From 8325404fe97098c38b51cf754f3f59ea00c8593f Mon Sep 17 00:00:00 2001 From: alsyah Date: Mon, 20 Jul 2026 19:13:42 +0700 Subject: [PATCH 1/2] fix: Remove --bytecode flag to fix Mach-O signing corruption on M4 The --bytecode flag in bun build --compile produces structurally corrupted Mach-O binary headers on Apple Silicon (M4), causing macOS Gatekeeper to SIGKILL the process. Removing the flag restores standard binary format compatibility. Co-Authored-By: Claude Opus 4.6 --- scripts/build.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/build.ts b/scripts/build.ts index b74db9233..af86003c7 100644 --- a/scripts/build.ts +++ b/scripts/build.ts @@ -170,7 +170,6 @@ const cmd = [ '--outfile', outfile, '--minify', - '--bytecode', '--packages', 'bundle', '--conditions', From f7aec78b018af3ec0dbb869d2250d8e086d9f1cd Mon Sep 17 00:00:00 2001 From: alsyah Date: Fri, 24 Jul 2026 13:47:54 +0700 Subject: [PATCH 2/2] chore: add GitHub workflow to lock closed PRs Prevents drive-by comments on resolved threads by locking PRs on close with lock_reason='resolved'. Uses minimal permissions (issues: write, pull-requests: write) and SHA-pinned actions to mitigate pwn-request attacks. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/github-lock-closed-prs.yml | 22 ++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/github-lock-closed-prs.yml diff --git a/.github/workflows/github-lock-closed-prs.yml b/.github/workflows/github-lock-closed-prs.yml new file mode 100644 index 000000000..baba9a902 --- /dev/null +++ b/.github/workflows/github-lock-closed-prs.yml @@ -0,0 +1,22 @@ +name: GitHub - Lock Closed PRs +on: + pull_request_target: + types: [closed] +permissions: + issues: write + pull-requests: write +jobs: + lock: + name: Lock Closed PR + runs-on: ubuntu-24.04 + steps: + - uses: actions/github-script@v3a2844b7e9c422d3c10d287c955573f7108da1b3 # v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.issues.lock({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + lock_reason: 'resolved' + }); \ No newline at end of file