fix(build): repair macOS signing and enable release recovery - #422
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8cfeb1b5ef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const production = lock => Object.fromEntries( | ||
| Object.entries(lock.packages).filter(([name, pkg]) => name && !pkg.dev) | ||
| ) | ||
| assert.deepEqual(production(recoveryLock), production(releasedLock), 'Production dependencies must stay unchanged') |
There was a problem hiding this comment.
When source_ref changes only lockfile resolutions for another dev dependency, this comparison ignores the changes because every package marked dev is removed. That includes Electron and build tools such as electron-vite/Vite, so the recovery workflow can pass validation and publish binaries built with a different runtime or toolchain even though it promises that only electron-builder may change. Validate the complete lockfile while allowing only electron-builder and its dependency closure, or restrict recovery to an explicitly approved lockfile.
Useful? React with 👍 / 👎.
1 participant
macOS releases v2.7.0 and v2.8.0 fail when electron-builder passes the certificate password to the temporary signing keychain. Upgrade electron-builder to 26.16.1, which includes the upstream keychain-password fix, and update the lockfile without changing production dependencies.
Add a manual macOS recovery workflow for an existing latest release. It verifies the source is descended from the release tag, rejects application and production-dependency changes, tests the recovery checkout, signs and notarizes both architectures, and verifies all nine macOS release assets. This lets us repair v2.8.0 without moving its tag or including later application changes.
Validation: npm ci, npm run check (137 files / 2,688 tests), npm run build, workflow YAML parsing and bash syntax checks, and git diff --check passed. The separate v2.8.0 recovery checkout passed npm ci, 132 files / 2,633 tests, build, and npm 11.4.2 frozen-lockfile dry run. Actual macOS signing and notarization will be verified through the recovery workflow after merge.
Upstream fix: electron-userland/electron-builder#10172