Skip to content

Commit 9dc04c3

Browse files
ngallodevclaude
ngallodev
and
claude
committed
fix(ci): clear macOS, Windows and security-audit failures
CI has been red on every PR, on macOS, Windows and security-static, for reasons unrelated to the PRs. Linux jobs were green. Windows (test-windows 1/2 and 2/2, test-windows-guards, pr-smoke): - src/cli/cli.c: delete cbm_remove_owned_legacy_hook_script. It is compiled only under _WIN32 and has had no callers since 4727371 ("separate CLI hook installation") gave the CLI its own hook filenames, so there is no extensionless legacy twin to clean up. -Wunused-function failed the build. - src/foundation/workspace.c: include foundation/win_utf8.h on Windows. canonical_path_has_root calls cbm_utf8_to_wide, which was undeclared (implicit declaration, then int-to-pointer errors) in the cbm-with-ui guards build. macOS (test-unix macos-14 and macos-15-intel, test-tsan macos-14): - tests/test_daemon_runtime.c: runtime_test_restore_shared_image is called only from the __linux__ changed-image case; wrap its definition in the same guard. macOS LSan (Homebrew LLVM): - src/cli/cli.c: g_mcp_command_path_probe_counter is written by the test setter on every platform but read only by the _WIN32 command-path probe, which newer clang reports as -Wunused-but-set-global. Define it only on Windows; the setter ignores its argument elsewhere. No test calls the setter. security-static (scripts/security-audit.sh): - scripts/security-allowlist.txt: add count-bounded WRITE entries for the six fopen("w...") sites the audit had no entry for. Each was reviewed: Windows exclusive-create temp files for atomic config replace in config_json_like.c, config_text_edit.c and config_yaml_edit.c; the stream copy fallback in compat_fs.c; the opt-in CBM_MEM_STATS_OUT dump in mem.c; and the index error log (cache logs/ or CBM_INDEX_LOG) in operations/index.c. - .github/workflows/claude.yml, claude-code-review.yml: pin actions/checkout and anthropics/claude-code-action to commit SHAs (same v4 and v1 tags). The audit blocks unpinned actions. The "repository build/ ancestor must be absent" line in macOS/Windows logs is expected output from the path-safety contract's negative case and is followed by "Build directory safety contract passed"; unchanged. Local (Linux): security-audit.sh passes, make lint-ci lint-tidy-diff passes, scripts/build-dev.sh builds. The macOS/Windows paths can only be confirmed by CI. Co-Authored-By: Claude Opus 5.5 <[email protected]>
1 parent 09f86d3 commit 9dc04c3

6 files changed

Lines changed: 22 additions & 27 deletions

File tree

‎.github/workflows/claude-code-review.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ jobs:
2727

2828
steps:
2929
- name: Checkout repository
30-
uses: actions/checkout@v4
30+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
3131
with:
3232
fetch-depth: 1
3333

3434
- name: Run Claude Code Review
3535
id: claude-review
36-
uses: anthropics/claude-code-action@v1
36+
uses: anthropics/claude-code-action@fd1c128679612beff4ca259c78021c506e8aa7a7 # v1
3737
with:
3838
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
3939
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

‎.github/workflows/claude.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ jobs:
2626
actions: read # Required for Claude to read CI results on PRs
2727
steps:
2828
- name: Checkout repository
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
3030
with:
3131
fetch-depth: 1
3232

3333
- name: Run Claude Code
3434
id: claude
35-
uses: anthropics/claude-code-action@v1
35+
uses: anthropics/claude-code-action@fd1c128679612beff4ca259c78021c506e8aa7a7 # v1
3636
with:
3737
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
3838

‎scripts/security-allowlist.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@ NETWORK:src/main.c:connect:1:loopback-v4:main_daemon_ctl_socket_connected:single
2929
# Format: WRITE:file:expected-count:justification
3030
WRITE:src/main.c:3:supervised worker response path; cache-scoped hook notice marker; test-seam-only browser-open marker at the caller-supplied test path
3131
WRITE:src/daemon/application.c:1:recovery truncates only its private uniquely-created per-job marker file
32+
WRITE:src/cli/config_json_like.c:1:Windows exclusive-create (wbx) sibling temp file for atomic agent config replace
33+
WRITE:src/cli/config_text_edit.c:1:Windows exclusive-create (w+bx) sibling temp file for atomic agent config replace
34+
WRITE:src/cli/config_yaml_edit.c:1:Windows exclusive-create (wbx) sibling temp file for atomic agent config replace
35+
WRITE:src/foundation/compat_fs.c:1:stream_copy_file fallback of the copy helper; destination chosen by the caller
36+
WRITE:src/foundation/mem.c:1:opt-in allocator stats dump to the user-set CBM_MEM_STATS_OUT path
37+
WRITE:src/operations/index.c:1:index error log in the cache logs/ directory, or the user-set CBM_INDEX_LOG path
3238

3339
# ── CLI: update command (user-initiated, interactive) ──────────────────────
3440
src/cli/cli.c:cbm_popen:sha256 checksum verification (update cmd)

‎src/cli/cli.c‎

Lines changed: 7 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1652,14 +1652,21 @@ static bool cbm_json_mcp_command_path_probe_safe(const char *command) {
16521652
#endif
16531653

16541654
#ifdef CBM_CLI_ENABLE_TEST_API
1655+
#ifdef _WIN32
1656+
/* Read only by the Windows command-path probe. */
16551657
static CBM_TLS int *g_mcp_command_path_probe_counter = NULL;
1658+
#endif
16561659

16571660
bool cbm_legacy_command_path_probe_safe_for_testing(const char *command, bool windows) {
16581661
return cbm_json_mcp_command_path_probe_safe_for_platform(command, windows);
16591662
}
16601663

16611664
void cbm_set_mcp_command_path_probe_counter_for_testing(int *counter) {
1665+
#ifdef _WIN32
16621666
g_mcp_command_path_probe_counter = counter;
1667+
#else
1668+
(void)counter;
1669+
#endif
16631670
}
16641671
#endif
16651672

@@ -4746,29 +4753,6 @@ static int cbm_remove_owned_hook_script(const char *path, const char *expected_c
47464753
* a missing/old/hung binary results in a silent exit 0 (issue #362/#288).
47474754
* The CLI-owned filename is intentionally distinct from MCP-era hook files so
47484755
* side-by-side installs never adopt or rewrite the MCP hook namespace. */
4749-
/* #929 (Windows): remove the pre-.cmd extensionless twin only when its bytes
4750-
* match a current or released installer-owned script. Modified/foreign files
4751-
* at the reserved path are preserved. POSIX keeps the extensionless name,
4752-
* where legacy == current, so no separate cleanup is needed there. */
4753-
#ifdef _WIN32
4754-
static int cbm_remove_owned_legacy_hook_script(const char *hooks_dir, const char *legacy_name,
4755-
const char *current_script,
4756-
const char *const *released_scripts,
4757-
size_t released_script_count) {
4758-
if (!hooks_dir || !legacy_name || !current_script) {
4759-
return CLI_ERR;
4760-
}
4761-
char legacy_path[CLI_BUF_1K];
4762-
int written = snprintf(legacy_path, sizeof(legacy_path), "%s/%s", hooks_dir, legacy_name);
4763-
if (written <= 0 || (size_t)written >= sizeof(legacy_path)) {
4764-
return CLI_ERR;
4765-
}
4766-
int result = cbm_text_remove_owned_document_any(legacy_path, current_script, released_scripts,
4767-
released_script_count);
4768-
return result < CLI_OK ? CLI_ERR : CLI_OK;
4769-
}
4770-
#endif
4771-
47724756
bool cbm_install_hook_gate_script(const char *home, const char *binary_path) {
47734757
if (!home || !binary_path) {
47744758
return false;

‎src/foundation/workspace.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
#include "foundation/compat_fs.h"
99
#include "foundation/platform.h"
1010
#include "foundation/sha256.h"
11+
#ifdef _WIN32
12+
#include "foundation/win_utf8.h"
13+
#endif
1114

1215
#include <stdlib.h>
1316

‎tests/test_daemon_runtime.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -570,6 +570,7 @@ static bool runtime_test_link_shared_image(const char *destination) {
570570
#endif
571571
}
572572

573+
#ifdef __linux__ /* only the Linux changed-image case restores the image */
573574
static bool runtime_test_restore_shared_image(void) {
574575
if (!runtime_shared_image[0]) {
575576
return false;
@@ -592,6 +593,7 @@ static bool runtime_test_restore_shared_image(void) {
592593
return truncate(runtime_shared_image, (off_t)runtime_shared_image_size) == 0;
593594
#endif
594595
}
596+
#endif
595597

596598
static void runtime_test_shared_image_cleanup(void) {
597599
if (runtime_shared_image[0]) {

0 commit comments

Comments
 (0)