macOS 那条腿静默退 1:一个没匹配到的 grep 被 pipefail 提升成了失败

构建报到 1564/1564 之后**没有任何输出**就退了 1。成因是捆绑块里每条流水线都以 grep
结尾,而**一个没匹配到东西的 grep 返回 1** —— pipefail 把它提升为整条流水线的状态,
errexit 再把它变成退出。

Linux 那条活了下来,因为它的第二个循环里没有 grep;macOS 的有:已经捆绑进来的 dylib
可能一个 /opt 依赖都不剩,于是 grep 空手而归。

⭐ 「捆绑步骤没找到东西要捆绑」不是错误;「载荷仍然指向自身之外」才是,而后者由下面
那条断言来说。所以这一段改为 set +e,并在结尾回报捆绑了几个库。

⚠️ 这是本项目已经记过一次的形状:pipefail 把一次成功的匹配读成失败(那次是 grep -q
被 SIGPIPE 打断读成 141)。同一条管道,反方向。

Author: speak-agent

.github/workflows/build.yml

@@ -315,6 +315,7 @@ jobs:
           # carrying a second libc into a process is the two-glibcs shape this
           # index's own contract text names as a SIGSEGV source.
           if [ "$RUNNER_OS" = "Linux" ]; then
+            set +e   # same reason as the macOS branch below
             ldd qemu-system-x86_64 \
               | awk '/=> \// {print $3}' \
               | grep -vE '/(libc|libm|libdl|librt|libpthread|libresolv|ld-linux[^ ]*)\.so' \
@@ -326,7 +327,19 @@ jobs:
             sudo apt-get install -y -qq patchelf
             patchelf --set-rpath '$ORIGIN/../lib' ../out/bin/qemu-system-x86_64
             for so in ../out/lib/*.so*; do patchelf --set-rpath '$ORIGIN' "$so" 2>/dev/null || true; done
+            echo "bundled: $(ls -1 ../out/lib 2>/dev/null | wc -l) libraries"
+            set -e
           elif [ "$RUNNER_OS" = "macOS" ]; then
+            # ⚠️ `set +e` FOR THIS BLOCK, AND THE REASON IS A SILENT KILL.
+            #
+            # The first version ran under `set -euo pipefail` and died with exit
+            # 1 and NO output, right after ninja reported 1564/1564. Every
+            # command here is in a pipeline ending in `grep`, and a `grep` that
+            # matches nothing returns 1 — which `pipefail` promotes to the
+            # pipeline's status and `-e` turns into an exit. A bundling step
+            # that finds nothing to bundle is not an error; a payload that still
+            # points outside itself is, and the assertion below is what says so.
+            set +e
             # Mach-O records each dependency by the install name the LIBRARY
             # carries, so copying is not enough: every reference has to be
             # rewritten, and so does each bundled library's own id.
@@ -350,6 +363,8 @@ jobs:
             # binary is killed by the kernel rather than merely warned about.
             codesign --force -s - ../out/bin/qemu-system-x86_64 2>/dev/null || true
             for dy in ../out/lib/*.dylib; do codesign --force -s - "$dy" 2>/dev/null || true; done
+            echo "bundled: $(ls -1 ../out/lib 2>/dev/null | wc -l) libraries"
+            set -e
           fi
           rmdir ../out/lib 2>/dev/null || true