Bump github/codeql-action/init from 4.37.0 to 4.37.1

.codex/environments/environment.toml

@@ -0,0 +1,11 @@
+# THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY
+version = 1
+name = "Codebase Combiner"
+
+[setup]
+script = ""
+
+[[actions]]
+name = "Run"
+icon = "run"
+command = "./script/build_and_run.sh --verify"

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,7 +7,7 @@ body:
     attributes:
       value: |
         Thanks for taking the time to report a bug.
-        Please search existing issues before filing a new one.
+        Please search existing issues before filing a new one. Redact source code, local paths, credentials, combined output, and other private data from every field and attachment.
   - type: textarea
     id: summary
     attributes:
@@ -45,7 +45,7 @@ body:
     id: logs
     attributes:
       label: Logs or screenshots
-      description: Paste relevant logs or attach screenshots.
+      description: Paste relevant logs or attach screenshots only after redacting source code, local paths, credentials, combined output, and other private data.
       render: shell
     validations:
       required: false
@@ -54,7 +54,7 @@ body:
     attributes:
       label: Version
       description: App or extension version.
-      placeholder: 0.0.1
+      placeholder: Extension 0.0.2 or macOS 0.1.0 candidate
     validations:
       required: false
   - type: dropdown
@@ -72,6 +72,6 @@ body:
     attributes:
       label: Environment
       description: OS + toolchain versions.
-      placeholder: macOS 14.x, Node 18.x, Swift 6.x
+      placeholder: macOS version, Node 20+ or 24.x, Swift 6.x, Xcode version
     validations:
       required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security reports
-    url: https://github.com/s1korrrr/codebase-combiner/security/advisories/new
-    about: Please report security vulnerabilities via private advisories.
+    url: https://github.com/s1korrrr/codebase-combiner/security/policy
+    about: Read the current private-reporting status; do not disclose vulnerabilities in a public issue.

.github/PULL_REQUEST_TEMPLATE.md

@@ -8,7 +8,7 @@
 - [ ] `npm run lint`
 - [ ] `npm run format:check`
 - [ ] `cd SwiftExplorerApp && swift test`
-- [ ] `swiftformat --lint .`
+- [ ] SwiftFormat 0.61.1: `test "$(swiftformat --version)" = "0.61.1" && swiftformat --lint .`
 
 # Checklist
 

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      development-tools:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -4,17 +4,28 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build-test:
     runs-on: macos-latest
+    timeout-minutes: 30
+    env:
+      SWIFTFORMAT_VERSION: 0.61.1
+      SWIFTFORMAT_SHA256: b990400779aceb7d7020796eb9ba814d4480543f671d38fc0ff48cb72f04c584
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 18
+          node-version: 24
           cache: npm
 
       - name: Install JS dependencies
@@ -29,11 +40,54 @@ jobs:
       - name: JS tests
         run: npm test
 
+      - name: Audit JS dependencies
+        run: |
+          npm audit --omit=dev
+          npm audit
+          npm audit signatures
+
+      - name: Package VS Code extension
+        run: |
+          npm run package
+          script/tests/vsix_inventory_test.sh
+
       - name: Install SwiftFormat
-        run: brew install swiftformat
+        run: |
+          archive="$RUNNER_TEMP/swiftformat.zip"
+          install_dir="$RUNNER_TEMP/swiftformat"
+          curl --fail --location --silent --show-error \
+            --output "$archive" \
+            "https://github.com/nicklockwood/SwiftFormat/releases/download/$SWIFTFORMAT_VERSION/swiftformat.zip"
+          echo "$SWIFTFORMAT_SHA256  $archive" | shasum --algorithm 256 --check
+          unzip -q "$archive" -d "$install_dir"
+          echo "$install_dir" >> "$GITHUB_PATH"
 
       - name: SwiftFormat lint
-        run: swiftformat --lint .
+        run: |
+          test "$(swiftformat --version)" = "$SWIFTFORMAT_VERSION"
+          swiftformat --lint .
 
       - name: Swift tests
         run: cd SwiftExplorerApp && swift test
+
+      - name: Swift Release build with warnings as errors
+        run: cd SwiftExplorerApp && swift build -c release -Xswiftc -warnings-as-errors
+
+      - name: Shell contracts
+        run: |
+          bash -n Packaging/AppStore/build_app_store_package.sh
+          bash -n Packaging/DeveloperID/build_release.sh
+          bash -n Packaging/DeveloperID/notarize_release.sh
+          bash Packaging/AppStore/tests/validate_provisioning_profile_test.sh
+          bash script/tests/build_and_run_contract_test.sh
+          bash script/tests/open_source_release_contract_test.sh
+
+      - name: Developer ID release contracts
+        run: Packaging/DeveloperID/tests/run_tests.sh
+
+      - name: App Store bundle validation
+        run: |
+          plutil -lint Packaging/AppStore/AppStore.entitlements
+          plutil -lint Packaging/AppStore/Info.plist.in
+          plutil -lint Packaging/AppStore/PrivacyInfo.xcprivacy
+          Packaging/AppStore/build_app_store_package.sh --skip-signing

.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: macos-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, swift]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0