Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/swift-sdk/run_tests.sh`:
- Around line 11-17: The script run_tests.sh currently sets SIM_NAME by parsing
device display names which can be ambiguous; instead derive a SIM_UDID and use
-destination "id=$SIM_UDID". Update run_tests.sh to introduce a SIM_UDID
variable (e.g., SIM_UDID="${SIM_UDID:-}") and, when empty, run xcrun simctl list
devices available to pick the first matching iPhone device UDID (not the display
name). Replace uses of SIM_NAME/-destination "platform=iOS
Simulator,name=$SIM_NAME" with -destination "id=$SIM_UDID" so xcodebuild targets
the exact simulator UDID.

In
`@packages/swift-sdk/SwiftTests/SwiftDashSDKIntegrationTests/Support/CoreRPCClient.swift`:
- Around line 74-76: CoreRPCClient.call builds a URLRequest but doesn't set a
timeout, leaving the default (~60s idle) which can hang tests; set an explicit
timeoutInterval on the URLRequest (e.g., request.timeoutInterval = 30) before
using URLSession to bound RPC call time, and ensure any related helper paths in
CoreRPCClient.call respect this timeout when creating the request.

---

Nitpick comments:
In
`@packages/swift-sdk/SwiftTests/SwiftDashSDKTests/PlatformWalletTypesTests.swift`:
- Around line 27-34: The test testDataFromOddLengthHexString currently only
asserts non-nil for an implementation-dependent outcome; change it to assert a
deterministic contract: decide whether Data(hexString:) should reject odd-length
hex (preferred) or normalize it, then update the test to assert that exact
behavior—for example, if you choose rejection, replace XCTAssertNotNil(data)
with XCTAssertNil(data) and optionally assert a specific error/path; if you
choose acceptance, assert the exact expected bytes (e.g., XCTAssertEqual(data,
expectedData)). Ensure the assertion references the Data(hexString:) initializer
and the test method name testDataFromOddLengthHexString so the behavior is
explicit and reproducible.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/swift-sdk-build.yml:
- Around line 95-98: The workflow currently disables failure handling with "set
+e" and forces success with a trailing "true", causing failures in "yarn
dashmate group stop --group=local --force" and "yarn dashmate group reset
--group=local --hard --verbose" to be ignored; restore strict error handling by
removing "set +e" and the final "true" (or re-enable with "set -e" after the
block) so any non-zero exit from those yarn dashmate commands fails the job, or
explicitly propagate errors by appending "|| exit 1" to the reset command.

In
`@packages/swift-sdk/SwiftTests/SwiftDashSDKIntegrationTests/Support/IntegrationTestCase.swift`:
- Line 9: The shared cached variable bootstrapResult in IntegrationTestCase is
accessed from nonisolated(unsafe) context in sharedEnv() and can race; protect
all reads/writes to bootstrapResult by introducing synchronization (e.g., a
private static serial DispatchQueue or an actor) and marshal all accesses
through it inside sharedEnv() and any other accessors; update sharedEnv() to
perform the check/read/write of bootstrapResult on that queue (or via await if
using an actor) so initialization is atomic and thread-safe while keeping the
existing API.

In
`@packages/swift-sdk/SwiftTests/SwiftDashSDKIntegrationTests/Support/IntegrationTestEnv.swift`:
- Around line 18-20: IntegrationTestEnv currently exposes nonisolated(unsafe)
shared mutable state via spvStarted and trackedWalletIds and performs an
unsynchronized check/set in ensureSPVStarted(), causing race conditions; fix by
moving these vars into a synchronized context (either make IntegrationTestEnv an
actor or add a private serial synchronization primitive such as a dedicated
DispatchQueue or Lock) and update all accessors (ensureSPVStarted(), any
append/iterate/clear operations on trackedWalletIds) to run on that
synchronization context so the check-and-set in ensureSPVStarted() is atomic (no
await between check and set) and all mutations/read of trackedWalletIds are
serialized.

In
`@packages/swift-sdk/SwiftTests/SwiftDashSDKIntegrationTests/Support/Shell.swift`:
- Around line 74-77: The code currently calls process.waitUntilExit() before
reading stdout/stderr which can deadlock; change Shell.run (or the function
creating Process and using stdoutPipe/stderrPipe) to read the pipes
asynchronously: set stdoutPipe.fileHandleForReading.readabilityHandler and
stderrPipe.fileHandleForReading.readabilityHandler to append incoming Data into
local Data buffers, then call process.waitUntilExit(), then clear the
readabilityHandlers and use the accumulated Data (instead of calling
readDataToEndOfFile() after waitUntilExit()). Ensure handlers are removed (set
to nil) to avoid leaks and convert the collected Data to strings as before.

In
`@packages/swift-sdk/SwiftTests/SwiftDashSDKIntegrationTests/Support/TestWallet.swift`:
- Around line 44-49: The loop currently checks the deadline before calling
condition(), which can suppress an exception thrown by condition() on the final
attempt; change the loop in the waiting helper (the block that creates deadline,
calls try await condition(), sleeps with Task.sleep using pollInterval, and
throws TimeoutError) so you call try await condition() first, return on success,
then if Date() >= deadline throw the TimeoutError, and only then await
Task.sleep; this ensures any error from condition() on the final attempt is
propagated instead of being replaced by the TimeoutError.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/swift-sdk-build.yml:
- Line 94: The workflow is using floating refs (actions/setup-node@v4 and
cargo-bins/cargo-binstall@v1.3.1); pin both Actions to immutable commit SHAs
instead of version tags to harden supply-chain integrity — locate the
corresponding repository commit SHAs for actions/setup-node and
cargo-bins/cargo-binstall (from their GitHub repos or Marketplace pages) and
replace the usages "actions/setup-node@v4" and
"cargo-bins/cargo-binstall@v1.3.1" with "actions/setup-node@<commit-sha>" and
"cargo-bins/cargo-binstall@<commit-sha>" respectively, keeping the rest of the
workflow unchanged.

      - name: Install wasm-pack
        run: cargo binstall wasm-pack@0.13.1 -y