Add blog: Turn Every PR Into an Installable Preview #444
Conversation
Covers how to set up PR previews with Capgo using GitHub Actions, enabling QA, PMs, and developers to test features without TestFlight. Co-Authored-By: Claude Opus 4.5 <[email protected]>
Co-Authored-By: Claude Opus 4.5 <[email protected]>
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughWalkthroughNew blog post documentation added describing Capgo's PR Preview feature, which enables testing pull requests through per-PR update channels without traditional TestFlight delays. The post covers setup, usage patterns, configuration, cleanup workflows, and best practices. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR adds a new blog article titled "Turn Every Pull Request Into an Installable Preview" that explains how to implement PR preview functionality using Capgo's channel system. The article provides a comprehensive guide for setting up GitHub Actions workflows that automatically create update channels for pull requests, allowing testers to switch to specific PR versions without reinstalling the app.
Changes:
- Added comprehensive tutorial on PR preview setup with Capgo
- Included GitHub Actions workflows for creating and cleaning up PR channels
- Documented two methods for testers to switch channels (shake menu and programmatic API)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| CapacitorUpdater: { | ||
| shakeMenu: true | ||
| } |
There was a problem hiding this comment.
The configuration snippet is incomplete and may confuse readers. It should be wrapped in the proper structure. The complete configuration should be: const config: CapacitorConfig = { plugins: { CapacitorUpdater: { shakeMenu: true } } }; or at minimum show it as: plugins: { CapacitorUpdater: { shakeMenu: true } } to clarify this is part of the Capacitor config structure.
| CapacitorUpdater: { | |
| shakeMenu: true | |
| } | |
| const config: CapacitorConfig = { | |
| plugins: { | |
| CapacitorUpdater: { | |
| shakeMenu: true, | |
| }, | |
| }, | |
| }; |
| author_url: 'https://x.com/martindonadieu' | ||
| created_at: 2026-01-22T00:00:00.000Z | ||
| updated_at: 2026-01-22T00:00:00.000Z | ||
| head_image: /capgo_pr_preview.webp |
There was a problem hiding this comment.
The head_image references '/capgo_pr_preview.webp' but this file does not appear to exist in the public directory. Please ensure the image file exists at the specified path or update the reference to an existing image.
| head_image: /capgo_pr_preview.webp | |
| head_image: '' |
| run: bunx @capgo/cli channel add pr-${{ github.event.pull_request.number }} --self-assign | ||
| env: | ||
| CAPGO_TOKEN: ${{ secrets.CAPGO_TOKEN }} | ||
|
|
||
| # Upload the build to that channel | ||
| - name: Upload to Capgo | ||
| run: bunx @capgo/cli bundle upload --channel pr-${{ github.event.pull_request.number }} | ||
| env: |
There was a problem hiding this comment.
The GitHub Actions workflow runs bunx @capgo/cli without pinning the CLI version while exposing the CAPGO_TOKEN secret, creating a supply chain risk if the npm package or its dependency chain is compromised. An attacker who gains control over the published @capgo/cli package could exfiltrate CAPGO_TOKEN or push malicious bundles/channels during CI runs. To reduce this risk, pin @capgo/cli to a specific, audited version or otherwise add integrity controls instead of relying on the latest package each run.
| run: bunx @capgo/cli channel delete pr-${{ github.event.pull_request.number }} | ||
| env: | ||
| CAPGO_TOKEN: ${{ secrets.CAPGO_TOKEN }} |
There was a problem hiding this comment.
The cleanup workflow also invokes bunx @capgo/cli without a pinned version while providing it the CAPGO_TOKEN secret, which repeats the same supply chain risk as the deploy workflow. If the unpinned npm package is ever compromised, an attacker could use this step to exfiltrate CAPGO_TOKEN or manipulate channels during cleanup. Pin the CLI version (or add equivalent integrity verification) here as well to ensure only trusted code runs with access to this secret.
- Use existing head_image (capgo_ci-cd-illustration.webp) - Only post PR comment on 'opened' event (not synchronize) - Add continue-on-error for channel creation (may exist) - Show complete Capacitor config structure - Use @capgo/cli@latest explicitly in workflows Co-Authored-By: Claude Opus 4.5 <[email protected]>
Show complete flow for building custom channel selector: - listChannels() to discover available PR channels - setChannel() to switch to selected channel - getChannel() to show current channel - unsetChannel() to return to production Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Add allowShakeChannelSelector: true to config - Update description to explain full shake menu flow - Document automatic update behavior after channel selection Co-Authored-By: Claude Opus 4.5 <[email protected]>
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@src/content/blog/en/turn-every-pr-into-installable-preview.md`:
- Around line 76-101: The create_channel step uses continue-on-error which lets
Upload to Capgo and Comment on PR run even when channel creation truly failed;
change create_channel (id: create_channel) to explicitly detect existence and
expose an output (e.g., run `bunx `@capgo/cli`@latest channel get pr-${{
github.event.pull_request.number }} || bunx ... channel add ...` and set `echo
"::set-output name=channel_created::true/false"`), then gate the subsequent
steps (IDs: Upload to Capgo and Comment on PR) with an if that checks
`steps.create_channel.outputs.channel_created == 'true'` so upload/comment only
run when the channel was successfully created or confirmed to already exist.
♻️ Duplicate comments (1)
src/content/blog/en/turn-every-pr-into-installable-preview.md (1)
76-88: Pin@capgo/clito an audited version.Still using
@capgo/cli@latestin both workflows; this repeats the prior supply‑chain risk note. Please pin to a specific version (or add integrity controls) in the docs so readers don’t copy an unsafe pattern.What is the latest stable version of `@capgo/cli`, and what CI pinning / integrity guidance does Capgo recommend?Also applies to: 214-217
| # Create a channel named after your PR (may already exist on synchronize) | ||
| - name: Create PR Channel | ||
| id: create_channel | ||
| continue-on-error: true | ||
| run: bunx @capgo/cli@latest channel add pr-${{ github.event.pull_request.number }} --self-assign | ||
| env: | ||
| CAPGO_TOKEN: ${{ secrets.CAPGO_TOKEN }} | ||
|
|
||
| # Upload the build to that channel | ||
| - name: Upload to Capgo | ||
| run: bunx @capgo/cli@latest bundle upload --channel pr-${{ github.event.pull_request.number }} | ||
| env: | ||
| CAPGO_TOKEN: ${{ secrets.CAPGO_TOKEN }} | ||
|
|
||
| # Post a comment with testing instructions (only on PR open) | ||
| - name: Comment on PR | ||
| if: github.event.action == 'opened' | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| github.rest.issues.createComment({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| issue_number: ${{ github.event.pull_request.number }}, | ||
| body: '📱 **Test this PR on device:**\n\nOpen your app and switch to channel: `pr-${{ github.event.pull_request.number }}`\n\nUse the shake menu or call `setChannel()` from your app.' | ||
| }) |
There was a problem hiding this comment.
Guard upload/comment on channel creation outcome.
With continue-on-error: true, a real failure on PR open will still proceed to upload and comment, which can mislead testers. Consider checking the step outcome (or only allow continue-on-error when the channel already exists) and gate subsequent steps.
✅ Suggested workflow adjustment
- name: Create PR Channel
id: create_channel
continue-on-error: true
run: bunx `@capgo/cli`@latest channel add pr-${{ github.event.pull_request.number }} --self-assign
env:
CAPGO_TOKEN: ${{ secrets.CAPGO_TOKEN }}
# Upload the build to that channel
- name: Upload to Capgo
+ if: steps.create_channel.outcome == 'success' || steps.create_channel.conclusion == 'success'
run: bunx `@capgo/cli`@latest bundle upload --channel pr-${{ github.event.pull_request.number }}
env:
CAPGO_TOKEN: ${{ secrets.CAPGO_TOKEN }}
# Post a comment with testing instructions (only on PR open)
- name: Comment on PR
- if: github.event.action == 'opened'
+ if: github.event.action == 'opened' && (steps.create_channel.outcome == 'success' || steps.create_channel.conclusion == 'success')
uses: actions/github-script@v7🤖 Prompt for AI Agents
In `@src/content/blog/en/turn-every-pr-into-installable-preview.md` around lines
76 - 101, The create_channel step uses continue-on-error which lets Upload to
Capgo and Comment on PR run even when channel creation truly failed; change
create_channel (id: create_channel) to explicitly detect existence and expose an
output (e.g., run `bunx `@capgo/cli`@latest channel get pr-${{
github.event.pull_request.number }} || bunx ... channel add ...` and set `echo
"::set-output name=channel_created::true/false"`), then gate the subsequent
steps (IDs: Upload to Capgo and Comment on PR) with an if that checks
`steps.create_channel.outputs.channel_created == 'true'` so upload/comment only
run when the channel was successfully created or confirmed to already exist.
Summary
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.