fix(preview): keep builds installed and updatable

[Eli Bosley (elibosley)]

Summary

CA PR previews now publish successfully, remain recognized as installed on the Apps page, and continue receiving updates from their stable per-PR channel.

Why This Exists

The trusted publisher could publish preview files but failed with 403 Resource not accessible by integration when it tried to create the installer comment. Separately, CA's installed-state check treated strict pluginURL equality as identity. A preview needs a per-PR pluginURL for updates, but that made the canonical CA app-feed entry appear uninstalled. Live artifact inspection also found GNU cp nesting the package below ./community.applications/, unlike the local BSD cp build, so CI previews did not place files at the filesystem root expected by upgradepkg.

Resolution

Grant the trusted publisher the pull-request write permission GitHub requires. Keep the canonical community.applications plugin name for WebGUI paths, retain the per-PR pluginURL as the preview update channel, and recognize only official numeric CA PR-preview URLs as aliases of the canonical CA app-feed template. Build deterministic archives with normalized metadata and reject any archive that does not contain CA's Apps.page at the expected package-root path. CI independently builds on Linux and macOS, byte-compares every output, and publishes only the verified result.

This changes the real CA installed-state matcher, not the built package after generation. The builder only supplies the preview version, package metadata, and per-PR update URL.

Reviewer Considerations

• The alias is deliberately narrow: exact official repository, pr-previews branch, numeric pr/<number> path, and community.applications.plg filename.
• Fork URLs, malformed PR paths, other branches, other manifests, and preview URLs compared with other plugin templates remain rejected.
• The archive-layout assertion runs inside the builder on both local and CI builds, preventing platform-specific cp behavior from publishing a structurally invalid package.
• The preview date and archive timestamps come from the PR head commit, so identical inputs remain identical across reruns and UTC date boundaries.
• CI publication now depends on exact Linux/macOS equality for the package, manifest, and metadata JSON.
• The installed preview version retains -pr<number>-<sha> for operator visibility.
• The trusted workflow_run boundary and all other workflow permissions remain unchanged.

Behavior Changes

• Successful preview publication can create or update the installer comment on its pull request.
• Installed previews are recognized as Community Applications on the Apps page.
• WebGUI update checks continue using the stable per-PR installer URL, so new pushes update the preview channel.
• Installing a preview continues to replace/update the existing CA plugin registration.

Implementation Summary

• Upgrade pull-requests permission from read to write in the trusted publisher.
• Add a focused CA plugin URL identity matcher with an official PR-preview alias.
• Route checkInstalledPlugin() through that matcher.
• Keep name canonical while restoring the per-PR pluginURL in generated manifests.
• Normalize GNU/BSD source-copy behavior and validate the package root before publication.
• Generate sorted, root-owned archives with normalized modes and commit-derived timestamps through Python's cross-platform tar/XZ implementation.
• Add Linux/macOS matrix builds and a byte-for-byte comparison gate before creating the publisher artifact.
• Add regression coverage and update the packaged ca.md5 integrity manifest.

Verification

• actionlint .github/workflows/pr-preview-publish.yml
• bash -n scripts/build-pr-preview.sh
• shellcheck scripts/build-pr-preview.sh
• PHP syntax checks for the matcher, helper integration, and regression test.
• php tests/test_plugin_identity.php, all eight cases pass.
• Built a complete PR fix(preview): keep builds installed and updatable #127 preview package and asserted its canonical name, per-PR update URL, and canonical Apps identity match.
• Asserted the archive contains ./usr/local/emhttp/plugins/community.applications/Apps.page and has no nested ./community.applications/ package root.
• Ran two local builds from the same PR/SHA and confirmed diff -r reports identical package, manifest, and JSON output.
• Confirmed normalized root ownership, modes, entry order, and commit-derived timestamps in the archive listing.
• Cross-platform GitHub matrix and reproducibility comparison pass.
• Extracted the package and passed every md5sum -c ca.md5 integrity check.
• git diff --check

Risk

Low; the exception is scoped to official CA preview URLs, has negative coverage for neighboring URL shapes, and preserves the existing exact-match rule for every other plugin. The builder and CI both fail closed when output structure or bytes diverge across platforms.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cb251f96-b345-4f4d-a08d-502d0cd48d67

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pr-preview-comment-permission

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/pr-preview-comment-permission

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}