From 289e41852e14bac64d34774c2203fd579eecd374 Mon Sep 17 00:00:00 2001 From: Considus Date: Thu, 23 Jul 2026 23:59:42 +0100 Subject: [PATCH 1/2] =?UTF-8?q?chore:=20repo=20hygiene=20=E2=80=94=20PR=20?= =?UTF-8?q?template,=20Dependabot,=20SHA-pinned=20actions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three gaps found in a settings audit of the public repo: - No pull request template. Added one that asks for the test evidence (coreverify / swift test / xcodebuild / device) and makes the README non-negotiables an explicit checklist rather than something a contributor has to go and find. - No Dependabot config. The repo has no third-party package manifest, so the only pinned versions are the CI workflow's actions — this tracks those weekly, matching proton-bridge-mcp. - CI actions were pinned to floating major tags (@v4). Pinned to commit SHAs with the version in a trailing comment, so a compromised tag can't silently change what runs. Dependabot now keeps the SHAs current. No behaviour change to the app or to what CI actually executes. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 15 +++++++++++++++ .github/pull_request_template.md | 31 +++++++++++++++++++++++++++++++ .github/workflows/ci.yml | 12 ++++++------ 3 files changed, 52 insertions(+), 6 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/pull_request_template.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..d912497 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,15 @@ +version: 2 +updates: + # The app has no third-party package dependencies today (Package.resolved is + # gitignored and never exists at checkout), so there is no Swift manifest to + # track. The only pinned versions in the repo are the CI workflow's actions, + # which are pinned to commit SHAs — this keeps those SHAs current. + # + # Add a "swift" ecosystem block here the day a third-party dependency lands + # and Package.resolved gets committed. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + commit-message: + prefix: "ci" diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..75f69d6 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,31 @@ + + +## What this changes + + + +## How it was tested + + + +- [ ] `swift run coreverify` (52/52 green) +- [ ] `swift test` +- [ ] `xcodebuild test` on a simulator +- [ ] Checked on a physical device + +## Non-negotiables + + + +- [ ] No analytics, no telemetry, no off-device data transmission +- [ ] Zero-knowledge and encryption-always-on still hold +- [ ] `kSecAttrSynchronizable: false` on every Keychain item +- [ ] No changes to the frozen crypto contract bytes in `Sources/CatchlightCore/Crypto/` +- [ ] No new third-party dependencies + +## Anything else + + diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index abb33e9..932613f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,7 +33,7 @@ jobs: runs-on: macos-15 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Intentionally not pinning the Xcode version — the macos-15 image ships # multiple side-by-side Xcodes (16.x and newer). Letting the runner use @@ -47,7 +47,7 @@ jobs: # the same thing). Commit Package.resolved and add it back here the day a # third-party dependency lands. - name: Cache SwiftPM - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | .build @@ -73,7 +73,7 @@ jobs: runs-on: macos-15 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install XcodeGen run: brew install xcodegen @@ -82,7 +82,7 @@ jobs: run: xcodegen generate - name: Cache SwiftPM - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/Library/Caches/org.swift.swiftpm key: ${{ runner.os }}-xcode-spm-${{ hashFiles('Package.swift') }} @@ -115,7 +115,7 @@ jobs: - 'platform=iOS Simulator,name=iPhone 16,OS=latest' steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 # Intentionally not pinning the Xcode version — the macos-15 image ships # multiple side-by-side Xcodes (16.x and newer). Letting the runner use @@ -135,7 +135,7 @@ jobs: # SourcePackages under DerivedData/-/), so it restored # nothing while costing save/restore time. - name: Cache SwiftPM - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: ~/Library/Caches/org.swift.swiftpm key: ${{ runner.os }}-xcode-spm-${{ hashFiles('Package.swift') }} From 7f026541238fd90c26ee8343835fa105fb3da3d3 Mon Sep 17 00:00:00 2001 From: Considus Date: Fri, 24 Jul 2026 00:02:25 +0100 Subject: [PATCH 2/2] ci: warn that matrix strings are the required check names MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The two xcodebuild matrix destinations become the status-check names on branch protection. The comment right above them invites bumping 18.5 when the runner image moves on, which would rename a required check — the old name stays required, never reports, and main locks. Says so at the spot where someone would do it. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 932613f..ddab604 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -111,6 +111,12 @@ jobs: # dropped the exact 18.0 runtime (2026-06-15: now ships 18.5 / 18.6 + # 26.x), so this is pinned to the lowest available 18.x. Bump again if a # future image drops 18.5 too (check the "List available simulators" step). + # + # ⚠️ These matrix strings ARE the status-check names on branch protection + # (e.g. "iOS (xcodebuild test) (platform=iOS Simulator,name=iPhone 16, + # OS=18.5)"). Editing one renames its check, and the old name stays + # required and never reports — which blocks every merge to main until + # branch protection is updated to match. Change both together. - 'platform=iOS Simulator,name=iPhone 16,OS=18.5' - 'platform=iOS Simulator,name=iPhone 16,OS=latest' steps: