Repository navigation
Publish prebuilt Linux and macOS CLIs on release, and fix explain on Macs through the gateway - #53
Merged
Merged
Conversation
![adaptcom[bot]](https://avatars.githubusercontent.com/in/1609964?s=60&v=4){kind=small}
There was a problem hiding this comment.
Confidence Score: 2/5
Summary
Score reconciled from 3/5 because the review includes a blocking finding.
Adds the repo's first workflow: tag-triggered Linux release build and GitHub release upload. PR run is green; risk is supply-chain hygiene (unpinned third-party action with write token) and an already-deprecated runner label.
Important Files Changed
| File | Overview |
|---|---|
| .github/workflows/release.yml | New tag-triggered release workflow; unpinned third-party action, deprecated ubuntu-22.04 runner |
Reviewed 8a2e896...bf93dfd · ↻ Re-run review · View in Adapt
shanebarakat
force-pushed
the
ci/linux-release
branch
from
October 23, 2026 20:51
bf93dfd to
6844bb9
Compare
On a v* tag: run the lib tests and authority_boundaries, build kinbase for x86_64-unknown-linux-gnu (ubuntu-24.04, for Wanda's sandbox) and aarch64-apple-darwin (for engineers' Macs), check each binary's version matches the tag, and attach tarballs + sha256 to the release from a separate tag-only job that alone holds contents: write. hook_install_and_ledger is left out of the gate: it fails on main today. Pull requests that touch the workflow build and test without publishing.
shanebarakat
force-pushed
the
ci/linux-release
branch
from
October 23, 2026 20:54
6844bb9 to
0e69133
Compare
A second Launcher::load in the same process re-ran the attestation and counted descriptors the process had opened itself. On macOS, loading the native TLS roots for an https Company URL leaves two open, so explain through the gateway refused with CONFIG_INVARIANT.
shanebarakat
changed the title
alexu8007
self-requested a review
October 23, 2026 23:55
alexu8007
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release binaries (
.github/workflows/release.yml): on av*tag, buildskinbasefor Linux x86_64 (Wanda's Ubuntu 24.04 sandbox has no Rust or nix) and macOS arm64, runs the lib andauthority_boundariestests, and attaches each tarball + sha256 to the release. PRs touching the workflow build without publishing.Fix:
explainrefused on Macs through the gateway (launcher.rs).explain(kindex's call) loads the launcher a second time, which re-ran the startup descriptor check after macOS's TLS roots had opened two descriptors, so it refused its own files. Now the first load attests and later loads reuse it; inherited descriptors are fixed at launch.Verified on a Mac through the staging gateway: main refuses, this branch works, a real inherited fd is still refused. New test fails without the fix; 225 lib tests pass.
Need help on this PR? Tag
@codesmith-botwith what you need.