Repository navigation
Harden Mac artifact acceptance and pause Windows downloads - #15
Merged
Merged
Conversation
🚀 Deploying Preview to Cloudflare 🚀Preview Deployments by commit
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Mac release previously passed CI while relying on the build checkout. Add a required macos-acceptance job on macOS 26 ARM64 that downloads the exact DMG and a precompiled test kit, with no source checkout or tool installation. It checks the installed bundle and runs connector/agent/lifecycle tests, then launches an unchanged release-identity app through LaunchServices in a disposable hosted account. Local smoke tests retain isolated identities.
Audit bundle resources, permissions, symlinks, ARM64 slices, macOS 14 deployment requirements and native library references. Remove the Swift development-toolchain run path before signing and record build inputs. Select Python wheels for macOS 14 and build dependencies with the same target; this caught caio selecting a macOS 26-only wheel on a newer build host.
Pause Windows promotion on the homepage/download page (including no-JavaScript rendering); retain Windows code, CI, and archived assets. Shared backend behavior is unchanged.
Validation: 23 desktop policy/audit tests, 15 website tests, and website build pass. Fresh DMG build passes the new audit. The standalone kit passed locally from temporary storage: installed backend startup, connector discovery, real agent call, permissions, restart/persistence, native window close/reopen, shutdown, and signature checks. GitHub Mac build and the separate artifact-only acceptance job passed on macOS 26 ARM64. The latter confirms app.umbod.desktop identity, unchanged signatures, LaunchServices startup, real connector/agent calls, restart/persistence and window lifecycle with no source checkout. All GitHub checks passed, including Windows and the Cloudflare website preview. Shared Semgrep retains 33 pre-existing findings. Browser visual verification is unavailable because the computer-use connection failed. Browser/quarantine first-launch remains an explicitly documented manual rehearsal; CI does not claim Gatekeeper approval or macOS 14 runtime verification.