Improve CI by koppor · Pull Request #15189 · JabRef/jabref

koppor · 2026-02-22T14:37:04Z

PR Description

Improves the CI based on our experience of the last release

Steps to test

See CI passing

Checklist

I own the copyright of the code submitted and I license it under the MIT license
[/] I manually tested my changes in running JabRef (always required)
[/] I added JUnit tests for changes (if applicable)
[/] I added screenshots in the PR description (if change is visible to the user)
[/] I added a screenshot in the PR description showing a library with a single entry with me as author and as title the issue number
[/] I described the change in CHANGELOG.md in a way that can be understood by the average user (if change is visible to the user)
[/] I checked the user documentation for up to dateness and submitted a pull request to our user documentation repository

qodo-free-for-open-source-projects · 2026-02-22T14:37:18Z

Review Summary by Qodo

Improve CI pipeline with macOS fixes and upload conditions

✨ Enhancement

Walkthroughs

Description

• Use gradlew wrapper on macOS instead of gradle command
• Add codesign verification for macOS builds
• Extend notarization to main-release branch
• Fix upload conditions for non-PR events
• Handle tag builds with proper path normalization
• Add progress indicator to wget downloads
• Remove unused useEaJdk parameter from workflows
• Improve artifact naming with shadowJar suffix

Diagram

flowchart LR
  A["CI Improvements"] --> B["macOS Build Changes"]
  A --> C["Upload & Notarization Logic"]
  A --> D["Artifact & Naming Updates"]
  B --> B1["Use gradlew wrapper"]
  B --> B2["Add codesign verification"]
  C --> C1["Extend to main-release"]
  C --> C2["Fix non-PR conditions"]
  C --> C3["Tag build path handling"]
  D --> D1["Remove useEaJdk param"]
  D --> D2["Add shadowJar suffix"]

File Changes

1. .github/actions/package/action.yml ✨ Enhancement +11/-1

Add codesign verification and improve artifact naming

• Added secretsPresent input parameter for conditional codesign verification
• Added codesign verification step for macOS builds when secrets are available
• Updated artifact upload name to include (shadowJar) suffix for clarity

.github/actions/package/action.yml

2. .github/workflows/binaries.yml ✨ Enhancement +21/-8

Fix macOS builds and upload conditions

• Changed macOS gradle command from gradle to ./gradlew wrapper
• Extended notarization condition to include main-release branch
• Updated upload condition to check for main-release branch alongside main
• Added logic to skip disk space check for non-PR events
• Fixed tag build path normalization to use proper branch name
• Removed unused useEaJdk parameter from all package action calls
• Added secretsPresent parameter to all package action invocations

.github/workflows/binaries.yml

3. .github/workflows/upload-release.yml ✨ Enhancement +1/-1

Show wget download progress
• Added --show-progress flag to wget command for better visibility during downloads
.github/workflows/upload-release.yml

Siedlerchr · 2026-02-22T14:39:01Z

          gradleCommand: ${{ matrix.gradleCommand }}
          component: jabgui
          componentShort: jabgui
-          useEaJdk: ${{ needs.conditions.outputs.useEaJdk }}


ea jdk option is no lonver available?

It is available, but setup in binaries, not in the custom action.

qodo-free-for-open-source-projects · 2026-02-22T14:39:52Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0)

1. codesign verify unguarded step 📘 Rule violation ⛯ Reliability

Description

A codesign --verify step runs unconditionally and will likely fail on non-macOS runners or when no
.dmg exists. Additionally, the guarded step checks inputs.os == 'macos-latest', but the workflow
passes macOS values like macos-15/macos-15-intel, so the condition is incorrect and the intended
gating may never apply.

Code

.github/actions/package/action.yml[R63-70]

+    - name: Validate signature
+      if: ${{ inputs.secretsPresent == 'true' && inputs.os == 'macos-latest' }}
+      shell: bash
+      run: |
+        codesign --verify --verbose ${{ inputs.component }}/build/packages/${{ inputs.os }}/*.dmg
+    - shell: bash
+      run: |
+        codesign --verify --verbose ${{ inputs.component }}/build/packages/${{ inputs.os }}/*.dmg

Evidence
PR Compliance ID 3 requires handling failure points/edge cases; running codesign without an
OS/file-existence guard introduces a brittle CI failure point. PR Compliance ID 25 requires correct
conditional logic; the if compares against macos-latest while the workflow uses macos-15 and
macos-15-intel, making the condition mismatched to actual inputs.
Rule 3: Generic: Robust Error Handling and Edge Case Management
.github/actions/package/action.yml[63-70]
.github/workflows/binaries.yml[396-413]
Best Practice: Learned patterns

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The composite action runs `codesign --verify` unconditionally and also contains an `if` guard that checks for `inputs.os == &amp;amp;#x27;macos-latest&amp;amp;#x27;`, which does not match the macOS OS values used in the calling workflow (e.g., `macos-15`, `macos-15-intel`). This can cause CI failures on non-macOS runners and makes the intended conditional signature validation ineffective.
## Issue Context
The workflow matrix uses macOS identifiers like `macos-15`/`macos-15-intel`, so any condition expecting `macos-latest` will not trigger. `codesign` is macOS-specific and should not run on other OSes, and the `.dmg` path/glob should be validated before executing verification.
## Fix Focus Areas
- .github/actions/package/action.yml[63-70]
- .github/workflows/binaries.yml[396-413]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

ⓘ The new review experience is currently in Beta. Learn more

qodo-free-for-open-source-projects · 2026-02-22T14:39:53Z

+    - name: Validate signature
+      if: ${{ inputs.secretsPresent == 'true' && inputs.os == 'macos-latest' }}
+      shell: bash
+      run: |
+        codesign --verify --verbose ${{ inputs.component }}/build/packages/${{ inputs.os }}/*.dmg
+    - shell: bash
+      run: |
+        codesign --verify --verbose ${{ inputs.component }}/build/packages/${{ inputs.os }}/*.dmg


1. codesign verify unguarded step 📘 Rule violation ⛯ Reliability

A codesign --verify step runs unconditionally and will likely fail on non-macOS runners or when no .dmg exists. Additionally, the guarded step checks inputs.os == 'macos-latest', but the workflow passes macOS values like macos-15/macos-15-intel, so the condition is incorrect and the intended gating may never apply.

Agent Prompt

## Issue description The composite action runs `codesign --verify` unconditionally and also contains an `if` guard that checks for `inputs.os == 'macos-latest'`, which does not match the macOS OS values used in the calling workflow (e.g., `macos-15`, `macos-15-intel`). This can cause CI failures on non-macOS runners and makes the intended conditional signature validation ineffective. ## Issue Context The workflow matrix uses macOS identifiers like `macos-15`/`macos-15-intel`, so any condition expecting `macos-latest` will not trigger. `codesign` is macOS-specific and should not run on other OSes, and the `.dmg` path/glob should be validated before executing verification. ## Fix Focus Areas - .github/actions/package/action.yml[63-70] - .github/workflows/binaries.yml[396-413]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

testlens-app · 2026-02-22T14:44:52Z

✅ All tests passed ✅

🏷️ Commit: 38bbd21
▶️ Tests: 10055 executed
⚪️ Checks: 66/66 completed

Learn more about TestLens at testlens.app.

…les-wizard-12709 * upstream/main: (106 commits) Merge common gating parts into composite action (JabRef#15197) Support protected institutional authors in PersonNamesChecker (JabRef#15175) adapt wix (JabRef#14969) Improve CI (JabRef#15189) Revert "Reduce complexity in dependencies setup (JabRef#15169)" (JabRef#15191) Fix compilation Fix heylogs test Fix icon on Linux (JabRef#15188) chore(deps): update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.5.5 (JabRef#15178) New Crowdin updates (JabRef#15173) Reduce complexity in dependencies setup (JabRef#15169) Start new development cycle snapcraft snapcraft use snapctl update metadata fiels try with mesa candidate fix snapcraft and skmanrc to use correct version Release v6.0-alpha.5 chore(sbom): update CycloneDX SBOM files (JabRef#15172) ...

* Use gradlew also on macOS * Show progress at wget * Fix displayname * Also notarize on main-release * Fix condition for uploading * Upload at non-pr * Fix path for tag builds * Remove non-used parameter useEaJdk * Add codesign verification * Always run (we did not see in the logs) * Remove codesign call --------- Co-authored-by: Oliver <koppor@red-debian.fritz.box>

Oliver added 10 commits February 21, 2026 12:51

Use gradlew also on macOS

4728dcd

Show progress at wget

c174a8e

Fix displayname

0c5e555

Also notarize on main-release

4e7a6a4

Fix condition for uploading

4c5ddb8

Upload at non-pr

749600e

Fix path for tag builds

628a373

Remove non-used parameter useEaJdk

d593644

Add codesign verification

adc7e41

Always run (we did not see in the logs)

62539a0

koppor added the dev: ci-cd label Feb 22, 2026

Siedlerchr previously approved these changes Feb 22, 2026

View reviewed changes

Siedlerchr reviewed Feb 22, 2026

View reviewed changes

qodo-free-for-open-source-projects Bot reviewed Feb 22, 2026

View reviewed changes

koppor added 2 commits February 22, 2026 16:27

Merge branch 'main' into fix-ci

b07eaf1

Remove codesign call

38bbd21

koppor dismissed Siedlerchr’s stale review via 38bbd21 February 22, 2026 15:29

koppor added the automerge PR is tagged with that label will be merged if workflows are green label Feb 22, 2026

jabref-machine approved these changes Feb 22, 2026

View reviewed changes

koppor enabled auto-merge February 22, 2026 15:40

koppor added this pull request to the merge queue Feb 22, 2026

github-actions Bot added the status: to-be-merged PRs which are accepted and should go into the merge-queue. label Feb 22, 2026

Merged via the queue into main with commit 70858c1 Feb 22, 2026
61 of 67 checks passed

koppor deleted the fix-ci branch February 22, 2026 16:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Improve CI#15189

Improve CI#15189
koppor merged 12 commits into
mainfrom
fix-ci

koppor commented Feb 22, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Feb 22, 2026

Uh oh!

Siedlerchr Feb 22, 2026

Uh oh!

koppor Feb 22, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

qodo-free-for-open-source-projects Bot Feb 22, 2026

Uh oh!

testlens-app Bot commented Feb 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

koppor commented Feb 22, 2026

PR Description

Steps to test

Checklist

Uh oh!

qodo-free-for-open-source-projects Bot commented Feb 22, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

Siedlerchr Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

koppor Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-free-for-open-source-projects Bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-free-for-open-source-projects Bot Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

testlens-app Bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ All tests passed ✅

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

qodo-free-for-open-source-projects Bot commented Feb 22, 2026 •

edited

Loading

testlens-app Bot commented Feb 22, 2026 •

edited

Loading