fix: bundle theia native dependencies with stricter permissions

.github/workflows/build.yml

@@ -322,7 +322,7 @@ jobs:
 
       - name: Install Node.js
         if: runner.name != 'WINDOWS-SIGN-PC'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
@@ -456,7 +456,7 @@ jobs:
           name: ${{ env.STAGED_CHANNEL_FILE_ARTIFACT_PREFIX }}*
 
       - name: Install Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'

.github/workflows/check-i18n-task.yml

@@ -59,7 +59,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node.js 18.17
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '18.17'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/check-javascript.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ env.NODE_VERSION }}

.github/workflows/check-yarn.yml

@@ -67,7 +67,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ env.NODE_VERSION }}

.github/workflows/compose-full-changelog.yml

@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'

.github/workflows/i18n-nightly-push.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node.js 18.17
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '18.17'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/i18n-weekly-pull.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node.js 18.17
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: '18.17'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/test-javascript.yml

@@ -85,7 +85,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           cache: yarn
           node-version: ${{ env.NODE_VERSION }}

.github/workflows/themes-weekly-pull.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'

electron-app/resources/entitlements.mac.plist

@@ -8,7 +8,5 @@
     <true/>
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
-    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
-    <true/>
 </dict>
 </plist>

electron-app/webpack.config.js

@@ -1,5 +1,7 @@
 const path = require('node:path');
+const fs = require('fs');
 const webpack = require('webpack');
+const TheiaNativeWebpackPlugin = require('@theia/native-webpack-plugin');
 const frontend = require('./gen-webpack.config');
 const backend = require('./gen-webpack.node.config');
 const {
@@ -39,6 +41,27 @@ backend.config.entry['parcel-watcher'] = {
   },
 };
 
+// Override Theia native dependency bundler to assign stricter file permissions (chmod 755)
+// https://github.com/eclipse-theia/theia/blob/9a52544fb4c1ea1d3d0d6bcbe106b97184279030/dev-packages/native-webpack-plugin/src/native-webpack-plugin.ts#L149
+class NativeWebpackPlugin extends TheiaNativeWebpackPlugin {
+  // Override the method that writes/copies files
+  async copyExecutable(source, target) {
+    const targetDirectory = path.dirname(target);
+    await fs.promises.mkdir(targetDirectory, { recursive: true });
+    await fs.promises.copyFile(source, target);
+    await fs.promises.chmod(target, 0o755);
+  }
+}
+backend.config.plugins.push(new NativeWebpackPlugin({
+  out: 'native',
+  trash: true,
+  ripgrep: true,
+  pty: true,
+  nativeBindings: {
+    drivelist: 'drivelist/build/Release/drivelist.node',
+  },
+}));
+
 // Use a customized backend main that can enable the file logger in bundled mode.
 backend.config.entry['main'] = require.resolve('./arduino-ide-backend-main.js');