External/5chan
1
0
Fork 0
mirror of https://github.com/bitsocialnet/5chan.git synced 2026-08-03 07:41:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): resolve Dependabot alerts

Browse Source
This commit is contained in:
Tommaso Casaburi
2026-04-23 14:06:18 +07:00
parent 3524c1c01e
commit 0366a16844
3 changed files with 86 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/agent-playbooks/known-surprises.md
+10
View File
@@ -28,6 +28,16 @@ If uncertain, ask the developer before adding an entry.
## Entries
### Android release signing still uses legacy keystore names
- **Date:** 2026-04-23
- **Observed by:** Codex
- **Context:** Cutting the `v0.8.0` release after the core terminology rename changed release workflow signing references.
- **What was surprising:** The tracked Android release keystore is still `android/plebbit.keystore`, and the available GitHub secret is still `PLEBBIT_REACT_KEYSTORE_PASSWORD`; changing only the workflow references to `bitsocial.keystore` / `BITSOCIAL_KEYSTORE_PASSWORD` made the Android release artifact fail at signing.
- **Impact:** Tag releases can pass the Android build and then fail before publishing because `apksigner` cannot find the keystore or password secret.
- **Mitigation:** Until the keystore migration is done, keep release APK signing pointed at `android/plebbit.keystore` and `PLEBBIT_REACT_KEYSTORE_PASSWORD`. If renaming, migrate the tracked file, workflow path, and GitHub secret in one change and verify with a tag release dry run or full release.
- **Status:** confirmed
### 5chan consumes a pinned hooks tarball instead of using the local hooks repo
- **Date:** 2026-04-15