feat(desktop): sign + notarize cliproxyapi-plusplus electron app via fleet-ops - #1063
Conversation
…fleet-ops Adds entitlements and .github/workflows/release-macos.yml. The reusable workflow at kooshapari/phenotype-fleet-ops/.github/workflows/macos-release.yml@main pulls Apple Developer secrets from Infisical (project 8efe392e-56a6-4c3c-89f9-8141183dd7e8, path /apple/cliproxyapi-plusplus). Constraints: zero billed runners (self-hosted only), no .p12 committed, Infisical as the only secret store. Refs: /tmp/kooshapari-audit/per_repo_drops/cliproxyapi-plusplus/PR_BODY.md
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:M
|
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| <key>com.apple.security.network.client</key> | ||
| <true/> | ||
| <key>com.apple.security.cs.allow-jit</key> | ||
| <true/> |
There was a problem hiding this comment.
Suggestion: The entitlement dictionary repeats com.apple.security.network.client and com.apple.security.cs.allow-jit; plist validation or signing can reject duplicate dictionary keys. [type error]
Assessment: 🟠 Major · 🔁 Occurrence: Sometimes
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** apps/desktop/Entitlements.plist
**Line:** 25:28
**Comment:**
*Type Error: The entitlement dictionary repeats `com.apple.security.network.client` and `com.apple.security.cs.allow-jit`; plist validation or signing can reject duplicate dictionary keys.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| jobs: | ||
| macos: | ||
| name: Build, sign, notarize cliproxyapi-plusplus | ||
| uses: kooshapari/phenotype-fleet-ops/.github/workflows/macos-release.yml@main |
There was a problem hiding this comment.
WARNING: Using @main for reusable workflow reference is a security risk
Referencing a reusable workflow by branch (@main) means the workflow can change without your knowledge. If the upstream repository is compromised, malicious code could execute in your workflow with access to your INFISICAL_TOKEN secret.
Pin to a full commit SHA for supply-chain security:
| uses: kooshapari/phenotype-fleet-ops/.github/workflows/macos-release.yml@main | |
| uses: kooshapari/phenotype-fleet-ops/.github/workflows/macos-release.yml@fd8373f |
Replace fd8373f with the actual commit SHA you trust.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| pnpm install --frozen-lockfile | ||
| pnpm --filter desktop build | ||
| pnpm --filter desktop electron-builder --mac --x64 --arm64 | ||
| cp -R apps/desktop/dist/mac*/cliproxyapi-plusplus.app dist/macos/ || true |
There was a problem hiding this comment.
WARNING: || true suppresses errors, hiding build failures
If the cp command fails (e.g., wrong source path, permission issue), the workflow continues silently. This could result in signing/notarizing a missing or incomplete app bundle, producing a broken release artifact.
Remove || true or add explicit error handling:
| cp -R apps/desktop/dist/mac*/cliproxyapi-plusplus.app dist/macos/ || true | |
| cp -R apps/desktop/dist/mac*/cliproxyapi-plusplus.app dist/macos/ |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 2 Issues Found | Recommendation: Address before next release Overview
Issue Details (click to expand)WARNING
Files Reviewed (2 files)
Fix these issues in Kilo Cloud Reviewed by free · Input: 20.5K · Output: 5.7K · Cached: 126.3K |
User description
feat(desktop): add macos signing workflow to cliproxyapi-plusplus
Summary
cliproxyapi-plusplus is a fork of a CLI proxy API tool with an Electron desktop surface. The fork needs Apple signing for any distributable macOS artifact. This PR adds the consumer workflow.
Notes
Fork; minimal Electron desktop surface
What this PR does
Entitlements.plistatapps/desktop/Entitlements.plist(minimal sandbox-safe defaults: network client, JIT where needed; repo-specific extras inlined).github/workflows/release-macos.ymlthat calls the reusable workflowkooshapari/phenotype-fleet-ops/.github/workflows/macos-release.yml@main8efe392e-56a6-4c3c-89f9-8141183dd7e8→/apple/cliproxyapi-plusplus), runscodesign+xcrun notarytool+xcrun stapler, attaches the signed + notarized DMG to the GitHub ReleaseWhy now
Constraints honored
[self-hosted, macos, arm64, mac-signing])INFISICAL_TOKEN(service identity, not Apple-specific) is in repo secrets.p12ever committed — cert +.p8API key are base64-encoded secrets in Infisical, decoded torunner.disk/.apple-keys/per build only, mode 600phenotype-fleet-ops; this repo just calls it. Any future repo adopting Apple signing gets the same pipeline by changingapp-nameandbuild-cmdVerification plan
v0.1.0-macsigtest→release-macos.ymltriggerscliproxyapi-plusplus-macos-signedartifactcodesign -dvvv cliproxyapi-plusplus.app→ Developer IDxcrun stapler validatepassesPre-merge checklist (run by Koosha)
/apple/cliproxyapi-pluspluswith these keys (if missing, default to/appleorg-level path):APPLE_TEAM_IDAPPLE_DEVELOPER_ID_P12_BASE64APPLE_DEVELOPER_ID_P12_PASSWORDAPPLE_NOTARIZATION_ISSUER_IDAPPLE_NOTARIZATION_KEY_IDAPPLE_NOTARIZATION_KEY_P8_BASE64APPLE_BUNDLE_ID = app.phenotype.cliproxyINFISICAL_TOKEN(machine identity, scoped to project8efe392e-56a6-4c3c-89f9-8141183dd7e8)KooshaPariis online with labels[self-hosted, macos, arm64, mac-signing]kooshapari/phenotype-fleet-ops@maincontains the new.github/workflows/macos-release.yml(already shipped at commitfd8373f)v*.*.*-macsigtestto dry-run-macsigtestand re-tag for real releaseCodeAnt-AI Description
Publish signed and notarized macOS desktop releases
What Changed
Impact
✅ Trusted macOS downloads✅ Installable releases on Intel and Apple Silicon Macs✅ Working network access in the desktop app💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.