release workflow and full cross-platform packaging matrix were not dispatched. Those checks are intentionally left for maintainer validation.
Summary by CodeRabbit
New Features
Documentation
Tests