4 commits

Author	SHA1	Message	Date
Leon Mika	22aa4d6069	Add end-to-end integration test with fake external binaries ... Exercises the full run() pipeline using fake shell scripts on PATH that record their argv to a temp RECORD_DIR. Verifies all external commands were invoked, outputs contain the expected version/app/artifact values, ditto was called twice (pre- and post-staple), and security delete-keychain ran during cleanup. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-02 10:37:12 +10:00
Leon Mika	445c99e6c4	Mask base64 cert and document add-mask stdout requirement ... DeveloperIDCertBase64 is the .p12 contents and equally sensitive as the password — register it with the log scrubber so a future code path that accidentally wraps cfg in a debug log can't leak it. Also documents why maskSecrets writes to stdout rather than stderr. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-02 10:34:05 +10:00
Leon Mika	97fb47d023	Wire orchestrator end-to-end ... Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-02 10:29:08 +10:00
Leon Mika	b86a9dc9eb	Bootstrap Go module and action skeleton ... Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-02 09:40:04 +10:00