feat: build the native macOS evidence workbench

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+# Actionlint 1.7.12 predates GitHub's official Xcode 27 preview image label.
+# Treat it as declared until the pinned validator includes the hosted label.
+self-hosted-runner:
+  labels:
+    - xcode-27

.github/dependabot.yml

@@ -4,6 +4,10 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    # Let ecosystem fixes settle before routine version PRs. Dependabot
+    # security updates are explicitly not delayed by this setting.
+    cooldown:
+      default-days: 7
     groups:
       ccusage-runtime:
         patterns:

.github/workflows/auto-release.yml

@@ -18,21 +18,24 @@ on:
       - "apps/desktop/src-tauri/tauri.conf.json"
   workflow_dispatch:
 
-permissions:
-  contents: write
-  actions: write
+permissions: {}
 
 concurrency:
   group: auto-release-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
   publish:
+    name: Publish release and dispatch build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Create the versioned GitHub release.
+      actions: write # Dispatch the separate signed-build workflow.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Read version from tauri.conf.json
         id: ver
@@ -50,12 +53,13 @@ jobs:
         id: check
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.ver.outputs.tag }}
         run: |
           set -euo pipefail
-          if gh release view "${{ steps.ver.outputs.tag }}" \
+          if gh release view "$RELEASE_TAG" \
               --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "exists=true" >> "$GITHUB_OUTPUT"
-            echo "Release ${{ steps.ver.outputs.tag }} already exists — skipping."
+            echo "Release $RELEASE_TAG already exists — skipping."
           else
             echo "exists=false" >> "$GITHUB_OUTPUT"
           fi
@@ -64,21 +68,23 @@ jobs:
         if: steps.check.outputs.exists != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.ver.outputs.tag }}
         run: |
           set -euo pipefail
-          gh release create "${{ steps.ver.outputs.tag }}" \
+          gh release create "$RELEASE_TAG" \
             --repo "$GITHUB_REPOSITORY" \
             --target "$GITHUB_SHA" \
-            --title "CodeVetter ${{ steps.ver.outputs.tag }}" \
+            --title "CodeVetter $RELEASE_TAG" \
             --generate-notes
 
       - name: Dispatch release build workflow
         if: steps.check.outputs.exists != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ steps.ver.outputs.tag }}
         run: |
           set -euo pipefail
           gh workflow run release.yml \
             --repo "$GITHUB_REPOSITORY" \
             --ref main \
-            -f tag="${{ steps.ver.outputs.tag }}"
+            -f tag="$RELEASE_TAG"

.github/workflows/ci.yml

@@ -4,19 +4,64 @@
     branches: [main]
   pull_request:
   workflow_dispatch:
+    inputs:
+      native_qualification:
+        description: "Run isolated native macOS qualification"
+        required: true
+        default: false
+        type: boolean
+      native_interaction:
+        description: "Include XCUITest on the isolated hosted desktop"
+        required: true
+        default: false
+        type: boolean
+      native_production_qualification:
+        description: "Run protected signing, notarization, and migration qualification"
+        required: true
+        default: false
+        type: boolean
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  native-qualification:
+    name: Native macOS qualification
+    if: >-
+      github.event_name == 'pull_request' ||
+      (github.event_name == 'workflow_dispatch' && inputs.native_qualification)
+    uses: ./.github/workflows/native-qualification.yml
+    with:
+      run_interaction: ${{ github.event_name == 'pull_request' || inputs.native_interaction }}
+    permissions:
+      contents: read
+
+  native-production-qualification:
+    name: Native macOS production-candidate qualification
+    if: github.event_name == 'workflow_dispatch' && inputs.native_production_qualification
+    uses: ./.github/workflows/native-production-qualification.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
   lint-and-typecheck:
+    name: Lint, test, and build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 2
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+          persist-credentials: false
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '22'
           cache: 'pnpm'
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
       - name: Install Tauri Linux dependencies
         run: |
           sudo apt-get update
@@ -25,7 +70,7 @@
             libayatana-appindicator3-dev \
             librsvg2-dev \
             libxdo-dev
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: apps/desktop/src-tauri
       - name: Install Dependencies
@@ -35,7 +80,9 @@
         run: pnpm run lint
       - name: Fetch code-health base
         if: github.event_name != 'workflow_dispatch'
-        run: git fetch --depth=1 origin ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD^' }}
+        env:
+          CODE_HEALTH_BASE: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD^' }}
+        run: git fetch --depth=1 origin "$CODE_HEALTH_BASE"
       - name: Code health
         env:
           CODE_HEALTH_BASE: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD^' }}
@@ -83,7 +130,8 @@
         run: |
           pnpm run test:ccusage-sidecar
           pnpm run prepare:ccusage-sidecar
-          src-tauri/binaries/ccusage-$(rustc -vV | sed -n 's/^host: //p') --version
+          CCUSAGE_TARGET="$(rustc -vV | sed -n 's/^host: //p')"
+          "src-tauri/binaries/ccusage-$CCUSAGE_TARGET" --version
       - name: Qualify CLI artifact
         working-directory: apps/desktop
         run: |

.github/workflows/deploy-landing.yml

@@ -7,26 +7,31 @@ name: Deploy Landing Page
 # apps/landing-page-astro/.
 on:
   workflow_dispatch:
-permissions:
-  contents: read
-  deployments: write
+
+permissions: {}
 
 concurrency:
   group: deploy-landing-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   deploy:
+    name: Build and deploy landing page
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: read
+      deployments: write # Record the Cloudflare Pages deployment.
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "22"
-          cache: pnpm
+          package-manager-cache: false
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -58,7 +63,7 @@ jobs:
 
       - name: Deploy to Cloudflare Pages
         if: steps.cloudflare.outputs.deploy_enabled == 'true'
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}