docs: highlight the native Mac app introduction #1976
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validation | |
| on: | |
| push: | |
| branches: [main, dev] | |
| pull_request: | |
| branches: [main, dev] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| tests: | |
| name: Unit & Integration Tests | |
| runs-on: macos-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: brew install bats-core shellcheck coreutils parallel | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Run test script | |
| env: | |
| MOLE_PERF_BYTES_TO_HUMAN_LIMIT_MS: "6000" | |
| MOLE_PERF_GET_FILE_SIZE_LIMIT_MS: "3000" | |
| MOLE_PERF_NORMALIZE_PATHS_LIMIT_MS: "10000" | |
| MOLE_TEST_JOBS: "6" | |
| # Emits a "Slowest test files" table at the end of the run. Parallel | |
| # TAP output cannot be attributed to a file, so without this a single | |
| # slow file that sets the whole job's wall clock stays invisible. | |
| MOLE_TEST_REPORT_DIR: ${{ runner.temp }}/bats-report | |
| BATS_FORMATTER: tap | |
| LANG: en_US.UTF-8 | |
| LC_ALL: en_US.UTF-8 | |
| run: ./scripts/test.sh | |
| compatibility: | |
| name: macOS | |
| strategy: | |
| matrix: | |
| os: [macos-14, macos-15] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install bats | |
| run: brew install bats-core coreutils | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Smoke load on ${{ matrix.os }} | |
| run: | | |
| echo "Testing on ${{ matrix.os }}..." | |
| bash -n mole | |
| source lib/core/common.sh | |
| echo "✓ Successfully loaded on ${{ matrix.os }}" | |
| - name: Run core bats subset | |
| env: | |
| MOLE_TEST_NO_AUTH: "1" | |
| MOLE_PERF_NORMALIZE_PATHS_LIMIT_MS: "10000" | |
| BATS_FORMATTER: tap | |
| LANG: en_US.UTF-8 | |
| LC_ALL: en_US.UTF-8 | |
| run: | | |
| bats tests/core_safe_functions.bats \ | |
| tests/core_common.bats \ | |
| tests/core_timeout.bats \ | |
| tests/regression.bats \ | |
| tests/cli.bats | |
| security: | |
| name: Security Checks | |
| runs-on: macos-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install tools | |
| run: brew install bats-core coreutils | |
| - name: Check for unsafe rm usage | |
| run: | | |
| echo "Checking for unsafe rm patterns..." | |
| # Filters in order: | |
| # safe_remove / validate_path: known safe wrapper helpers in file_ops.sh | |
| # # SAFE: explicit annotation that a direct rm is gated by narrow checks | |
| # ^path:line:[ws]#: pure comment lines that mention rm -rf in docs | |
| # echo : help text or messages that print rm -rf as documentation | |
| if grep -rn "rm -rf" lib/ bin/ install.sh mole 2>/dev/null | grep -v -E "safe_remove|validate_path|# SAFE|^[^:]+:[0-9]+:[[:space:]]*#|echo "; then | |
| echo "✗ Unsafe rm -rf usage found (annotate gated calls with '# SAFE: <reason>' or route through safe_remove)" | |
| exit 1 | |
| fi | |
| echo "✓ No unsafe rm usage found" | |
| - name: Verify app protection | |
| run: | | |
| echo "Verifying critical file protection..." | |
| bash -c ' | |
| source lib/core/common.sh | |
| if should_protect_from_uninstall "com.apple.Safari"; then | |
| echo "✓ Safari is protected" | |
| else | |
| echo "✗ Safari protection failed" | |
| exit 1 | |
| fi | |
| ' | |
| - name: Scan for secrets (gitleaks) | |
| uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| - name: Run high-risk path regression tests | |
| env: | |
| MOLE_TEST_NO_AUTH: "1" | |
| BATS_FORMATTER: tap | |
| LANG: en_US.UTF-8 | |
| LC_ALL: en_US.UTF-8 | |
| run: bats tests/core_safe_functions.bats tests/purge.bats tests/installer.bats |