Skip to content

Provide app version validation #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Vladyslav-Kuksiuk merged 5 commits into from
Jul 22, 2026
Merged

Provide app version validation #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e48a1cb
Secure app version.
Vladyslav-Kuksiuk Jul 21, 2026
4fd76ce
Secure paths.
Vladyslav-Kuksiuk Jul 21, 2026
a37e752
Make version treatment as release tag.
Vladyslav-Kuksiuk Jul 22, 2026
8e2aa29
Bump version -> `0.1.1`.
Vladyslav-Kuksiuk Jul 22, 2026
8e956a7
Improve readability.
Vladyslav-Kuksiuk Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,18 +87,23 @@ Embedding instructions refer to these roots with `$model/` and

By default, the plugin checks the latest Embed Code release before running a task.
It reuses the executable in `build/embed-code/latest` while the release
version remains unchanged and downloads a new executable only after a new
tag remains unchanged and downloads a new executable only after a new
release is published. When the release check fails, for example without
network access, the plugin reuses the previously installed executable.

To use a specific Embed Code application release, add its version to the extension:
To use a specific Embed Code application release, set `version` to its exact release tag.
The plugin uses this value verbatim and does not add a `v` prefix.

```kotlin
embedCode {
version.set("1.2.4")
version.set("v1.2.4")

@Oleg-Melnik Oleg-Melnik Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The verbatim-tag semantics are a behavioral break for existing configurations: version.set("1.2.4") used to be auto-prefixed to v1.2.4, and after this change it requests a tag literally named 1.2.4, which fails at download with a message that gives no hint about the removed convention. The README documents the new behavior well, but nothing helps someone upgrading.

Cheap mitigations, either or both:

  • a one-line migration note here ("previous plugin versions prefixed v automatically; set the exact tag now");
  • when a pinned download fails and the tag does not start with v, append a hint to the error: "a release tag v<tag> may exist — previous plugin versions added this prefix automatically."

Related one-liner: the pinned cache moved from build/embed-code/<version> to build/embed-code/versions/<tag>, so caches from earlier plugin versions are orphaned (self-heals via one re-download; stale directories linger until a clean). Not worth documenting for end users, but worth knowing it's expected.

}
```

Omit `version`, or set it to an empty string, to use the latest release.
Setting `version` to `"latest"` targets a release tag literally named `latest`;
it is not an alias for the latest release.

Before installing an executable, the plugin verifies the release asset's SHA-256
digest from the GitHub Releases API. API requests are unauthenticated unless a
token provider is configured explicitly:
Expand Down
Loading