Repository navigation
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Provide a standalone Rust application SDK setup Action and staging helper so independent app repositories can compile native mochiOS applications without checking out or building the OS. Install the published shared.8 C/C++ SDK through komeup, verify its pinned SHA-256, and fetch immutable Rust std, protocol, ViewKit and font sources. Use the same overlay namespace for build-std shims to avoid duplicate compiler runtime resolution.
The helper runs host tests, builds native ELF, checks host linkage/build paths, preserves application metadata/resources/capabilities and exports the actual Cargo resolution for review. It stages ordinary application installation metadata without built-in provenance. The public build-mpkg Action remains independently usable by any publisher.
Add trusted host msign preparation and a generic approval-protected artifact publication helper. It binds the actual MPKG manifest/checksum to the approved source and SDK, fails closed when the requested Team/branch Environment policy is absent or unreadable, uses explicitly configured signing credentials, verifies the resulting package, and refuses to replace releases/tags. No application code is checked out in the publication job; no release or production signing has been performed.
Validation: 13 Python tests pass locally; the signer preparation/build and existing signer tests passed on Actions at https://github.com/mochiOS/devkit/actions/runs/42973661191 . Edit completed 14 host tests, native compilation, MPKG generation and artifact upload at https://github.com/mochiOS/Edit.app/actions/runs/42973025838 ; downloaded payload hashes/sizes and absence of runner paths were verified. Latest approval-policy CI passed: https://github.com/mochiOS/devkit/actions/runs/42977073094 . The final Edit caller also passed at https://github.com/mochiOS/Edit.app/actions/runs/42977115103 ; its downloaded artifact source/SDK binding, all payload hashes/sizes, runner-path audit and committed dependency resolution were verified. Native target execution remains unverified.