feat: Comprehensive demo polish — login, dashboard, CSS fixes, CI/CD with APK - #11
Conversation
…with APK - Add Login page (demo: click to enter dashboard, no auth required) - Add Dashboard page (sidebar + stats + quick actions + profile) - Add 'Iniciar Sesion' button in navbar - Fix CSS: hover/focus/active states for all interactive elements - Fix CSS: hide API endpoint text (.form-note display:none) - Fix CSS: hide TODO M2 badges from production UI - Fix CSS: add @Keyframes spin animation for WASM loading - Fix CSS: improve footer contrast and accessibility - Fix CSS: add focus-visible outlines for keyboard navigation - Fix CSS: add empty state styles with icons - Fix CSS: add login + dashboard responsive breakpoints - Fix backend main.rs formatting (rustfmt compliance for CI) - Update CI workflow (unchanged) - Add Android APK build job to release workflow - Add GitHub Release creation with all artifacts - Update README with Helder's 10-point checklist coverage - Document demo/placeholder boundaries clearly - Document reusable vs demo code clearly
|
Warning Review limit reached
More reviews will be available in 54 minutes and 1 second. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds ChangesLogin & Dashboard Frontend Feature
WASM CI Artifact, Docs, and Backend Cleanup
Sequence Diagram(s)sequenceDiagram
actor User
participant Navbar
participant App
participant LoginPage
participant DashboardPage
User->>Navbar: clicks "Iniciar Sesión"
Navbar->>App: on_navigate(Page::Login)
App->>LoginPage: render full-screen (no navbar/footer)
User->>LoginPage: clicks "Iniciar Sesión" button
LoginPage->>App: on_navigate(Page::Dashboard)
App->>DashboardPage: render full-screen (no navbar/footer)
User->>DashboardPage: clicks sidebar tab or quick-action
DashboardPage->>App: on_navigate(Page::Driver / Page::Passenger)
User->>DashboardPage: clicks logout
DashboardPage->>App: on_navigate(Page::Home)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 122: Replace all third-party GitHub Actions references in the release.yml
file that currently use version tags with their full commit SHA equivalents. For
each action (actions/checkout, dtolnay/rust-toolchain, actions/upload-artifact,
actions/setup-java, android-actions/setup-android, actions/download-artifact,
and softprops/action-gh-release), update the `uses:` directive from the current
tag format (e.g., `@v4`) to the immutable full commit SHA format to prevent
supply-chain vulnerabilities. Ensure every `uses:` statement across all workflow
jobs uses a pinned commit SHA instead of a floating tag reference.
- Line 122: Add `persist-credentials: false` to all four instances of the
`actions/checkout@v4` step in the workflow to prevent Git credentials from
persisting in the local Git config. Since this workflow does not perform any
authenticated Git operations after checkout, this change follows the principle
of least privilege and reduces credential exposure risk. Locate each checkout
step using the actions/checkout@v4 identifier and add the with clause containing
persist-credentials: false to each one.
- Around line 190-194: The glob pattern in the files section for the
pickando-frontend-wasm artifacts uses `artifacts/pickando-frontend-wasm/*` which
only matches top-level files and excludes the `assets/` subdirectory containing
critical files like pickando.js, pickando_bg.wasm, and main.css. Change this
pattern to use a recursive glob pattern (e.g.,
`artifacts/pickando-frontend-wasm/**/*` or
`artifacts/pickando-frontend-wasm/**`) to include all files and subdirectories
in the release artifacts.
- Around line 117-177: Add explicit least-privilege permissions to the workflow
to follow security best practices. At the workflow root level (before the jobs
section), define a global permissions block with minimal permissions (typically
read-only access like contents: read). Then, in the create-release job which
needs to create GitHub releases, override with elevated permissions by adding a
permissions block to that specific job with the necessary permissions (such as
contents: write) to perform release operations. This ensures all jobs start with
minimal permissions and only the create-release job has the elevated access it
requires.
In `@crates/frontend/src/components/dashboard.rs`:
- Around line 43-44: Spanish UI text strings in the dashboard component are
missing proper diacritical marks, reducing copy quality. Locate and update all
Spanish language strings to include correct accents: "Cerrar Sesion" should be
"Cerrar Sesión", "Aqui" should be "Aquí", "direccion" should be "dirección",
"todavia" should be "todavía", "Calificacion" should be "Calificación",
"informacion" should be "información", "estadisticas" should be "estadísticas",
and "ubicacion" should be "ubicación". Search the entire dashboard component for
these misspelled strings and replace them with their correctly accented Spanish
equivalents.
- Around line 14-17: The sidebar-brand div element is styled to appear clickable
with cursor: pointer but lacks actual interactivity and keyboard accessibility.
Convert the div with class "sidebar-brand" containing the brand-icon span and
"Pickando" text into a semantic interactive element (such as a button or link)
with proper on_navigate event handling to navigate to Page::Home, or
alternatively remove the cursor: pointer styling from the CSS if the element
should remain non-interactive. This ensures the visual presentation matches the
actual functionality and provides proper keyboard navigation support.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5e252c25-a104-45cf-b9a4-0362fe95b642
📒 Files selected for processing (9)
.github/workflows/release.ymlREADME.mdcrates/backend/src/main.rscrates/frontend/assets/main.csscrates/frontend/src/components/dashboard.rscrates/frontend/src/components/login.rscrates/frontend/src/components/mod.rscrates/frontend/src/components/navbar.rscrates/frontend/src/main.rs
| build-android: | ||
| name: Android APK | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
|
|
||
| - name: Install Android targets | ||
| run: | | ||
| rustup target add aarch64-linux-android | ||
| rustup target add armv7-linux-androideabi | ||
| rustup target add x86_64-linux-android | ||
|
|
||
| - name: Setup Java | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: 'zulu' | ||
| java-version: '17' | ||
|
|
||
| - name: Setup Android SDK | ||
| uses: android-actions/setup-android@v3 | ||
|
|
||
| - name: Install Android NDK | ||
| run: | | ||
| sdkmanager --install "ndk;27.0.12077973" | ||
| echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/27.0.12077973" >> $GITHUB_ENV | ||
|
|
||
| - name: Install cargo-ndk | ||
| run: cargo install cargo-ndk | ||
|
|
||
| - name: Build Android native libraries | ||
| run: | | ||
| cargo ndk -t arm64-v8a -t armeabi-v7a -t x86_64 build --release -p pickando-frontend --features mobile | ||
| env: | ||
| ANDROID_NDK_HOME: ${{ env.ANDROID_NDK_HOME }} | ||
|
|
||
| - name: Install Dioxus CLI | ||
| run: cargo install dioxus-cli --version 0.7.9 | ||
|
|
||
| - name: Initialize Android project | ||
| working-directory: crates/frontend | ||
| run: dx android init | ||
|
|
||
| - name: Build Android APK | ||
| working-directory: crates/frontend | ||
| run: dx android build --release | ||
|
|
||
| - name: Upload APK | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: pickando-android-apk | ||
| path: crates/frontend/target/android/app/release/app-release.apk | ||
|
|
||
| create-release: | ||
| name: Create GitHub Release | ||
| needs: [build-backend, build-wasm, build-android] | ||
| runs-on: ubuntu-latest | ||
| if: startsWith(github.ref, 'refs/tags/') |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/release.ymlRepository: enerBydev/pickando-demo
Length of output: 8714
🌐 Web query:
GitHub Actions upload-artifact download-artifact permissions required scope
💡 Result:
When using GitHub Actions, the permissions required for actions/upload-artifact and actions/download-artifact depend on the scope of the operation [1][2][3]. For standard usage within the same workflow run, no explicit additional permissions or tokens are required beyond the default GITHUB_TOKEN permissions [1][3]. If you need to download artifacts from other workflow runs or other repositories, the action requires elevated permissions [1][2][3]. In these scenarios, you must provide a github-token (such as a Personal Access Token or a token with appropriate scope) that possesses actions:read permissions for the target repository [1][3]. When configuring this for cross-repository or cross-run downloads, you specify the token alongside the repository name and the run ID [1][3]: - uses: actions/download-artifact@v8 with: name: my-other-artifact github-token: ${{ secrets.GH_PAT }} repository: owner/repo-name run-id: 1234 Please note that file permissions (such as executable bits) are not preserved during the standard artifact upload process, as zipping files resets directory permissions to 755 and file permissions to 644 [1][4]. If preserving specific file permissions is required, it is recommended to archive your files using tar before uploading [1][3][4].
Citations:
- 1: https://github.com/actions/download-artifact
- 2: https://github.com/actions/toolkit/blob/main/packages/artifact/README.md
- 3: https://github.com/actions/download-artifact/blob/main/README.md
- 4: https://github.com/actions/upload-artifact?tab=readme-ov-file
🌐 Web query:
softprops action-gh-release permissions contents:write requirement
💡 Result:
The softprops/action-gh-release action requires the contents: write permission to function correctly [1][2][3]. This permission allows the action to create, update, and upload assets to GitHub Releases [1][4]. If you use the optional discussion_category_name input, you must also grant the discussions: write permission [1][2][5]: permissions: contents: write discussions: write Important Considerations: - Permission Scope: These permissions can be defined at the job level or the workflow level [1][2]. Be aware that defining an explicit permissions block in your workflow overrides the default permissions, so ensure you include any other necessary permissions if your workflow performs other tasks [6]. - Repository Settings: In addition to the workflow-level configuration, ensure your repository's GitHub Actions settings permit the GITHUB_TOKEN to have read and write access (check Settings > Actions > General > Workflow permissions) [6]. - Release Events: If you are triggering your workflow on the release: { types: [published] } event, the default GITHUB_TOKEN will not trigger a subsequent workflow. In this specific scenario, you must use a personal access token (PAT) instead of the default token [1][2][3].
Citations:
- 1: https://github.com/softprops/action-gh-release/blob/master/README.md
- 2: https://github.com/softprops/action-gh-release
- 3: https://github.com/marketplace/actions/gh-release
- 4: https://github.com/step-security/action-gh-release
- 5: https://github.com/softprops/action-gh-release/tree/v2.0.6
- 6: https://stackoverflow.com/questions/76362343/creating-a-release-using-github-action-fails-with-http-403
Add explicit least-privilege permissions for GITHUB_TOKEN.
This workflow currently relies on default token permissions. Define minimal permissions globally and elevate only where needed (release job).
Proposed hardening
+permissions:
+ contents: read
+
jobs:
build-backend:
@@
create-release:
+ permissions:
+ contents: write
name: Create GitHub Release🧰 Tools
🪛 zizmor (1.25.2)
[warning] 122-122: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 117-171: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[error] 122-122: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 125-125: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 134-134: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 140-140: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 168-168: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 117 - 177, Add explicit
least-privilege permissions to the workflow to follow security best practices.
At the workflow root level (before the jobs section), define a global
permissions block with minimal permissions (typically read-only access like
contents: read). Then, in the create-release job which needs to create GitHub
releases, override with elevated permissions by adding a permissions block to
that specific job with the necessary permissions (such as contents: write) to
perform release operations. This ensures all jobs start with minimal permissions
and only the create-release job has the elevated access it requires.
Source: Linters/SAST tools
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/release.yml | grep -A 2 -B 2 "uses:"Repository: enerBydev/pickando-demo
Length of output: 1878
Pin all third-party GitHub Actions to full commit SHAs instead of version tags.
Using tag refs (@v4, @v3, @v2, @stable, etc.) leaves the workflow vulnerable to upstream tag retargeting and supply-chain drift attacks. Pin every uses: reference to an immutable commit SHA.
This applies to multiple actions throughout the file:
- Line 16, 35, 122, 180:
actions/checkout - Line 19, 38, 125:
dtolnay/rust-toolchain - Line 25, 112, 168:
actions/upload-artifact - Line 134:
actions/setup-java - Line 140:
android-actions/setup-android - Line 183:
actions/download-artifact - Line 188:
softprops/action-gh-release
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 122-122: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 122-122: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 122, Replace all third-party GitHub
Actions references in the release.yml file that currently use version tags with
their full commit SHA equivalents. For each action (actions/checkout,
dtolnay/rust-toolchain, actions/upload-artifact, actions/setup-java,
android-actions/setup-android, actions/download-artifact, and
softprops/action-gh-release), update the `uses:` directive from the current tag
format (e.g., `@v4`) to the immutable full commit SHA format to prevent
supply-chain vulnerabilities. Ensure every `uses:` statement across all workflow
jobs uses a pinned commit SHA instead of a floating tag reference.
Source: Linters/SAST tools
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/release.yml | sed -n '110,135p'Repository: enerBydev/pickando-demo
Length of output: 878
🏁 Script executed:
cat -n .github/workflows/release.yml | sed -n '170,190p'Repository: enerBydev/pickando-demo
Length of output: 779
🏁 Script executed:
cat -n .github/workflows/release.yml | head -50Repository: enerBydev/pickando-demo
Length of output: 1605
🏁 Script executed:
cat -n .github/workflows/release.yml | tail -20Repository: enerBydev/pickando-demo
Length of output: 1108
🏁 Script executed:
wc -l .github/workflows/release.ymlRepository: enerBydev/pickando-demo
Length of output: 101
🏁 Script executed:
cat -n .github/workflows/release.yml | sed -n '1,207p' | grep -E '(checkout|run:|git|push|token)'Repository: enerBydev/pickando-demo
Length of output: 836
🌐 Web query:
persist-credentials false GitHub Actions checkout security best practice
💡 Result:
In GitHub Actions, setting persist-credentials to false is considered a security best practice when you do not need to perform authenticated Git operations (such as git push) during your workflow [1][2]. The actions/checkout action defaults to true for the persist-credentials input [3][4]. When enabled, this action configures the local Git environment with the GITHUB_TOKEN (or provided SSH key) [3][2]. While newer versions of actions/checkout have improved security by storing these credentials in a separate file under $RUNNER_TEMP instead of directly in.git/config, keeping them persisted still allows any subsequent steps or third-party actions in the same job to potentially access and use these credentials [3][2][5]. By explicitly setting persist-credentials: false, you prevent the action from configuring Git with these credentials, which follows the principle of least privilege and reduces the risk of credential exposure if a workflow step is compromised [1][2]. Example of the recommended configuration: - uses: actions/checkout@v4 with: persist-credentials: false You should only omit this setting or set it to true if your workflow explicitly requires running authenticated Git commands, such as pushing commits back to your repository [2].
Citations:
- 1: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 2: https://actsense.dev/vulnerabilities/unsafe_checkout/
- 3: https://github.com/actions/checkout
- 4: https://github.com/actions/checkout/blob/main/action.yml
- 5: https://github.com/actions/checkout/tree/v6.0.2
Apply persist-credentials: false to all checkout steps.
This workflow does not perform authenticated Git operations after checkout, so credentials should not be persisted in the local Git config. Setting persist-credentials: false follows the principle of least privilege and reduces the risk of credential exposure if a workflow step is compromised (per OWASP GitHub Actions Security Cheat Sheet).
Suggested patch
- uses: actions/checkout@v4
+ with:
+ persist-credentials: falseThis applies to all four checkout steps in the workflow: lines 16, 35, 122, and 180.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 122-122: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 122-122: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 122, Add `persist-credentials: false`
to all four instances of the `actions/checkout@v4` step in the workflow to
prevent Git credentials from persisting in the local Git config. Since this
workflow does not perform any authenticated Git operations after checkout, this
change follows the principle of least privilege and reduces credential exposure
risk. Locate each checkout step using the actions/checkout@v4 identifier and add
the with clause containing persist-credentials: false to each one.
Source: Linters/SAST tools
| files: | | ||
| artifacts/pickando-backend-linux/pickando-backend | ||
| artifacts/pickando-android-apk/app-release.apk | ||
| artifacts/pickando-frontend-wasm/* | ||
| body: | |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat .github/workflows/release.yml | head -n 200 | tail -n 30Repository: enerBydev/pickando-demo
Length of output: 1048
🏁 Script executed:
# Let's also check if there are any WASM artifacts to understand the directory structure
fd pickando-frontend-wasm -type d 2>/dev/null || echo "No WASM directory found in repo (expected, as artifacts are generated)"Repository: enerBydev/pickando-demo
Length of output: 138
🏁 Script executed:
# Check the GitHub Actions documentation for glob pattern behavior
# by examining the workflow file more carefully
rg -A 20 'files:' .github/workflows/release.yml | head -n 40Repository: enerBydev/pickando-demo
Length of output: 909
🌐 Web query:
softprops/action-gh-release glob pattern matching behavior documentation
💡 Result:
The softprops/action-gh-release action uses glob pattern matching to identify files for release [1][2]. Its behavior and usage are documented as follows: Core Glob Behavior The files input accepts a newline-delimited list of glob expressions [1][3]. Patterns are resolved against the working_directory if provided; otherwise, they are resolved relative to the ${{ github.workspace }} directory [1][4]. Platform-Specific Considerations On Windows runners, the action accepts both forward slash (/) and backslash () as path separators in glob patterns [1][3]. It is recommended to use forward slashes for cross-platform consistency [5]. Handling Special Characters Because the files input is glob-based, filenames containing glob metacharacters (such as [ or ]) must be escaped in the pattern to be matched literally [1][2]. Home Directory Expansion The action supports the use of ~/ at the start of a pattern, which is expanded to the runner's home directory [1][3]. Unmatched Files If the fail_on_unmatched_files option is enabled, the action will fail if any provided glob pattern does not match at least one file [1][6]. Technical Implementation The action uses the Node.js glob library [7]. The working_directory support (introduced in v2.4.0) ensures that glob resolution, including the identification of unmatched patterns, correctly respects the specified base directory [7][4].
Citations:
- 1: https://github.com/softprops/action-gh-release/blob/master/README.md
- 2: https://github.com/softprops/action-gh-release
- 3: https://github.com/softprops/action-gh-release?tab=readme-ov-file
- 4: feat(action): respect working_directory for files globs softprops/action-gh-release#667
- 5: Pattern does not match any files softprops/action-gh-release#280
- 6: https://context7.com/softprops/action-gh-release/llms.txt
- 7: https://github.com/softprops/action-gh-release/blob/master/src/util.ts
🏁 Script executed:
# Check the actual build steps to see what files are generated in the WASM directory
rg -B 5 -A 5 'pickando-frontend-wasm' .github/workflows/release.ymlRepository: enerBydev/pickando-demo
Length of output: 1209
🏁 Script executed:
# Let's look at the complete workflow to see how the WASM artifact is generated
rg -B 10 -A 10 'build-wasm' .github/workflows/release.yml | head -n 50Repository: enerBydev/pickando-demo
Length of output: 1130
🏁 Script executed:
# Check what's in the dist directory that gets uploaded as WASM artifact
rg -B 5 -A 15 'name: Build WASM' .github/workflows/release.ymlRepository: enerBydev/pickando-demo
Length of output: 49
🏁 Script executed:
# Search for any references to assets directory in the WASM build
rg 'assets' .github/workflows/release.ymlRepository: enerBydev/pickando-demo
Length of output: 433
🏁 Script executed:
# Look at the frontend build configuration to understand output structure
find . -name 'Dioxus.toml' -o -name 'dioxus.toml' 2>/dev/null | head -5Repository: enerBydev/pickando-demo
Length of output: 97
🏁 Script executed:
# Check the complete WASM build step to see the full output structure
rg -B 2 -A 20 'Upload WASM artifacts' .github/workflows/release.ymlRepository: enerBydev/pickando-demo
Length of output: 638
🏁 Script executed:
# Look for index.html or other root files in the dist directory creation
rg 'dist/' .github/workflows/release.yml -B 2 -A 2Repository: enerBydev/pickando-demo
Length of output: 753
🏁 Script executed:
# Check Dioxus build output configuration
cat ./crates/frontend/Dioxus.tomlRepository: enerBydev/pickando-demo
Length of output: 444
Use a recursive WASM artifact glob in release files.
The pattern artifacts/pickando-frontend-wasm/* matches only top-level files (like index.html) but excludes files in the assets/ subdirectory. Since the build generates critical files—assets/pickando.js, assets/pickando_bg.wasm, and assets/main.css—these will be missing from the release. Use the recursive pattern to include all files:
Safer file pattern
files: |
artifacts/pickando-backend-linux/pickando-backend
artifacts/pickando-android-apk/app-release.apk
- artifacts/pickando-frontend-wasm/*
+ artifacts/pickando-frontend-wasm/**/*📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| files: | | |
| artifacts/pickando-backend-linux/pickando-backend | |
| artifacts/pickando-android-apk/app-release.apk | |
| artifacts/pickando-frontend-wasm/* | |
| body: | | |
| files: | | |
| artifacts/pickando-backend-linux/pickando-backend | |
| artifacts/pickando-android-apk/app-release.apk | |
| artifacts/pickando-frontend-wasm/**/* | |
| body: | |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 190 - 194, The glob pattern in
the files section for the pickando-frontend-wasm artifacts uses
`artifacts/pickando-frontend-wasm/*` which only matches top-level files and
excludes the `assets/` subdirectory containing critical files like pickando.js,
pickando_bg.wasm, and main.css. Change this pattern to use a recursive glob
pattern (e.g., `artifacts/pickando-frontend-wasm/**/*` or
`artifacts/pickando-frontend-wasm/**`) to include all files and subdirectories
in the release artifacts.
| div { class: "sidebar-brand", | ||
| span { class: "brand-icon", "P" } | ||
| span { "Pickando" } | ||
| } |
There was a problem hiding this comment.
Make the sidebar brand truly interactive (or non-clickable).
At Line 14-17, sidebar-brand is a plain div, but it’s styled as clickable in CSS (cursor: pointer), which is misleading and not keyboard-accessible. Use a semantic button/link with on_navigate.call(Page::Home), or remove clickable styling.
Suggested fix
- div { class: "sidebar-brand",
+ button {
+ class: "sidebar-brand",
+ onclick: move |_| on_navigate.call(Page::Home),
span { class: "brand-icon", "P" }
span { "Pickando" }
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| div { class: "sidebar-brand", | |
| span { class: "brand-icon", "P" } | |
| span { "Pickando" } | |
| } | |
| button { | |
| class: "sidebar-brand", | |
| onclick: move |_| on_navigate.call(Page::Home), | |
| span { class: "brand-icon", "P" } | |
| span { "Pickando" } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/frontend/src/components/dashboard.rs` around lines 14 - 17, The
sidebar-brand div element is styled to appear clickable with cursor: pointer but
lacks actual interactivity and keyboard accessibility. Convert the div with
class "sidebar-brand" containing the brand-icon span and "Pickando" text into a
semantic interactive element (such as a button or link) with proper on_navigate
event handling to navigate to Page::Home, or alternatively remove the cursor:
pointer styling from the CSS if the element should remain non-interactive. This
ensures the visual presentation matches the actual functionality and provides
proper keyboard navigation support.
| "Cerrar Sesion" | ||
| } |
There was a problem hiding this comment.
Normalize Spanish copy accents for production UI text.
Several visible strings are missing diacritics (e.g., “Sesion”, “Aqui”, “direccion”, “todavia”, “Calificacion”, “informacion”, “estadisticas”, “ubicacion”). This creates inconsistent UX copy quality.
Also applies to: 54-55, 98-99, 108-109, 155-156, 174-175, 189-190
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/frontend/src/components/dashboard.rs` around lines 43 - 44, Spanish UI
text strings in the dashboard component are missing proper diacritical marks,
reducing copy quality. Locate and update all Spanish language strings to include
correct accents: "Cerrar Sesion" should be "Cerrar Sesión", "Aqui" should be
"Aquí", "direccion" should be "dirección", "todavia" should be "todavía",
"Calificacion" should be "Calificación", "informacion" should be "información",
"estadisticas" should be "estadísticas", and "ubicacion" should be "ubicación".
Search the entire dashboard component for these misspelled strings and replace
them with their correctly accented Spanish equivalents.
1 participant
Changes
New Features
CSS Fixes
Bug Fixes
Documentation
Addresses
Summary by CodeRabbit
New Features
Style