Repository navigation
bug(release): production dependency audit blocks macOS release builds #965
Description
Expected
Release macOS App (.github/workflows/release.yml), dispatched on main with publish_release=false, runs through to packaging and produces the arm64 and x64 .dmg/.zip artifacts. This is the gate before signing and notarization can be tested with the new Apple Developer account.
Actual
The build-app job's Audit production dependencies step (npm run audit:production = npm audit --omit=dev --audit-level=high) exits 1 against main's lockfile. The step runs before Prepare bundled runtime tools, Build app and the whole package-macos job, so no packaging, structural verification or smoke test runs.
Two high advisories, both in transitive production dependencies with in-range fixes:
| Package | Locked | Pulled in by | Advisories |
|---|---|---|---|
fast-uri |
3.1.4 | [email protected] (^3.0.1) |
GHSA-7p8r-x3mc-p8w7, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp (host confusion / SSRF, fixed in 3.1.6) |
ip-address |
10.2.0 | [email protected] (^10.2.0) |
GHSA-mwp4-54f8-5fhr (high) plus GHSA-4xrf-jv44-h6hh and GHSA-22jq-vg5j-6vgg (moderate), SSRF / trust-boundary bypass |
The same audit also reports moderate advisories in hono, @hono/node-server and qs, all with in-range fixes. These do not fail the gate.
Reproduction / evidence
git show origin/main:package.jsonandgit show origin/main:package-lock.json(atd12cd347) into an empty directory, thennpm audit --omit=dev --audit-level=high --package-lock-only: exit 1, summary{"moderate":6,"high":2}.- The release run dispatched on
d12cd347for this test is https://github.com/Juliusolsson05/agent-code/actions/runs/34739188324. - The last successful release run was 2026-04-26, before these advisories were published.
ci.ymldoes not run the audit, which is whymainstays green.
Impact
- No release artifacts can be built from
main, so the first signed and notarized build (and the planned nightly releases) is blocked. - The flagged packages ship inside the packaged app.
Environment
GitHub Actions macos-latest, Node 24, npm ci --include=dev, commit d12cd347.
Activity
Juliusolsson05 commentedon Sep 13, 2026
Confirmed in CI: run 34739188324 on
d12cd347passed install, type-check, Workflow MCP tests and the integration/renderer tests onmacos-latest, then failed at Audit production dependencies with8 vulnerabilities (6 moderate, 2 high), exit code 1.package-macoswas skipped. Fix: #966.fix(release): treat empty signing secrets as unset when packaging
Juliusolsson05 commentedon Sep 13, 2026
Second blocker, found once the audit passed on the fix branch. Run 34739476044 passed type-check, tests, audit, runtime-tool preparation and the app build, then
Package macOS artifactsfailed with⨯ /Users/runner/work/agent-code/agent-code not a file.Cause:
release.ymlpasses${{ secrets.CSC_LINK }}, which is""when the secret is missing. electron-builder'sgetCscLinkaccepts an empty string as a set value and resolves it as a certificate path (the repo root).scripts/package-mac.mjschose the unsigned branch but left the empty variable in the child env. Fixed in #966 by deleting emptyCSC_LINK/CSC_NAME/CSC_KEY_PASSWORDfirst.fix(release): keep executable bits across the build/package job handoff
Juliusolsson05 commentedon Sep 13, 2026
Third blocker, found once packaging ran. Run 34739982565 built both
.appbundles, thenverify-packaged-macfailed withrequired packaged executable missing or not executable: …/out/main/runtime/hotkey-helper/AgentCodeDictationHotkeyHelper.Cause:
build-apphandsout/topackage-macosthroughactions/upload-artifact, which zips without file modes (every file comes back644, per its README). The hotkey helper, and the bundledtmux/cloudflared/mitmproxybinaries behind it, lose the execute bit before packaging. Fixed in #966:out/is now uploaded as a tar and unpacked inpackage-macos.Juliusolsson05 commentedon Sep 13, 2026
With all three fixes in #966, release run 34740689235 (
980865b6,publish_release=false, unsigned) succeeds end to end:.dmg/.zipare packaged.verify-packaged-macreports OK for both architectures, and[packaging-smoke] OK arm64 0.0.2-beta.1.macos-unsigned-devartifact is uploaded.Signing and notarization remain untested until the Developer ID secrets exist.