[CI VERIFY ONLY] worktree-switcher rebased onto upstream/main

.github/actions/setup-macos/action.yml

@@ -1,56 +1,74 @@
 name: Setup macOS build deps
-description: Install + cache mise tools and Ghostty build outputs
+description: Install + cache mise tools and ThirdParty build outputs (Ghostty, zmx)
+
+inputs:
+  disable-tools:
+    description: Comma-separated mise tools to skip, so CI installs only what it needs.
+    default: spm:swiftlang/swift-format,npm:create-dmg
 
 runs:
   using: composite
   steps:
-    # The bundled zig (0.15.2) self-hosted linker can't link the macOS 26.4+ SDK
-    # (ziglang/zig#31272), which breaks `make build-ghostty-xcframework`. Pin to the
-    # newest installed Xcode <= 26.3, whose SDK zig can link.
-    - name: Select Xcode <= 26.3
+    # Job-wide so every later mise call (install, plus auto-install during the
+    # build steps under MISE_YES) skips the unneeded tools, not just this step.
+    - name: Limit mise to the tools CI needs
+      shell: bash
+      run: echo "MISE_DISABLE_TOOLS=${{ inputs.disable-tools }}" >> "$GITHUB_ENV"
+    # The bundled zig 0.15.2 linker can't link the macOS 26.4+ SDK (ziglang/zig#31658).
+    # Reuse the shared selector so CI and local agree on the Zig-linkable Xcode.
+    - name: Select a Zig-linkable Xcode
       shell: bash
       run: |
         set -euo pipefail
-        selected=""
-        for app in /Applications/Xcode_26.3*.app /Applications/Xcode_26.2*.app \
-          /Applications/Xcode_26.1*.app /Applications/Xcode_26.0*.app; do
-          if [ -d "$app" ]; then selected="$app"; break; fi
-        done
-        if [ -z "$selected" ]; then
-          echo "No Xcode <= 26.3 found on runner; available:" >&2
-          ls -d /Applications/Xcode_*.app >&2 || true
-          exit 1
-        fi
-        sudo xcode-select -s "$selected/Contents/Developer"
+        developer_dir="$(./scripts/select-developer-dir.sh)"
+        sudo xcode-select -s "$developer_dir"
         xcodebuild -version
     - uses: jdx/mise-action@v4
       with:
         version: 2026.3.0
         cache: true
+    # Tuist auth (OIDC) only works on the canonical upstream repo, which is the
+    # one linked in the Tuist dashboard. Skip it on forks and on cross-fork PRs
+    # (external contributors can't access the OIDC trust) — `tuist generate`
+    # works fine without auth; auth only buys the Tuist remote cache.
     - name: Authenticate with Tuist
-      if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+      if: ${{ github.repository == 'supabitapp/supacode' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
       shell: bash
       run: mise exec -- tuist auth login
     - name: Xcode cache key
       shell: bash
       run: |
         XCODE_VERSION="$(xcodebuild -version | tr '\n' '-' | sed 's/[^A-Za-z0-9._-]/_/g; s/-$//')"
         printf '%s\n' "XCODE_VERSION=$XCODE_VERSION" >> "$GITHUB_ENV"
-    - name: Ghostty cache key
+    - name: ThirdParty cache keys
       shell: bash
       run: |
         set -euo pipefail
-        GHOSTTY_SHA="$(git -C ThirdParty/ghostty rev-parse HEAD)"
-        printf '%s\n' "GHOSTTY_SHA=$GHOSTTY_SHA" >> "$GITHUB_ENV"
+        printf '%s\n' "GHOSTTY_SHA=$(git -C ThirdParty/ghostty rev-parse HEAD)" >> "$GITHUB_ENV"
+        printf '%s\n' "ZMX_SHA=$(git -C ThirdParty/zmx rev-parse HEAD)" >> "$GITHUB_ENV"
+    # Key on only the inputs that change the built artifact (submodule SHA, build
+    # script, zig version, patches) so unrelated action/project edits don't evict it.
     - name: Ghostty cache
       id: ghostty_cache
       uses: actions/cache@v5
       with:
         path: .build/ghostty
-        key: ${{ runner.os }}-${{ runner.arch }}-xcode-${{ env.XCODE_VERSION }}-ghostty-v2-${{ env.GHOSTTY_SHA }}-${{ hashFiles('.github/actions/setup-macos/action.yml', 'Project.swift', 'scripts/build-ghostty.sh', 'mise.toml', '.gitmodules') }}
+        key: ${{ runner.os }}-${{ runner.arch }}-xcode-${{ env.XCODE_VERSION }}-ghostty-v3-${{ env.GHOSTTY_SHA }}-${{ hashFiles('scripts/build-ghostty.sh', 'mise.toml', '.gitmodules', 'patches/*.patch') }}
     - name: Build ghostty
       if: steps.ghostty_cache.outputs.cache-hit != 'true'
       shell: bash
       run: |
         set -euo pipefail
         make build-ghostty-xcframework
+    - name: zmx cache
+      id: zmx_cache
+      uses: actions/cache@v5
+      with:
+        path: .build/zmx
+        key: ${{ runner.os }}-${{ runner.arch }}-xcode-${{ env.XCODE_VERSION }}-zmx-v1-${{ env.ZMX_SHA }}-${{ hashFiles('scripts/build-zmx.sh', 'mise.toml', '.gitmodules') }}
+    - name: Build zmx
+      if: steps.zmx_cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+        make build-zmx

.github/workflows/test.yml → .github/workflows/ci.yml

@@ -1,9 +1,6 @@
-name: test
+name: ci
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
     branches:
       - main
@@ -27,5 +24,8 @@ jobs:
           submodules: recursive
       - uses: ./.github/actions/setup-macos
       - run: make lint
+      - run: make inspect-dependencies
       - run: make build-app
+        env:
+          XCODEBUILD_FLAGS: -showBuildTimingSummary
       - run: make test

.github/workflows/fork-build.yml

@@ -0,0 +1,36 @@
+name: fork-build
+
+# Build the Debug app on feature branches and upload it as an artifact so a
+# fork (where local builds are impossible) can download and install a testable
+# build. No tests, no signing — just a runnable .app.zip per commit.
+on:
+  push:
+    branches:
+      - "feat/**"
+      - "fix/**"
+      - "exp/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: macos-26
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      MISE_HTTP_TIMEOUT: 120
+      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+      - uses: ./.github/actions/setup-macos
+      - run: make package-app
+      - uses: actions/upload-artifact@v6
+        with:
+          name: supacode-${{ github.sha }}
+          path: build/supacode.app.zip
+          if-no-files-found: error