Repository navigation
fix: recover marketplace sources and render catalog logos under CSP - #648
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (8)
📒 Files selected for processing (14)
Included review availability: Your plan provides up to 8 included reviews per hour; 3 remain after this review. WalkthroughThe changes fix GitHub archive media-type handling, classify marketplace source failures, improve retry and stale-source reporting, and restrict marketplace icons to bundled assets or supported data URLs. ChangesMarketplace acquisition and source diagnostics
Marketplace refresh and stale-source state
Bundled catalog icon resolution
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Bug fix · Severity of issue fixed: Medium Sequence Diagram(s)sequenceDiagram
participant MarketplaceUI
participant refreshCatalog
participant MarketplaceSources
participant MarketplaceStaleLine
MarketplaceUI->>refreshCatalog: request catalog refresh
refreshCatalog->>MarketplaceSources: refresh all sources
MarketplaceSources-->>refreshCatalog: source results and error classes
refreshCatalog-->>MarketplaceUI: combined refresh result
MarketplaceUI->>MarketplaceStaleLine: render source states
MarketplaceStaleLine-->>MarketplaceUI: show degraded or recovered state
Merge Risk: ⚪ Minimal · up to The Marketplace recovery and local icon handling changes have no identified unresolved behavior risk and are ready to merge after normal validation. 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
Full details: Linked Issues checkExplanation The reviewed changes address the core coding requirements in Resolution Provide reviewable evidence for the required updates in docs/qa/scenarios/ET-web-marketplace-landing-browse.md, docs/_memory/change-impact.md, packages/site/content/docs/marketplace/index.mdx, and packages/site/content/docs/marketplace/sources.mdx, or otherwise confirm those coding-scope requirements are satisfied.
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
React Doctor found no new issues. 🎉 Reviewed by React Doctor for commit |
|
| Filename | Overview |
|---|---|
| internal/registry/github/repository.go | Changes pinned repository archive requests to use GitHub's required API media type. |
| internal/registry/github/http.go | Keeps binary release assets and repository source archives on their respective media types. |
| internal/marketplace/pluginsource/github.go | Maps transport and upstream failures to safe source-level diagnostic classes. |
| internal/registry/extract.go | Allows consumed Git global PAX metadata without weakening decompressed-size or filesystem-entry protections. |
| web/src/systems/marketplace/lib/marketplace-icon.ts | Resolves exact published catalog icon URLs to bundled assets and admits supported inline images only. |
| web/src/systems/marketplace/components/marketplace-results.tsx | Attributes stale-catalog warnings and cached timestamps to degraded sources. |
| web/src/systems/marketplace/hooks/use-marketplace-page.ts | Reports every failed source returned by refresh rather than only the first. |
| .github/workflows/marketplace-public.yml | Adds an opt-in integration lane that exercises public document and pinned-snapshot acquisition. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
Feed[Marketplace source] --> Fetch[Fetch document]
Fetch --> Pin[Resolve pinned commit]
Pin --> Archive[Request GitHub archive<br/>API media type]
Archive --> Extract[Bounded archive extraction<br/>consume global PAX metadata]
Extract --> Catalog[Authoritative catalog projection]
Catalog --> Web[Marketplace UI]
Web --> Status[Degraded-source warning and Retry]
Web --> Icons[Bundled CSP-compatible logos]
Status --> Fetch
Reviews (2): Last reviewed commit: "fix: consume Git archive metadata and ad..." | Re-trigger Greptile
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
First-review dispositionsCollected all REST pages of reviews, inline comments and general comments, plus GraphQL review threads. Both reviewers completed coverage of
The real public-source CI probe additionally exposed Git global PAX metadata rejection after HTTP 415 was fixed. |
Consolidated integration dispositionSquash merge: All seven unfinished worktree fixes were preserved in main repair 09648e0: errcheck/formatting, valid global PAX fixture metadata, unique E2E ID and corrected evidence upload glob. The source worktree remains unchanged with diff SHA256 0ae7b09d4044cc4a5a4d8a20a19c988dfb7dbe1d81fefa8852729020f838a8f9. The old lint and fixture failures were repaired without weakening assertions. First reviews produced no inline defects; generic documentation/filter notices have explicit dispositions. The public 52-entry acquisition and pinned-snapshot probe passed on 09648e0; registry and marketplace acquisition code is byte-identical at the final integration head. All pages of general/inline reviews and review threads, including outdated and collapsed material, were collected. Existing test owners were retained. Blanket docstring quotas and invitations to change reviewer filters do not override repository conventions and were not treated as production defects. No reviewer configuration, branch protection or published main history was rewritten. Validation: integrated-main CI — passed: 26 successful jobs, with only the PR-title job skipped because this is a main push. Heavy verification ran only in GitHub CI under the explicit user override. Authorship and verification are agent-based, not human approval. React Doctor on integrated main: 69/100, zero errors, 178 baseline warnings, unchanged from preceding main. PR-diff analyses reported no new issues; this is not a zero-warning full scan. Final-head marketplace browser artifact passed and was visually inspected: degraded-source cached state, recovery, desktop/mobile layout and logos under production CSP. |
This branch was successfully deployed
1 participant
What & why
Closes #644. Repository archives use GitHub API media negotiation and accept bounded global PAX metadata. Source warnings name only degraded sources; Retry preserves cached entries and clears warnings on recovery. Shipped logos resolve to bundled assets under the unchanged production CSP.
Authored and integrated by Codex (GPT-6 Astra). No human verification is claimed.
Squash-merged as
5fa857dabd755e6de012660e6c0346361c00ba90. All five PRs (#645–#649) are integrated and verified on main.How you verified it
Public acquisition passed on 24dfc27: 52 entries plus pinned snapshot. PR CI passed all browser/runtime/desktop E2E but failed Go lint and PAX fixture creation. Main commit 09648e0 preserves all seven unfinished worktree fixes: errcheck/formatting, valid PAX fixture metadata, unique E2E-006 ID and corrected screenshot artifact path. These fixes passed main CI. Main public acquisition also passed all 52 entries and the pinned snapshot. The corrected marketplace screenshot artifact is present; the integration executor inspected partial-failure and recovered desktop states and recovered mobile state, including loaded logos under production CSP. The temporary error toast can still be visible immediately after recovery; per-source stale state and Retry clear correctly. First reviews have no inline defects; documentation/filter warnings have explicit dispositions. React Doctor reported no new PR issues. The full main scan reports 69/100, zero errors and 178 baseline warnings, matching the preceding main scan; a successful workflow status is not zero-warning evidence.
CI-only user override: no local make gate, builds, tests, typechecks or React Doctor runs. Local work is limited to source inspection, formatting and diff checks. Final integrated-main CI passed on
e7e4a7e329499a56fa11b364ed453a1e9d5447f7: 26 successful jobs covering Go lint/build/race, frontend lint/types/tests/build, native Windows, real role/Goal integrations, and web/runtime/desktop E2E. PR-title validation is skipped on push; no applicable CI job failed or remained pending.All available general, inline, outdated and collapsed first-review findings were collected. One consolidated remediation round is authorized; no second review or final-head reapproval is requested. Generic docstring quotas do not override the repository's requirement to comment non-obvious intent rather than repeat identifiers; no reviewer configuration or check is changed.
Final-head marketplace browser artifact passed and was visually inspected: degraded-source cached state, recovery, desktop/mobile layout and logos under production CSP.
Impact
Marketplace error classes and Web warning/logo behavior; public schemas, native IDs, config, hooks, ownership and credentials remain unchanged. Pinning, network policy, extraction limits and CSP are preserved. Marketplace guides, landing QA, cache inputs and change-impact audit co-ship. Official skill remains accurate.
Cross-surface audit:
docs/_memory/change-impact.md.make gatepasses locally; this PR is delivered only after its required CI checks are green — local execution waived by explicit CI-only user instruction.