[agent] Run the agent when launched with no arguments #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| # tacet only runs on macOS, but the suite is portable and Linux is the | |
| # faster signal. Both are here because the scripted checks are shell, and | |
| # GNU and BSD awk/grep are exactly where a passing test stops meaning | |
| # anything on the machine a user actually installs to. | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Pinned to an exact version: astral-sh/setup-uv publishes no floating | |
| # major tag, so @v9 does not resolve. | |
| - uses: astral-sh/setup-uv@v9.0.0 | |
| with: | |
| enable-cache: true | |
| # --locked fails if uv.lock has drifted from pyproject.toml, so a | |
| # dependency change can't land without the lockfile that pins it. | |
| - name: pytest | |
| run: uv run --locked pytest -q | |
| shellcheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Preinstalled on the Ubuntu runner image. | |
| - name: shellcheck | |
| run: shellcheck install-server.sh install-client.sh | |
| # The client is macOS-only and needs a real Swift toolchain, so it cannot | |
| # join the portable matrix above. Builds the bundle and asserts the signature | |
| # verifies — an unsigned or broken-signature bundle is exactly the state in | |
| # which TCC grants stop surviving a rebuild. | |
| swift: | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Test | |
| run: cd swift && swift test | |
| - name: Build Tacet.app | |
| # A runner has no Developer ID, and build-app.sh refuses to sign | |
| # ad-hoc by default (#21) — so CI has to opt in explicitly. That is | |
| # the intended shape: what CI checks here is that the bundle | |
| # assembles and keeps its entitlements, not that it is | |
| # distributable. A release build is signed on a machine that has | |
| # the certificate. | |
| env: | |
| TACET_ALLOW_ADHOC: "1" | |
| run: cd swift && swift build -c release && bash Packaging/build-app.sh | |
| - name: Verify the signature | |
| run: codesign --verify --strict --verbose=2 swift/Packaging/Tacet.app | |
| - name: Verify the microphone entitlement survived signing | |
| run: | | |
| codesign -d --entitlements - --xml swift/Packaging/Tacet.app 2>/dev/null \ | |
| | grep -q 'com.apple.security.device.audio-input' \ | |
| || { echo "missing audio-input entitlement — TCC will refuse to prompt"; exit 1; } |