CC-19: Swift compile gate (hosted macOS CI + ruleset handoff)

[jaywedgeworth22]

CC-19 — CodeCaps had no compile gate: Swift CI ran but ruleset default-main-protection (24433457) required no status checks, and parallel macos-latest jobs could starve the queue.

Summary

Adds the CC-19 hosted Swift compile gate for CodeCaps. The change wires Swift CI job names into required status-check contexts, serializes the iOS companion compile behind the Mac package build, cancels stale pull-request runs, and makes Mac Release wait for those Swift CI checks on push commits before publishing a Sparkle release. It also adds rollout documentation for the repository-admin handoff needed to configure the existing ruleset.

Functional changes

• Swift CI (.github/workflows/swift-ci.yml)

  • Adds explicit job names Mac package build and test and iOS companion compile so GitHub reports stable status contexts for required checks.
  • Adds workflow_dispatch support.
  • Changes concurrency cancellation so stale pull-request runs are cancelled; other runs are not cancelled.
  • Adds job timeouts of 45 minutes.
  • Makes companion depend on package (needs: package), ensuring a PR does not hold two macOS runners at once and that companion compile runs only after the package job succeeds.

• Mac Release (.github/workflows/mac-release.yml)

  • Adds an await-swift-ci job for non-fork push events on ubuntu-latest.
  • Polls GitHub check-runs for Mac package build and test and iOS companion compile on the current commit.
  • Fails closed when either check concludes failure, cancelled, timed_out, action_required, or stale; waits while checks are missing or pending; and times out after roughly 85 minutes.
  • Makes the release job depend on await-swift-ci and proceed only when the gate succeeded or was skipped.
  • Intended to close the race where Sparkle releases could publish while Swift compile jobs were still pending.

• Rollout documentation (docs/rollouts/2026-10-15-cc19-compile-gate.md)

  • Documents the purpose of the compile gate and the ruleset handoff.
  • Provides required status-check contexts for ruleset default-main-protection (24433457):
    • Mac package build and test
    • iOS companion compile
    • gitleaks
  • Notes that the ruleset edit itself is not applied in CI and must be done by an admin.
  • Includes order-of-operations guidance, verification commands, and deferred work.

• Agent documentation (AGENTS.md)

  • Adds a reference to the hosted compile gate workflow and rollout document, including the required check names for the default-main-protection ruleset.

Rollout / verification

• The ruleset change is documented but not applied by this PR; an admin must add the required status checks after this lands on main.
• Validation in the rollout doc uses YAML parse checks for both workflows.
• Hosted macOS compile is validated by the PR’s Swift CI run after push.

Automated review findings

The automated review reported three findings against this PR:

• High: .github/workflows/mac-release.yml — workflow_dispatch of mac-release bypasses the await-swift-ci gate, allowing Sparkle releases without compile verification.
• High: .github/workflows/mac-release.yml — the single-page check-runs fetch can miss Swift CI checks on busy commits, causing the gate to time out.
• Medium: a business logic gap was detected based on the PR requirements.

[linear-code]

CC-19

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

❌ Error processing validation

An error occurred while processing the system response. Please try again.

Details

• Analyzer execution failed: Timeout after 120000ms in business-rules-analyzer-attempt-1

---

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.

[kody-ai]

Manual workflow_dispatch of the mac-release workflow publishes a Sparkle release without any Swift CI compile check because await-swift-ci is gated to github.event_name == 'push' only, causing await-swift-ci.result == 'skipped' to be treated as a green light and defeating the CC-19 gate. Loosen the await-swift-ci if to just github.event.repository.fork == false so release gates on result == 'success' for all triggers.

await-swift-ci:
  if: github.event.repository.fork == false

Prompt for LLM

File .github/workflows/mac-release.yml:

Line 59:

Manual `workflow_dispatch` of the `mac-release` workflow publishes a Sparkle release without any Swift CI compile check because `await-swift-ci` is gated to `github.event_name == 'push'` only, causing `await-swift-ci.result == 'skipped'` to be treated as a green light and defeating the CC-19 gate. Loosen the `await-swift-ci` if to just `github.event.repository.fork == false` so `release` gates on `result == 'success'` for all triggers.

Suggested Code:

  await-swift-ci:
    if: github.event.repository.fork == false

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​

[kody-ai]

The check-runs poll in await-swift-ci fetches ?per_page=100 once per iteration with no server-side name filter or Link header pagination, so required checks like Mac package build and test and iOS companion compile on page 2+ of a mature repo's check-runs list are never detected, keeping pending at 1 until the 5100s deadline. Filter the gh api call with an encoded &check_name= parameter per required check to ensure the gate sees all required entries.

while [ "$(date +%s)" -lt "$deadline" ]; do
  pending=0
  failed=0
  for check_name in "${required_checks[@]}"; do
    enc_name=$(printf '%s' "$check_name" | python3 -c 'import sys,urllib.parse;print(urllib.parse.quote(sys.stdin.read(),safe=""))')
    payload="$(gh api "repos/${REPO}/commits/${SHA}/check-runs?per_page=100&check_name=${enc_name}")"

Prompt for LLM

File .github/workflows/mac-release.yml:

Line 75 to 76:

The check-runs poll in `await-swift-ci` fetches `?per_page=100` once per iteration with no server-side name filter or `Link` header pagination, so required checks like `Mac package build and test` and `iOS companion compile` on page 2+ of a mature repo's check-runs list are never detected, keeping `pending` at 1 until the 5100s deadline. Filter the `gh api` call with an encoded `&check_name=` parameter per required check to ensure the gate sees all required entries.

Suggested Code:

          while [ "$(date +%s)" -lt "$deadline" ]; do
            pending=0
            failed=0
            for check_name in "${required_checks[@]}"; do
              enc_name=$(printf '%s' "$check_name" | python3 -c 'import sys,urllib.parse;print(urllib.parse.quote(sys.stdin.read(),safe=""))')
              payload="$(gh api "repos/${REPO}/commits/${SHA}/check-runs?per_page=100&check_name=${enc_name}")"

_{Talk to Kody by mentioning @kody}

_{Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.}

​

​