Add OS-level sandbox execution for bash and code-exec (CLI + desktop) #118
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Desktop App | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths: | |
| - "packages/**" | |
| pull_request: | |
| branches: [ main ] | |
| paths: | |
| - "packages/**" | |
| workflow_dispatch: | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Audit production dependencies | |
| # GHSA-w5hq-g745-h8pq is a buffer-bounds issue in `uuid`'s v3/v5/v6 | |
| # functions when called with a `buf` argument. Our only `uuid` | |
| # consumer is `mermaid`, which uses `v4` (random IDs) for diagram | |
| # instance ids and never passes a user-controlled buffer, so this | |
| # advisory does not apply to us. The advisory is fixed only in | |
| # uuid >=14.0.0, but mermaid pins `uuid: ^11.1.0` — forcing uuid | |
| # to 14 via overrides breaks `electron-builder`'s manual | |
| # node_modules traversal (it can no longer satisfy mermaid's | |
| # declared dependency range), so we ignore the advisory instead. | |
| # Re-evaluate when mermaid widens its uuid range. | |
| run: bun audit --prod --ignore=GHSA-w5hq-g745-h8pq | |
| - name: Lint (CLI) | |
| run: bun run --filter @ouroboros/cli lint | |
| - name: Typecheck (CLI) | |
| run: bun run --filter @ouroboros/cli ts-check | |
| - name: Typecheck (desktop) | |
| run: bun run --filter @ouroboros/desktop ts-check | |
| - name: Unit + integration tests (CLI) | |
| run: bun run --filter @ouroboros/cli test | |
| - name: Build CLI binary (for desktop E2E) | |
| working-directory: packages/desktop | |
| run: bash scripts/build-cli.sh | |
| - name: Build desktop bundles (for E2E) | |
| working-directory: packages/desktop | |
| run: bun run build:vite | |
| - name: Desktop E2E (Playwright + Electron) | |
| working-directory: packages/desktop | |
| run: xvfb-run --auto-servernum bun run test:e2e | |
| - name: Upload Playwright test-results on failure | |
| if: failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: playwright-test-results | |
| path: packages/desktop/test-results/ | |
| if-no-files-found: ignore | |
| retention-days: 7 | |
| build: | |
| needs: verify | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Audit production dependencies | |
| # GHSA-w5hq-g745-h8pq is a buffer-bounds issue in `uuid`'s v3/v5/v6 | |
| # functions when called with a `buf` argument. Our only `uuid` | |
| # consumer is `mermaid`, which uses `v4` (random IDs) for diagram | |
| # instance ids and never passes a user-controlled buffer, so this | |
| # advisory does not apply to us. The advisory is fixed only in | |
| # uuid >=14.0.0, but mermaid pins `uuid: ^11.1.0` — forcing uuid | |
| # to 14 via overrides breaks `electron-builder`'s manual | |
| # node_modules traversal (it can no longer satisfy mermaid's | |
| # declared dependency range), so we ignore the advisory instead. | |
| # Re-evaluate when mermaid widens its uuid range. | |
| run: bun audit --prod --ignore=GHSA-w5hq-g745-h8pq | |
| - name: Build CLI binary | |
| working-directory: packages/desktop | |
| run: bash scripts/build-cli.sh | |
| - name: Build desktop app (unsigned) | |
| working-directory: packages/desktop | |
| run: bun run build:dist | |
| env: | |
| CSC_IDENTITY_AUTO_DISCOVERY: "false" |