krz/octosentry

macOS menu bar app to monitor GitHub security alerts

clone: git clone https://gitbay.org/krz/octosentry.git

5f19c5dfef989f0ae7b7ebcb48d98ef8a8d98b74

signed_unknown_key

author: Christian Cleberg <hello@cleberg.net> · 2026-08-22T20:30:30Z
committer: <noreply@github.com>

Add CI workflow running xcodebuild test (#24)

Runs the macOS test scheme on pull_request and push to main.

Pins Xcode 26.1: the runner defaults to 16.4, which rejects
SecurityEventStore's async-let fetches under strict concurrency.

Ad-hoc signing, since the runner has no Developer ID certificate and
the sandbox/hardened-runtime entitlements need a signature for the UI
tests to launch the app.

Also adds the github-actions ecosystem to dependabot, now that there
are workflow action versions to update.

 .github/dependabot.yml     |  5 +++++
 .github/workflows/test.yml | 39 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 07c4e28..ed2c821 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,3 +9,8 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..1700853
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,39 @@
+name: test
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v4
+
+      # The runner defaults to Xcode 16.4, whose strict-concurrency checking
+      # rejects SecurityEventStore's async-let fetches. Pin to the newest
+      # Xcode on the image.
+      - name: Select Xcode
+        run: sudo xcode-select -s /Applications/Xcode_26.1.app
+
+      - name: Show toolchain
+        run: xcodebuild -version
+
+      # Ad-hoc signing: the runner has no Developer ID certificate, and the
+      # app's sandbox/hardened-runtime entitlements need a signature to be
+      # applied at all. Building fully unsigned makes the UI tests fail to
+      # launch the app.
+      - name: Test
+        run: |
+          xcodebuild test \
+            -scheme octosentry \
+            -destination 'platform=macOS' \
+            CODE_SIGN_IDENTITY="-" \
+            CODE_SIGN_STYLE=Manual \
+            DEVELOPMENT_TEAM="" \
+            PROVISIONING_PROFILE_SPECIFIER=""