ci(release): validate the shipped Universal Binary before upload - #47
Merged
Merged
Conversation
Assert both arm64 and x86_64 slices with lipo, run the SHA-pinned pluginval v1.0.4 strictness-10 sweep (native + Rosetta 2) and auval -strict against the signed, stapled stage/ bundles before gh release upload. Mirrors ci.yml's validation, pointed at the artefact that actually ships. macOS job timeout 45 -> 60 minutes. Closes #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #45 — fleet audit class 1 follow-up (basilica-audio/.github#1).
release.ymlbuilt, signed, notarized and attached the macOS binary without ever validating it; PR-level CI validates a different build of the same commit. This PR gates the upload on the artefact that actually ships:lipo -archsassertion on the signed, stapledstage/bundles (VST3, AU, Standalone) — botharm64andx86_64must be present.arch -x86_64), so both slices are exercised. Pass/fail is asserted through the existing.github/scripts/assert-pluginval-passed.shmulti-signal gate.auval -stricton the shipped AU, native + Rosetta 2.All steps run after signing/stapling and before
gh release upload, so a broken bundle can no longer reach the release page. The macOS job timeout goes 45 → 60 minutes to make room for the sweep next to the existing 40-minute notarization step budget. No other change to the release flow.Honesty note: a tag-triggered workflow only truly proves itself on a tag push — CI on this PR proves the file parses (actionlint clean locally), not that a release run passes. The validation steps themselves are step-for-step the ones
ci.ymlhas been running green since the CI-hardening wave, pointed atstage/instead of the build tree.