From b63e591c75bc30816a71169fe62fb14574da97af Mon Sep 17 00:00:00 2001 From: BigMarc Date: Wed, 26 Aug 2026 21:42:19 +0200 Subject: [PATCH] ci: findstr never opened the binary, so the URL gate was inert Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build-windows.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml index 3cf1bb7..c218fdd 100644 --- a/.github/workflows/build-windows.yml +++ b/.github/workflows/build-windows.yml @@ -58,16 +58,22 @@ jobs: # Same gate as the private repo's release workflow: an agent baked against localhost looks # perfectly healthy in CI and is simply never heard from once someone installs it. + # Deliberately not findstr: it reads a leading `/` in a path as a switch prefix, so + # `src-tauri/target/...` fails with "Cannot open" and exits 2 — which reads as "string not + # found" and would let a localhost build sail through the check that exists to stop it. - name: Verify the baked server URL working-directory: apps/agent run: | - $exe = "src-tauri/target/release/timebunny-agent.exe" - & findstr /C:"http://localhost:3000" $exe > $null - if ($LASTEXITCODE -eq 0) { + $exe = Join-Path $PWD "src-tauri\target\release\timebunny-agent.exe" + if (-not (Test-Path $exe)) { throw "No agent binary at $exe" } + $text = [System.Text.Encoding]::ASCII.GetString([System.IO.File]::ReadAllBytes($exe)) + if ($text.Contains("http://localhost:3000")) { throw "Agent binary still carries the localhost fallback - TIMEBUNNY_API_URL was not set at build time" } - & findstr /C:"https://time.bunny.team" $exe > $null - if ($LASTEXITCODE -ne 0) { throw "Agent binary does not contain the production API URL" } + if (-not $text.Contains("https://time.bunny.team")) { + throw "Agent binary does not contain the production API URL" + } + Write-Host "ok: production URL baked, no localhost fallback" - name: Checksum working-directory: apps/agent