Add privileged lifecycle integration coverage - #1
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6401fbf03a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| test ! -e /usr/local/share/portless/ca.pem | ||
| test -e "/Library/Application Support/Portless/pki/ca.pem" | ||
| ca_hash="$(openssl x509 -in "/Library/Application Support/Portless/pki/ca.pem" -noout -fingerprint -sha256 | cut -d= -f2 | tr -d :)" | ||
| if /usr/bin/security find-certificate -a -Z /Library/Keychains/System.keychain | grep -Fq "$ca_hash"; then |
There was a problem hiding this comment.
When the CA hash is found before security finishes writing the system keychain listing, grep -q exits early and security can receive SIGPIPE; because this script enables pipefail, the pipeline is then nonzero and the if incorrectly treats the certificate as absent. This can let the workflow pass even when uninstall leaves the CA trusted, so avoid early-exit grep or capture the complete output before checking it.
AGENTS.md reference: AGENTS.md:L45-L46
Useful? React with 👍 / 👎.
| - name: Build release-equivalent binary | ||
| run: go build -trimpath -o "$RUNNER_TEMP/portless" ./cmd/portless |
There was a problem hiding this comment.
This step uses the runner's default CGO setting and leaves the development version/stripping flags in place, whereas .goreleaser.yaml:9-19 builds with CGO_ENABLED=0 and release ldflags. Consequently, lifecycle failures specific to the actual shipped binary configuration can pass this supposedly release-equivalent privileged workflow; build with the GoReleaser settings or exercise a GoReleaser-produced artifact.
Useful? React with 👍 / 👎.
Summary
Validation
go fmt ./...go vet ./...go test ./...go test -race ./...golangci-lint run --timeout=5mactionlintgo mod tidywith no module diff