- Add SignPath signing step to windows-bin job in build workflow
- Configure signing for all Windows executables (NSIS installers and portable .exe)
- Disable auto-release in electron-builder to allow signing before release
- Add manual GitHub Release upload after signing completes
- Add comprehensive documentation for SignPath setup and configuration
- Document required GitHub secrets and workflow configuration
- Include verification steps and troubleshooting guide
The integration is ready but signing steps will be commented out initially
until the SignPath certificate is fully issued (currently CSR PENDING).
Prevents race condition where upload attempts happen before sync config
is loaded from IndexedDB, eliminating 404 errors to default baseUrl
during app startup and E2E tests.
- Update peter-evans/find-comment to v4.0.0 (pinned SHA)
- Update peter-evans/create-or-update-comment to v5.0.0 (pinned SHA)
Fixes GitHub Actions failure where v4 tag pointed to unavailable commit.
Uses commit SHAs instead of version tags for supply chain security.
There is no reason to run certain checks on simple documentation
updates. These Actions showed up during the initial v0.1 PR and added
noise to the PR process.
Add automated preview deployments for pull requests using Cloudflare Pages.
Each PR gets a unique preview URL that updates on every push.
Requires configuring these repository secrets:
- CLOUDFLARE_API_TOKEN
- CLOUDFLARE_ACCOUNT_ID
WebDAV and SuperSync E2E tests require dedicated server infrastructure
and should only run in the scheduled E2E workflow or manually. This
prevents build failures when the required servers are not available.
- Added @webdav tag to all WebDAV test files for consistent filtering
- Updated build.yml to exclude @webdav and @supersync tagged tests
Add allowed_non_write_users parameter to bypass actor permission check for PRs from external contributors. This enables automated code reviews for all PRs, including those from forks, while maintaining security through pull_request_target context.
Pin all GitHub Actions to immutable commit SHAs to prevent supply chain attacks.
This protects against tag-poisoning attacks like the March 2025 tj-actions compromise
that affected 23,000+ repositories.
Changes:
- Pin 55 action references across 19 workflow files to commit SHAs
- Add version comments (e.g., "# v6") for readability
- Manually resolved: gradle/actions, github/codeql-action, actions/setup-node
All actions now use immutable references following GitHub security best practices:
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
Future updates should be managed via Dependabot to automate SHA updates.
Contains both a first-draft of content as well as
a comprehensive GH Action to replicate from
docs/wiki to the `.wiki` sub-repo. The linting is
non-blocking at the moment.
- the existing markdown linking appears reliably
rendered in GH but more testing needed.
- style guide for contributions/expectations needs
to be added to the wiki
- **a significant re-work of the README** to
re-direct users to the Wiki is needed to avoid
doc duplication
- updates to the PR templates and contributor
guidelines to emphasize the importance of adding
documentation is still needed
Change trigger from pull_request to pull_request_target to allow the
workflow to run with write permissions even for external contributors.
This fixes the "Actor has insufficient permissions" error.
Also add condition to skip draft PRs to reduce API usage.
The E2E test suite has grown to 111+ spec files with an estimated
execution time of 80-100 minutes, exceeding the previous 60-minute
timeout limit. This increase prevents premature workflow termination.
- Change workflow runner from macos-latest to macos-26
- Add Xcode and SDK version verification step
- Ensures compliance with Apple's April 2026 requirement for iOS 26 SDK
- Maintains iOS 14.0 deployment target for backward compatibility
Docker Compose was failing because env_file: .env was referenced but the
file doesn't exist in CI (it's gitignored). Also updates deprecated
set-output command to use GITHUB_OUTPUT environment file.
The Claude Code Review workflow needs pull-requests: write permission to post review comments on PRs. Previously it only had read access, causing "Actor does not have write permissions" errors.
The Claude Code GitHub Action was failing with 403 errors when trying
to create comments on issues due to read-only permissions. Updated
contents, pull-requests, and issues permissions from read to write.
Angular Material overlay backdrops were not being properly cleared between
tag operations, causing subsequent clicks to timeout when overlays blocked
element interactions.
Added ensureOverlaysClosed() helper with:
- Early exit if no overlays present (performance)
- Escape key dismissal with retry for stacked overlays
- Logging for debugging when fallbacks trigger
- Uses Playwright's native locator.waitFor() instead of waitForFunction()
- Cleanup at operation start (prevent blocking) and end (clean state)
Benefits:
- Eliminates fixed timeouts, uses smart waiting (tests run 2x faster)
- Handles edge cases like stacked overlays
- Provides visibility into when overlays are unexpectedly present
Fixes 4 failing tests:
- Tag CRUD: remove tag via context menu
- Tag CRUD: delete tag and update tasks
- Tag CRUD: navigate to tag view
- Menu: toggle tags via submenu
- Remove PROVISIONING_PROFILE_SPECIFIER from archive (breaks Pods)
- Use CODE_SIGN_STYLE=Automatic for archive step
- Manual signing handled during export via ExportOptions.plist
- Add bundle ID verification to catch mismatches early
- Create build-ios.yml workflow triggered on releases
- Configure signing keychain with iOS distribution certificate
- Install provisioning profile for App Store distribution
- Sync version from package.json using agvtool
- Build, archive, and export IPA with manual code signing
- Validate and upload to App Store Connect via xcrun altool
- Add sync:ios and dist:ios:prod npm scripts
