Conversation
Update `main` 10/10/25
Release to Production - 2025-10-12
Release to Staging - 2025-10-24
Release to Production - 2025-10-26
Release to Staging - 2025-11-01
Release to Production - 2025-11-04
Release to Staging - 2025-11-07
Release to Staging - 2025-11-14
Release to Staging - 2025-11-20
Release to Staging - 2025-12-05
…allowing dynamic switching between iOS and Android during tests. This change improves test isolation and avoids hoisting issues with jest.mock.
Bugfix: Workaround Mobile CI tests flakiness
Release to Staging - 2025-12-12
Release alpha build for 2.9.5
Release to Staging - 2025-12-16
…nges. Added checks for 'circuits' in circuits.yml and 'contracts' or 'common' in contracts.yml to determine if tests should execute on dev branch. This avoids too wide changelist in trigger filter that is problematic
…in circuits.yml and contracts.yml. This change ensures that the full history is available for subsequent steps in the workflows.
… checks. Added error handling for git diff command in circuits.yml and contracts.yml to ensure robust execution and prevent workflow failures due to diff errors.
…tibility and performance across all CI configurations. This change replaces the previous version v4 in circuits, contracts, and other workflow files.
…pendency installation process.
…pha package.json for version checks.
SELF-1684: Ensure checks are run with pull requests to staging/main
Release to Production - 2025-12-07
Release to Staging v2.9.16 - 2026-03-10
Release to Production v2.9.16 - 2026-03-10
Release to Staging v2.9.16 - 2026-03-13
Release to Production v2.9.16 - 2026-03-16
Release to Staging v2.9.16 - 2026-03-27
Release to Staging v2.9.16 - 2026-03-30
Release to Production v2.9.16 - 2026-03-29
Release to Staging v2.9.16 - 2026-04-03
Release to Production v2.9.16 - 2026-04-06
Release to Staging v2.9.16 - 2026-04-08
Release: staging v2.9.16 — recovery, navigation, security, cleanup
Release to Staging v2.9.17 - 2026-04-09
Release to Staging v2.9.17 - 2026-04-10
Release to Staging v2.9.17 - 2026-04-10
Release to Production v2.9.16 - 2026-04-12
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 19414827 | Triggered | Generic Password | a9d87bf | app/ios/PassportReaderCore.swift | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Greptile SummaryThis PR introduces two new display variants for the Key findings:
Confidence Score: 3/5Safe to merge only after the The desktop variant and overall architecture are well-structured and additive. However, sdk/qrcode/components/MobileQRcode.tsx requires the most attention — the unused Important Files Changed
|
| <div style={mobileCardStyle()} role="region" aria-label="Self authentication"> | ||
| <DesktopHeader appName={selfApp.appName} appLogo={selfApp.logoBase64} /> | ||
| <div style={mobilePhoneSectionWrapperStyle()}> | ||
| <div style={mobilePhoneSectionStyle()}> |
There was a problem hiding this comment.
proofStep accepted but never used
proofStep is declared in MobileQRcodeProps and destructured, but it is never referenced in the render. The component always shows the same phone mockup + "Open Self app" CTA regardless of whether proof generation is in progress, has succeeded, or has failed. This means mobile users get no visual feedback after they return to the page — the button remains visible even after a successful or failed verification.
The analogous DesktopFooter component shows a status card (connecting, verified, failed) when proofStep is not an initial state. The mobile variant should do the same — either hide the CTA and show a status message, or at minimum disable/hide the button after verification is complete.
| } from '../utils/styles.js'; | ||
| import { getDesktopDescription } from '../utils/utils.js'; | ||
| import DesktopHeader from './DesktopHeader.js'; | ||
| import { ArrowReturnIcon, DownloadIcon, VerifyIcon } from './icons.js'; |
There was a problem hiding this comment.
getDesktopDescription is imported but never used directly in MobileQRcode. It is used internally by the DesktopHeader component; importing it here is redundant and will trigger lint warnings.
| import { ArrowReturnIcon, DownloadIcon, VerifyIcon } from './icons.js'; | |
| import DesktopHeader from './DesktopHeader.js'; |
| </div> | ||
| </div> | ||
| ); | ||
| })} | ||
| </div> | ||
| <div style={mobileCtaSectionStyle()}> |
There was a problem hiding this comment.
The CTA button rendered here (<a href={qrValue} style={mobileCtaButtonStyle()}>…) is nearly identical to the SelfDeepLinkButton component that is already exported from index.ts. Consider reusing SelfDeepLinkButton to avoid divergence between the two implementations — replace the inline <a> block with <SelfDeepLinkButton href={qrValue} />.
| const DesktopQRcode = memo( | ||
| ({ proofStep, qrValue, size, darkMode, selfApp }: DesktopQRcodeProps) => ( | ||
| <div style={desktopCardStyle()} role="img" aria-label="Self authentication QR code"> | ||
| <DesktopHeader appName={selfApp.appName} appLogo={selfApp.logoBase64} /> | ||
| <div style={desktopQrSectionStyle()}> | ||
| <div style={desktopQrWrapperStyle(proofStep)}> | ||
| <QRCode value={qrValue} size={size} darkMode={darkMode} proofStep={proofStep} /> | ||
| </div> | ||
| </div> | ||
| <DesktopFooter proofStep={proofStep} /> | ||
| </div> | ||
| ) |
There was a problem hiding this comment.
darkMode prop not applied to card/header/footer styles
darkMode is forwarded to the inner QRCode component (which changes the QR dot colour) but none of the wrapping elements — desktopCardStyle(), desktopHeaderStyle(), desktopFooterStyle(), etc. — are aware of it. As a result the card always renders with a white background and black text even when darkMode={true} is passed by the consumer.
If dark mode is intentionally out-of-scope for the desktop variant in this PR, consider removing the darkMode prop from DesktopQRcodeProps to signal that clearly, or document the limitation.
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 002eec19-e158-40aa-a486-599303076082
⛔ Files ignored due to path filters (9)
sdk/qrcode/assets/3dots.pngis excluded by!**/*.pngsdk/qrcode/assets/error.pngis excluded by!**/*.pngsdk/qrcode/assets/phone-mockup.pngis excluded by!**/*.pngsdk/qrcode/assets/qrcode.pngis excluded by!**/*.pngsdk/qrcode/assets/shieldcheck.pngis excluded by!**/*.pngsdk/qrcode/assets/shieldcheck2.pngis excluded by!**/*.pngsdk/qrcode/assets/shieldlightning.pngis excluded by!**/*.pngsdk/qrcode/assets/squarecheck.pngis excluded by!**/*.pngsdk/qrcode/assets/warning.pngis excluded by!**/*.png
📒 Files selected for processing (16)
.github/workflows/circuits.yml.github/workflows/contracts.yml.github/workflows/core-sdk-ci.yml.github/workflows/qrcode-sdk-ci.ymlsdk/qrcode/components/DesktopFooter.tsxsdk/qrcode/components/DesktopHeader.tsxsdk/qrcode/components/DesktopQRcode.tsxsdk/qrcode/components/MobileQRcode.tsxsdk/qrcode/components/SelfDeepLinkButton.tsxsdk/qrcode/components/SelfQRcode.tsxsdk/qrcode/components/icons.tsxsdk/qrcode/index.tssdk/qrcode/tsup.config.tssdk/qrcode/types/svg.d.tssdk/qrcode/utils/styles.tssdk/qrcode/utils/utils.ts
| proofStep: number; | ||
| qrValue: string; | ||
| selfApp: SelfApp; | ||
| } | ||
|
|
||
| const MOBILE_STEPS = [ | ||
| { icon: DownloadIcon, text: 'Download the Self Mobile app' }, | ||
| { icon: VerifyIcon, text: 'Verify your identity' }, | ||
| { icon: ArrowReturnIcon, text: 'Return to this application and click on the button below' }, | ||
| ]; | ||
|
|
||
| const MobileQRcode = memo(({ proofStep, qrValue, selfApp }: MobileQRcodeProps) => ( | ||
| <div style={mobileCardStyle()} role="region" aria-label="Self authentication"> | ||
| <DesktopHeader appName={selfApp.appName} appLogo={selfApp.logoBase64} /> | ||
| <div style={mobilePhoneSectionWrapperStyle()}> | ||
| <div style={mobilePhoneSectionStyle()}> | ||
| <img src={phoneMockup} alt="Self app preview" style={mobilePhoneImgStyle()} /> | ||
| </div> | ||
| </div> | ||
| <div style={mobileFooterStyle()}> | ||
| {MOBILE_STEPS.map((step, index) => { | ||
| const Icon = step.icon; | ||
| return ( | ||
| <div key={index} style={desktopStepStyle()}> | ||
| <div style={desktopStepInnerStyle()}> | ||
| <div style={desktopStepIconStyle()}> | ||
| <Icon size={18} /> | ||
| </div> | ||
| <span style={desktopStepTextStyle()}>{step.text}</span> | ||
| </div> | ||
| </div> | ||
| ); | ||
| })} |
There was a problem hiding this comment.
proofStep is accepted but never rendered — status feedback missing on mobile.
The component signature takes proofStep, but it's never read anywhere in the JSX (linter confirms: 'proofStep' is defined but never used). The desktop variant uses proofStep to drive border color and a status card; on mobile, users will get no visual feedback as the proof progresses through MOBILE_CONNECTED → PROOF_GENERATION_STARTED → PROOF_VERIFIED / FAILED. Either wire it up (e.g. swap the footer/CTA for a status card like desktop once proofStep > WAITING_FOR_MOBILE) or drop it from the props so callers don't think it has an effect.
🧰 Tools
🪛 GitHub Check: quality-checks
[failure] 39-39:
'proofStep' is defined but never used
Description
A brief description of the changes, what and how is being changed.
Tested
Explain how the change has been tested (for example by manual testing, unit tests etc) or why it's not necessary (for example version bump).
How to QA
How can the change be tested in a repeatable manner?
Summary by CodeRabbit
New Features
SelfDeepLinkButtoncomponent as public API entry pointChores