Repository navigation
Prune archives; fix Mac upload signing and archive-based validation - #342
Merged
Merged
Conversation
jlipworth
changed the title
6 of 7 tasks
jlipworth
added a commit
that referenced
this pull request
Oct 16, 2026
## Summary Makes outside pull requests cheap to review by flagging the ones that touch essential surfaces, and says plainly that a PR may be re-implemented rather than merged. - `.github/triage/sensitive-paths.txt` is the single list of sensitive paths, grouped by category: signing and entitlements, auth and credentials, the transcode profile, dependencies, CI and release tooling, App Store text, agent instructions (`CLAUDE.md`, `AGENTS.md`, `.claude/`, `.codex/`), and policies. - `scripts/check-sensitive-paths.py` lists the matching files for a PR (`--pr N`), a branch (`--base REF`), or a list of paths. For PRs it also checks the old path of renamed files. It is read-only and never checks out PR code. - The new `sensitive-paths` label has been created. Under BOT-POLICY the bot applies it and names the matched categories, without judging whether the change is safe. It never removes the label. - `docs/CONTRIBUTING.md` and the PR template: PRs are proposals. The maintainer may merge one or re-implement it with credit, and sensitive-path changes usually get re-implemented. - `CLAUDE.md`: before proposing to merge someone else's PR, run the checker, report every match, and review those files line by line. GitHub Actions is disabled for this repo, and Woodpecker has no token that can label PRs, so the label is applied by the bot (or by hand), not by CI. ## Linked issue None. This is a follow-up to #348. ## Affected surface - Platforms: none (tooling and docs) - Backends: none ## Verification evidence - [x] Commands run and results: - 5 new unit tests pass. - `scripts/ci-hygiene.sh` passes locally: strict MkDocs build, link and Mermaid checks, tooling tests. - Checker on recent PRs: #346 finds nothing; #342 finds the TestFlight script and both skill mirrors; this branch finds 5 files. - [x] Simulator / host / device evidence: not applicable, no app code. - [ ] Not verified (and why): the bot behavior. The bot runs on the maintainer's own accounts. ## Privacy checklist - [x] No tokens, client identifiers, passwords, or signing/team identifiers. - [x] No real server hostnames, IPs, or URLs. - [x] No usernames, media titles, filenames, library paths, or personal home-directory paths. - [x] Security-sensitive changes were discussed privately first (n/a). ## AI assistance Claude Opus via Claude Code wrote the change. The maintainer reviews it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Archive pruning —
scripts/testflight-release.py prune-archives(dry run by default,--yesdeletes) and automatic pruning after a successfulship. Keeps the newest 3 archive sets that exist on App Store Connect, every set attached to an App Store version, and any set newer than the newest upload (pending/failed). Live dry run would remove the 17 never-uploaded 1.7.2 (1) archives (~1.1 GB).Fixes found by the first real
ship(1.7.2 build 1490):.pkgneeds the team's installer identity. The script now finds the "3rd Party Mac Developer Installer" (or Mac Installer Distribution) identity for the profile's team and setsinstallerSigningCertificate. A local-only export confirmed a correctly signedLabstream.pkg, and the Mac 1490 upload then succeeded.validate/uploadno longer require the checkout HEAD to equal the archive commit. They check the archive's own build ID: clean, matching the archive name, and onorigin/main. This makes failed uploads retryable aftermainmoves.Verified: 22 tests in the new suite (prune policy/grouping, installer selection, slug checks, Mac export options); live
validateof the 1490 set and the Mac upload; tooling suite passes except the knowndv-decoder-init-probefailure; diff screened for account identifiers.