chore(repo): Build and publish native passkeys binaries on production releases#8955
Open
wobsoriano wants to merge 9 commits into
Open
chore(repo): Build and publish native passkeys binaries on production releases#8955wobsoriano wants to merge 9 commits into
wobsoriano wants to merge 9 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: e7caae9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 6 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
📝 WalkthroughWalkthroughAdds a native binary CI pipeline for ChangesElectron Passkeys Native Binary Pipeline
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
wobsoriano
changed the title
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
wobsoriano
commented
Jun 23, 2026
Comment on lines
+11
to
+19
| "fixed": [ | ||
| [ | ||
| "@clerk/electron-passkeys", | ||
| "@clerk/electron-passkeys-darwin-arm64", | ||
| "@clerk/electron-passkeys-darwin-x64", | ||
| "@clerk/electron-passkeys-win32-arm64-msvc", | ||
| "@clerk/electron-passkeys-win32-x64-msvc" | ||
| ] | ||
| ], |
Member
Author
There was a problem hiding this comment.
all five packages must publish at the same version number. The four platform packages are optionalDependencies of the wrapper at an exact version, and napi-rs's native loader matches the .node binary by the package version it was built with
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/electron-passkeys.yml:
- Around line 11-20: The workflow file has a duplicate permissions key defined
in the YAML structure, which causes a parsing error. Remove the second
permissions block that only contains contents: read and keep only the first
permissions block that includes both contents: read and actions: read. This will
resolve the YAML syntax error and allow the workflow to parse correctly.
In @.github/workflows/release.yml:
- Around line 46-52: Navigate to the `.github/workflows/electron-passkeys.yml`
reusable workflow file and locate the duplicate `permissions` key that is
causing the YAML parsing error. Remove one of the duplicate `permissions` blocks
so that only a single `permissions` definition remains in the file. This will
resolve the syntax error and allow the workflow call in the build-native job to
execute successfully.
In `@scripts/check-electron-passkeys-binaries.mjs`:
- Around line 27-45: The main function lacks error handling for the
findMissingBinaries call, which means any thrown errors will result in unhandled
rejections instead of GitHub annotations. Wrap the await
findMissingBinaries(npmDir) call in a try-catch block and use console.error with
the ::error:: format to report caught exceptions. Additionally, the error
message template is inaccurate as it always says "empty package" regardless of
the count value; update the message logic to correctly indicate that the issue
is having an incorrect number of binaries (not exactly 1), adjusting the text
appropriately when count is greater than 1 versus when count is 0.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 935b7c82-ea09-45c8-a2d9-eae66f8d7961
📒 Files selected for processing (10)
.changeset/config.json.changeset/electron-passkeys-native-binaries.md.github/workflows/electron-passkeys.yml.github/workflows/release.ymlscripts/canary.mjsscripts/check-electron-passkeys-binaries.mjsscripts/check-electron-passkeys-binaries.test.mjsscripts/common.mjsscripts/detect-electron-passkeys-publish.mjsscripts/snapshot.mjs
wobsoriano
commented
Jun 23, 2026
| name: Electron Passkeys Native Build | ||
|
|
||
| on: | ||
| workflow_dispatch: |
Member
Author
There was a problem hiding this comment.
This workflow is manual because native passkey releases are rare. The release workflow consumes the artifact only when publish is pending.
wobsoriano
commented
Jun 23, 2026
Comment on lines
+68
to
+70
| - name: Determine whether electron-passkeys is about to publish | ||
| id: detect-native | ||
| run: node scripts/detect-electron-passkeys-publish.mjs >> "$GITHUB_OUTPUT" |
Member
Author
There was a problem hiding this comment.
This only enables the binary download path when @clerk/electron-passkeys is actually about to publish
wobsoriano
commented
Jun 23, 2026
Comment on lines
+75
to
+87
| - name: Download electron-passkeys native binaries | ||
| if: ${{ steps.detect-native.outputs.should-build == 'true' }} | ||
| uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21 | ||
| with: | ||
| github_token: ${{ github.token }} | ||
| workflow: electron-passkeys.yml | ||
| name: electron-passkeys-npm | ||
| path: packages/electron-passkeys/npm | ||
| branch: ${{ github.ref_name }} | ||
| event: workflow_dispatch | ||
| workflow_conclusion: success | ||
| search_artifacts: true | ||
| allow_forks: false |
Member
Author
There was a problem hiding this comment.
Pulls the latest successful manual native-build artifact for this branch so changesets can publish the platform packages with their .node files
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 75-91: The workflow downloads electron-passkeys binaries without
verifying they were built from the same commit as the release. The "Download
electron-passkeys native binaries" step retrieves artifacts by branch and build
success but doesn't validate the source commit, and the "Verify
electron-passkeys binaries are present" step only checks for file presence, not
provenance. Add a verification step between these two that captures the source
commit SHA of the downloaded artifact and compares it against the current
release commit (accessible via github.sha or github.ref_name context). Only
proceed with subsequent steps if the commit SHAs match, preventing mismatched
binaries from being published.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 7554401e-7ff6-4ce4-a600-57648f32ebd6
📒 Files selected for processing (4)
.github/workflows/electron-passkeys.yml.github/workflows/release.ymlscripts/check-electron-passkeys-binaries.mjsscripts/check-electron-passkeys-binaries.test.mjs
🚧 Files skipped from review as they are similar to previous changes (3)
- scripts/check-electron-passkeys-binaries.test.mjs
- .github/workflows/electron-passkeys.yml
- scripts/check-electron-passkeys-binaries.mjs
wobsoriano
commented
Jun 23, 2026
| timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }} | ||
|
|
||
| permissions: | ||
| actions: read |
Member
Author
There was a problem hiding this comment.
required because we need to read workflow runs and artifacts from electron-passkeys.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #8786, which added the Electron SDK scaffold and the
@clerk/electron-passkeyspackages without shipping native binaries. This PR adds the release path for those native passkey binaries.Since the passkeys package should be updated rarely, native binaries are produced by manually running the Electron Passkeys Native Build workflow before a production release that bumps
@clerk/electron-passkeys. The workflow builds the macOS arm64/x64 and Windows arm64/x64.nodefiles on native runners, assembles them into the per-platform npm package directories, verifies every platform package contains exactly one binary, and uploads the assembledelectron-passkeys-npmartifact with 90-day retention.During a production release, the release workflow detects when
@clerk/electron-passkeysis about to publish, downloads the latest successful manual artifact for the current branch, and verifies the binaries beforechangesets/actionpublishes.Canary and snapshot releases continue to exclude these packages.
Here's a mermaid flow I generated with codex for this change:
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
Summary by CodeRabbit
New Features
Build & Release Automation
Quality & Validation