ci: add pinned platform validation and maintainer-only signing workflows

Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.

scripts/check-dependencies.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""Fail closed on OSV findings or unavailable advisory service. No app runtime use."""
+import json
+from pathlib import Path
+import re
+import urllib.request
+
+ROOT = Path(__file__).resolve().parents[1]
+coordinates = set()
+lockfile = ROOT / "android/app/gradle.lockfile"
+assert lockfile.is_file(), "Generate the reviewed Gradle dependency lockfile before scanning."
+for source in [ROOT / "android/app/build.gradle.kts", ROOT / "android/build.gradle.kts", lockfile,
+               ROOT / "android/buildscript-gradle.lockfile"]:
+    if source.exists():
+        coordinates.update(re.findall(r'([\w.-]+:[\w.-]+:[\w.+-]+)(?:["=])', source.read_text()))
+agp = re.search(r'id\("com.android.application"\) version "([^"]+)"', (ROOT / "android/build.gradle.kts").read_text())
+assert agp, "Cannot determine Android build plugin version"
+coordinates.add("com.android.tools.build:gradle:" + agp.group(1))
+queries = [{"package": {"ecosystem": "Maven", "name": coordinate.rsplit(":", 1)[0]},
+            "version": coordinate.rsplit(":", 1)[1]} for coordinate in sorted(coordinates)]
+request = urllib.request.Request("https://api.osv.dev/v1/querybatch", method="POST",
+                                 headers={"Content-Type": "application/json"},
+                                 data=json.dumps({"queries": queries}).encode())
+with urllib.request.urlopen(request, timeout=60) as response:
+    results = json.load(response)["results"]
+assert len(results) == len(queries)
+findings = [(coordinate, [item["id"] for item in result.get("vulns", [])])
+            for coordinate, result in zip(sorted(coordinates), results) if result.get("vulns")]
+if findings:
+    for coordinate, identifiers in findings:
+        print(coordinate, ", ".join(identifiers))
+    raise SystemExit("Dependency advisories require review and remediation before release.")
+print(f"OSV: no listed advisories for {len(coordinates)} locked/direct Maven coordinates and build plugins.")

scripts/check-format.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+directory="${TMPDIR:-/tmp}/yuvomi-format-tools"
+mkdir -p "$directory"
+jar="$directory/ktlint-1.7.1.jar"
+if [ ! -f "$jar" ]; then
+  curl --fail --location https://repo.maven.apache.org/maven2/com/pinterest/ktlint/ktlint-cli/1.7.1/ktlint-cli-1.7.1-all.jar -o "$jar"
+fi
+printf '%s  %s\n' 5f3de4ee4014137b05c72ed68eb46fe686aeb11fbdef27faf77f55d51c1b2536 "$jar" | sha256sum -c -
+java -jar "$jar" 'android/**/*.kt' 'android/**/*.kts'

scripts/check-repository.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+"""Static release invariants; these checks do not replace platform/runtime tests."""
+import json
+from pathlib import Path
+import plistlib
+import re
+import subprocess
+import xml.etree.ElementTree as ET
+
+ROOT = Path(__file__).resolve().parents[1]
+required = ["README.md", "LICENSE", "THIRD_PARTY_NOTICES.md", "CONTRIBUTING.md", "SECURITY.md",
+            "CHANGELOG.md", "docs/architecture.md", "docs/build-android.md", "docs/build-ios.md",
+            "docs/server-compatibility.md", "docs/release-process.md", "docs/validation.md"]
+for name in required:
+    assert (ROOT / name).is_file(), f"Missing {name}"
+
+paths = subprocess.check_output(["git", "ls-files", "--cached", "--others", "--exclude-standard"], cwd=ROOT, text=True).splitlines()
+for name in paths:
+    path = ROOT / name
+    if not path.is_file():
+        continue
+    assert not any(part in {"node_modules", "build", ".gradle", "DerivedData"} for part in path.relative_to(ROOT).parts), name
+    assert path.suffix not in {".jks", ".keystore", ".p12", ".mobileprovision", ".apk", ".aab"}, name
+    if path.suffix == ".xml":
+        ET.parse(path)
+    if path.suffix == ".xcprivacy":
+        with path.open("rb") as source:
+            assert plistlib.load(source)["NSPrivacyTracking"] is False
+    if path.suffix == ".json":
+        json.loads(path.read_text())
+    if path.suffix in {".swift", ".kt", ".kts", ".py", ".md", ".yml", ".xml", ".properties", ".mjs", ".sh"}:
+        text = path.read_text()
+        assert not re.search(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----", text), f"Private key in {name}"
+        if path.suffix == ".md":
+            for target in re.findall(r"\]\(([^)]+)\)", text):
+                if ":" not in target and not target.startswith("#"):
+                    assert (path.parent / target.split("#")[0]).exists(), f"Broken link in {name}: {target}"
+
+android = "{http://schemas.android.com/apk/res/android}"
+manifest = ET.parse(ROOT / "android/app/src/main/AndroidManifest.xml").getroot()
+app = manifest.find("application")
+assert app.get(android + "usesCleartextTraffic") == "false"
+assert app.get(android + "allowBackup") == "false"
+assert app.get(android + "debuggable") != "true"
+assert len(manifest.findall("application/activity/intent-filter")) == 1, "Unreviewed deep-link entry point"
+network = ET.parse(ROOT / "android/app/src/main/res/xml/network_security_config.xml").getroot()
+assert network.find("base-config").get("cleartextTrafficPermitted") == "false"
+assert [node.get("src") for node in network.findall(".//certificates")] == ["system"]
+assert "distributionSha256Sum=" in (ROOT / "android/gradle/wrapper/gradle-wrapper.properties").read_text()
+for workflow in (ROOT / ".github/workflows").glob("*.yml"):
+    for action in re.findall(r"uses:\s*([^\s#]+)", workflow.read_text()):
+        assert re.fullmatch(r"[\w.-]+/[\w./-]+@[0-9a-f]{40}", action), f"Unpinned action: {action}"
+assert "NSAllowsArbitraryLoads" not in (ROOT / "ios/project.yml").read_text()
+print(f"Repository invariants: {len(paths)} source/documentation paths checked.")

scripts/install-xcodegen.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+version=2.44.1
+destination="${1:-${TMPDIR:-/tmp}/yuvomi-xcodegen}"
+mkdir -p "$destination"
+curl --fail --location "https://github.com/yonaskolb/XcodeGen/releases/download/$version/xcodegen.zip" -o "$destination/xcodegen.zip"
+printf '%s  %s\n' a2e905fb68446e9bb4008cdfe2e13e3f176d0cbcca828b71770f8e53fca91b73 "$destination/xcodegen.zip" | shasum -a 256 -c -
+unzip -qo "$destination/xcodegen.zip" -d "$destination"
+"$destination/xcodegen/bin/xcodegen" --version

scripts/select-simulator.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python3
+"""Select an available iPhone instead of depending on a runner-specific device name."""
+import json
+import re
+import subprocess
+
+devices = json.loads(subprocess.check_output(["xcrun", "simctl", "list", "devices", "available", "--json"]))
+phones = []
+for runtime, entries in devices["devices"].items():
+    match = re.search(r"\.iOS-(\d+)-(\d+)", runtime)
+    if not match:
+        continue
+    version = tuple(map(int, match.groups()))
+    if version < (18, 4):
+        continue
+    phones.extend((version, device) for device in entries
+                  if device.get("isAvailable") and device["name"].startswith("iPhone"))
+phones.sort(key=lambda entry: entry[0], reverse=True)
+if not phones:
+    raise SystemExit("No available iPhone simulator; install an iOS simulator runtime in Xcode.")
+print(phones[0][1]["udid"])