Commit graph

4 commits

Author SHA1 Message Date
Leon Mika 22aa4d6069 Add end-to-end integration test with fake external binaries
Exercises the full run() pipeline using fake shell scripts on PATH that
record their argv to a temp RECORD_DIR. Verifies all external commands
were invoked, outputs contain the expected version/app/artifact values,
ditto was called twice (pre- and post-staple), and security delete-keychain
ran during cleanup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 10:37:12 +10:00
Leon Mika 445c99e6c4 Mask base64 cert and document add-mask stdout requirement
DeveloperIDCertBase64 is the .p12 contents and equally sensitive as
the password — register it with the log scrubber so a future code
path that accidentally wraps cfg in a debug log can't leak it. Also
documents why maskSecrets writes to stdout rather than stderr.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 10:34:05 +10:00
Leon Mika 97fb47d023 Wire orchestrator end-to-end
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 10:29:08 +10:00
Leon Mika b86a9dc9eb Bootstrap Go module and action skeleton
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 09:40:04 +10:00