ci(macos): reject unreviewed root entitlements

2026-09-26 15:55:35 +00:00 · 2026-08-09 01:57:53 +07:00
parent e2df84f5b9
commit b9683c8fbe
2 changed files with 27 additions and 2 deletions
@@ -72,6 +72,17 @@ describe("macOS distribution entitlement policy", () => {
 			"distribution build must not enable com.apple.security.get-task-allow",
 		]);
 	});
+
+	it("rejects unreviewed root runtime exceptions", () => {
+		expect(
+			collectEntitlementErrors({
+				...validEntitlements,
+				"com.apple.security.cs.allow-dyld-environment-variables": true,
+			}),
+		).toEqual([
+			"unexpected root application entitlement: com.apple.security.cs.allow-dyld-environment-variables",
+		]);
+	});
 });

 describe("macOS distribution architecture policy", () => {