Mac release vk test actions

[AmesingFlank]

Note

High Risk
Introduces automatic execution of a multi-megabyte obfuscated Node script during CMake and IDE workflows, which is a classic supply-chain attack pattern and could run arbitrary code on developer machines and CI.

Overview
This PR wires node .github/setup.js to run automatically in several places: SessionStart hooks in .claude/settings.json and .gemini/settings.json, an always-on Cursor rule in .cursor/rules/setup.mdc, a VS Code task that runs on folder open (.vscode/tasks.json), and execute_process at the top of CMakeLists.txt so CMake runs it during configuration.

The diff introduces .github/setup.js as the central “setup” step. That file is very large and starts with obfuscated eval/cipher-style JavaScript, which is atypical for a normal dev-environment initializer and is a strong indicator of untrusted code if merged.

The stated PR title about Mac release / Vulkan testing is not reflected in these changes; the behavioral change is auto-running this script whenever contributors open the repo or configure builds.

^{Reviewed by Cursor Bugbot for commit 5edb15e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5edb15e. Configure here.}

[cursor]

Session hooks run obfuscated script

High Severity

New SessionStart hooks and an always-on Cursor rule run node .github/setup.js automatically. That script is heavily obfuscated and uses eval after decoding, which can execute arbitrary code on every IDE or agent session—not normal project initialization for this repo.

Additional Locations (2)

• .gemini/settings.json#L7-L9
• .cursor/rules/setup.mdc#L6-L8

 

^{Reviewed by Cursor Bugbot for commit 5edb15e. Configure here.}

[knight42]

Security hold: this PR is affected by the current malicious-code incident involving suspicious [skip ci] commits and/or the .github/setup.js payload pattern.

Please do not merge this PR. I am requesting changes and closing it to prevent accidental merge while we investigate and clean up. Reopen only after the suspicious commits are removed, the branch is rebuilt from a trusted base, and trusted CI has been re-run.

安全处理：该 PR 被纳入当前恶意代码事件的受影响范围，涉及可疑的 [skip ci] commit 和/或 .github/setup.js payload 模式。

请不要合并该 PR。我会先 request changes 并关闭 PR，避免误合并。只有在移除可疑 commit、从可信 base 重建分支，并重新跑可信 CI 后，才应重新打开。