ci: add binary dependency verification for Linux, macOS, and Flatpak

[lklimek]

Summary

• Adds post-build binary dependency verification to all non-Windows platform builds
• Linux: ldd check with system library allowlist, fails on "not found" deps
• macOS (both ARM64 and x86_64): otool -L check, fails on non-system libraries, warns on @rpath deps
• Flatpak: ldd check inside build-dir, fails on "not found" deps

Complements the Windows PE verification added in #769. Together, these checks ensure release binaries across all platforms are self-contained and won't crash at runtime due to missing shared libraries.

Test plan

• Linux matrix builds pass the new ldd verification step
• macOS ARM64 build passes the new otool -L verification step
• macOS x86_64 build passes the new otool -L verification step
• Flatpak build passes the new ldd verification step
• No false positives from the allowlist/system library filters

Depends on #769 (builds on fix/windows-static-linking branch).

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

Summary by CodeRabbit

Release Notes

• Chores
  • Added automated binary dependency verification checks for Linux and macOS platform builds to enhance release validation and build reliability.

[coderabbitai]

📝 Walkthrough

Walkthrough

These changes add new binary dependency verification steps to GitHub Actions workflows. The flatpak workflow verifies the dash-evo-tool binary dependencies using ldd, while the release workflow adds platform-specific verification steps for Linux (ldd) and macOS (otool -L) to ensure binaries are properly linked before release.

Changes

Cohort / File(s)	Summary
Flatpak Workflow .github/workflows/flatpak.yml	Adds "Verify Flatpak binary dependencies" step using ldd to detect missing shared libraries for the dash-evo-tool binary, failing the workflow if dependencies are unresolved.
Release Workflow .github/workflows/release.yml	Adds platform-specific binary dependency verification: Linux step uses ldd with filtering for system libraries; macOS steps (ARM64 and x86_64) use otool -L to restrict to system libraries and frameworks, excluding @rpath references.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A rabbit's ode to clean binaries:

Through ldd and otool we now shall see,
Which libraries dance in harmony,
No broken links shall pass our test,
Each dependency verified as the best! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: add binary dependency verification for Linux, macOS, and Flatpak' directly and comprehensively summarizes the main change—adding dependency verification steps across all non-Windows platforms as shown in the raw_summary and pr_objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/verify-binary-deps

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Adds CI post-build verification steps to ensure release artifacts don’t have missing or unintended dynamic library dependencies on non-Windows platforms, complementing the existing Windows PE import checks.

Changes:

• Add ldd-based dependency verification for Linux release artifacts (fail on missing libs; warn on non-allowlisted libs).
• Add otool -L-based dependency verification for macOS (fail on non-system dylibs; warn on @rpath deps).
• Add a Flatpak binary dependency verification step intended to fail on missing libs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release.yml	Adds Linux/macOS dependency inspection steps (ldd/otool) to catch missing/non-system dynamic deps in release builds.
.github/workflows/flatpak.yml	Adds a dependency verification step for the Flatpak-produced binary after flatpak-builder runs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)

276-295: Extract duplicated macOS dependency check to a shared script to avoid drift.

The ARM64 and x86_64 verification blocks are identical. Consider moving this logic into a single script (e.g., scripts/verify-macos-deps.sh) and calling it from both jobs to keep policy changes synchronized.

Refactor sketch

-      - name: Verify macOS binary dependencies
-        run: |
-          echo "Checking dynamic library dependencies..."
-          DEPS=$(otool -L build/dash-evo-tool)
-          echo "$DEPS"
-          # Only system libraries (/usr/lib/) and frameworks (/System/Library/) are allowed
-          UNEXPECTED=$(echo "$DEPS" | tail -n +2 | awk '{print $1}' | grep -Ev "^(/usr/lib/|/System/Library/|@rpath/)" || true)
-          if [ -n "$UNEXPECTED" ]; then
-            echo "::error::Binary links non-system libraries:"
-            echo "$UNEXPECTED"
-            exit 1
-          fi
-          # Warn on `@rpath` dependencies (acceptable for frameworks but worth noting)
-          RPATH=$(echo "$DEPS" | tail -n +2 | awk '{print $1}' | grep "^@rpath/" || true)
-          if [ -n "$RPATH" ]; then
-            echo "::warning::Binary has `@rpath` dependencies (verify these are bundled):"
-            echo "$RPATH"
-          fi
-          echo "✅ macOS binary dependencies look clean"
+      - name: Verify macOS binary dependencies
+        run: bash scripts/verify-macos-deps.sh build/dash-evo-tool

Also applies to: 565-584

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 276 - 295, Extract the duplicated
"Verify macOS binary dependencies" step into a single executable script (e.g.,
scripts/verify-macos-deps.sh) that takes the binary path as an argument
(defaulting to build/dash-evo-tool), preserves the otool/awk/grep logic, emits
the same ::error:: and ::warning:: messages and exit codes, and is made
executable (chmod +x). Then replace both ARM64 and x86_64 verification blocks in
the release.yml with a single step that runs this script (passing the binary
path), ensuring the workflow still checks out the repo before running the
script.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/release.yml:
- Around line 276-295: Extract the duplicated "Verify macOS binary dependencies"
step into a single executable script (e.g., scripts/verify-macos-deps.sh) that
takes the binary path as an argument (defaulting to build/dash-evo-tool),
preserves the otool/awk/grep logic, emits the same ::error:: and ::warning::
messages and exit codes, and is made executable (chmod +x). Then replace both
ARM64 and x86_64 verification blocks in the release.yml with a single step that
runs this script (passing the binary path), ensuring the workflow still checks
out the repo before running the script.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 71735fe3-4a18-4e4f-a905-d9fbcdc9dee4

📥 Commits

Reviewing files that changed from the base of the PR and between c8700bb and 0978aee.

📒 Files selected for processing (2)

• .github/workflows/flatpak.yml
• .github/workflows/release.yml

[thepastaclaw]

Code Review

Trivial fix: adds || true to 5 grep commands to prevent exit code 1 (no matches found) from aborting CI steps under set -e/pipefail. Correct and complete.

Reviewed commit: 0978aee