ci: fix libgit2 and openssl dependencies

Author: brucehsu

.github/workflows/desktop-build.yml

@@ -57,6 +57,27 @@ jobs:
       - name: Build desktop app bundle
         run: pnpm --filter @codelegate/desktop tauri build
 
+      - name: Verify macOS bundle does not link Homebrew libraries
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          binary_path="$(find apps/desktop/src-tauri/target -path '*/bundle/macos/Codelegate.app/Contents/MacOS/codelegate-desktop' -print -quit)"
+
+          if [[ -z "$binary_path" ]]; then
+            echo "Unable to locate built macOS app binary"
+            exit 1
+          fi
+
+          echo "Inspecting $binary_path"
+          otool -L "$binary_path"
+
+          if otool -L "$binary_path" | grep -q '/opt/homebrew/'; then
+            echo "macOS bundle links against Homebrew libraries, which breaks signed distribution builds."
+            exit 1
+          fi
+
       - name: Upload Linux AppImage artifact
         if: runner.os == 'Linux'
         uses: actions/upload-artifact@v4

.github/workflows/desktop-release.yml

@@ -167,6 +167,32 @@ jobs:
 
           echo "APPLE_SIGNING_IDENTITY=$signing_identity" >> "$GITHUB_ENV"
 
+      - name: Verify macOS binary does not link Homebrew libraries
+        if: matrix.platform == 'macos'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          cargo build \
+            --manifest-path apps/desktop/src-tauri/Cargo.toml \
+            --release \
+            --target "${{ matrix.target }}"
+
+          binary_path="apps/desktop/src-tauri/target/${{ matrix.target }}/release/codelegate-desktop"
+
+          if [[ ! -f "$binary_path" ]]; then
+            echo "Unable to locate built macOS binary at $binary_path"
+            exit 1
+          fi
+
+          echo "Inspecting $binary_path"
+          otool -L "$binary_path"
+
+          if otool -L "$binary_path" | grep -q '/opt/homebrew/'; then
+            echo "macOS binary links against Homebrew libraries, which breaks signed distribution builds."
+            exit 1
+          fi
+
       - name: Build and publish macOS release
         if: matrix.platform == 'macos'
         uses: tauri-apps/tauri-action@action-v0.6.0

apps/desktop/src-tauri/Cargo.lock

@@ -12,7 +12,7 @@ tauri-plugin-dialog = "2"
 tauri-plugin-notification = "2"
 portable-pty = "0.8"
 base64 = "0.22"
-git2 = "0.20"
+git2 = { version = "0.20", default-features = false, features = ["vendored-libgit2"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"