From 04faff315a5385da3c8fed4ebbc4e0af30f89881 Mon Sep 17 00:00:00 2001 From: ciregenz Date: Mon, 1 Jun 2026 15:01:13 -0700 Subject: [PATCH] [eric] ci: fix mcp-bundles node path and whitelist wheel sboms in host-leakage --- scripts/ci/verify-host-leakage.js | 1 + scripts/ci/verify-mcp-bundles.js | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/scripts/ci/verify-host-leakage.js b/scripts/ci/verify-host-leakage.js index a06d9647..520f06c6 100644 --- a/scripts/ci/verify-host-leakage.js +++ b/scripts/ci/verify-host-leakage.js @@ -67,6 +67,7 @@ function shouldScan(file) { const DEFAULT_ALLOW = [ /\.dist-info[\\/]direct_url\.json$/, // PEP 610 install provenance, not read at runtime /\.dist-info[\\/]RECORD$/, // wheel file list, lists relative paths only + /\.dist-info[\\/]sboms[\\/]/, // CycloneDX SBOMs bake the wheel PUBLISHER's CI path (e.g. /Users/runner/work), never ours ]; function walk(dir, out = []) { diff --git a/scripts/ci/verify-mcp-bundles.js b/scripts/ci/verify-mcp-bundles.js index e3d8e6f0..09f22213 100644 --- a/scripts/ci/verify-mcp-bundles.js +++ b/scripts/ci/verify-mcp-bundles.js @@ -22,14 +22,17 @@ function bundlesRoot(appExe) { return path.join(path.dirname(appExe), 'resources', 'backend', 'mcp-bundles'); } +// POSIX ships node under bin/ (node//bin/node); Windows drops it (node.exe +// straight under arch). Must mirror electron/main.js getBundledNodePath() or this +// gate cant find the binary it bundled and false-fails a perfectly good build. function bundledNode(appExe) { if (process.platform === 'win32') return path.join(path.dirname(appExe), 'resources', 'node', 'x64', 'node.exe'); if (process.platform === 'darwin') { const i = appExe.indexOf('.app'); const appRoot = i === -1 ? appExe : appExe.slice(0, i + 4); - return path.join(appRoot, 'Contents', 'Resources', 'node', process.arch, 'node'); + return path.join(appRoot, 'Contents', 'Resources', 'node', process.arch, 'bin', 'node'); } - return path.join(path.dirname(appExe), 'resources', 'node', process.arch, 'node'); + return path.join(path.dirname(appExe), 'resources', 'node', process.arch, 'bin', 'node'); } // Locate the JS entry for each bundle. Single-file bundles ship as .js;