krz/domain-dig

 1name: Build
 2
 3# 9201ef0 retired the previous workflow because the accessibility audit it ran
 4# reported findings that did not reproduce locally. That commit also recorded
 5# what went with it: nothing built a clean checkout of the merge result any
 6# more, and DomainDig.xcodeproj uses file-system-synchronized groups, so a
 7# folder missing from a commit still builds on the machine that has it and
 8# breaks for everyone else. The pre-push hook cannot catch that — it runs
 9# against a working tree where the file is still present.
10#
11# This restores the compile gate without the audit. -only-testing runs the unit
12# suite alone; DomainDigUITests, which holds AccessibilityAuditTests, is not
13# run. The app, widget and share extension are still built, because the scheme
14# builds them as dependencies — which is the part that was actually missed.
15on:
16  pull_request:
17    paths-ignore: ['*.md', 'Docs/*.md', '*.txt', 'Docs/*.txt']
18  workflow_dispatch:
19
20permissions:
21  contents: read
22
23concurrency:
24  group: build-${{ github.ref }}
25  cancel-in-progress: true
26
27jobs:
28  test:
29    name: xcodebuild test
30    # macos-latest still points at macOS 15, which lacks the iOS 26+ SDK this
31    # app is built against.
32    runs-on: macos-26
33
34    steps:
35      - uses: actions/checkout@v7
36
37      - name: Show toolchain
38        run: |
39          xcodebuild -version
40          swift --version
41
42      - name: Select simulator
43        id: sim
44        run: |
45          set -euo pipefail
46
47          # Newest available iPhone runtime; "newest" is always at or above the
48          # deployment target, so no floor filtering is needed.
49          selected=$(xcrun simctl list devices available --json \
50            | jq -c '
51                [ .devices | to_entries[]
52                  | (.key | capture("SimRuntime\\.iOS-(?<maj>[0-9]+)-(?<min>[0-9]+)$")) as $v
53                  | (($v.maj | tonumber) * 1000 + ($v.min | tonumber)) as $rank
54                  | .value[]
55                  | select(.name | startswith("iPhone"))
56                  | { rank: $rank, udid: .udid, name: .name, os: "\($v.maj).\($v.min)" }
57                ]
58                | sort_by(.rank, .name)
59                | last
60              ')
61
62          if [ -z "$selected" ] || [ "$selected" = "null" ]; then
63            echo "::error::No iPhone simulator available on this image"
64            xcrun simctl list devices available >&2
65            exit 1
66          fi
67
68          label=$(echo "$selected" | jq -r '"\(.name) (iOS \(.os))"')
69          echo "Selected $label"
70          echo "udid=$(echo "$selected" | jq -r .udid)" >> "$GITHUB_OUTPUT"
71          echo "label=$label" >> "$GITHUB_OUTPUT"
72
73      # CODE_SIGNING_ALLOWED=NO builds without a signing identity, which strips
74      # entitlements. OwnerAccess guards CloudKit behind an entitlements check
75      # for exactly that reason — without it the app aborts before its first
76      # screen.
77      - name: Test on ${{ steps.sim.outputs.label }}
78        run: |
79          set -o pipefail
80          xcodebuild test \
81            -project DomainDig.xcodeproj \
82            -scheme DomainDig \
83            -destination "id=${{ steps.sim.outputs.udid }}" \
84            -only-testing:DomainDigTests \
85            -resultBundlePath TestResults.xcresult \
86            CODE_SIGNING_ALLOWED=NO
87
88      - name: Upload results
89        if: failure()
90        uses: actions/upload-artifact@v7
91        with:
92          name: test-results
93          path: TestResults.xcresult
94          retention-days: 7