[codex] fix Codex 26.727 Settings renderer detection (#334) #370
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| static-checks: | |
| name: Static checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "22" | |
| - name: Check shell syntax | |
| shell: bash | |
| run: | | |
| while IFS= read -r file; do | |
| bash -n "$file" | |
| done < <( | |
| find macos -type f \( -name '*.sh' -o -name '*.command' \) \ | |
| ! -path '*/release/*' -print | |
| ) | |
| - name: Check Node.js syntax | |
| shell: bash | |
| run: | | |
| while IFS= read -r file; do | |
| node --check "$file" >/dev/null | |
| done < <( | |
| find macos windows -type f \( -name '*.mjs' -o -name '*.js' \) -print | |
| ) | |
| - name: Check Windows PowerShell source encoding | |
| shell: bash | |
| run: | | |
| node <<'NODE' | |
| const fs = require("node:fs"); | |
| const path = require("node:path"); | |
| function visit(directory) { | |
| for (const entry of fs.readdirSync(directory, { withFileTypes: true })) { | |
| const file = path.join(directory, entry.name); | |
| if (entry.isDirectory()) visit(file); | |
| if (!entry.isFile() || path.extname(file) !== ".ps1") continue; | |
| const bytes = fs.readFileSync(file); | |
| const hasBom = bytes.subarray(0, 3).equals(Buffer.from([0xef, 0xbb, 0xbf])); | |
| const content = hasBom ? bytes.subarray(3) : bytes; | |
| if (content.some((byte) => byte >= 0x80) && !hasBom) { | |
| throw new Error(`${file}: non-ASCII PowerShell 5.1 source requires a UTF-8 BOM`); | |
| } | |
| } | |
| } | |
| visit("windows"); | |
| NODE | |
| - name: Check runtime safety assertions | |
| shell: bash | |
| run: | | |
| if grep -R -n -E 'dream-skin-skin|DREAM_SKIN_SKIN|1\.0\.0-rc2' \ | |
| macos/scripts macos/assets >/dev/null; then | |
| printf 'Legacy release-candidate identifiers remain in runtime files.\n' >&2 | |
| exit 1 | |
| fi | |
| if grep -R -n -E '(writeFile|rename|copyFile|rm).*app\.asar' \ | |
| macos/scripts >/dev/null; then | |
| printf 'A runtime script appears to mutate app.asar.\n' >&2 | |
| exit 1 | |
| fi | |
| if grep -R -n --include='*.ps1' --include='*.iss' \ | |
| -F -- '-ExecutionPolicy Bypass' windows/scripts windows/installer >/dev/null; then | |
| printf 'Windows runtime or installer code bypasses the PowerShell execution policy.\n' >&2 | |
| exit 1 | |
| fi | |
| if grep -n -E '/usr/bin/python3|(^|[[:space:]])eval([[:space:]]|$)' \ | |
| macos/scripts/common-macos.sh >/dev/null; then | |
| printf 'The macOS runtime must parse state without python3 or eval.\n' >&2 | |
| exit 1 | |
| fi | |
| if grep -n -E 'target\.(title|url)' \ | |
| macos/scripts/injector.mjs windows/scripts/injector.mjs >/dev/null; then | |
| printf 'Injector logs and results must not record page titles or URLs; keep only target IDs and structural markers.\n' >&2 | |
| exit 1 | |
| fi | |
| if grep -n -E '(document\.title|location\.href)' \ | |
| macos/scripts/injector.mjs windows/scripts/injector.mjs >/dev/null; then | |
| printf 'Injector renderer probes must not read the page title or URL back to the host.\n' >&2 | |
| exit 1 | |
| fi | |
| for injector in macos/scripts/injector.mjs windows/scripts/injector.mjs; do | |
| if grep -n -E '\.replace\("__DREAM_SKIN_[A-Z0-9_]+_JSON__", [^(]' \ | |
| "$injector" >/dev/null; then | |
| printf '%s: payload placeholders must use function replacements so a theme name containing $ cannot corrupt the payload.\n' \ | |
| "$injector" >&2 | |
| exit 1 | |
| fi | |
| done | |
| - name: Check version consistency | |
| shell: bash | |
| run: | | |
| expected="$(tr -d '\r\n' < macos/VERSION)" | |
| windows_version="$(tr -d '\r\n' < windows/VERSION)" | |
| package_version="$(node -p "JSON.parse(require('fs').readFileSync('macos/package.json','utf8')).version")" | |
| common="$(sed -n 's/^SKIN_VERSION="\([^"]*\)"$/\1/p' macos/scripts/common-macos.sh)" | |
| macos_injector="$(sed -n 's/^const SKIN_VERSION = "\([^"]*\)";$/\1/p' macos/scripts/injector.mjs)" | |
| windows_injector="$(sed -n 's/^const SKIN_VERSION = "\([^"]*\)";$/\1/p' windows/scripts/injector.mjs)" | |
| test -n "$expected" | |
| test "$windows_version" = "$expected" | |
| test "$package_version" = "$expected" | |
| test "$common" = "$expected" | |
| test "$macos_injector" = "$expected" | |
| test "$windows_injector" = "$expected" | |
| - name: Run portable Node.js regressions | |
| shell: bash | |
| run: | | |
| node --test macos/tests/*.test.mjs | |
| node --test windows/tests/*.test.mjs | |
| node macos/scripts/injector.mjs --check-payload >/dev/null | |
| node windows/scripts/injector.mjs --check-payload >/dev/null | |
| windows-tests: | |
| name: Windows (${{ matrix.name }}) | |
| runs-on: windows-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: Windows PowerShell 5.1 | |
| executable: powershell.exe | |
| - name: PowerShell 7 | |
| executable: pwsh.exe | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "22" | |
| - name: Run Windows regression suite | |
| shell: cmd | |
| run: ${{ matrix.executable }} -NoLogo -NoProfile -ExecutionPolicy RemoteSigned -File .\windows\tests\run-tests.ps1 | |
| - name: Run Windows installer static checks | |
| shell: cmd | |
| run: ${{ matrix.executable }} -NoLogo -NoProfile -ExecutionPolicy RemoteSigned -File .\windows\tests\installer-static.tests.ps1 | |
| - name: Install pinned Inno Setup | |
| if: matrix.executable == 'powershell.exe' | |
| shell: pwsh | |
| run: | | |
| $requiredVersion = '6.7.1' | |
| choco upgrade innosetup --version=$requiredVersion --allow-downgrade --no-progress --yes | |
| if ($LASTEXITCODE -ne 0) { throw "Could not install Inno Setup $requiredVersion." } | |
| $iscc = Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe' | |
| if (-not (Test-Path -LiteralPath $iscc -PathType Leaf)) { throw 'ISCC.exe is missing.' } | |
| "ISCC_PATH=$iscc" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append | |
| - name: Compile Windows Setup.exe | |
| if: matrix.executable == 'powershell.exe' | |
| shell: pwsh | |
| run: | | |
| $output = Join-Path $env:RUNNER_TEMP 'codex-dream-skin-ci-installer' | |
| & powershell.exe -NoLogo -NoProfile -ExecutionPolicy RemoteSigned ` | |
| -File .\windows\installer\build-release.ps1 ` | |
| -OutputDirectory $output -IsccPath $env:ISCC_PATH | |
| if ($LASTEXITCODE -ne 0) { throw "Windows release builder failed with exit code $LASTEXITCODE." } | |
| $version = [System.IO.File]::ReadAllText((Resolve-Path .\windows\VERSION)).Trim() | |
| $artifact = Join-Path $output "CodexDreamSkin-Setup-v$version.exe" | |
| if (-not (Test-Path -LiteralPath $artifact -PathType Leaf) -or | |
| (Get-Item -LiteralPath $artifact).Length -le 0) { | |
| throw 'Windows installer artifact is missing or empty.' | |
| } | |
| macos-tests: | |
| name: macOS repository regressions | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "22" | |
| - name: Locate runner Node.js | |
| id: node | |
| shell: bash | |
| run: echo "path=$(command -v node)" >> "$GITHUB_OUTPUT" | |
| - name: Run macOS regressions without installed-app checks | |
| shell: bash | |
| env: | |
| NODE: ${{ steps.node.outputs.path }} | |
| CODEX_DREAM_SKIN_SKIP_SIGNED_RUNTIME_TESTS: "1" | |
| CODEX_DREAM_SKIN_SKIP_DOCTOR: "1" | |
| run: ./macos/tests/run-tests.sh | |
| - name: Build and test the native menu bar app | |
| run: swift test --package-path macos/menubar-app | |
| - name: Compile and verify the universal DMG | |
| run: ./macos/scripts/build-dmg.sh --skip-tests | |
| - name: Upload DMG artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: CodexDreamSkin-dmg | |
| path: macos/release/*.dmg | |
| retention-days: 7 |