From 933dfb1480c9e00f887035f3def2cbf48dc64a15 Mon Sep 17 00:00:00 2001 From: Colin Adler Date: Sun, 6 Sep 2026 15:03:16 -0500 Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=A4=96=20fix:=20allow=20macOS=20build?= =?UTF-8?q?s=20without=20signing=20credentials?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Default optional CSC_LINK to an empty string under strict Bash mode. Generated with xum • Model: GPT-6 • Thinking: unknown • Cost: unknown --- Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 23033945f09..3ad3fe2327a 100644 --- a/Makefile +++ b/Makefile @@ -494,7 +494,8 @@ ensure-mac-sharp-runtime-deps: node_modules/.installed dist-mac: build ## Build macOS distributables (x64 + arm64) @$(MAKE) --no-print-directory ensure-mac-sharp-runtime-deps - @if [ -n "$$CSC_LINK" ]; then \ + @# Local builds may omit signing credentials; keep the check safe under bash -u. + @if [ -n "$${CSC_LINK:-}" ]; then \ echo "🔐 Code signing enabled - using unified build for correct yml..."; \ bun x electron-builder --mac --x64 --arm64 --publish never; \ else \ From 28792b6dff8bf70aadc42d670d3a40ecc4ee59e5 Mon Sep 17 00:00:00 2001 From: Colin Adler Date: Sun, 6 Sep 2026 15:22:55 -0500 Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=A4=96=20fix:=20require=20code=20sign?= =?UTF-8?q?ing=20for=20official=20macOS=20releases?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Allow unsigned local builds while enforcing Electron Builder forceCodeSigning in the release workflow. Generated with xum • Model: GPT-6 • Thinking: unknown • Cost: unknown --- .github/workflows/_desktop-release.yml | 3 +++ Makefile | 8 +++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/_desktop-release.yml b/.github/workflows/_desktop-release.yml index 4557393a09b..654c35b4ff7 100644 --- a/.github/workflows/_desktop-release.yml +++ b/.github/workflows/_desktop-release.yml @@ -59,6 +59,9 @@ jobs: - name: Package for macOS # Retry for transient Apple timestamp-server failures during code signing. run: ./scripts/retry.sh 3 30 make dist-mac + env: + # Local/PR builds may be unsigned, but official releases must fail without signing. + MAC_FORCE_CODE_SIGNING: "true" - name: Create legacy mux artifact aliases run: ./scripts/create-legacy-mux-artifact-aliases.sh diff --git a/Makefile b/Makefile index 3ad3fe2327a..7929889ced4 100644 --- a/Makefile +++ b/Makefile @@ -470,6 +470,8 @@ test-e2e-perf: ## Run automated performance profiling scenarios @XUM_E2E_RUN_PERF=1 XUM_PROFILE_REACT=1 XUM_E2E_LOAD_DIST=1 XUM_E2E_SKIP_BUILD=1 PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 bun x playwright test --project=electron tests/e2e/scenarios/perf*.spec.ts $(PLAYWRIGHT_ARGS) ## Distribution +MAC_FORCE_CODE_SIGNING ?= false + dist: build ## Build distributable packages @bun x electron-builder --publish never @@ -497,11 +499,11 @@ dist-mac: build ## Build macOS distributables (x64 + arm64) @# Local builds may omit signing credentials; keep the check safe under bash -u. @if [ -n "$${CSC_LINK:-}" ]; then \ echo "🔐 Code signing enabled - using unified build for correct yml..."; \ - bun x electron-builder --mac --x64 --arm64 --publish never; \ + bun x electron-builder --mac --x64 --arm64 --publish never --config.forceCodeSigning=$(MAC_FORCE_CODE_SIGNING); \ else \ echo "Building macOS architectures in parallel..."; \ - bun x electron-builder --mac --x64 --publish never & pid1=$$! ; \ - bun x electron-builder --mac --arm64 --publish never & pid2=$$! ; \ + bun x electron-builder --mac --x64 --publish never --config.forceCodeSigning=$(MAC_FORCE_CODE_SIGNING) & pid1=$$! ; \ + bun x electron-builder --mac --arm64 --publish never --config.forceCodeSigning=$(MAC_FORCE_CODE_SIGNING) & pid2=$$! ; \ wait $$pid1 && wait $$pid2; \ fi @echo "✅ Both architectures built successfully" From cbd78825998b5850b2d6d17074e4b2ccff279417 Mon Sep 17 00:00:00 2001 From: Colin Adler Date: Sun, 6 Sep 2026 15:25:21 -0500 Subject: [PATCH 3/3] =?UTF-8?q?=F0=9F=A4=96=20fix:=20exclude=20Codex=20sta?= =?UTF-8?q?tus=20summaries=20from=20unresolved=20findings?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Continue blocking substantive comments and unresolved review threads while ignoring bot status metadata. Generated with xum • Model: GPT-6 • Thinking: unknown • Cost: unknown --- scripts/check_codex_comments.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/check_codex_comments.sh b/scripts/check_codex_comments.sh index 20af90f4986..c9b7f2d44d5 100755 --- a/scripts/check_codex_comments.sh +++ b/scripts/check_codex_comments.sh @@ -83,9 +83,11 @@ compute_codex_sets_from_arrays() { # JSON goes through stdin, never argv: a long review history exceeds Linux's # per-argument limit (MAX_ARG_STRLEN, ~128KB) and made --argjson fail with # "Argument list too long". printf is a shell builtin, so it has no such limit. + # The bot's live status summary is metadata; its findings are gated by review threads below. REGULAR_COMMENTS=$(printf '%s' "$comments_json" | jq -c --arg bot "$BOT_LOGIN_GRAPHQL" '[ .[] | select(.author.login == $bot and .isMinimized == false and (.body | test("Didn.t find any major issues|usage limits have been reached|create a Codex account") | not)) + | select(.body | startswith("") | not) ]') UNRESOLVED_THREADS=$(printf '%s' "$threads_json" | jq -c --arg bot "$BOT_LOGIN_GRAPHQL" '[