Repository navigation
bug(release): production dependency audit blocks macOS release builds #965
Description
Activity
Confirmed in CI: run 34739188324 on
d12cd347passed install, type-check, Workflow MCP tests and the integration/renderer tests onmacos-latest, then failed at Audit production dependencies with8 vulnerabilities (6 moderate, 2 high), exit code 1.package-macoswas skipped. Fix: #966.- added a commit that references this issue
on Sep 13, 2026 Second blocker, found once the audit passed on the fix branch. Run 34739476044 passed type-check, tests, audit, runtime-tool preparation and the app build, then
Package macOS artifactsfailed with⨯ /Users/runner/work/agent-code/agent-code not a file.Cause:
release.ymlpasses${{ secrets.CSC_LINK }}, which is""when the secret is missing. electron-builder'sgetCscLinkaccepts an empty string as a set value and resolves it as a certificate path (the repo root).scripts/package-mac.mjschose the unsigned branch but left the empty variable in the child env. Fixed in #966 by deleting emptyCSC_LINK/CSC_NAME/CSC_KEY_PASSWORDfirst.- added a commit that references this issue
on Sep 13, 2026 Third blocker, found once packaging ran. Run 34739982565 built both
.appbundles, thenverify-packaged-macfailed withrequired packaged executable missing or not executable: …/out/main/runtime/hotkey-helper/AgentCodeDictationHotkeyHelper.Cause:
build-apphandsout/topackage-macosthroughactions/upload-artifact, which zips without file modes (every file comes back644, per its README). The hotkey helper, and the bundledtmux/cloudflared/mitmproxybinaries behind it, lose the execute bit before packaging. Fixed in #966:out/is now uploaded as a tar and unpacked inpackage-macos.With all three fixes in #966, release run 34740689235 (
980865b6,publish_release=false, unsigned) succeeds end to end:- Type-check, tests and the production audit pass; runtime tools are prepared and the app builds.
- arm64 and x64
.dmg/.zipare packaged. verify-packaged-macreports OK for both architectures, and[packaging-smoke] OK arm64 0.0.2-beta.1.- The
macos-unsigned-devartifact is uploaded.
Signing and notarization remain untested until the Developer ID secrets exist.
Expected
Release macOS App(.github/workflows/release.yml), dispatched onmainwithpublish_release=false, runs through to packaging and produces the arm64 and x64.dmg/.zipartifacts. This is the gate before signing and notarization can be tested with the new Apple Developer account.Actual
The
build-appjob's Audit production dependencies step (npm run audit:production=npm audit --omit=dev --audit-level=high) exits 1 againstmain's lockfile. The step runs before Prepare bundled runtime tools, Build app and the wholepackage-macosjob, so no packaging, structural verification or smoke test runs.Two high advisories, both in transitive production dependencies with in-range fixes:
fast-uriajv@8.20.0(^3.0.1)ip-addressexpress-rate-limit@8.5.2(^10.2.0)The same audit also reports moderate advisories in
hono,@hono/node-serverandqs, all with in-range fixes. These do not fail the gate.Reproduction / evidence
git show origin/main:package.jsonandgit show origin/main:package-lock.json(atd12cd347) into an empty directory, thennpm audit --omit=dev --audit-level=high --package-lock-only: exit 1, summary{"moderate":6,"high":2}.d12cd347for this test is https://github.com/Juliusolsson05/agent-code/actions/runs/34739188324.ci.ymldoes not run the audit, which is whymainstays green.Impact
main, so the first signed and notarized build (and the planned nightly releases) is blocked.Environment
GitHub Actions
macos-latest, Node 24,npm ci --include=dev, commitd12cd347.