Build native modules for Mac

[Dreamsorcerer]

No description provided.

[greptile-apps]

Greptile Summary

This change adds an Apple-silicon macOS Cachix publishing path, separate platform publication markers, and native-module provisioning for self-hosted macOS tests. The new macOS publisher exposes its Cachix publishing credential to a mutable third-party action reference and must be fixed before merging.

Confidence Score: 3/5

Not safe to merge until the secret-bearing Cachix action is pinned to an immutable commit reference.

The confirmed credential-exposure issue affects the new macOS publishing configuration.

Files Needing Attention: .github/workflows/ci.yml

Security Review

The new macOS Cachix publisher passes CACHIX_AUTH_TOKEN to cachix/cachix-action@v17. Because v17 is mutable, a retargeted action reference could run unreviewed code with access to the publishing credential.

T-Rex Logs

What T-Rex did

• The macOS-related job plumbing was added to HEAD, introducing four mutable action refs (checkout, cache, cachix-action, and cache/save) and token wiring for CACHIX_AUTH_TOKEN when needs-build-macos is true.
• The harness demonstrated that cachix-build-macos: failure still allowed a Linux matrix job to be scheduled, because the if condition uses !cancelled() and GitHub Actions does not enforce a success gate in that scenario.
• T-Rex produced a proof for a posted P1 finding, linking to the reviewer comment detailing the finding.
• T-Rex produced a second proof for the posted P1 finding, adding supporting artifacts as evidence.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Mutable Cachix action receives the publishing token

   • Bug
     • The newly added macOS Cachix publisher job runs cachix/cachix-action@v17 and passes ${{ secrets.CACHIX_AUTH_TOKEN }} through its authToken input. v17 is a mutable major-version tag, so a later retarget of that tag can execute changed third-party action code with the publisher token.
   • Cause
     • The workflow pins the Cachix action to the mutable v17 tag instead of an immutable full commit SHA while wiring a secret into the action.
   • Fix
     • Pin cachix/cachix-action to a verified full 40-character commit SHA (with an audit comment/version label if desired) before passing CACHIX_AUTH_TOKEN. The same new job also introduces mutable refs for actions/checkout@v7, actions/cache@v6, and actions/cache/save@v6; pin these newly added refs to immutable SHAs as well.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Build native modules for Mac" | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

@@            Coverage Diff             @@
##           nix-cache    #3979   +/-   ##
==========================================
  Coverage      77.91%   77.91%           
==========================================
  Files           1399     1399           
  Lines         132324   132324           
  Branches       11492    11492           
==========================================
+ Hits          103104   103105    +1     
  Misses         25952    25952           
+ Partials        3268     3267    -1     

Components	Coverage Δ
Tests	94.71% <ø> (ø)

Flag	Coverage Δ
OS-ubuntu-24.04-arm	74.25% <ø> (-0.01%)	⬇️
OS-ubuntu-latest	74.76% <ø> (+<0.01%)	⬆️
Py-3.10	74.76% <ø> (-0.01%)	⬇️
Py-3.11	74.75% <ø> (+<0.01%)	⬆️
Py-3.12	74.75% <ø> (-0.01%)	⬇️
Py-3.13	74.76% <ø> (+<0.01%)	⬆️
Py-3.14	74.76% <ø> (-0.01%)	⬇️
Py-3.14t	74.76% <ø> (+<0.01%)	⬆️
SelfHosted-Large	30.70% <ø> (ø)
SelfHosted-Linux	35.76% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.