bundle_audit.yml

name: Bundle Drift Audit

# Monthly check that mole's protected bundle lists still cover every system
# app shipped in the latest macOS image. Opens an issue if /System/Applications
# contains a bundle ID not matched by the protection patterns.

on:
  schedule:
    - cron: '0 12 1 * *' # 1st of each month, 12:00 UTC
  workflow_dispatch:

permissions:
  contents: read
  issues: write

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

jobs:
  audit:
    name: Bundle drift
    runs-on: macos-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run drift audit
        id: drift
        continue-on-error: true
        run: |
          # pipefail so the audit's exit 2 (drift found) propagates through
          # tee. Without it the step's status is tee's 0, outcome stays
          # 'success', and the "Open issue on drift" gate below never fires.
          set -o pipefail
          ./scripts/audit_bundle_drift.sh | tee /tmp/audit.txt

      - name: Open issue on drift
        if: ${{ steps.drift.outcome != 'success' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          MACOS=$(sw_vers -productVersion)
          TITLE="Bundle drift on macOS $MACOS"
          # Avoid duplicate issues for the same macOS version.
          EXISTING=$(gh issue list --label bundle-drift --search "$TITLE in:title" --json number --jq '.[0].number' || true)
          if [[ -n "$EXISTING" ]]; then
            echo "Updating existing issue #$EXISTING"
            gh issue comment "$EXISTING" --body "$(cat /tmp/audit.txt)"
          else
            gh issue create \
              --title "$TITLE" \
              --label bundle-drift \
              --body "$(cat /tmp/audit.txt)"
          fi