Build native modules for Mac

[Dreamsorcerer]

No description provided.

[greptile-apps]

Greptile Summary

This change adds an Apple-silicon macOS Cachix publishing path, separate platform publication markers, and native-module provisioning for self-hosted macOS tests. The new macOS publisher exposes its Cachix publishing credential to a mutable third-party action reference and must be fixed before merging.

Confidence Score: 3/5

Not safe to merge until the secret-bearing Cachix action is pinned to an immutable commit reference.

The confirmed credential-exposure issue affects the new macOS publishing configuration.

Files Needing Attention: .github/workflows/ci.yml

Security Review

The new macOS Cachix publisher passes CACHIX_AUTH_TOKEN to cachix/cachix-action@v17. Because v17 is mutable, a retargeted action reference could run unreviewed code with access to the publishing credential.

T-Rex Logs

What T-Rex did

• The macOS-related job plumbing was added to HEAD, introducing four mutable action refs (checkout, cache, cachix-action, and cache/save) and token wiring for CACHIX_AUTH_TOKEN when needs-build-macos is true.
• The harness demonstrated that cachix-build-macos: failure still allowed a Linux matrix job to be scheduled, because the if condition uses !cancelled() and GitHub Actions does not enforce a success gate in that scenario.
• T-Rex produced a proof for a posted P1 finding, linking to the reviewer comment detailing the finding.
• T-Rex produced a second proof for the posted P1 finding, adding supporting artifacts as evidence.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Mutable Cachix action receives the publishing token

   • Bug
     • The newly added macOS Cachix publisher job runs cachix/cachix-action@v17 and passes ${{ secrets.CACHIX_AUTH_TOKEN }} through its authToken input. v17 is a mutable major-version tag, so a later retarget of that tag can execute changed third-party action code with the publisher token.
   • Cause
     • The workflow pins the Cachix action to the mutable v17 tag instead of an immutable full commit SHA while wiring a secret into the action.
   • Fix
     • Pin cachix/cachix-action to a verified full 40-character commit SHA (with an audit comment/version label if desired) before passing CACHIX_AUTH_TOKEN. The same new job also introduces mutable refs for actions/checkout@v7, actions/cache@v6, and actions/cache/save@v6; pin these newly added refs to immutable SHAs as well.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "Build native modules for Mac" | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...imos/experimental/memory/test_rust_recorder_e2e.py	0.00%	1 Missing and 1 partial ⚠️

@@           Coverage Diff           @@
##             main    #3979   +/-   ##
=======================================
  Coverage   78.49%   78.50%           
=======================================
  Files        1454     1454           
  Lines      137431   137432    +1     
  Branches    11830    11831    +1     
=======================================
+ Hits       107880   107887    +7     
+ Misses      26208    26205    -3     
+ Partials     3343     3340    -3     

Components	Coverage Δ
Tests	94.71% <0.00%> (-0.01%)	⬇️

Flag	Coverage Δ
OS-ubuntu-24.04-arm	74.81% <0.00%> (-0.01%)	⬇️
OS-ubuntu-latest	75.42% <0.00%> (+<0.01%)	⬆️
Py-3.10	75.42% <0.00%> (+<0.01%)	⬆️
Py-3.11	75.41% <0.00%> (-0.01%)	⬇️
Py-3.12	75.42% <0.00%> (-0.01%)	⬇️
Py-3.13	75.41% <0.00%> (-0.01%)	⬇️
Py-3.14	75.42% <0.00%> (+<0.01%)	⬆️
Py-3.14t	75.42% <0.00%> (-0.01%)	⬇️
SelfHosted-Large	30.78% <0.00%> (+<0.01%)	⬆️
SelfHosted-Linux	35.66% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...imos/experimental/memory/test_rust_recorder_e2e.py	90.68% <0.00%> (-0.94%)	⬇️

... and 6 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.