Sync with upstream silo-apple main (2026-09-28)

.github/workflows/ci-scripts.yml

@@ -0,0 +1,53 @@
+name: CI scripts
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/ci/**'
+      - 'scripts/sync-apiv2-fixtures*.sh'
+      - '.github/workflows/ci-scripts.yml'
+      - 'iosApp/iosApp/**'
+      - 'iosApp/TopShelf/**'
+      - 'iosApp/NotificationService/**'
+      - 'iosApp/DownloadsActivity/**'
+      - 'iosApp/Tests/**'
+  push:
+    branches: [main]
+    paths:
+      - 'scripts/ci/**'
+      - 'scripts/sync-apiv2-fixtures*.sh'
+      - '.github/workflows/ci-scripts.yml'
+      - 'iosApp/iosApp/**'
+      - 'iosApp/TopShelf/**'
+      - 'iosApp/NotificationService/**'
+      - 'iosApp/DownloadsActivity/**'
+      - 'iosApp/Tests/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Test release input parsing
+        run: |
+          bash scripts/ci/resolve-marketing-version.test.sh
+          bash scripts/ci/resolve-platform.test.sh
+      - name: Test release source archive
+        run: python3 scripts/ci/package-release-source.test.py
+      - name: Test subtitle packaging validation
+        run: python3 scripts/ci/validate-subtitle-packaging.test.py
+      - name: Test API v2 fixture sync
+        run: bash scripts/sync-apiv2-fixtures.test.sh
+      - name: Test the /api/v1 path guard
+        run: bash scripts/ci/check-no-api-v1.test.sh
+      - name: Block new /api/v1 paths in app sources
+        run: bash scripts/ci/check-no-api-v1.sh

.github/workflows/player-regression.yml

@@ -0,0 +1,202 @@
+name: Apple regression
+
+on:
+  pull_request:
+    paths:
+      - 'iosApp/**'
+      - '.github/workflows/player-regression.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'iosApp/**'
+      - '.github/workflows/player-regression.yml'
+  workflow_dispatch:
+    inputs:
+      baseline_ref:
+        description: Optional unchanged upstream commit for a comparative iOS run (the tvOS test target may not exist there)
+        type: string
+        required: false
+      record_preview:
+        description: Also record a synthetic playback clip after a manually requested build
+        type: boolean
+        default: false
+      ios_only:
+        description: Build and validate only the iOS simulator app for an iOS-only change
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: player-regression-${{ github.ref }}-${{ inputs.baseline_ref || 'head' }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: macos-15
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        include: >-
+          ${{ fromJSON((inputs.ios_only || inputs.baseline_ref) &&
+            '[{"scheme":"Prairie","destination":"platform=iOS Simulator,name=iPhone 17 Pro","action":"test","platform":"iOS","test_target":"PrairieTests"}]' ||
+            '[{"scheme":"Prairie","destination":"platform=iOS Simulator,name=iPhone 17 Pro","action":"test","platform":"iOS","test_target":"PrairieTests"},
+              {"scheme":"PrairieTV","destination":"platform=tvOS Simulator,name=Apple TV 4K (3rd generation)","action":"test","platform":"tvOS","test_target":"PrairieTVTests"},
+              {"scheme":"PrairieMac","destination":"generic/platform=macOS","action":"build"}]') }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          ref: ${{ inputs.baseline_ref || github.sha }}
+      - uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: '26.3'
+      - name: Prepare simulator
+        if: matrix.action == 'test'
+        timeout-minutes: 10
+        shell: bash
+        env:
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          set -euo pipefail
+          # Hosted images do not always have a usable pre-created device.
+          # Match the selected Xcode SDK and reuse one explicit destination.
+          # iOS and tvOS differ only in SDK name, runtime prefix, and device.
+          case "$PLATFORM" in
+            iOS)
+              sdk=iphonesimulator
+              runtime_prefix=com.apple.CoreSimulator.SimRuntime.iOS-
+              device_type=com.apple.CoreSimulator.SimDeviceType.iPhone-17-Pro
+              destination_platform="iOS Simulator"
+              ;;
+            tvOS)
+              sdk=appletvsimulator
+              runtime_prefix=com.apple.CoreSimulator.SimRuntime.tvOS-
+              device_type=com.apple.CoreSimulator.SimDeviceType.Apple-TV-4K-3rd-generation-4K
+              destination_platform="tvOS Simulator"
+              ;;
+            *)
+              echo "::error::Unknown simulator platform $PLATFORM"
+              exit 1
+              ;;
+          esac
+          runtime_version=$(xcrun --sdk "$sdk" --show-sdk-version)
+          find_runtime() {
+            xcrun simctl list runtimes --json | jq -r --arg version "$runtime_version" --arg prefix "$runtime_prefix" \
+              '[.runtimes[] | select(.isAvailable and .version == $version and
+                (.identifier | startswith($prefix)))][0].identifier // empty'
+          }
+          runtime_id=$(find_runtime)
+          if [ -z "$runtime_id" ]; then
+            xcodebuild -downloadPlatform "$PLATFORM" -buildVersion "$runtime_version"
+            runtime_id=$(find_runtime)
+          fi
+          if [ -z "$runtime_id" ]; then
+            echo "::error::No available $PLATFORM $runtime_version simulator runtime"
+            exit 1
+          fi
+          simulator_id=$(xcrun simctl create "Prairie-Player-Regression-$PLATFORM" \
+            "$device_type" "$runtime_id")
+          echo "PRAIRIE_SIMULATOR_ID=$simulator_id" >> "$GITHUB_ENV"
+          echo "PRAIRIE_TEST_DESTINATION=platform=$destination_platform,id=$simulator_id" >> "$GITHUB_ENV"
+          xcrun simctl boot "$simulator_id"
+          xcrun simctl bootstatus "$simulator_id" -b
+      - name: Generate Xcode project
+        run: |
+          set -euo pipefail
+          curl -fsSL -o /tmp/xcodegen.zip https://github.com/yonaskolb/XcodeGen/releases/download/2.43.0/xcodegen.zip
+          # Pin the official 2.43.0 release asset before unpacking/executing it.
+          echo "a4847ed77d3341a4d24049bc4424a3babca4c94ff1dcaaee923eaca2b32c678f  /tmp/xcodegen.zip" | shasum -a 256 -c -
+          unzip -q /tmp/xcodegen.zip -d /tmp/xcodegen-dist
+          /tmp/xcodegen-dist/xcodegen/bin/xcodegen generate --spec iosApp/project.yml
+      - name: Build player
+        id: build
+        env:
+          SCHEME: ${{ matrix.scheme }}
+          DESTINATION: ${{ matrix.destination }}
+          ACTION: ${{ matrix.action }}
+        run: |
+          set -o pipefail
+          if [ "$ACTION" = test ]; then
+            # Simulator-only ad-hoc signing supplies the application identifier
+            # required by Keychain. No certificate or release secret is used.
+            xcodebuild build-for-testing -project iosApp/Prairie.xcodeproj -scheme "$SCHEME" \
+              -destination "$PRAIRIE_TEST_DESTINATION" -derivedDataPath /tmp/prairie-derived \
+              CODE_SIGNING_ALLOWED=YES CODE_SIGN_IDENTITY=- | tee /tmp/player-build.log
+          else
+            xcodebuild build -project iosApp/Prairie.xcodeproj -scheme "$SCHEME" \
+              -destination "$DESTINATION" -derivedDataPath /tmp/prairie-derived \
+              -resultBundlePath /tmp/player-validation.xcresult \
+              CODE_SIGNING_ALLOWED=NO | tee /tmp/player-validation.log
+          fi
+      - name: Package simulator tests for focused visual verification
+        if: matrix.action == 'test' && matrix.platform == 'iOS' && !inputs.baseline_ref
+        run: ditto -c -k --keepParent /tmp/prairie-derived/Build/Products /tmp/Prairie-simulator-tests.zip
+      - name: Upload compiled simulator tests
+        if: matrix.action == 'test' && matrix.platform == 'iOS' && !inputs.baseline_ref
+        uses: actions/upload-artifact@v4
+        with:
+          name: Prairie-simulator-tests
+          path: /tmp/Prairie-simulator-tests.zip
+          retention-days: 3
+      - name: Run complete simulator suite
+        if: matrix.action == 'test'
+        timeout-minutes: 12
+        env:
+          SCHEME: ${{ matrix.scheme }}
+          TEST_TARGET: ${{ matrix.test_target }}
+        run: |
+          set -o pipefail
+          xcodebuild test-without-building -project iosApp/Prairie.xcodeproj -scheme "$SCHEME" \
+            -destination "$PRAIRIE_TEST_DESTINATION" -derivedDataPath /tmp/prairie-derived \
+            -only-testing:"$TEST_TARGET" \
+            -parallel-testing-enabled NO \
+            -test-timeouts-enabled YES -maximum-test-execution-time-allowance 60 \
+            -resultBundlePath /tmp/player-validation.xcresult \
+            CODE_SIGNING_ALLOWED=YES CODE_SIGN_IDENTITY=- | tee /tmp/player-validation.log
+      - name: Record synthetic preview expansion and successor playback
+        if: matrix.action == 'test' && matrix.platform == 'iOS' && !inputs.baseline_ref && steps.build.outcome == 'success' && !cancelled() && github.event_name == 'workflow_dispatch' && inputs.record_preview
+        timeout-minutes: 10
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Reuse the compiled test bundle. This records only the bounded
+          # synthetic-video test, not a second build or the full test suite.
+          # XCTest can shut down the simulator after the full suite. Boot the
+          # exact recording destination before starting the recorder.
+          simulator_id="$PRAIRIE_SIMULATOR_ID"
+          simulator_state=$(xcrun simctl list devices available --json | jq -r \
+            --arg id "$simulator_id" '.devices[][] | select(.udid == $id) | .state')
+          if [ "$simulator_state" != Booted ]; then
+            xcrun simctl boot "$simulator_id"
+          fi
+          xcrun simctl bootstatus "$simulator_id" -b
+          xcrun simctl io "$simulator_id" recordVideo /tmp/preview-transition.mp4 &
+          recorder_pid=$!
+          trap 'kill -INT "$recorder_pid" 2>/dev/null || true; wait "$recorder_pid" || true' EXIT
+          xcodebuild test-without-building -project iosApp/Prairie.xcodeproj -scheme Prairie \
+            -destination "platform=iOS Simulator,id=$simulator_id" \
+            -derivedDataPath /tmp/prairie-derived \
+            -parallel-testing-enabled NO \
+            -destination-timeout 60 \
+            -test-timeouts-enabled YES -maximum-test-execution-time-allowance 60 \
+            -only-testing:PrairieTests/PlayerSurfaceLayoutTests/testPlayingPreviewExpandsWithoutReplacingItemOrLosingItsLayer \
+            -resultBundlePath /tmp/preview-recording.xcresult CODE_SIGNING_ALLOWED=YES CODE_SIGN_IDENTITY=-
+          kill -INT "$recorder_pid"
+          wait "$recorder_pid"
+          trap - EXIT
+          test -s /tmp/preview-transition.mp4
+      - name: Upload validation evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: player-validation-${{ matrix.scheme }}
+          path: |
+            /tmp/player-build.log
+            /tmp/player-validation.log
+            /tmp/player-validation.xcresult
+            /tmp/preview-transition.mp4
+            /tmp/preview-recording.xcresult
+          retention-days: 7

.github/workflows/release-source.yml

@@ -0,0 +1,60 @@
+name: Publish release source
+
+on:
+  workflow_call:
+    inputs:
+      release_tag:
+        required: true
+        type: string
+    outputs:
+      source_url:
+        value: ${{ jobs.source.outputs.source_url }}
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-source-${{ inputs.release_tag }}
+  cancel-in-progress: false
+
+jobs:
+  source:
+    runs-on: ubuntu-latest
+    outputs:
+      source_url: ${{ steps.publish.outputs.source_url }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Package exact app and library sources
+        run: python3 scripts/ci/package-release-source.py "$RUNNER_TEMP/release-source"
+      - name: Publish source before distributing binaries
+        id: publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          set -euo pipefail
+          if ! gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            # The sideload workflow may create the same tag's release first.
+            FLAGS=()
+            if [[ "$RELEASE_TAG" == source-* ]]; then FLAGS+=(--latest=false); fi
+            gh release create "$RELEASE_TAG" --target "$GITHUB_SHA" \
+              --title "$RELEASE_TAG" \
+              "${FLAGS[@]}" \
+              --notes "Release source and rebuild instructions are in the Prairie-source archive." \
+              || gh release view "$RELEASE_TAG" >/dev/null
+          fi
+          IS_DRAFT="$(gh release view "$RELEASE_TAG" --json isDraft --jq '.isDraft')"
+          if [[ "$IS_DRAFT" == "true" ]]; then
+            echo "::error::Source release $RELEASE_TAG is a draft. Publish it before distributing binaries."
+            exit 1
+          fi
+          ASSET="Prairie-source-${GITHUB_SHA}.tar.gz"
+          gh release upload "$RELEASE_TAG" "$RUNNER_TEMP/release-source/$ASSET" --clobber
+          SOURCE_URL="$(gh release view "$RELEASE_TAG" --json assets --jq ".assets[] | select(.name == \"$ASSET\") | .url")"
+          test -n "$SOURCE_URL"
+          echo "source_url=$SOURCE_URL" >> "$GITHUB_OUTPUT"

.github/workflows/release.yml

@@ -27,8 +27,8 @@ concurrency:
   group: testflight-release
   cancel-in-progress: false
 
-# Least privilege: the jobs only check out code and talk to Apple via the ASC
-# API key. They never use GITHUB_TOKEN to write to the repo.
+# Apple build jobs only read the repository. The source publication job gets
+# contents: write so it can attach rebuild sources before binary distribution.
 permissions:
   contents: read
 
@@ -38,6 +38,13 @@ env:
   TESTFLIGHT_NOTIFY_EXTERNAL_TESTERS: "true"
 
 jobs:
+  source:
+    permissions:
+      contents: write
+    uses: ./.github/workflows/release-source.yml
+    with:
+      release_tag: ${{ github.event_name == 'push' && github.ref_name || format('source-{0}', github.sha) }}
+
   # Resolve the target platform from either the dispatch input or the tag's
   # +ios / +tvos build-metadata suffix, so both trigger paths share one gate.
   setup:
@@ -84,7 +91,7 @@ jobs:
           BUILD_NUMBERS_FILE="$GITHUB_OUTPUT" bundle exec fastlane ios reserve_build_numbers
 
   ios:
-    needs: [setup, build-numbers]
+    needs: [setup, build-numbers, source]
     # Skip only when the selection is tvOS-only. 'both' and 'ios' both run iOS.
     # No status function in the if -> implicit success() gate on needs, so a
     # failed build-numbers job skips this build.
@@ -139,13 +146,14 @@ jobs:
           APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
           APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY }}
           TESTFLIGHT_EXTERNAL_GROUPS: ${{ secrets.TESTFLIGHT_EXTERNAL_GROUPS }}
+          PRAIRIE_RELEASE_SOURCE_URL: ${{ needs.source.outputs.source_url }}
 
   tvos:
     # No longer needs: ios — build numbers are reserved up front, so tvOS runs in
     # parallel with iOS rather than after it. (Trade-off: on a both run, tvOS now
     # releases even if iOS fails; the platforms' build-number sequences are
     # independent, so a gap is harmless.)
-    needs: [setup, build-numbers]
+    needs: [setup, build-numbers, source]
     # Skip only when the selection is iOS-only. Implicit success() gate on needs.
     if: ${{ needs.setup.outputs.platform != 'ios' }}
     runs-on: macos-15
@@ -198,3 +206,4 @@ jobs:
           APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
           APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_KEY }}
           TESTFLIGHT_EXTERNAL_GROUPS: ${{ secrets.TESTFLIGHT_EXTERNAL_GROUPS }}
+          PRAIRIE_RELEASE_SOURCE_URL: ${{ needs.source.outputs.source_url }}

.github/workflows/sideload-ipa.yml

@@ -121,13 +121,22 @@ jobs:
             gh release create "$TAG" \
               --target "$GITHUB_SHA" \
               --title "$TITLE" \
-              --notes "Unsigned iOS/tvOS IPAs for third-party signing / sideloading. See docs/release/sideloading.md."
+              --notes "Unsigned iOS/tvOS IPAs for third-party signing / sideloading. See docs/release/sideloading.md. The Prairie-source archive contains the matching source and rebuild instructions." \
+              || gh release view "$TAG" >/dev/null
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Releasing as $TAG (build $BUILD)"
 
+  source:
+    needs: release
+    permissions:
+      contents: write
+    uses: ./.github/workflows/release-source.yml
+    with:
+      release_tag: ${{ needs.release.outputs.tag }}
+
   build:
-    needs: [setup, release]
+    needs: [setup, release, source]
     runs-on: macos-15
     # Only the release-upload step (tag builds) needs write; scope it to the job
     # rather than the whole workflow to keep the rest at least privilege.