[Benoît Cortier (CBenoit)]

The Agent and the shared crates carry macOS-specific code, but CI compiled only jetsocat for macOS, so that code was never type-checked or tested there. Add a macos-15 (arm64) leg to the clippy and test jobs, let a failing leg finish without cancelling the other platforms, and bound the tests job at 60 minutes.

Running on macOS exposed these failures, now fixed:

• The PEDM hook declared its Windows-only dependencies unconditionally, and retour does not compile on aarch64, so the workspace did not build on Apple Silicon.
• The network scanner's async TCP connect treated only Linux's EINPROGRESS as a pending connection, so on macOS it never completed. It now fails with the error connect returns instead of waiting for the caller's timeout, and reads a failed connection's cause from the pending socket error, which kqueue needs and which lets callers tell a refused port from an unreachable host on every platform.
• Gateway configuration failed to load on macOS without an explicit web app path, even with the web app disabled; it now defaults to webapp under the macOS configuration directory.
• An agent stdin test outlasted the 5 s exit grace period on the macOS runner while draining its pipe.

The macOS Rust shim repair now runs before the Rust cache setup, including in the jetsocat job, because the cache action runs rustc first and a broken shim left those jobs uncached.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Rust shim repairs should precede cache initialization in both macOS jobs so broken shims do not prevent dependency caching.

1 open issue

• Repair the compiler shim before initializing the Rust cache · New

What changed in this PR

This PR extends CI coverage to macOS so platform-specific code in the Agent and shared crates is linted and tested, rather than only compiling jetsocat.

Changes:

• Add a macos-15 leg to Clippy and workspace tests.
• Configure tests for aarch64-apple-darwin while preserving Windows and Linux coverage.
• Add macOS Rust shim repair steps before linting and testing.

File	Description
.github/​workflows/​ci.yml	Adds macOS lint/test matrix entries and Rust shim repairs.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The focused workflow changes preserve existing platform coverage, address the prior cache-ordering feedback, and have no unresolved findings.

No open issues 🎉

1 resolved since last review

• Repair the compiler shim before initializing the Rust cache

_{Review effort: Balanced}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Benoît Cortier (CBenoit)]

Lines changed at 9e6e1c544 (added/removed):

Area	Files	+	−
Production code	network-scanner-net/src/socket.rs, devolutions-gateway/src/config.rs, devolutions-pedm-hook/Cargo.toml	54	19
Tests	network-scanner-net/src/tests.rs, devolutions-agent/src/psu_agent/process.rs (test module only)	43	6
Other (CI)	.github/workflows/ci.yml	52	19

No UNTESTED: comments were added.

Note

LLM-assisted content (no human feedback).

[Benoît Cortier (CBenoit)]

Review record. Copilot could not review 16c296075 for lack of quota, so the rounds after it ran with fresh-context local reviewers.

• Round 1 at 16c296075: fixed in 578bf5fc1 a connect that failed on the spot staying pending until the caller's timeout, failures seen through epoll or IOCP losing their cause, and two shim-repair steps missing their line continuation. Declined: sharing the shim-repair step in a composite action, because these jobs can check out an older commit that lacks it; the ci: squash title hiding the fix(dgw) changes from the changelog, since Gateway does not ship on macOS.
• Round 2 at 578bf5fc1: fixed in 4743f654e the untested immediate-failure path, EAGAIN counting as a connection in progress on Unix, the closed-port oracle section, and comment layout. Declined: a re-poll on Windows can restart a refused connect, which delays the same refused result.
• Round 3 at 4743f654e, final verdict: "I found no problems of low severity or above. The commit is correct and the new test should be deterministic on Linux, macOS and Windows." Its one nit, a missing Winsock oracle marker, is fixed in 9e6e1c544 (comment only, not re-reviewed).

Note

LLM-assisted content (no human feedback).