ci: stub web assets so tauri_build succeeds in the security workflow

Tommy · claude · Tommy · commit 510e48a02795 · 2026-06-30T00:11:38.000-07:00
The lint-and-test and hardening-flags jobs run bare cargo (no pnpm/vite/noscript
build), so tauri_build failed on the missing bundled NoScript .so and frontendDist.
This CI only verifies the Rust backend + ELF hardening, not the web bundle, so we
stub an empty .so and a minimal dist/index.html to satisfy tauri_build instead of
running the full frontend build. Validated locally with the stubs in place.

Co-Authored-By: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -52,6 +52,15 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y $APT_DEPS
+      - name: Stub web assets
+        # This job verifies the Rust backend (tests) — not the web bundle. tauri_build
+        # only checks that the bundled NoScript .so and the frontendDist exist, so we
+        # stub them instead of running the full pnpm/vite/noscript build.
+        run: |
+          mkdir -p apps/reclaim/src-tauri/resources/noscript
+          touch apps/reclaim/src-tauri/resources/noscript/libearth_noscript_ext.so
+          mkdir -p apps/reclaim/dist
+          printf '<!doctype html><meta charset="utf-8"><title>ci</title><div id="root"></div>' > apps/reclaim/dist/index.html
       - name: Unit tests (vault isolation, totp, hygiene)
         run: cargo test --lib
       - name: Clippy (our crates)
@@ -69,6 +78,14 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y $APT_DEPS
+      - name: Stub web assets
+        # We only readelf the binary's hardening flags here, not run the app, so the
+        # NoScript .so + frontendDist just need to exist for tauri_build.
+        run: |
+          mkdir -p apps/reclaim/src-tauri/resources/noscript
+          touch apps/reclaim/src-tauri/resources/noscript/libearth_noscript_ext.so
+          mkdir -p apps/reclaim/dist
+          printf '<!doctype html><meta charset="utf-8"><title>ci</title><div id="root"></div>' > apps/reclaim/dist/index.html
       - name: Build release binary
         run: cargo build --release --bin reclaim
       - name: Verify hardening (RELRO now + NX + PIE)
