ci: build unit tests on Xcode 27 (test-only 12.0 target) and baseline six historical secret findings #1

Open

forge-recovery wants to merge 1 commits from ci/xcode27-unit-tests into master

pull from: ci/xcode27-unit-tests

merge into: KofTwentyTwo:master

KofTwentyTwo:master

KofTwentyTwo:gh-pages

KofTwentyTwo:cloudflare

KofTwentyTwo:many-windows-perf

KofTwentyTwo:yes-video

KofTwentyTwo:video-thumbnails

KofTwentyTwo:sequoia-bug-workaround

KofTwentyTwo:swipe

KofTwentyTwo:test-github-actions

KofTwentyTwo:dev

KofTwentyTwo:pull-3468

KofTwentyTwo:netlify

KofTwentyTwo:mouse-hover

KofTwentyTwo:develop

KofTwentyTwo:apple-events-login-items

KofTwentyTwo:interpolated-imageview

Conversation 0 Commits 1 Files Changed 2

+13 -2

forge-recovery commented 2026-11-01 22:13:57 +00:00

Owner

Copy link

Copy source

Unblocks the central native CI for this fork on Xcode 27.2 (native.yaml run 713 on master, run 730 on this branch).

Changes (2 files)

• config/test-base.xcconfig (unit-tests target only): MACOSX_DEPLOYMENT_TARGET 10.13 -> 12.0, the lowest Xcode 27.2 accepts
  (run 713: "set to 10.13, but the range of supported deployment target versions is 12.0 to 27.2.x"). The shipping app keeps 10.13 in
  config/base.xcconfig, which scripts/update_appcast.sh also reads. At 12.0 the test build turned uses of APIs deprecated in macOS 11/12
  into errors (SidebarList.swift, Mocks.swift) because of SWIFT_TREAT_WARNINGS_AS_ERRORS; for the test build only that setting is replaced by
  -warnings-as-errors -Wwarning DeprecatedDeclaration, so every other warning is still an error and no shipping code changes.
• .gitleaksignore: the six exact historical fingerprints reported by the central scan (AppCenter MSACEncrypterPrivate.h, readOnlyToken in four
  scripts). No patterns. Verified with the pinned gitleaks 8.21.2: 6 findings without the file, none with it. Run 730 secrets job: success.

Guard A (the Test scheme / scripts/run_tests.sh), Guard B (LicenseManager depaywall + guard false else) and Guard C (conflict markers)
and guard.yml are untouched.

Verified

• Same project, Test scheme, Release, Xcode 27.2 on the Grogu Mac in a normal user session: build succeeds, 492 tests executed, 0 failures,
  16 skipped (TEST SUCCEEDED).
• Central run 730 on this branch: build compiles, secrets green, tests still fail on the runner, see below.

Still open (not fixed here, not hidden)

1. Runner session (root-owned): in the gitea-native LaunchDaemon session (launchctl managername: System) xcodebuild test cannot reach
   com.apple.testmanagerd.control ("Connection init failed at lookup with error 3 - No such process"), even though unit-tests has no
   TEST_HOST (a logic-test bundle). This is the runner-session issue, not a source problem.
2. 16 skipped tests: all LicenseManagerTests, if true { throw XCTSkip("alt-tab-free [depaywall] ...") }, the fork's deliberate marker for neutralized
   paywall tests. The native Swift profile fails on any skip. They are not removed or allowlisted here; that needs an explicit decision.

Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com

Unblocks the central native CI for this fork on Xcode 27.2 (native.yaml run 713 on master, run 730 on this branch). ## Changes (2 files) - `config/test-base.xcconfig` (unit-tests target only): `MACOSX_DEPLOYMENT_TARGET` 10.13 -> 12.0, the lowest Xcode 27.2 accepts (run 713: "set to 10.13, but the range of supported deployment target versions is 12.0 to 27.2.x"). The shipping app keeps 10.13 in `config/base.xcconfig`, which `scripts/update_appcast.sh` also reads. At 12.0 the test build turned uses of APIs deprecated in macOS 11/12 into errors (`SidebarList.swift`, `Mocks.swift`) because of `SWIFT_TREAT_WARNINGS_AS_ERRORS`; for the test build only that setting is replaced by `-warnings-as-errors -Wwarning DeprecatedDeclaration`, so every other warning is still an error and no shipping code changes. - `.gitleaksignore`: the six exact historical fingerprints reported by the central scan (AppCenter `MSACEncrypterPrivate.h`, `readOnlyToken` in four scripts). No patterns. Verified with the pinned gitleaks 8.21.2: 6 findings without the file, none with it. Run 730 `secrets` job: success. Guard A (the `Test` scheme / `scripts/run_tests.sh`), Guard B (LicenseManager `depaywall` + `guard false else`) and Guard C (conflict markers) and `guard.yml` are untouched. ## Verified - Same project, `Test` scheme, Release, Xcode 27.2 on the Grogu Mac in a normal user session: build succeeds, 492 tests executed, 0 failures, **16 skipped** (`TEST SUCCEEDED`). - Central run 730 on this branch: build compiles, secrets green, tests still fail on the runner, see below. ## Still open (not fixed here, not hidden) 1. **Runner session (root-owned)**: in the `gitea-native` LaunchDaemon session (`launchctl managername: System`) `xcodebuild test` cannot reach `com.apple.testmanagerd.control` ("Connection init failed at lookup with error 3 - No such process"), even though `unit-tests` has no `TEST_HOST` (a logic-test bundle). This is the runner-session issue, not a source problem. 2. **16 skipped tests**: all `LicenseManagerTests`, `if true { throw XCTSkip("alt-tab-free [depaywall] ...") }`, the fork's deliberate marker for neutralized paywall tests. The native Swift profile fails on any skip. They are not removed or allowlisted here; that needs an explicit decision. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

forge-recovery added 1 commit 2026-11-01 22:13:57 +00:00

ci: build the unit-test target on Xcode 27 and baseline approved historical secret findings ... d748647e9b

- config/test-base.xcconfig (unit-tests target only): MACOSX_DEPLOYMENT_TARGET 10.13 -> 12.0, the lowest Xcode 27.2 supports. The shipping app keeps 10.13 in config/base.xcconfig (also read by scripts/update_appcast.sh).
- Same file: deprecation warnings (APIs deprecated in macOS 11/12 and used by the 10.13 app code) are downgraded for the test build only, via -warnings-as-errors followed by -Wwarning DeprecatedDeclaration; every other warning stays an error.
- .gitleaksignore: the six exact historical fingerprints from the central scan, no patterns.

Guards A (Test scheme), B (LicenseManager depaywall markers) and C (conflict markers) are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes referenced this issue from a commit 2026-11-08 23:27:44 +00:00

ci: build on the shared ci-workflows macOS workflow (build only)

james.maes referenced this pull request 2026-11-08 23:27:45 +00:00

ci: build on the shared ci-workflows macOS workflow (build only) #2

Some required checks failed

Hide all checks

KofTwentyTwo/ci-policy: ci / fork-guard (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / go-0 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / go-nix-1 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / gradle-2 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / gradle-3 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / java-docker-4 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / java-maven-5 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / manifests-6 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / nix-7 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / node-8 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / python-9 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / rust-10 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / rust-11 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / rust-12 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-0 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-1 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-2 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-3 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-4 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-5 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-6 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / image-build-7 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: ci / not-enrolled (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: native / fork-deny (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: native / dotnet-0 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: native / dotnet-1 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: native / swift-3 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: native / swift-4 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: native / swift-5 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: native / swift-6 (pull_request) Skipped

Details

KofTwentyTwo/ci-policy: Shared source and config CI / verify (pull_request) Failing after 17s

Details

KofTwentyTwo/ci-policy: Shared Swift CI / verify (pull_request) Failing after 18s

Details

KofTwentyTwo/ci-policy: Shared source and config CI / secrets (pull_request) Successful in 45s

Details

KofTwentyTwo/ci-policy: Shared Swift CI / secrets (pull_request) Successful in 46s

Details

KofTwentyTwo/ci-policy: Shared source and config CI / gate (pull_request) Failing after 11s

Details

KofTwentyTwo/ci-policy: ci / source-config-13 (pull_request) Failing after 58s

Details

KofTwentyTwo/ci-policy: Shared Swift CI / gate (pull_request) Failing after 12s

Details

KofTwentyTwo/ci-policy: native / swift-2 (pull_request) Failing after 59s

Details

KofTwentyTwo/ci-policy: ci / ci-result (pull_request) Failing after 8s

Details

KofTwentyTwo/ci-policy: native / native-result (pull_request) Failing after 8s

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin ci/xcode27-unit-tests:ci/xcode27-unit-tests

git checkout ci/xcode27-unit-tests

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

chokepoint-refresh

De-paywall chokepoint needs re-verification after upstream change (PLAN §4.2)

conflict

Upstream sync had merge conflicts; needs manual resolution (PLAN §4.2)

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

sync

Upstream-sync PR (PLAN §4.2)

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/CommandTabFree#1