* ci(build-webview): sweep stale hashed chunks before rsync (#46)
Vite emits content-hashed asset names (e.g. `index-CXPb0I5z.js`), so the
active bundle filename rotates on every source/dependency edit. The
existing rsync runs without `--delete` (to preserve `bus-harness.html`
and `.gitignore`), so old chunks accumulated in
`App/Resources/webview/assets/` — observed 9 stale `index-*.js` /
`.js.map` pairs locally before this fix.
Add an explicit `rm -f` of the asset glob (JS + JS map + CSS + CSS map)
before the rsync drops the fresh bundle. The preserved files
(`bus-harness.html`, `index.html`, `.gitignore`) live one level up in
`$DEST`, not in `$DEST/assets`, so the rm cannot reach them.
Verified locally: `bash scripts/build-webview.sh` now leaves exactly one
`index-*.js` + `.js.map` in `assets/` (matching the reference in
`index.html`).
Refs #46
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* ci(scorecard): add OpenSSF Scorecard workflow + README badge (#178)
Adds `.github/workflows/scorecard.yml` running `ossf/scorecard-action@v2.4.0`
on:
- Weekly cron (Mondays 06:00 UTC) for posture drift detection
- Push to develop for prompt regression visibility
- workflow_dispatch for ad-hoc runs
Permissions follow the canonical Scorecard set (`id-token: write`,
`contents: read`, `security-events: write`) with top-level `read-all` and
job-scoped writes. Results are published to the OpenSSF public dataset
(powers the README badge URL) and uploaded as SARIF to code-scanning.
The workflow consumes no untrusted user inputs in `run:` blocks, so it is
not exposed to workflow-injection patterns documented in
github.blog/security/.../how-to-catch-github-actions-workflow-injections.
README.md gains the standard Scorecard badge next to the existing
license/platform/swift badges.
Refs #178
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
The Xcode build phase 'Build webview bundle' couldn't find pnpm when it
was installed under any standard Nix profile location (~/.nix-profile/bin,
/etc/profiles/per-user/$USER/bin, /run/current-system/sw/bin) — the
hard-coded PATH only listed Homebrew, /usr/local, ~/.local/bin, and nvm.
Add the three canonical Nix profile paths to the PATH export so the App-build
gate works identically for users on Homebrew, npm-global, nvm, OR Nix.
Updates the FATAL hint to mention Nix as a third install option.
Surfaced during Phase 6 Wave 4 verification: scripts/check-app-builds.sh
failed identically on develop and worktree with `pnpm not found`. Root
cause was environmental (pnpm uninstalled since prior session) but the
script's PATH was the latent fragility.
Xcode IDE GUI build phases don't inherit the user's shell PATH (only
xcodebuild from a terminal does). pnpm at /opt/homebrew/bin was
unreachable from Xcode → 'pnpm: command not found' →
PhaseScriptExecution failed.
Prepend /opt/homebrew/bin + /usr/local/bin + ~/.local/bin to PATH and
add an explicit pnpm-availability check with an actionable error
message. CLI builds unaffected (PATH was already correct there).
Verified: bash scripts/build-webview.sh still works from the terminal.
james.maesandClaude Opus 4.7