chore(repo): Build and publish native passkeys binaries on production releases#8955
Open
wobsoriano wants to merge 12 commits into
Open
chore(repo): Build and publish native passkeys binaries on production releases#8955wobsoriano wants to merge 12 commits into
wobsoriano wants to merge 12 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: dda7004 The changes in this PR will be included in the next version bump. This PR includes changesets to release 6 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Repository UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds native binary build, validation, and release wiring for ChangesElectron Passkeys Native Binary Pipeline
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
wobsoriano
changed the title
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
wobsoriano
commented
Jun 23, 2026
Comment on lines
+11
to
+19
| "fixed": [ | ||
| [ | ||
| "@clerk/electron-passkeys", | ||
| "@clerk/electron-passkeys-darwin-arm64", | ||
| "@clerk/electron-passkeys-darwin-x64", | ||
| "@clerk/electron-passkeys-win32-arm64-msvc", | ||
| "@clerk/electron-passkeys-win32-x64-msvc" | ||
| ] | ||
| ], |
Member
Author
There was a problem hiding this comment.
all five packages must publish at the same version number. The four platform packages are optionalDependencies of the wrapper at an exact version, and napi-rs's native loader matches the .node binary by the package version it was built with
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/electron-passkeys.yml:
- Around line 11-20: The workflow file has a duplicate permissions key defined
in the YAML structure, which causes a parsing error. Remove the second
permissions block that only contains contents: read and keep only the first
permissions block that includes both contents: read and actions: read. This will
resolve the YAML syntax error and allow the workflow to parse correctly.
In @.github/workflows/release.yml:
- Around line 46-52: Navigate to the `.github/workflows/electron-passkeys.yml`
reusable workflow file and locate the duplicate `permissions` key that is
causing the YAML parsing error. Remove one of the duplicate `permissions` blocks
so that only a single `permissions` definition remains in the file. This will
resolve the syntax error and allow the workflow call in the build-native job to
execute successfully.
In `@scripts/check-electron-passkeys-binaries.mjs`:
- Around line 27-45: The main function lacks error handling for the
findMissingBinaries call, which means any thrown errors will result in unhandled
rejections instead of GitHub annotations. Wrap the await
findMissingBinaries(npmDir) call in a try-catch block and use console.error with
the ::error:: format to report caught exceptions. Additionally, the error
message template is inaccurate as it always says "empty package" regardless of
the count value; update the message logic to correctly indicate that the issue
is having an incorrect number of binaries (not exactly 1), adjusting the text
appropriately when count is greater than 1 versus when count is 0.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 935b7c82-ea09-45c8-a2d9-eae66f8d7961
📒 Files selected for processing (10)
.changeset/config.json.changeset/electron-passkeys-native-binaries.md.github/workflows/electron-passkeys.yml.github/workflows/release.ymlscripts/canary.mjsscripts/check-electron-passkeys-binaries.mjsscripts/check-electron-passkeys-binaries.test.mjsscripts/common.mjsscripts/detect-electron-passkeys-publish.mjsscripts/snapshot.mjs
wobsoriano
commented
Jun 23, 2026
| name: Electron Passkeys Native Build | ||
|
|
||
| on: | ||
| workflow_dispatch: |
Member
Author
There was a problem hiding this comment.
This workflow is manual because native passkey releases are rare. The release workflow consumes the artifact only when publish is pending.
wobsoriano
commented
Jun 23, 2026
Comment on lines
+68
to
+70
| - name: Determine whether electron-passkeys is about to publish | ||
| id: detect-native | ||
| run: node scripts/detect-electron-passkeys-publish.mjs >> "$GITHUB_OUTPUT" |
Member
Author
There was a problem hiding this comment.
This only enables the binary download path when @clerk/electron-passkeys is actually about to publish
wobsoriano
commented
Jun 23, 2026
Comment on lines
+75
to
+87
| - name: Download electron-passkeys native binaries | ||
| if: ${{ steps.detect-native.outputs.should-build == 'true' }} | ||
| uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21 | ||
| with: | ||
| github_token: ${{ github.token }} | ||
| workflow: electron-passkeys.yml | ||
| name: electron-passkeys-npm | ||
| path: packages/electron-passkeys/npm | ||
| branch: ${{ github.ref_name }} | ||
| event: workflow_dispatch | ||
| workflow_conclusion: success | ||
| search_artifacts: true | ||
| allow_forks: false |
Member
Author
There was a problem hiding this comment.
Pulls the latest successful manual native-build artifact for this branch so changesets can publish the platform packages with their .node files
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 75-91: The workflow downloads electron-passkeys binaries without
verifying they were built from the same commit as the release. The "Download
electron-passkeys native binaries" step retrieves artifacts by branch and build
success but doesn't validate the source commit, and the "Verify
electron-passkeys binaries are present" step only checks for file presence, not
provenance. Add a verification step between these two that captures the source
commit SHA of the downloaded artifact and compares it against the current
release commit (accessible via github.sha or github.ref_name context). Only
proceed with subsequent steps if the commit SHAs match, preventing mismatched
binaries from being published.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 7554401e-7ff6-4ce4-a600-57648f32ebd6
📒 Files selected for processing (4)
.github/workflows/electron-passkeys.yml.github/workflows/release.ymlscripts/check-electron-passkeys-binaries.mjsscripts/check-electron-passkeys-binaries.test.mjs
🚧 Files skipped from review as they are similar to previous changes (3)
- scripts/check-electron-passkeys-binaries.test.mjs
- .github/workflows/electron-passkeys.yml
- scripts/check-electron-passkeys-binaries.mjs
wobsoriano
commented
Jun 23, 2026
| timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }} | ||
|
|
||
| permissions: | ||
| actions: read |
Member
Author
There was a problem hiding this comment.
required because we need to read workflow runs and artifacts from electron-passkeys.yml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
scripts/check-electron-passkeys-binaries.test.mjs (1)
56-63: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a mismatch test where
mainis path-prefixed (e.g.,./passkeys.node).This will lock in expected behavior for common
package.jsonmainformats and prevent false release gate failures.Suggested test addition
+ test('accepts declared binary when main uses ./ prefix', async () => { + const root = await createRoot(); + await createPlatformDir(root, 'darwin-arm64', ['passkeys.node'], './passkeys.node'); + + await expect(findMissingBinaries(root)).resolves.toEqual([]); + });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/check-electron-passkeys-binaries.test.mjs` around lines 56 - 63, Add a new mismatch test in findMissingBinaries coverage for the package.json main field when it is path-prefixed, such as ./passkeys.node, so the behavior is locked in for common main formats. Update the test suite around findMissingBinaries and createPlatformDir to assert that a dir is still flagged correctly when the declared binary includes a leading path prefix, matching the existing missing-binary expectations in this check-electron-passkeys-binaries test file.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/electron-passkeys.yml:
- Line 34: Disable persisted checkout credentials in both workflow jobs by
updating the actions/checkout usage in the electron-passkeys workflow to set
persist-credentials to false. Make this change in each checkout step (the one in
the first job and the one in the second job) since the workflow does not perform
git-authenticated write operations, and refer to the actions/checkout step
configurations to locate them.
---
Nitpick comments:
In `@scripts/check-electron-passkeys-binaries.test.mjs`:
- Around line 56-63: Add a new mismatch test in findMissingBinaries coverage for
the package.json main field when it is path-prefixed, such as ./passkeys.node,
so the behavior is locked in for common main formats. Update the test suite
around findMissingBinaries and createPlatformDir to assert that a dir is still
flagged correctly when the declared binary includes a leading path prefix,
matching the existing missing-binary expectations in this
check-electron-passkeys-binaries test file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 84671be1-109d-4716-b8a6-97add6e2ea5e
📒 Files selected for processing (3)
.github/workflows/electron-passkeys.ymlscripts/check-electron-passkeys-binaries.mjsscripts/check-electron-passkeys-binaries.test.mjs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #8786, which added the Electron SDK scaffold and the
@clerk/electron-passkeyspackages without shipping native binaries. This PR adds the release path for those native passkey binaries.Since the passkeys package should be updated rarely, native binaries are produced by manually running the Electron Passkeys Native Build workflow before a production release that bumps
@clerk/electron-passkeys. The workflow builds the macOS arm64/x64 and Windows arm64/x64.nodefiles on native runners, assembles them into the per-platform npm package directories, verifies every platform package contains exactly one binary, and uploads the assembledelectron-passkeys-npmartifact with 90-day retention.During a production release, the release workflow detects when
@clerk/electron-passkeysis about to publish, downloads the latest successful manual artifact for the current branch, and verifies the binaries beforechangesets/actionpublishes.Canary and snapshot releases continue to exclude these packages.
Here's a mermaid flow I generated with codex for this change:
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
Summary
New Features
Build & Release Automation
Quality & Validation
.nodefile matches each package’s declared entry point, backed by expanded automated tests.