feat(webview2): port generator overhaul, generated tests and examples to v3/internal/webview2#5768
Open
taliesin-ai wants to merge 3 commits into
Open
feat(webview2): port generator overhaul, generated tests and examples to v3/internal/webview2#5768taliesin-ai wants to merge 3 commits into
taliesin-ai wants to merge 3 commits into
Conversation
… to v3/internal/webview2 Realigns the feat/webview2-v2-clean work with the fold (#5711): the binding now lives inside the v3 module, so the /v2 module strategy is dropped (no go.mod, no tags — versions with v3 itself). - scripts/: replace the generator with the overhauled webview2gen pipeline (download/generate/capabilities/changelog/latest/verify/full subcommands, incremental generation, internal idl/notes/capabilities/idlversion packages) at 100% test coverage. - pkg/webview2/: regenerate from SDK 1.0.3967.48 with the ABI fixes (inherited vtbl slots, per-arch by-value doubles/aggregates, QI helpers on the right types, LPWSTR**/array marshalling, 24-byte VARIANT, BOOL struct layout) plus 267 generated *_gen_test.go files (1020 hermetic tests) and a live smoke test. The putdouble/putrect helper files are superseded by inlined compile-time arch switches in the generated code. - pkg/edge/, webviewloader/, combridge/: untouched — all runtime fixes that landed on master (#5734, #5741, #5658, #5597, #5568) are preserved; the generated bindings subsume #5741's by-value double handling. - _examples/: minimal, interactive (12 code-kind PASS/FAIL checklist) and kitchensink (17-feature interactive control panel), all verified on real Windows. - docs: README/ARCHITECTURE/CHANGELOG rewritten for the folded layout. - CI: webview2-verify.yml (hermetic + live Windows jobs, regeneration determinism gate) and webview2-update.yml (weekly SDK-update PRs) at the new paths; release machinery stays retired (#5748). Validated: webview2gen verify reports 587 files byte-identical; scripts suite green; v3 cross-builds for windows/amd64+arm64+386; full generated suite PASS on win-node1 (amd64 + native 386); live environment round-trip via the generated binding returned runtime 149.0.4022.98.
Contributor
|
Important Review skippedToo many files! This PR contains 653 files, which is 503 over the limit of 150. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (653)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
Documentation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+15
to
+50
| runs-on: ubuntu-latest | ||
| env: | ||
| GOWORK: "off" | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: '1.24' | ||
|
|
||
| - name: Generator tests | ||
| working-directory: v3/internal/webview2/scripts | ||
| run: go test -race ./... | ||
|
|
||
| - name: Verify generated bindings are up to date | ||
| working-directory: v3/internal/webview2/scripts | ||
| run: | | ||
| go run ./cmd/webview2gen verify | ||
| # capabilities.go is also generator-output; regenerate it from the | ||
| # cached release-notes snapshot and fail if it changes. | ||
| go run ./cmd/webview2gen capabilities --source test.md | ||
| if ! git diff --exit-code -- ../pkg/webview2/capabilities.go; then | ||
| echo "::error::pkg/webview2/capabilities.go is out of date — run 'webview2gen capabilities'" | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Cross-compile generated bindings + tests for Windows | ||
| working-directory: v3 | ||
| run: | | ||
| GOOS=windows GOARCH=amd64 go vet ./internal/webview2/pkg/webview2/ | ||
| GOOS=windows GOARCH=arm64 go vet ./internal/webview2/pkg/webview2/ | ||
| GOOS=windows GOARCH=386 go vet ./internal/webview2/pkg/webview2/ | ||
|
|
||
| test-windows: |
Comment on lines
+51
to
+100
| runs-on: windows-latest | ||
| env: | ||
| GOWORK: "off" | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: '1.24' | ||
| cache-dependency-path: | | ||
| v3/internal/webview2/scripts/go.sum | ||
| v3/go.sum | ||
|
|
||
| - name: Generator tests | ||
| working-directory: v3/internal/webview2/scripts | ||
| shell: bash | ||
| run: go test -race ./... | ||
|
|
||
| - name: Binding + generated binding tests (amd64) | ||
| working-directory: v3 | ||
| shell: bash | ||
| run: | | ||
| go build ./internal/webview2/... | ||
| go test ./internal/webview2/... | ||
|
|
||
| # Live smoke test: create a real CoreWebView2 environment and call a | ||
| # generated binding (GetBrowserVersionString) through the live vtable. | ||
| # This is the only layer that proves the generator's ABI model matches | ||
| # Microsoft's actual DLL; it is opt-in (WEBVIEW2_LIVE=1) because it spawns | ||
| # a browser process and pumps a message loop. windows-latest ships the | ||
| # Evergreen runtime preinstalled, so the environment can be created. | ||
| - name: Live WebView2 environment smoke test (amd64) | ||
| working-directory: v3 | ||
| shell: bash | ||
| timeout-minutes: 3 | ||
| env: | ||
| WEBVIEW2_LIVE: "1" | ||
| run: go test -v -run TestLiveEnvironmentCreation ./internal/webview2/pkg/webview2/ | ||
|
|
||
| # Windows runs 32-bit binaries natively, so the 386 marshalling | ||
| # branches (two-word doubles/tokens, four-word RECTs) are executed | ||
| # for real here, not just compiled. | ||
| - name: Generated binding tests (386) | ||
| working-directory: v3 | ||
| shell: bash | ||
| env: | ||
| GOARCH: "386" | ||
| run: go test ./internal/webview2/pkg/webview2/ |
![semgrep-code-wailsapp[bot]](https://avatars.githubusercontent.com/u/39746503?s=60&v=4){kind=small}
|
|
||
| func fetchOne(url string) ([]byte, error) { | ||
| client := &http.Client{Timeout: FetchTimeout} | ||
| resp, err := client.Get(url) |
There was a problem hiding this comment.
Medium severity and reachable issue identified in your code:
Line 82 has a vulnerable usage of golang.org/x/net, introducing a medium severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of golang.org/x/net.
Affected versions of golang.org/x/net, golang.org/x/net/http2, and net/http are vulnerable to Uncontrolled Resource Consumption. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
To resolve this comment:
Upgrade this dependency to at least version 0.23.0 at v3/internal/webview2/scripts/go.mod.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| } | ||
|
|
||
| url := fmt.Sprintf(NuGetPackageURL, version) | ||
| resp, err := f.HTTPClient.Get(url) |
There was a problem hiding this comment.
Medium severity and reachable issue identified in your code:
Line 107 has a vulnerable usage of golang.org/x/net, introducing a medium severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of golang.org/x/net.
Affected versions of golang.org/x/net, golang.org/x/net/http2, and net/http are vulnerable to Uncontrolled Resource Consumption. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.
To resolve this comment:
Upgrade this dependency to at least version 0.23.0 at v3/internal/webview2/scripts/go.mod.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
The amd64 test step ran 'go test ./internal/webview2/...', which swept in pkg/edge's real-WebView2 integration tests (TestCookieManager). Those need an interactive environment — TestCookieManager CoInitializes without locking the OS thread, so a goroutine migration mid-test yields 'CoInitialize has not been called' and the test hangs to the 10m timeout. That package is already covered by the main v3 CI (build-and-test-v3.yml). Test only pkg/webview2 here (matching the 386 and live-smoke steps); keep the broad 'go build' for compile coverage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ports the WebView2 binding-generator overhaul onto the folded layout at
v3/internal/webview2(following #5711). The overhaul was previously staged as a standalone/v2module onfeat/webview2-v2-clean; that module strategy is now obsolete, so this drops it entirely — nogo.mod, no tags, versions with v3 itself.Scope — dormant by design
The generated
pkg/webview2package has no production importer. The v3 runtime still drives WebView2 exclusively through the hand-maintainedpkg/edge+webviewloader(untouched by this PR). Merging therefore changes zero runtime behavior — it lands the generator + tested bindings so a follow-up PR can migratechromium.goonto them. That migration is tracked separately.All runtime fixes already on master are preserved: #5734 (mixed-DPI), #5658 (transient COM recovery), #5597 (non-fatal SetSize/PutBounds), #5568 (Focus guard) live in
pkg/edgeand are not touched. The by-value-double ABI fix #5741 is subsumed structurally by the generator (generated bindings are correct by construction).Contents
scripts/— overhauledwebview2genpipeline (download/generate/capabilities/changelog/latest/verify/full), incremental generation, internal idl/notes/capabilities/idlversion packages, at 100% test coverage.pkg/webview2/— regenerated from SDK 1.0.3967.48 with the ABI fixes (inherited vtbl slots, per-arch by-value doubles/aggregates, QI helpers on the right types, LPWSTR**/array marshalling, 24-byte VARIANT, BOOL struct layout) plus 1,020+ generated hermetic tests and a live smoke test._examples/— minimal, interactive (12 code-kind PASS/FAIL checklist), kitchensink (17-feature interactive control panel).webview2-verify.yml(hermetic + live Windows jobs + regeneration-determinism gate) andwebview2-update.yml(weekly SDK-update PRs) at the new paths. Release machinery stays retired (ci: retire webview2 release machinery after the fold #5748).Validation
webview2gen verify: 587 files byte-identical to committed output.149.0.4022.98.