fix(clean): preserve authored data and require explicit purge consent #1994
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validation | |
| on: | |
| push: | |
| branches: [main, dev] | |
| pull_request: | |
| branches: [main, dev] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| tests: | |
| name: Unit & Integration Tests | |
| runs-on: macos-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install tools | |
| run: brew install bats-core shellcheck coreutils parallel | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Run test script | |
| env: | |
| MOLE_PERF_BYTES_TO_HUMAN_LIMIT_MS: "6000" | |
| MOLE_PERF_GET_FILE_SIZE_LIMIT_MS: "3000" | |
| MOLE_PERF_NORMALIZE_PATHS_LIMIT_MS: "10000" | |
| MOLE_TEST_JOBS: "6" | |
| # Emits a "Slowest test files" table at the end of the run. Parallel | |
| # TAP output cannot be attributed to a file, so without this a single | |
| # slow file that sets the whole job's wall clock stays invisible. | |
| MOLE_TEST_REPORT_DIR: ${{ runner.temp }}/bats-report | |
| BATS_FORMATTER: tap | |
| LANG: en_US.UTF-8 | |
| LC_ALL: en_US.UTF-8 | |
| run: ./scripts/test.sh | |
| compatibility: | |
| name: macOS | |
| # Hosted runtime coverage is macOS 14/15. Release builds separately enforce | |
| # an LC_BUILD_VERSION minimum of macOS 12 in check_release_minos.sh. | |
| strategy: | |
| matrix: | |
| os: [macos-14, macos-15] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install bats | |
| run: brew install bats-core coreutils | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Smoke load on ${{ matrix.os }} | |
| run: | | |
| echo "Testing on ${{ matrix.os }}..." | |
| bash -n mole | |
| source lib/core/common.sh | |
| echo "✓ Successfully loaded on ${{ matrix.os }}" | |
| - name: Run core bats subset | |
| env: | |
| MOLE_TEST_NO_AUTH: "1" | |
| MOLE_PERF_NORMALIZE_PATHS_LIMIT_MS: "10000" | |
| BATS_FORMATTER: tap | |
| LANG: en_US.UTF-8 | |
| LC_ALL: en_US.UTF-8 | |
| run: | | |
| bats tests/core_safe_functions.bats \ | |
| tests/core_common.bats \ | |
| tests/core_timeout.bats \ | |
| tests/regression.bats \ | |
| tests/cli.bats | |
| security: | |
| name: Security Checks | |
| runs-on: macos-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install tools | |
| run: brew install bats-core coreutils | |
| - name: Check for unsafe rm usage | |
| run: python3 scripts/audit_destructive_sinks.py | |
| - name: Verify app protection | |
| run: | | |
| echo "Verifying critical file protection..." | |
| bash -c ' | |
| source lib/core/common.sh | |
| if should_protect_from_uninstall "com.apple.Safari"; then | |
| echo "✓ Safari is protected" | |
| else | |
| echo "✗ Safari protection failed" | |
| exit 1 | |
| fi | |
| ' | |
| - name: Scan for secrets (gitleaks) | |
| uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| - name: Run high-risk path regression tests | |
| env: | |
| MOLE_TEST_NO_AUTH: "1" | |
| BATS_FORMATTER: tap | |
| LANG: en_US.UTF-8 | |
| LC_ALL: en_US.UTF-8 | |
| run: bats tests/core_safe_functions.bats tests/purge.bats tests/installer.bats |