fix(ci): drop dangling symlinks before signing the macOS bundle

[pacnpal]

Follow-up to #23. macOS release builds currently fail at the signing step — with or without signing secrets configured, so this blocks every macOS release on main today, not just signed ones.

Signing dist/floppybootcd.app with: ***
xattr: No such file: dist/floppybootcd.app/Contents/Frameworks/PySide6/glue
xattr: No such file: dist/floppybootcd.app/Contents/Frameworks/PySide6/include
xattr: No such file: dist/floppybootcd.app/Contents/Frameworks/PySide6/typesystems
xattr: No such file: dist/floppybootcd.app/Contents/Frameworks/PySide6/support
xattr: No such file: dist/floppybootcd.app/Contents/Frameworks/PySide6/scripts
Error: Process completed with exit code 1

Cause

The Prune unused Qt and PySide6 resources step deletes typesystems/, include/, glue/, support/ and scripts/ from Contents/Resources/PySide6. PyInstaller also cross-links each of those entries from Contents/Frameworks/PySide6, so pruning one side leaves the other pointing at nothing.

xattr -cr stats through a symlink — on a broken one it prints No such file and exits non-zero, which set -e turns into a failed job. The five paths in the log are exactly the five pruned directories.

Fix

Sweep broken symlinks out of the bundle before anything walks it, rather than tolerating xattr's exit code:

• codesign can't seal a link to a missing target either, and Apple's notary service rejects them — suppressing the xattr failure would just move the error later.
• They resolve to nothing, so deleting them costs nothing.
• It runs on the ad-hoc path too, so bundles built without secrets stop shipping five links to nowhere.

Valid symlinks (e.g. Frameworks/PySide6/Qt) are untouched.

Testing

Reproduced against a bundle shaped like the real post-prune layout, with stubbed xattr/codesign/file/security that mimic the macOS tools (xattr stats through links and fails on broken ones):

Case	Result
Pre-fix script	fails with the same five paths as CI, exit 1
Post-fix, Developer ID path	drops exactly the 5 broken links, keeps the valid Qt one, signs, exit 0
Post-fix, ad-hoc path (no secrets)	same, exit 0
Post-fix, re-run on a clean bundle	no-op, nothing reported, exit 0

Still unverified without a Mac: that the resulting bundle notarizes and launches. This unblocks the smoke test that surfaced the bug.

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9e38fe41-75b8-428a-8990-1221cfa6d40c

📥 Commits

Reviewing files that changed from the base of the PR and between 0d7bb3d and 26340b2.

📒 Files selected for processing (1)

• .github/signing/macos-sign.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved macOS app signing reliability by automatically detecting and removing dangling links from the application bundle before signing.
  • Added reporting of any removed items during the signing process.

Walkthrough

The macOS signing script now removes dangling symlinks from the app bundle before clearing extended attributes and signing. It logs each removal and reports the total count.

Changes

macOS signing preparation

Layer / File(s)	Summary
Pre-signing symlink cleanup .github/signing/macos-sign.sh	The script scans the app bundle for broken symlinks, removes them with logging, counts removals, and reports the count before signing passes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 26340

The PR removes only dangling symlinks before macOS bundle signing while preserving valid links and covering both signed and ad-hoc builds; no actionable merge-blocking risk remains after normal checks and review.

Poem

Broken links wobble in the night,
The signing script makes them right.
Each stray thread is neatly swept,
The bundle’s tasty, clean, and prepped.
Then signatures dance in light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the macOS signing fix for dangling symlinks.
Description check	✅ Passed	The description directly explains the signing failure, root cause, fix, and testing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/macos-signing-injection-rvlnbq

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}