Repository navigation
Macos runner - #54
Merged
Merged
Macos runner#54
Conversation
Nightly govulncheck has failed since 2026-10-09. go.mod pinned go 1.26.6 and the workflow builds with that version, so twelve reachable stdlib vulns fail the scan: x509 distrust of compromised intermediates (fixed in 1.26.10), plus HTTP/2, HTTP/1 CONNECT, TLS ECH and textproto fixes (1.26.9). Release binaries ship those same bugs, so this isn't only a scan problem. x/net goes to v0.60.0 because it carries its own copy of the HTTP/2 bugs. The CI matrix floor moves with go.mod. Left at 1.26.6, GOTOOLCHAIN=auto would quietly download 1.26.10 and the job label would lie about what it tested. Revisit when the next stdlib security release lands. Same bump.
Linux CI never compiles the darwin-only files (claude_desktop_darwin.go), so a break there first shows up in the release job, after the tag is cut. Releases build on macos-latest, so that's the platform that needs a gate. Kept as its own workflow instead of an os axis on ci-linux.yaml. Folding them together renames the existing Linux check, which breaks any branch protection that requires it by name. Revisit when the two drift enough to justify a shared reusable workflow, or when branch protection is set up fresh.
macOS CI runs the hook test under the system bash 3.2, where a failing [[ ]] does not trip set -e. The fake codesign and notarytool kept going after their injected failure, so the signing failure and notary failure cases saw a clean exit and the test reported the hook as broken. Built bash 3.2.57 here and reproduced both failures; || exit 1 holds on 3.2 and 5.2 alike. sign-macos.sh itself uses no [[ ]], so the shipped hook was never affected.
On darwin os.UserConfigDir reads only HOME, so tests that set just XDG_CONFIG_HOME all shared the one directory TestMain made. State left by a destroy test made TestDestroySkipsABridgeThatNeverStarted see a machine, and the read-only settings test chmodded an XDG path that was never written. The existing isolateConfig helper had the same gap; it now sets HOME and returns the directory os.UserConfigDir resolves, and every bridges test goes through it. Other packages still isolate with XDG_CONFIG_HOME alone but pass on macOS today; they would want the same treatment if they start colliding.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add mac os runner to PR checks.