Bump @eslint/js from 9.39.5 to 10.0.1

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      development-tools:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -4,17 +4,28 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-test:
     runs-on: macos-latest
+    timeout-minutes: 30
+    env:
+      SWIFTFORMAT_VERSION: 0.61.1
+      SWIFTFORMAT_SHA256: b990400779aceb7d7020796eb9ba814d4480543f671d38fc0ff48cb72f04c584
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 18
+          node-version: 24
           cache: npm
 
       - name: Install JS dependencies
@@ -29,11 +40,54 @@ jobs:
       - name: JS tests
         run: npm test
 
+      - name: Audit JS dependencies
+        run: |
+          npm audit --omit=dev
+          npm audit
+          npm audit signatures
+
+      - name: Package VS Code extension
+        run: |
+          npm run package
+          script/tests/vsix_inventory_test.sh
+
       - name: Install SwiftFormat
-        run: brew install swiftformat
+        run: |
+          archive="$RUNNER_TEMP/swiftformat.zip"
+          install_dir="$RUNNER_TEMP/swiftformat"
+          curl --fail --location --silent --show-error \
+            --output "$archive" \
+            "https://github.com/nicklockwood/SwiftFormat/releases/download/$SWIFTFORMAT_VERSION/swiftformat.zip"
+          echo "$SWIFTFORMAT_SHA256  $archive" | shasum --algorithm 256 --check
+          unzip -q "$archive" -d "$install_dir"
+          echo "$install_dir" >> "$GITHUB_PATH"
 
       - name: SwiftFormat lint
-        run: swiftformat --lint .
+        run: |
+          test "$(swiftformat --version)" = "$SWIFTFORMAT_VERSION"
+          swiftformat --lint . --disable redundantSendable
 
       - name: Swift tests
         run: cd SwiftExplorerApp && swift test
+
+      - name: Swift Release build with warnings as errors
+        run: cd SwiftExplorerApp && swift build -c release -Xswiftc -warnings-as-errors
+
+      - name: Shell contracts
+        run: |
+          bash -n Packaging/AppStore/build_app_store_package.sh
+          bash -n Packaging/DeveloperID/build_release.sh
+          bash -n Packaging/DeveloperID/notarize_release.sh
+          bash Packaging/AppStore/tests/validate_provisioning_profile_test.sh
+          bash script/tests/build_and_run_contract_test.sh
+          bash script/tests/open_source_release_contract_test.sh
+
+      - name: Developer ID release contracts
+        run: Packaging/DeveloperID/tests/run_tests.sh
+
+      - name: App Store bundle validation
+        run: |
+          plutil -lint Packaging/AppStore/AppStore.entitlements
+          plutil -lint Packaging/AppStore/Info.plist.in
+          plutil -lint Packaging/AppStore/PrivacyInfo.xcprivacy
+          Packaging/AppStore/build_app_store_package.sh --skip-signing

.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: macos-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, swift]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@641a925cfafe92d0fdf8b239ba4053e3f8d99d6d # v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@641a925cfafe92d0fdf8b239ba4053e3f8d99d6d # v3
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@641a925cfafe92d0fdf8b239ba4053e3f8d99d6d # v3

.github/workflows/release.yml

@@ -0,0 +1,222 @@
+name: macOS Developer ID Release
+
+on:
+  push:
+    tags:
+      - 'macos-v*'
+
+permissions:
+  contents: read
+
+jobs:
+  verify-source:
+    if: startsWith(github.ref, 'refs/tags/macos-v')
+    runs-on: macos-15
+    timeout-minutes: 10
+    permissions:
+      checks: read
+      contents: read
+    outputs:
+      commit: ${{ steps.verify.outputs.commit }}
+      version: ${{ steps.verify.outputs.version }}
+    steps:
+      - name: Checkout exact tag
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify signed annotated tag, main ancestry, and required checks
+        id: verify
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#macos-v}"
+          [[ "$version" =~ ^[0-9]+([.][0-9]+){1,2}$ ]]
+
+          ref_json="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$GITHUB_REF_NAME")"
+          test "$(jq -r '.object.type' <<< "$ref_json")" = tag
+          tag_object="$(jq -r '.object.sha' <<< "$ref_json")"
+          tag_json="$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$tag_object")"
+          test "$(jq -r '.verification.verified' <<< "$tag_json")" = true
+
+          commit="$(jq -r '.object.sha' <<< "$tag_json")"
+          test "$commit" = "$GITHUB_SHA"
+          git fetch --no-tags origin main
+          test "$commit" = "$(git rev-parse origin/main)"
+
+          checks="$(gh api "repos/$GITHUB_REPOSITORY/commits/$commit/check-runs?per_page=100")"
+          required_checks=(build-test 'Analyze javascript-typescript' 'Analyze swift')
+          for required_check in "${required_checks[@]}"; do
+            passed="$(jq --arg name "$required_check" \
+              '[.check_runs[] | select(.name == $name and .status == "completed" and .conclusion == "success")] | length' \
+              <<< "$checks")"
+            test "$passed" -ge 1 || {
+              echo "Required successful check is missing: $required_check" >&2
+              exit 1
+            }
+          done
+
+          echo "commit=$commit" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  sign-notarize:
+    if: ${{ vars.CI_SIGNING_PROVISIONED == 'true' }}
+    needs: verify-source
+    runs-on: macos-15
+    timeout-minutes: 45
+    environment: release
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+    env:
+      SIGNING_IDENTITY: 'Developer ID Application: Rafal Sikora (2NY8A789TN)'
+      NOTARY_PROFILE: codebase-combiner-notary
+    steps:
+      - name: Checkout verified source commit
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ needs.verify-source.outputs.commit }}
+          fetch-depth: 0
+
+      - name: Import Developer ID identity
+        env:
+          DEVELOPER_ID_P12_BASE64: ${{ secrets.DEVELOPER_ID_P12_BASE64 }}
+          DEVELOPER_ID_P12_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
+          CI_DEVELOPER_ID_CERTIFICATE_SHA256: ${{ vars.CI_DEVELOPER_ID_CERTIFICATE_SHA256 }}
+          LOCAL_DEVELOPER_ID_CERTIFICATE_SHA256: ${{ vars.LOCAL_DEVELOPER_ID_CERTIFICATE_SHA256 }}
+        run: |
+          set -euo pipefail
+          [[ "$CI_DEVELOPER_ID_CERTIFICATE_SHA256" =~ ^[A-Fa-f0-9]{64}$ ]]
+          [[ "$LOCAL_DEVELOPER_ID_CERTIFICATE_SHA256" =~ ^[A-Fa-f0-9]{64}$ ]]
+          test "${CI_DEVELOPER_ID_CERTIFICATE_SHA256^^}" != "${LOCAL_DEVELOPER_ID_CERTIFICATE_SHA256^^}"
+          keychain="$RUNNER_TEMP/release.keychain-db"
+          keychain_secret="$(openssl rand -hex 32)"
+          certificate="$RUNNER_TEMP/developer-id.p12"
+          public_certificate="$RUNNER_TEMP/developer-id.pem"
+          printf '%s' "$DEVELOPER_ID_P12_BASE64" | base64 --decode > "$certificate"
+          security create-keychain -p "$keychain_secret" "$keychain"
+          security set-keychain-settings -lut 21600 "$keychain"
+          security unlock-keychain -p "$keychain_secret" "$keychain"
+          security import "$certificate" -k "$keychain" -P "$DEVELOPER_ID_P12_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_secret" "$keychain"
+          security list-keychains -d user -s "$keychain"
+          security find-identity -p codesigning -v "$keychain" | grep -F "$SIGNING_IDENTITY"
+          security find-certificate -c "$SIGNING_IDENTITY" -p "$keychain" > "$public_certificate"
+          actual_fingerprint="$(openssl x509 -in "$public_certificate" -noout -fingerprint -sha256 | sed 's/^sha256 Fingerprint=//; s/^SHA256 Fingerprint=//; s/://g' | tr '[:lower:]' '[:upper:]')"
+          test "$actual_fingerprint" = "${CI_DEVELOPER_ID_CERTIFICATE_SHA256^^}"
+          test "$actual_fingerprint" != "${LOCAL_DEVELOPER_ID_CERTIFICATE_SHA256^^}"
+          rm -f "$public_certificate"
+          echo "RELEASE_KEYCHAIN=$keychain" >> "$GITHUB_ENV"
+
+      - name: Store notary credentials in the ephemeral Keychain
+        env:
+          APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+        run: |
+          set -euo pipefail
+          key="$RUNNER_TEMP/AuthKey_${APPLE_API_KEY_ID}.p8"
+          printf '%s' "$APPLE_API_KEY_P8_BASE64" | base64 --decode > "$key"
+          chmod 600 "$key"
+          xcrun notarytool store-credentials "$NOTARY_PROFILE" \
+            --key "$key" \
+            --key-id "$APPLE_API_KEY_ID" \
+            --issuer "$APPLE_API_ISSUER_ID" \
+            --keychain "$RELEASE_KEYCHAIN" \
+            --validate
+          rm -f "$key"
+
+      - name: Build and sign the DMG
+        env:
+          DEVELOPER_ID_SOURCE_TAG: ${{ github.ref_name }}
+        run: |
+          Packaging/DeveloperID/build_release.sh \
+            --version "${{ needs.verify-source.outputs.version }}" \
+            --signing-identity "$SIGNING_IDENTITY"
+
+      - name: Notarize, staple, and validate
+        run: |
+          version="${{ needs.verify-source.outputs.version }}"
+          Packaging/DeveloperID/notarize_release.sh \
+            --dmg "dist/developer-id/Codebase-Combiner-$version-arm64.dmg" \
+            --keychain-profile "$NOTARY_PROFILE" \
+            --keychain "$RELEASE_KEYCHAIN" \
+            --timeout 30m
+
+      - name: Attest every published release subject
+        uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3
+        with:
+          subject-path: |
+            dist/developer-id/Codebase-Combiner-${{ needs.verify-source.outputs.version }}-arm64.dmg
+            dist/developer-id/Codebase-Combiner-${{ needs.verify-source.outputs.version }}-arm64.cdx.json
+            dist/developer-id/Codebase-Combiner-${{ needs.verify-source.outputs.version }}-arm64-symbols.zip
+            dist/developer-id/release-manifest.json
+            dist/developer-id/notarization/summary.json
+            dist/developer-id/notarization/submission.json
+            dist/developer-id/notarization/*-log.json
+
+      - name: Transfer verified release assets
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: macos-release-${{ needs.verify-source.outputs.version }}
+          if-no-files-found: error
+          retention-days: 14
+          path: |
+            dist/developer-id/Codebase-Combiner-${{ needs.verify-source.outputs.version }}-arm64.dmg
+            dist/developer-id/Codebase-Combiner-${{ needs.verify-source.outputs.version }}-arm64.cdx.json
+            dist/developer-id/Codebase-Combiner-${{ needs.verify-source.outputs.version }}-arm64-symbols.zip
+            dist/developer-id/SHA256SUMS
+            dist/developer-id/release-manifest.json
+            dist/developer-id/notarization/summary.json
+            dist/developer-id/notarization/submission.json
+            dist/developer-id/notarization/*-log.json
+
+      - name: Remove ephemeral signing material
+        if: always()
+        run: |
+          rm -f "$RUNNER_TEMP"/AuthKey_*.p8 "$RUNNER_TEMP/developer-id.p12"
+          if [[ -n "${RELEASE_KEYCHAIN:-}" ]]; then
+            security delete-keychain "$RELEASE_KEYCHAIN" || true
+          fi
+
+  draft-release:
+    needs: [verify-source, sign-notarize]
+    runs-on: macos-15
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout verified source commit
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ needs.verify-source.outputs.commit }}
+
+      - name: Download verified release assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: macos-release-${{ needs.verify-source.outputs.version }}
+          path: release-assets
+
+      - name: Create draft GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          version="${{ needs.verify-source.outputs.version }}"
+          notes="docs/release/$version/RELEASE_NOTES.md"
+          test -f "$notes"
+          gh release create "$GITHUB_REF_NAME" \
+            --verify-tag \
+            --draft \
+            --title "Codebase Combiner $version for macOS" \
+            --notes-file "$notes" \
+            "release-assets/Codebase-Combiner-$version-arm64.dmg" \
+            "release-assets/SHA256SUMS" \
+            "release-assets/Codebase-Combiner-$version-arm64.cdx.json" \
+            "release-assets/Codebase-Combiner-$version-arm64-symbols.zip" \
+            "release-assets/release-manifest.json" \
+            "release-assets/notarization/summary.json" \
+            "release-assets/notarization/submission.json" \
+            "release-assets/notarization/"*-log.json