Repository navigation
fix(ci): verify Mac distribution signing and await Android popup focus - #101
Conversation
Scope public payload creation to Xcode archive and export subprocesses while retaining private signing credentials. Reject unreadable macOS archive entries before upload and include the same guard in local release preflight.
Bind standing owner authorization to independently reviewed source 81fa045, conditional on required hosted checks and current Codex review passing before merge and delivery.
Retain the runner's configured official HTTPS fallback instead of its repeatedly stalled Azure HTTP mirror. Bound APT connection and data waits, preserve package trust, and cover Linux setup, macOS skip, idempotency, missing fallback, and privileged-operation failures.
Bind standing owner authorization to reviewed source 8a30e2c, conditional on required hosted checks and current Codex review before merge and macOS delivery.
Regenerate the wrapper with the verified Gradle 9.8.1 security patch and official distribution checksum. Align native toolchain documentation and clear exact-source approval until the corrected release revision is reviewed.
Record standing publication authority for source 3632596. Delivery remains conditional on green hosted checks and current Codex review; preserve immutable v4 artifacts and existing store reviews.
Archive the Mac app and Swift resource bundles with the validated distribution certificate. Scope the provisioning profile to the application and reject nested certificate mismatches before export and upload. Preserve the existing iOS delivery flow.
Generate isolated synthetic certificates with the system tool on Apple and Linux runners without requiring a package binary.
Record existing conditional publication authorization for the independently reviewed source after local validation. Require green hosted checks and current Codex review before merge or delivery.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Keep real Back dismissal coverage while waiting for Android popup window focus. Reset source-bound approval until the reviewed correction is committed.
Apply standing authorization to the locally validated Mac delivery and Android input-focus correction. Required hosted checks and current Codex review still gate protected merge.
santi020k
changed the title
|
@codex review Please review the complete current PR at source revision 4346ff5, including Mac distribution signing/certificate verification and the Android popup-focus test correction. Local repository validation, CI preflight, Compose CI builds, staged consumers, all 107 Android 15 phone/Wear device tests, and affected repeat tests passed. Review completion and all hosted checks remain required before protected merge and delivery. |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
The previous Mac upload was rejected during Apple processing with ITMS-90284: the Swift resource bundle retained an Apple Development signature after the app was exported for distribution. Mac archives now use the validated distribution certificate for the app and its resource bundles. The provisioning profile is scoped to the app target, and a pre-upload guard verifies the archive and every nested bundle certificate against the selected profile. iOS delivery keeps its existing behavior.
Android tooltip and tour Back tests now wait for native popup window focus before injecting a real system Back event. This prevents InputDispatcher from dropping input while window focus is still registering. The original dismissal, disabled-state and controlled-state assertions remain intact.
Validation: full repository validation passed (2,755 tests in 262 files, zero-warning lint, strict types, security and clean package consumers), CI preflight passed, all 107 Android 15 phone/Wear device tests passed locally, Android 17 phone tests passed (102/102), native lint passed, and repeated tooltip/tour tests passed. The Compose CI build/publication sequence passed (221 tasks), and the staged Android consumer build/isolation check passed (107 tasks). Mac signing/delivery regressions, resolved Xcode signing settings and a fresh unsigned Mac archive passed. Independent reviews found no actionable findings in the final correction. Hosted checks and Codex review must pass on the latest head before protected merge.
Lumen 4.0.0 package versions, changelog, immutable tags/artifacts, and approved iOS/Android 1.0.3 submissions and rollout holds are preserved. These delivery and test-infrastructure changes require no consumer migration. Recovery uses a new corrected Mac upload from merged main. If processing fails, retain the existing published Mac version and recover through another reviewed commit without changing published tags.