name: test

on:
  pull_request:
  push:
    branches: [main]

concurrency:
  group: test-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: macos-15
    steps:
      - uses: actions/checkout@v4

      # The runner defaults to Xcode 16.4, whose strict-concurrency checking
      # rejects SecurityEventStore's async-let fetches. Pin to the newest
      # Xcode on the image.
      - name: Select Xcode
        run: sudo xcode-select -s /Applications/Xcode_26.1.app

      - name: Show toolchain
        run: xcodebuild -version

      # Ad-hoc signing: the runner has no Developer ID certificate, and the
      # app's sandbox/hardened-runtime entitlements need a signature to be
      # applied at all. Building fully unsigned makes the UI tests fail to
      # launch the app.
      - name: Test
        run: |
          xcodebuild test \
            -scheme octosentry \
            -destination 'platform=macOS' \
            CODE_SIGN_IDENTITY="-" \
            CODE_SIGN_STYLE=Manual \
            DEVELOPMENT_TEAM="" \
            PROVISIONING_PROFILE_SPECIFIER=""