Repository navigation
Prepare and publish extension packages through a queue - #308
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
api | 5c4c0d9 | Nov 10 2026, 03:37 AM |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 55 files
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 20 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 16 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 1 file (changes from recent commits).
Requires human review: Adds an async package-preparation pipeline (queue consumer, B2 storage, new DB tables) and changes v1 latest-release semantics; needs human sign-off on public pre-approval icons, schema migration, and API/operational tradeoffs.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 4 files (changes from recent commits).
Requires human review: Adds queue-based package preparation with B2 storage, image processing, DB migrations, and v1 latest-release changes; needs human sign-off on public pending icons, schema migration, v1 contract, and operational queue tradeoffs.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 4 files (changes from recent commits).
Requires human review: Queue-based package preparation with B2 storage, image processing, migrations, and v1 latest-release semantics. Despite doc/config improvements, public pending icons, schema, v1 contract, and queue capacity decisions need human sign-off.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 2 files (changes from recent commits).
Requires human review: Queue-based package preparation adds B2/public-icon storage, migrations, queue bindings, and new v1 latest-release semantics. Pending-icon visibility, the v1 contract, and queue capacity/retry tradeoffs are deliberate human decisions.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
All reported issues were addressed across 6 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
There was a problem hiding this comment.
0 issues found across 3 files (changes from recent commits).
Requires human review: Queue-based package preparation introduces public storage for pending icons, v1 latest-release contract changes, DB migrations, and queue operational tradeoffs; package mode stays disabled, but these choices still need human sign-off.
Turn on auto-fix | Re-trigger cubic
Accept ready-to-install extension ZIPs and prepare them asynchronously through a queue. Preserve their compressed file payloads, replace the manifest with directory metadata, and verify checksums. Releases reference immutable artifacts; submission and approval check that the reviewed listing matches the selected package. Uploaded code and build scripts are never executed.
ZIPs stay in private B2 storage. Sanitized SVG or optimized AVIF/PNG icons are stored during packaging in the public asset bucket at
extensions/<extension UUID>/icons/<asset UUID>.<format>. Pending image URLs are unlisted, not private; API previews remain permission-checked. New extensions receive a permanent UUID draft identity after validation, and the first submission reuses it. Approval reuses the existing CDN assets without copying them.Queue processing rechecks owner and publisher access, handles duplicate delivery and interrupted work, and bounds retries and archive processing. The package workflow depends on narrow repository, object-store and image-processing interfaces. Cloudflare queue delivery, binding configuration and image processing live in platform adapters; B2 storage has its own adapter. SQL and guarded writes stay in persistence repositories. Node tests exercise ZIP preparation and manifest corrections without Cloudflare runtime imports. Package integration tests use the B2 adapter with mocked S3 responses and D1/image bindings; package storage has no R2 fallback.
Local development uses the regular Worker configuration. Public URLs and deployment controls remain in Wrangler. B2 connection details and the MXroute server/username are dashboard-managed runtime variables, preserved by
keep_vars: true. Documentation uses placeholders for operational values; credentials stay in secrets.Deployment: package mode remains disabled. Provision the declared Queue and confirm Images binding support before automatic deployment. Configure the separate B2 credentials and complete production runtime/capacity measurements before enabling package mode. Enable and smoke-test this API before deploying the directory changes or publisher changes.