mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
e6b5157a2a
* ci: add macOS test job Darwin-tagged tests (Seatbelt translator, diagnostics, upcoming network lockdown tests) never ran in CI: the test matrix covered ubuntu and windows only. The M0 sandbox lockdown milestone is macOS-first, so macOS coverage must exist before enforcement work lands. Also establishes the convention that darwin integration tests requiring sandbox-exec must fail (not skip) when running in CI, so missing tooling cannot silently hide security tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS * test(sandbox): make Seatbelt render golden test machine-independent The golden file baked the authoring machine's HOME, CWD and TMPDIR parent into the expected profile, so TestRenderSeatbelt_Golden could only pass on that machine. It never ran in CI before the macOS job exposed it. Normalize CWD, home and TMPDIR parents (raw and query-escaped forms) to stable placeholders before comparison, longest path first so prefix overlaps survive, and rewrite the golden accordingly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS * ci: make setup-go cache explicit in macOS job Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS --------- Co-authored-by: Claude <noreply@anthropic.com>