Merge pull request 'ci: build on the shared ci-workflows macOS workflow (build only)' (#2) from ci/shared-macos into master

The background closures in ExceptionsTab.applyContent and
ExceptionEditorView.resolveHeaderAsync captured row/self strongly while the
inner main-queue closure asked for weak; Xcode 27's Swift diagnoses the
mismatch (#ImplicitStrongCapture), an error under warnings-as-errors. Both
closures now capture weakly, so neither keeps the row or view alive while
the app info resolves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -0,0 +1,31 @@
+# Gitea CI on the shared KofTwentyTwo/ci-workflows macOS workflow (grogu). The .github workflows keep
+# running on the GitHub mirror (release, notarization, appcast); this one is build only and unsigned.
+#
+#   Guard B  the de-paywall marker and the if-false wrap are still in computeState() (docs/PLAN-maintained-fork.md §4.4)
+#   Guard C  no unresolved merge conflict markers in the tree
+#   build    the Release scheme, unsigned (a compile check at macOS 12.0: grogu has only Xcode 27)
+#   Guard A  the Test scheme is compiled (build-for-testing) but not run: the grogu runner has no GUI session for
+#            testmanagerd. Run scripts/run_tests.sh locally before merging (docs/contributing.md).
+name: build
+on:
+  push:
+    branches: ['**']
+jobs:
+  macos:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/macos.yaml@v1
+    with:
+      commands: |
+        F=src/pro/license/LicenseManager.swift
+        [ -f "$F" ] || { echo "::error::Guard B: $F not found; chokepoint moved? Refresh the de-paywall patch (§6.2)."; exit 1; }
+        grep -q 'depaywall' "$F" || { echo "::error::PAYWALL RELOCKED: 'depaywall' marker missing from $F (§6.2)."; exit 1; }
+        grep -Eq 'guard[[:space:]]+false[[:space:]]+else' "$F" || { echo "::error::PAYWALL RELOCKED: 'if false { … }' wrap missing from $F (§6.2)."; exit 1; }
+        echo "Guard B OK"
+        if git -c grep.lineNumber=false grep -nE '^(<<<<<<<|=======|>>>>>>>)' -- . ':(exclude)docs/'; then
+          echo "::error::UNRESOLVED CONFLICT MARKERS present; resolve before merge (§4.4 Guard C)."; exit 1
+        fi
+        echo "Guard C OK"
+        # grogu has only Xcode 27.2, which rejects the app's 10.13 deployment target (the shipping build is the GitHub
+        # mirror's, on Xcode 26.0.1). This compile check builds at 12.0 with the same deprecation downgrade as
+        # config/test-base.xcconfig; every other Swift warning stays an error.
+        xcodebuild -quiet -project alt-tab-macos.xcodeproj -scheme Release -derivedDataPath DerivedData CODE_SIGN_IDENTITY=- CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO MACOSX_DEPLOYMENT_TARGET=12.0 SWIFT_TREAT_WARNINGS_AS_ERRORS=NO 'OTHER_SWIFT_FLAGS=$(inherited) -warnings-as-errors -Wwarning DeprecatedDeclaration' build
+        xcodebuild -quiet -project alt-tab-macos.xcodeproj -scheme Test -configuration Release -derivedDataPath DerivedData build-for-testing

.gitleaksignore

@@ -1,8 +0,0 @@
-# Approved historical findings (exact fingerprints only, no patterns): readOnlyToken values in contributor/l10n scripts and an AppCenter
-# encryption key size constant, all introduced upstream before this fork. Any new or different finding is still reported.
-9147a4a864689ab94531c75b1b04d7c4f3581def:vendor/AppCenter/Sources/AppCenter/Internals/Util/MSACEncrypterPrivate.h:generic-api-key:20
-44007195b77d6809048c134c78a6d68d1895704f:scripts/update_readme_and_website.sh:generic-api-key:6
-528028d41bbbe57ea90b89a04a96a114872c405f:scripts/export_l10n_strings_to_poeditor.sh:generic-api-key:5
-d544ff3b7a6d4023ccd25783008836f50ec5b79d:scripts/import_l10n_strings_from_poeditor.sh:generic-api-key:5
-9a04c275cb9fba763c2272acc09055bf6476755d:scripts/update_contributors.sh:generic-api-key:5
-13c1cb0d000401df11a1c496b5273338db1886d7:scripts/import_l10n_strings_from_poeditor.sh:generic-api-key:6

docs/contributing.md

@@ -11,6 +11,12 @@ This project has minimal dependency on Xcode-only features (e.g. InterfaceBuilde
 * `scripts/codesign/setup_local.sh` to generate a local self-signed certificate, to avoid having to re-check the `System Preferences > Security & Privacy` permissions on every build
 * Either open `alt-tab-macos.xcodeproj` with Xcode, or use the CLI: `xcodebuild -project alt-tab-macos.xcodeproj -scheme Debug` to build the .app with the `Debug` build configuration
 
+### Tests (run locally before merging)
+
+The Gitea CI (`.gitea/workflows/build.yaml`) runs Guards B and C (the de-paywall markers and conflict markers), builds the `Release` scheme unsigned and compiles the `Test` scheme (`build-for-testing`), but does not run the tests: its macOS runner has no GUI session, so `xcodebuild test` cannot reach `testmanagerd`. Run them, including the anti-relock tests in `src/pro/license/LicenseManagerTests.swift` (Guard A, `docs/PLAN-maintained-fork.md` §4.4), locally before merging, especially an upstream sync:
+
+* `scripts/run_tests.sh` (the `Test` scheme, `-configuration Release`)
+
 ## Mac development
 
 Mac development ecosystem is pretty terrible in general. They keep piling on the tech stacks on top of each other, so you have C APIs, ObjC APIs, Swift APIs, Interface builder, Playgrounds, Swift UI, Mac Catalyst. All these are bridging with each other with a bunch of macros, SDKs glue, compiler flags, compatibility mode, XCode legacy build system, etc. For alt-tab, we are on Swift 5.0. Note that swift just recently started being stable, but overall any change of version breaks a lot of stuff. Swift itself is the mainstream language with the worst governance I’ve seen in modern times.

src/preferences/settings-window/tabs/ExceptionEditorView.swift

@@ -291,7 +291,7 @@ class ExceptionEditorView: NSView {
     }
 
     private func resolveHeaderAsync(for bundleId: String) {
-        DispatchQueue.global(qos: .userInitiated).async {
+        DispatchQueue.global(qos: .userInitiated).async { [weak self] in
             let info = AppDisplayInfo.resolve(bundleId: bundleId)
             DispatchQueue.main.async { [weak self] in
                 guard let self, self.entry.bundleIdentifier == bundleId else { return }

src/preferences/settings-window/tabs/ExceptionsTab.swift

@@ -319,7 +319,7 @@ class ExceptionsTab {
         // BundleId changed (or first paint): show a synchronous placeholder, then resolve async.
         row.setIcon(AppDisplayInfo.genericIcon, size: iconSize)
         row.setContent(bundleId, summary)
-        DispatchQueue.global(qos: .userInitiated).async {
+        DispatchQueue.global(qos: .userInitiated).async { [weak row] in
             let info = AppDisplayInfo.resolve(bundleId: bundleId)
             DispatchQueue.main.async { [weak row] in
                 guard let row else { return }