[client] Wire the installer to the Swift agent, delete Hammerspoon #18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| # hark only runs on macOS, but the suite is portable and Linux is the | |
| # faster signal. Both are here because the scripted checks are shell, and | |
| # GNU and BSD awk/grep are exactly where a passing test stops meaning | |
| # anything on the machine a user actually installs to. | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Pinned to an exact version: astral-sh/setup-uv publishes no floating | |
| # major tag, so @v9 does not resolve. | |
| - uses: astral-sh/setup-uv@v9.0.0 | |
| with: | |
| enable-cache: true | |
| # --locked fails if uv.lock has drifted from pyproject.toml, so a | |
| # dependency change can't land without the lockfile that pins it. | |
| - name: pytest | |
| run: uv run --locked pytest -q | |
| shellcheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Preinstalled on the Ubuntu runner image. | |
| - name: shellcheck | |
| run: shellcheck install-server.sh install-client.sh | |
| # The client is macOS-only and needs a real Swift toolchain, so it cannot | |
| # join the portable matrix above. Builds the bundle and asserts the signature | |
| # verifies — an unsigned or broken-signature bundle is exactly the state in | |
| # which TCC grants stop surviving a rebuild. | |
| swift: | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Test | |
| run: cd swift && swift test | |
| - name: Build Hark.app | |
| run: cd swift && swift build -c release && bash Packaging/build-app.sh | |
| - name: Verify the signature | |
| run: codesign --verify --strict --verbose=2 swift/Packaging/Hark.app | |
| - name: Verify the microphone entitlement survived signing | |
| run: | | |
| codesign -d --entitlements - --xml swift/Packaging/Hark.app 2>/dev/null \ | |
| | grep -q 'com.apple.security.device.audio-input' \ | |
| || { echo "missing audio-input entitlement — TCC will refuse to prompt"; exit 1; } |