feat(spotlight): Add self-contained spotlight binary creation#559
feat(spotlight): Add self-contained spotlight binary creation#559
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #559 +/- ##
==========================================
+ Coverage 29.00% 31.15% +2.14%
==========================================
Files 60 83 +23
Lines 4144 5030 +886
Branches 72 99 +27
==========================================
+ Hits 1202 1567 +365
- Misses 2942 3463 +521 ☔ View full report in Codecov by Sentry. 🚨 Try these New Features:
|
| console.warn( | ||
| "Missing required environment variables for macOS signing, you won't be able to use this binary until you sign it yourself.", | ||
| ); | ||
| console.info({ APPLE_TEAM_ID, APPLE_CERT_PATH, APPLE_CERT_PASSWORD }); |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI over 1 year ago
To fix the problem, we need to ensure that sensitive information is not logged in clear text. Instead of logging the actual values of APPLE_TEAM_ID, APPLE_CERT_PATH, and APPLE_CERT_PASSWORD, we can log a message indicating that the required environment variables are missing without exposing their values.
- Replace the logging of sensitive information with a generic message.
- Specifically, change the code on line 113 to avoid logging the actual values of the sensitive environment variables.
- No additional methods or imports are needed to implement this change.
| @@ -112,3 +112,3 @@ | ||
| ); | ||
| console.info({ APPLE_TEAM_ID, APPLE_CERT_PATH, APPLE_CERT_PASSWORD }); | ||
| console.info("Missing required environment variables for macOS signing."); | ||
| return; | ||
| @@ -134,3 +134,3 @@ | ||
| ); | ||
| console.info({ APPLE_API_KEY_PATH }); | ||
| console.info("Missing required environment variable for macOS notarization."); | ||
| return; |
This PR adds a new release type which is a self-contained CLI akin to
running
npx @spotlightjs/spotlightbut without anynodeornpxor any other requirements on the system.
It also changes how we serve the static assets: instead of serving the
entire folder, which can be dangerous as it allows access to arbitrary
files, we now use the
manifest.jsongenerated when compiling it andonly serve files listed there, directly from memory. This should also
increase the performance.