ci(release): 显式 strip macOS bundle xattr (defense-in-depth)

[appergb]

防御性步骤：在 macOS 产物 upload 之前 xattr -cr 一次。GitHub Actions 输出本来就不带 quarantine，但显式声明让 "云端 artifact 一定干净" 变成可验证承诺。

Summary by Sourcery

CI:

• Add a macOS-only step in the Tauri release workflow to strip extended attributes and quarantine flags from .app and .dmg artifacts before upload.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adds a defensive CI step in the Tauri release workflow to strip extended attributes (including com.apple.quarantine) from macOS bundles before uploading them as artifacts, ensuring uploaded artifacts are verifiably clean.

Sequence diagram for macOS bundle xattr stripping before artifact upload

sequenceDiagram
  participant WF as Workflow
  participant R as Actions_runner_macos
  participant X as xattr_tool
  participant FS as macOS_filesystem
  participant A as GitHub_Artifacts

  WF->>R: Execute job for matrix.platform == macos-latest
  R->>R: Build macOS bundles
  R->>FS: List bundle directories (ls macos/ dmg/ ...)

  WF->>R: Run Strip xattr / quarantine step
  loop For each path in macos/*.app and dmg/*.dmg
    R->>FS: Check if path exists
    alt Path exists
      R->>X: xattr -cr path
      X->>FS: Clear extended attributes
      R->>X: xattr -lr path
      X->>R: List remaining attributes (for logging)
    else Path does not exist
      R-->>R: Skip path
    end
  end

  WF->>R: Run Upload macOS artifacts step
  R->>A: Upload sanitized .app and .dmg bundles

Loading

Flow diagram for new macOS xattr stripping step in release workflow

flowchart TD
  A["Build macOS bundles"] --> B["List bundle directories (ls macos/ dmg/ ...)"]
  B --> C["Strip xattr / quarantine on macOS bundles (macos-latest only)"]
  C --> D["Upload macOS artifacts via actions/upload-artifact"]

  subgraph Strip_xattr_step
    C1["Loop over macos/*.app"]
    C2["Loop over dmg/*.dmg"]
    C3["For each existing path: xattr -cr path"]
    C4["Then: xattr -lr path (log remaining attributes)"]

    C --> C1
    C1 --> C3
    C --> C2
    C2 --> C3
    C3 --> C4
  end

Loading

File-Level Changes

Change	Details	Files
Add a macOS-only CI step to recursively clear and then list extended attributes on .app and .dmg bundles before artifact upload.	Introduce a bash step conditioned on matrix.platform == 'macos-latest' in the release workflow. Run a loop over macOS bundle output directories (macos/.app and dmg/.dmg), skipping non-existent paths gracefully. For each existing bundle, invoke xattr -cr to strip all extended attributes, ignoring failures, and then xattr -lr to log remaining attributes for auditability. Place the stripping step immediately before the macOS artifact upload step so that uploaded artifacts are guaranteed to be post-processed.	.github/workflows/release-tauri.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider using xattr -d com.apple.quarantine (or a targeted attribute list) instead of xattr -cr, so you only remove the quarantine flag and avoid unintentionally stripping other extended attributes that might be meaningful (e.g., for signing or metadata).
• Right now both xattr invocations are suffixed with || true, which will hide any unexpected failures; if the intent is defense-in-depth, you might want to at least log non-zero exit codes or only ignore specific, benign failures (like "No such xattr").

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider using `xattr -d com.apple.quarantine` (or a targeted attribute list) instead of `xattr -cr`, so you only remove the quarantine flag and avoid unintentionally stripping other extended attributes that might be meaningful (e.g., for signing or metadata).
- Right now both `xattr` invocations are suffixed with `|| true`, which will hide any unexpected failures; if the intent is defense-in-depth, you might want to at least log non-zero exit codes or only ignore specific, benign failures (like "No such xattr").

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}