🤖 fix: allow local macOS builds and require signing for releases - #4110
🤖 fix: allow local macOS builds and require signing for releases#4110coadler wants to merge 3 commits into
Conversation
Default optional CSC_LINK to an empty string under strict Bash mode. Generated with xum • Model: GPT-6 • Thinking: unknown • Cost: unknown <!-- mux-attribution: model=GPT-6 thinking=unknown costs=unknown -->
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 933dfb1480
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
The intended scope is to restore the existing unsigned local-build branch: unset The security finding correctly identifies a broader release-policy concern because Separately, the Codex Comments CI job currently treats the bot's review-summary/status comment as unresolved feedback. Local |
Allow unsigned local builds while enforcing Electron Builder forceCodeSigning in the release workflow. Generated with xum • Model: GPT-6 • Thinking: unknown • Cost: unknown <!-- mux-attribution: model=GPT-6 thinking=unknown costs=unknown -->
coadler
changed the title
|
@codex review |
Continue blocking substantive comments and unresolved review threads while ignoring bot status metadata. Generated with xum • Model: GPT-6 • Thinking: unknown • Cost: unknown <!-- mux-attribution: model=GPT-6 thinking=unknown costs=unknown -->
1 participant
bun run dist:macfailed withbash: CSC_LINK: unbound variablewhen signing credentials were unset because Make runs Bash with-u. Default the optional variable to an empty string so local builds reach the existing parallel packaging path.Official nightly/release CI sets
MAC_FORCE_CODE_SIGNING=true, which passes Electron Builder's--config.forceCodeSigning=trueto both packaging paths. Missing signing identities then fail packaging before release uploads; local and PR builds default to optional signing.Validation:
make static-checkpassed. The original local build completed for Intel and Apple Silicon DMG/ZIP artifacts. Exercised Electron Builder's installed macOS signing implementation: a missing identity permits optional signing but rejects required signing. Verified the Make recipe forwards the required-signing flag to both architectures and the unified signed path.Generated with
xum• Model:GPT-6• Thinking:unknown• Cost:unknown