open-eid · martenrebane · Sep 11, 2026
diff --git a/.github/actions/setup-build-env/action.yml b/.github/actions/setup-build-env/action.yml
@@ -0,0 +1,111 @@
+name: Set up RIA DigiDoc build environment
+description: Prepares a macOS runner to build RIA DigiDoc iOS.
+
+inputs:
+  xcode:
+    description: Xcode version
+    required: true
+  google-services-plist:
+    description: Base64-encoded GoogleService-Info.plist
+    required: true
+
+outputs:
+  app-version:
+    description: MARKETING_VERSION from the project, also exported as APP_VERSION
+    value: ${{ steps.app-version.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Download Libdigidocpp iOS artifact
+      uses: dawidd6/action-download-artifact@v21
+      with:
+        workflow: build.yml
+        branch: master
+        name: iphoneos
+        path: libdigidocpp-ios
+        repo: open-eid/libdigidocpp
+    - name: Download Libdigidocpp iOS Simulator artifact
+      uses: dawidd6/action-download-artifact@v21
+      with:
+        workflow: build.yml
+        branch: master
+        name: iphonesimulator
+        path: libdigidocpp-ios-simulator
+        repo: open-eid/libdigidocpp
+    - name: Extract libdigidocpp artifacts
+      shell: bash
+      run: |
+        unzip -o libdigidocpp-ios/libdigidocpp.iphoneos.zip -d libdigidocpp.iphoneos
+        unzip -o libdigidocpp-ios-simulator/libdigidocpp.iphonesimulator.zip -d libdigidocpp.iphonesimulator
+    - name: Update libdigidocpp in project
+      shell: bash
+      run: |
+        export LIBDIGIDOCPP_PATH=${{ github.workspace }}/Modules/LibdigidocLib/Sources/LibdigidocObjC/Libs/digidocpp.xcframework
+        rm -rf $LIBDIGIDOCPP_PATH/ios-arm64 && mkdir $LIBDIGIDOCPP_PATH/ios-arm64 && cp -r ${{ github.workspace }}/libdigidocpp.iphoneos/libdigidocpp.iphoneos/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64/
+        rm -rf $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && mkdir $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && cp -r ${{ github.workspace }}/libdigidocpp.iphonesimulator/libdigidocpp.iphonesimulator/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator/
+    - name: Install dependencies
+      shell: bash
+      run: brew install mockolo
+    - name: Setup config and TSL files
+      shell: bash
+      run: |
+        export RESOURCES_DIRECTORY="Modules/ConfigLib/Sources/ConfigLib/Resources"
+        export CONFIG_DIRECTORY="$RESOURCES_DIRECTORY/config"
+        export TSL_FILES_DIRECTORY="$RESOURCES_DIRECTORY/tslFiles"
+
+        # Create TSL folder and mock folders for each module
+        mkdir -p $TSL_FILES_DIRECTORY
+
+        # SPM packages must exist and need at least 1 file. Mock files are generated in 'Run tests' step
+        for module in CommonsLib ConfigLib WebEidLib CryptoLib IdCardLib LibdigidocLib MobileIdLib SmartIdLib UtilsLib; do
+          mock_dir="Modules/${module}/Tests/Mocks/Generated"
+          mkdir -p "$mock_dir"
+          echo "// Placeholder for generated mocks" > "${mock_dir}/__placeholder.swift"
+        done
+
+        # Remove current files in tslFiles.bundle
+        echo "Removing current TSL files"
+        find $TSL_FILES_DIRECTORY -mindepth 1 ! -name ".keep" -delete
+
+        # Download latest 'eu-lotl.xml' file"
+        echo "Downloading latest 'eu-lotl.xml' file"
+        wget "https://ec.europa.eu/tools/lotl/eu-lotl.xml" -P $TSL_FILES_DIRECTORY
+
+        if [ -f "$TSL_FILES_DIRECTORY/eu-lotl.xml" ]; then
+          echo "Getting TSL (local LOTL)"
+          python3 scripts/tsl_xml_downloader.py --tslFile="$TSL_FILES_DIRECTORY/eu-lotl.xml" --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False"
+
+          echo "Finished downloading TSL"
+        else
+          echo "Getting TSL (remote LOTL)"
+          python3 scripts/tsl_xml_downloader.py --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False"
+          echo "Finished downloading TSL"
+        fi
+
+        echo "Moving TSLs to app's TSL files directory"
+        mv -v scripts/TSL/* $TSL_FILES_DIRECTORY
+        echo "Done moving TSLs"
+    - name: Setup environment
+      shell: bash
+      env:
+        GOOGLE_SERVICES_PLIST: ${{ inputs.google-services-plist }}
+      run: |
+        export LANG=en_US.UTF-8
+
+        sudo xcode-select -s /Applications/Xcode_${{ inputs.xcode }}.app
+
+        # Setup Google Services
+        echo $GOOGLE_SERVICES_PLIST | base64 --decode > "${{ github.workspace }}/RIADigiDoc/Supporting files/GoogleService-Info.plist"
+    - name: Read app version
+      id: app-version
+      shell: bash
+      run: |
+        VERSION=$(xcodebuild -project ${{ github.workspace }}/RIADigiDoc.xcodeproj -showBuildSettings | grep MARKETING_VERSION | tr -d 'MARKETING_VERSION =')
+        echo "APP_VERSION=$VERSION" >> $GITHUB_ENV
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
+    - name: Fetch default configuration
+      shell: bash
+      run: |
+        echo "Fetching default configuration"
+        python3 scripts/setup_configuration.py
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,26 +1,11 @@
 name: RIA DigiDoc iOS
-on:
-  push:
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: "0 3 * * 1" # Weekly
+on: [push]
 env:
   BUILD_NUMBER: ${{ github.run_number }}
 jobs:
   build:
     name: Build RIA DigiDoc on macOS
-    if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS')
     runs-on: macos-26
-    timeout-minutes: 120
-    permissions:
-      contents: read
-      actions: read
-      security-events: write
-    concurrency:
-      group: build-${{ github.ref }}
-      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
     strategy:
       matrix:
         xcode:
@@ -32,94 +17,11 @@ jobs:
       uses: actions/checkout@v7
       with:
         submodules: recursive
-    - name: Download Libdigidocpp iOS artifact
-      uses: dawidd6/action-download-artifact@v21
+    - name: Set up build environment
+      uses: ./.github/actions/setup-build-env
       with:
-        workflow: build.yml
-        branch: master
-        name: iphoneos
-        path: libdigidocpp-ios
-        repo: open-eid/libdigidocpp
-    - name: Download Libdigidocpp iOS Simulator artifact
-      uses: dawidd6/action-download-artifact@v21
-      with:
-        workflow: build.yml
-        branch: master
-        name: iphonesimulator
-        path: libdigidocpp-ios-simulator
-        repo: open-eid/libdigidocpp
-    - name: Extract libdigidocpp artifacts
-      run: |
-        unzip -o libdigidocpp-ios/libdigidocpp.iphoneos.zip -d libdigidocpp.iphoneos
-        unzip -o libdigidocpp-ios-simulator/libdigidocpp.iphonesimulator.zip -d libdigidocpp.iphonesimulator
-    - name: Update libdigidocpp in project
-      run: |
-          export LIBDIGIDOCPP_PATH=${{ github.workspace }}/Modules/LibdigidocLib/Sources/LibdigidocObjC/Libs/digidocpp.xcframework
-          rm -rf $LIBDIGIDOCPP_PATH/ios-arm64 && mkdir $LIBDIGIDOCPP_PATH/ios-arm64 && cp -r ${{ github.workspace }}/libdigidocpp.iphoneos/libdigidocpp.iphoneos/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64/
-          rm -rf $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && mkdir $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator && cp -r ${{ github.workspace }}/libdigidocpp.iphonesimulator/libdigidocpp.iphonesimulator/lib/digidocpp.framework $LIBDIGIDOCPP_PATH/ios-arm64_x86_64-simulator/
-    - name: Install dependencies
-      run: brew install mockolo
-    - name: Setup config and TSL files
-      run: |
-        export RESOURCES_DIRECTORY="Modules/ConfigLib/Sources/ConfigLib/Resources"
-        export CONFIG_DIRECTORY="$RESOURCES_DIRECTORY/config"
-        export TSL_FILES_DIRECTORY="$RESOURCES_DIRECTORY/tslFiles"
-
-        # Create TSL folder and mock folders for each module
-        mkdir -p $TSL_FILES_DIRECTORY
-
-        # SPM packages must exist and need at least 1 file. Mock files are generated in 'Run tests' step
-        for module in CommonsLib ConfigLib WebEidLib CryptoLib IdCardLib LibdigidocLib MobileIdLib SmartIdLib UtilsLib; do
-          mock_dir="Modules/${module}/Tests/Mocks/Generated"
-          mkdir -p "$mock_dir"
-          echo "// Placeholder for generated mocks" > "${mock_dir}/__placeholder.swift"
-        done
-
-        # Remove current files in tslFiles.bundle
-        echo "Removing current TSL files"
-        find $TSL_FILES_DIRECTORY -mindepth 1 ! -name ".keep" -delete
-
-        # Download latest 'eu-lotl.xml' file"
-        echo "Downloading latest 'eu-lotl.xml' file"
-        wget "https://ec.europa.eu/tools/lotl/eu-lotl.xml" -P $TSL_FILES_DIRECTORY
-
-        if [ -f "$TSL_FILES_DIRECTORY/eu-lotl.xml" ]; then
-          echo "Getting TSL (local LOTL)"
-          python3 scripts/tsl_xml_downloader.py --tslFile="$TSL_FILES_DIRECTORY/eu-lotl.xml" --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False"
-
-          echo "Finished downloading TSL"
-        else
-          echo "Getting TSL (remote LOTL)"
-          python3 scripts/tsl_xml_downloader.py --tslTestFile="$TSL_FILES_DIRECTORY/$(basename 'https://ec.europa.eu/tools/lotl/eu-lotl.xml')" --countries="EE" --isDevBuild="False"
-          echo "Finished downloading TSL"
-        fi
-
-        echo "Moving TSLs to app's TSL files directory"
-        mv -v scripts/TSL/* $TSL_FILES_DIRECTORY
-        echo "Done moving TSLs"
-    - name: Setup environment
-      env:
-        GOOGLE_SERVICES_PLIST: ${{ secrets.GOOGLE_SERVICES_PLIST }}
-      run: |
-        export LANG=en_US.UTF-8
-
-        sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode }}.app
-
-        # Setup Google Services
-        echo $GOOGLE_SERVICES_PLIST | base64 --decode > "${{ github.workspace }}/RIADigiDoc/Supporting files/GoogleService-Info.plist"
-
-        # Setup app version
-        echo APP_VERSION=$(xcodebuild -project ${{ github.workspace }}/RIADigiDoc.xcodeproj -showBuildSettings | grep MARKETING_VERSION | tr -d 'MARKETING_VERSION =') >> $GITHUB_ENV
-    - name: Fetch default configuration
-      run: |
-        echo "Fetching default configuration"
-        python3 scripts/setup_configuration.py
-    - name: Initialize CodeQL
-      if: github.event_name != 'push' || github.ref == 'refs/heads/main'
-      uses: github/codeql-action/init@v4
-      with:
-        languages: swift,c-cpp
-        build-mode: manual
+        xcode: ${{ matrix.xcode }}
+        google-services-plist: ${{ secrets.GOOGLE_SERVICES_PLIST }}
     - name: Run tests
       run: |
         cd ${{ github.workspace }}
@@ -164,9 +66,6 @@ jobs:
           -destination 'platform=iOS Simulator,name=iPhone 17' \
           -derivedDataPath "${{ github.workspace }}/build" \
           -quiet
-    - name: Perform CodeQL analysis
-      if: github.event_name != 'push' || github.ref == 'refs/heads/main'
-      uses: github/codeql-action/analyze@v4
     - name: Rename app file
       run: |
         mv \
@@ -190,37 +89,3 @@ jobs:
         rm -rf ~/Library/Developer/Xcode/DerivedData/*
         rm -rf ${{ github.workspace }}/build
         rm -rf ${{ github.workspace }}/.build
-
-  codeql:
-    name: CodeQL (${{ matrix.language }})
-    if: >-
-      contains(github.repository, 'open-eid/RIA-DigiDoc-iOS') &&
-      (github.event_name == 'pull_request' ||
-       github.event_name == 'schedule' ||
-       github.ref == 'refs/heads/main')
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      actions: read
-      security-events: write
-    concurrency:
-      group: codeql-${{ matrix.language }}-${{ github.ref }}
-      cancel-in-progress: true
-    strategy:
-      fail-fast: false
-      matrix:
-        language:
-          - actions
-          - python
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v6
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ matrix.language }}
-    - name: Perform CodeQL analysis
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,109 @@
+name: CodeQL
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "0 3 * * 1" # Weekly
+
+jobs:
+  swift:
+    name: CodeQL (swift)
+    if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS')
+    runs-on: macos-26
+    timeout-minutes: 120
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    concurrency:
+      group: codeql-swift-${{ github.ref }}
+      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+    strategy:
+      matrix:
+        xcode:
+          - 26.6
+        platform:
+          - iOS
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+      with:
+        submodules: recursive
+    - name: Set up build environment
+      uses: ./.github/actions/setup-build-env
+      with:
+        xcode: ${{ matrix.xcode }}
+        google-services-plist: ${{ secrets.GOOGLE_SERVICES_PLIST }}
+    - name: Resolve package dependencies
+      run: |
+        cd ${{ github.workspace }}
+
+        rm -rf ~/Library/Developer/Xcode/DerivedData/*
+        rm -rf "${{ runner.temp }}/codeql-build"
+        rm -rf ${{ github.workspace }}/.build
+
+        xcodebuild -resolvePackageDependencies \
+          -project RIADigiDoc.xcodeproj \
+          -scheme RIADigiDoc \
+          -derivedDataPath "${{ runner.temp }}/codeql-build"
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: swift
+        build-mode: manual
+    - name: Build
+      run: |
+        cd ${{ github.workspace }}
+
+        xcodebuild build \
+          -project RIADigiDoc.xcodeproj \
+          -skipPackagePluginValidation \
+          -scheme RIADigiDoc \
+          -destination 'platform=iOS Simulator,name=iPhone 17' \
+          -derivedDataPath "${{ runner.temp }}/codeql-build" \
+          COMPILATION_CACHE_ENABLE_CACHING=NO \
+          SWIFT_ENABLE_COMPILE_CACHE=NO \
+          SWIFT_USE_INTEGRATED_DRIVER=NO \
+          -quiet
+    - name: Perform CodeQL analysis
+      uses: github/codeql-action/analyze@v4
+    - name: Clean up
+      if: ${{ always() }}
+      run: |
+        rm -rf ~/Library/Developer/Xcode/DerivedData/*
+        rm -rf "${{ runner.temp }}/codeql-build"
+        rm -rf ${{ github.workspace }}/.build
+
+  scripts:
+    name: CodeQL (${{ matrix.language }})
+    if: contains(github.repository, 'open-eid/RIA-DigiDoc-iOS')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    concurrency:
+      group: codeql-${{ matrix.language }}-${{ github.ref }}
+      cancel-in-progress: true
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - python
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+    - name: Perform CodeQL analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{ matrix.language }}"