ci(desktop): gate PRs on the packaged macOS app actually launching - #3472
Open
benjaminshafii wants to merge 1 commit into
Open
ci(desktop): gate PRs on the packaged macOS app actually launching#3472benjaminshafii wants to merge 1 commit into
benjaminshafii wants to merge 1 commit into
Conversation
The Electron 41 revert exposed a hole: adding the restricted keychain-access-groups entitlement made the signed app die at exec with AMFI SIGKILL (exit 137) before any JS ran, while every check went green. ci-tests.yml runs on macos-14 but never packages or launches Electron, and the signed build only runs on push to dev — after merge. Ad-hoc signing reproduces the failure with no Developer ID and no notarization, so this gate needs no secrets and works on fork PRs: package, ad-hoc sign with the real entitlements, launch, require the process to survive 10s. On failure it prints the exit signal and the AMFI log lines naming the cause. Verified both directions locally: passes on dev's entitlements, and fails with exit 137 when the keychain entitlement is restored.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the hole that let the Electron 41 revert happen.
What went wrong
Adding the restricted
keychain-access-groupsentitlement made the signed app fail to launch — macOS AMFI killed it at exec:codesign --verify,spctlandstapler validateall passed. Signing succeeded; runtime entitlement authorization failed. So no build-time check could see it.Why every check was green
evals/specs(Daytona)ci-tests.ymlonmacos-14pnpm devpush: dev, i.e. after mergeNothing in the pipeline ever launched the artifact a user receives, before merge.
build-electron-desktop.ymlcan sign+notarize but only triggers onworkflow_dispatchor a branch namedelectron-notary-test— never on PRs.Also worth noting: the test added alongside that entitlement asserted the plist contained the keychain group. It tested shape, never effect — the more correctly the fatal entitlement was wired, the greener it went.
The gate
.github/workflows/ci-macos-packaged-launch.yml+apps/desktop/scripts/macos-launch-gate.sh: package the app, ad-hoc sign it with the repo's real entitlements plist, launch it, require it to survive 10s.Key point: ad-hoc signing reproduces the failure, so this needs no Developer ID cert, no notarization, and no repository secrets — it works on fork PRs and stays fast.
entitlements*.plist,electron-builder*.yml,apps/desktop/electron/**, packaging scripts, lockfile)Verified both directions locally
dev's current entitlementskeychain-access-groupsentitlement restoredRestricted entitlements not validated(31s)Entitlement reverted afterwards. Electron stays on 35 — this PR is the gate only, no re-land.
Also green:
pnpm --filter @openwork/desktop test(174 passed, 1 skipped),actionlint,bash -n.What this does NOT catch
Developer ID credential problems, provisioning-profile correctness, notarization/stapling/Gatekeeper failures, non-arm64 architectures, and anything that only breaks after the 10s window. It catches launch-blocking entitlement and startup-crash regressions — the class that just bit us.