Improve CI caching, fix lint config, harden Linux supply chain

.github/workflows/ci.yml

@@ -29,14 +29,30 @@ jobs:
           swift --version
           swift package --version
 
+      - name: Cache lint tools
+        uses: actions/cache@v4
+        with:
+          path: .build/lint-tools
+          key: lint-tools-${{ runner.os }}-swiftformat-0.59.1-swiftlint-0.63.2
+
+      - name: Cache SwiftPM dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            .build/artifacts
+            .build/repositories
+            .build/workspace-state.json
+          key: ${{ runner.os }}-spm-${{ hashFiles('Package.resolved') }}
+          restore-keys: ${{ runner.os }}-spm-
+
       - name: Install lint tools
         run: ./Scripts/install_lint_tools.sh
 
       - name: Lint
         run: ./Scripts/lint.sh lint
 
       - name: Swift Test
-        run: swift test --no-parallel
+        run: swift test
 
   build-linux-cli:
     strategy:
@@ -63,6 +79,16 @@ jobs:
           swift-version: "6.2.1"
           skip-verify-signature: true
 
+      - name: Cache SwiftPM dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            .build/artifacts
+            .build/repositories
+            .build/workspace-state.json
+          key: ${{ runner.os }}-${{ runner.arch }}-spm-${{ hashFiles('Package.resolved') }}
+          restore-keys: ${{ runner.os }}-${{ runner.arch }}-spm-
+
       - name: Build CodexBarCLI (release, static Swift stdlib)
         run: swift build -c release --product CodexBarCLI --static-swift-stdlib
 

.swiftformat

@@ -1,4 +1,4 @@
-# SwiftFormat configuration for Peekaboo project
+# SwiftFormat configuration for CodexBar
 # Compatible with Swift 6 strict concurrency mode
 
 # IMPORTANT: Don't remove self where it's required for Swift 6 concurrency
@@ -47,4 +47,4 @@
 --allman false
 
 # Exclusions
---exclude .build,.swiftpm,DerivedData,node_modules,dist,coverage,xcuserdata,Core/PeekabooCore/Sources/PeekabooCore/Extensions/NSArray+Extensions.swift
+--exclude .build,.swiftpm,DerivedData,node_modules,dist,coverage,xcuserdata

.swiftlint.yml

@@ -1,4 +1,4 @@
-# SwiftLint configuration for Peekaboo - Swift 6 compatible
+# SwiftLint configuration for CodexBar - Swift 6 compatible
 
 # Paths to include
 included:
@@ -14,16 +14,10 @@ excluded:
   - "**/.build"
   - "**/Package.swift"
   - "**/Tests/Resources"
-  - "Apps/CLI/.build"
   - "**/DerivedData"
   - "**/.swiftpm"
-  - Pods
-  - Carthage
-  - fastlane
   - vendor
   - "*.playground"
-  # Exclude specific files that should not be linted/formatted
-  - "Core/PeekabooCore/Sources/PeekabooCore/Extensions/NSArray+Extensions.swift"
 
 # Analyzer rules (require compilation)
 analyzer_rules:
@@ -61,14 +55,14 @@ opt_in_rules:
 disabled_rules:
   # Swift 6 requires explicit self - disable explicit_self rule
   - explicit_self
-  
+
   # SwiftFormat handles these
   - trailing_whitespace
   - trailing_newline
   - trailing_comma
   - vertical_whitespace
   - indentation_width
-  
+
   # Too restrictive or not applicable
   - identifier_name # Single letter names are fine in many contexts
   - file_header
@@ -104,7 +98,7 @@ disabled_rules:
   - untyped_error_in_catch
   - file_name
   - todo
-  
+
 # Rule configurations
 force_cast: warning
 force_try: warning

Scripts/install_lint_tools.sh

@@ -9,9 +9,18 @@ BIN_DIR="${TOOLS_DIR}/bin"
 SWIFTFORMAT_VERSION="0.59.1"
 SWIFTLINT_VERSION="0.63.2"
 
+# macOS (universal)
 SWIFTFORMAT_SHA256_DARWIN="8b6289b608a44e73cd3851c3589dbd7c553f32cc805aa54b3a496ce2b90febe7"
 SWIFTLINT_SHA256_DARWIN="c59a405c85f95b92ced677a500804e081596a4cae4a6a485af76065557d6ed29"
 
+# Linux x86_64
+SWIFTFORMAT_SHA256_LINUX_X64="150d9693570cf234ec91d8a03ba7165bd36a78335c5e40ed91e4c013a492eb54"
+SWIFTLINT_SHA256_LINUX_X64="dd1017cfd20a1457f264590bcb5875a6ee06cd75b9a9d4f77cd43a552499143b"
+
+# Linux aarch64
+SWIFTFORMAT_SHA256_LINUX_ARM64="c55cea3543dd8488863d14132fa677db765c8f0ad5a6e6184cf822ca626bb1db"
+SWIFTLINT_SHA256_LINUX_ARM64="104dedff762157f5cff7752f1cc2a289b60f3ea677e72d651c6f3a3287fdd948"
+
 log() { printf '%s\n' "$*"; }
 fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
 
@@ -104,21 +113,22 @@ case "$OS" in
       x86_64)
         SWIFTFORMAT_URL="https://github.com/nicklockwood/SwiftFormat/releases/download/${SWIFTFORMAT_VERSION}/swiftformat_linux.zip"
         SWIFTLINT_URL="https://github.com/realm/SwiftLint/releases/download/${SWIFTLINT_VERSION}/swiftlint_linux_amd64.zip"
+        SWIFTFORMAT_SHA256="$SWIFTFORMAT_SHA256_LINUX_X64"
+        SWIFTLINT_SHA256="$SWIFTLINT_SHA256_LINUX_X64"
         ;;
       aarch64|arm64)
         SWIFTFORMAT_URL="https://github.com/nicklockwood/SwiftFormat/releases/download/${SWIFTFORMAT_VERSION}/swiftformat_linux_aarch64.zip"
         SWIFTLINT_URL="https://github.com/realm/SwiftLint/releases/download/${SWIFTLINT_VERSION}/swiftlint_linux_arm64.zip"
+        SWIFTFORMAT_SHA256="$SWIFTFORMAT_SHA256_LINUX_ARM64"
+        SWIFTLINT_SHA256="$SWIFTLINT_SHA256_LINUX_ARM64"
         ;;
       *)
         fail "Unsupported Linux arch: ${ARCH}"
         ;;
     esac
 
-    # SHA256 is intentionally only enforced for the macOS CI path.
-    # If we later run lint on Linux CI, add pinned SHAs here as well.
-    log "WARN: Linux SHA256 verification not configured for ${ARCH}; installing anyway."
-    install_zip_binary "SwiftFormat ${SWIFTFORMAT_VERSION}" "$SWIFTFORMAT_URL" "" "swiftformat"
-    install_zip_binary "SwiftLint ${SWIFTLINT_VERSION}" "$SWIFTLINT_URL" "" "swiftlint"
+    install_zip_binary "SwiftFormat ${SWIFTFORMAT_VERSION}" "$SWIFTFORMAT_URL" "$SWIFTFORMAT_SHA256" "swiftformat"
+    install_zip_binary "SwiftLint ${SWIFTLINT_VERSION}" "$SWIFTLINT_URL" "$SWIFTLINT_SHA256" "swiftlint"
     ;;
   *)
     fail "Unsupported OS: ${OS}"

package.json

@@ -4,7 +4,7 @@
   "scripts": {
     "start": "./Scripts/compile_and_run.sh",
     "start:debug": "./Scripts/compile_and_run.sh",
-    "start:release": "sh -c './Scripts/package_app.sh release && (pkill -x CodexBar || pkill -f CodexBar.app || true) && cd /Users/steipete/Projects/codexbar && open -n /Users/steipete/Projects/codexbar/CodexBar.app'",
+    "start:release": "sh -c './Scripts/package_app.sh release && (pkill -x CodexBar || pkill -f CodexBar.app || true) && open -n \"$(pwd)/CodexBar.app\"'",
     "lint": "./Scripts/lint.sh lint",
     "format": "./Scripts/lint.sh format",
     "check": "./Scripts/lint.sh lint",