From 1a1dac6481348d143f7d1bd41de628ba5ffeb2de Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:37:29 -0700
Subject: [PATCH 1/9] Add verified GitHub workflow and repository policy

---
 .github/workflows/ci.yml                      | 16 ++++++------
 .github/workflows/codeql.yml                  | 25 ++++++++++++++++---
 .github/workflows/dependency-review.yml       |  4 +--
 .github/workflows/release.yml                 | 13 +++++-----
 AGENTS.md                                     | 19 ++++++++++++++
 .../Views/ActionsViews.swift                  |  4 ++-
 6 files changed, 61 insertions(+), 20 deletions(-)
 create mode 100644 AGENTS.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b2c39c6..034f465 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Select Xcode
         run: scripts/ci-select-xcode.sh
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: .build
           key: spm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Package.resolved') }}
@@ -58,7 +58,7 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Select Xcode
         run: scripts/ci-select-xcode.sh
       - name: Build the app and UI tests with zero warnings
@@ -85,7 +85,7 @@ jobs:
           scripts/check-layout.sh \
             "$RUNNER_TEMP/dd/Build/Products/Debug/iOS Developer Toolkit (Swift).app/Contents/MacOS/iOS Developer Toolkit (Swift)" \
             "$RUNNER_TEMP/layout"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
         with:
           name: ui-test-results
@@ -99,10 +99,10 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Select Xcode
         run: scripts/ci-select-xcode.sh
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: .build
           key: spm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Package.resolved') }}
@@ -118,13 +118,13 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Select Xcode
         run: scripts/ci-select-xcode.sh
       - name: Install the firmware helpers' build tools
         run: brew install autoconf automake libtool pkg-config cmake
       - name: Reuse the firmware helpers built from the same pinned sources
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: build-output/restore-helpers
           key: restore-helpers-${{ hashFiles('scripts/build-restore-helpers.sh') }}-${{ env.XCODE_VERSION }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 132a86c..749107a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,10 +27,10 @@ jobs:
       packages: read
       security-events: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Select Xcode
         run: scripts/ci-select-xcode.sh
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: swift
           build-mode: manual
@@ -40,6 +40,25 @@ jobs:
           xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
             -configuration Debug -destination 'platform=macOS' \
             -derivedDataPath "$RUNNER_TEMP/dd" build
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           category: "/language:swift"
+
+  analyze-actions:
+    name: Analyze Actions
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        with:
+          languages: actions
+          build-mode: none
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        with:
+          category: /language:actions
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 84f4b16..691b7c7 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -15,5 +15,5 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/dependency-review-action@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c4a66e8..e9b01a2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: macos-26
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Select Xcode
         run: scripts/ci-select-xcode.sh
       - name: Test before packaging
@@ -27,14 +27,14 @@ jobs:
       - name: Install the firmware helpers' build tools
         run: brew install autoconf automake libtool pkg-config cmake
       - name: Reuse the firmware helpers built from the same pinned sources
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: build-output/restore-helpers
           key: restore-helpers-${{ hashFiles('scripts/build-restore-helpers.sh') }}-${{ env.XCODE_VERSION }}
       - name: Build, sign, and verify the release
         # Fails unless the tag (without "v") matches ToolkitVersion.current and MARKETING_VERSION.
         run: scripts/build-release.sh "${GITHUB_REF_NAME#v}" release-assets
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: release-assets
           path: release-assets/*
@@ -42,6 +42,7 @@ jobs:
 
   publish:
     name: Attest and publish
+    environment: github-release
     needs: build
     runs-on: ubuntu-latest
     permissions:
@@ -50,7 +51,7 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: release-assets
           path: release-assets
@@ -67,11 +68,11 @@ jobs:
           echo "zip=$zip" >> "$GITHUB_OUTPUT"
           echo "sbom=$sbom" >> "$GITHUB_OUTPUT"
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v4.2.2
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: ${{ steps.files.outputs.zip }}
       - name: Attest SBOM
-        uses: actions/attest@v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: ${{ steps.files.outputs.zip }}
           sbom-path: ${{ steps.files.outputs.sbom }}
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..ece4909
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,19 @@
+# Repository instructions
+
+## Git and GitHub
+
+- Verify the canonical checkout, applicable overrides, branch, origin, revision, index, and dirty files before Git changes. Preserve unrelated work; isolate conflicting work in a worktree.
+- Use a focused codex/ branch for a reviewable change. Keep uncommitted work available for user review unless a commit is authorized.
+- Commit, push, PR creation, merge, tag, release, deployment, visibility changes, and deletion require authorization covering the operation and target. Honor an existing scoped authorization; do not infer publication from implementation approval.
+- Stage explicit paths or approved hunks, review the complete staged diff, and keep private evidence and secrets out of GitHub.
+- Merge only after applicable checks and conversations are satisfied for the latest candidate revision. Preserve required checks and prefer merge commits over rebase or squash when compatible with repository rules.
+- Pin external Actions to upstream-verified full commit SHAs. Keep PR jobs read-only except the scoped code-scanning upload permission; publishing jobs require the protected github-release environment.
+
+## Repository workflow
+
+- Follow CONTRIBUTING.md, SECURITY.md, and docs/release-verification.md.
+- Preserve the five required main checks: Swift package tests; App build, UI tests, and layout; Real simulator end-to-end test; Release packaging; Analyze Swift.
+- Run the applicable commands in CONTRIBUTING.md. Preserve warnings-as-errors, real simulator execution, UI tests, rendered layout checks, and release verification.
+- Verify a successful Swift CodeQL analysis at the candidate revision. An older scan or successful Actions analysis does not validate new Swift code.
+- Releases are version 1.x or later from main. Confirm the tag, ToolkitVersion.current, MARKETING_VERSION, and exact candidate revision before publishing.
+- A v[1-9]* tag push starts release publication through .github/workflows/release.yml; obtain authorization covering publication before pushing it, and retain owner approval on github-release.
diff --git a/App/iOSDeveloperToolkit/Views/ActionsViews.swift b/App/iOSDeveloperToolkit/Views/ActionsViews.swift
index 47d5e89..a87278c 100644
--- a/App/iOSDeveloperToolkit/Views/ActionsViews.swift
+++ b/App/iOSDeveloperToolkit/Views/ActionsViews.swift
@@ -101,7 +101,7 @@ struct ActionsView: View {
                 TextField("Search guided commands", text: $search)
                     .textFieldStyle(.roundedBorder)
                     .accessibilityIdentifier("command-search")
-                Picker("Category", selection: Binding(get: { filter }, set: selectFilter)) {
+                Picker("Category", selection: Binding(get: { filter }, set: { selectFilter($0) })) {
                     Text("All categories").tag(GuidedCommandFilter.all)
                     ForEach(GuidedCommandCategory.allCases) { category in
                         Text(category.rawValue)
@@ -113,6 +113,8 @@ struct ActionsView: View {
                     }
                 }
                 .labelsHidden()
+                // Separate the control's identity from its menu items' identifiers.
+                .accessibilityElement(children: .contain)
                 .accessibilityIdentifier("command-categories")
                 List(selection: $model.selectedActionID) {
                     ForEach(GuidedCommandCategory.allCases.filter { category in actions.contains { category.contains($0) } }) { category in

From e1b5e0756956d31650aed7eac383da261447ea41 Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:39:29 -0700
Subject: [PATCH 2/9] Separate read-only CodeQL analysis from report upload

---
 .github/workflows/codeql.yml | 62 ++++++++++++++++++++++++++++++++++--
 AGENTS.md                    |  2 +-
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 749107a..b9290dd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,7 +25,6 @@ jobs:
     permissions:
       contents: read
       packages: read
-      security-events: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Select Xcode
@@ -42,7 +41,16 @@ jobs:
             -derivedDataPath "$RUNNER_TEMP/dd" build
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
+          upload: false
+          output: ${{ runner.temp }}/codeql-sarif
           category: "/language:swift"
+      - name: Upload SARIF artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: codeql-swift
+          path: ${{ runner.temp }}/codeql-sarif
+          if-no-files-found: error
+          retention-days: 1
 
   analyze-actions:
     name: Analyze Actions
@@ -50,7 +58,6 @@ jobs:
     timeout-minutes: 20
     permissions:
       contents: read
-      security-events: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -61,4 +68,55 @@ jobs:
           build-mode: none
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
+          upload: false
+          output: ${{ runner.temp }}/codeql-sarif
+          category: /language:actions
+      - name: Upload SARIF artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: codeql-actions
+          path: ${{ runner.temp }}/codeql-sarif
+          if-no-files-found: error
+          retention-days: 1
+
+  upload-analyze:
+    name: Upload Swift analysis
+    needs: analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Download SARIF artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: codeql-swift
+          path: sarif
+      - name: Upload analysis to code scanning
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        with:
+          sarif_file: sarif
+          category: /language:swift
+          wait-for-processing: true
+
+  upload-analyze-actions:
+    name: Upload Actions analysis
+    needs: analyze-actions
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Download SARIF artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: codeql-actions
+          path: sarif
+      - name: Upload analysis to code scanning
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        with:
+          sarif_file: sarif
           category: /language:actions
+          wait-for-processing: true
diff --git a/AGENTS.md b/AGENTS.md
index ece4909..6c94b10 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,7 +7,7 @@
 - Commit, push, PR creation, merge, tag, release, deployment, visibility changes, and deletion require authorization covering the operation and target. Honor an existing scoped authorization; do not infer publication from implementation approval.
 - Stage explicit paths or approved hunks, review the complete staged diff, and keep private evidence and secrets out of GitHub.
 - Merge only after applicable checks and conversations are satisfied for the latest candidate revision. Preserve required checks and prefer merge commits over rebase or squash when compatible with repository rules.
-- Pin external Actions to upstream-verified full commit SHAs. Keep PR jobs read-only except the scoped code-scanning upload permission; publishing jobs require the protected github-release environment.
+- Pin external Actions to upstream-verified full commit SHAs. Run PR code with read-only tokens. Give security-events write only to separate upload jobs that execute pinned Actions without repository scripts; publishing jobs require the protected github-release environment.
 
 ## Repository workflow
 

From 34f67681cb6b97e411928c7c76b4792047fdc236 Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:54:49 -0700
Subject: [PATCH 3/9] Require read-only native analysis and successful uploads

---
 .github/workflows/codeql.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b9290dd..bf89fa6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,6 +17,10 @@ permissions:
 env:
   XCODE_VERSION: ${{ vars.XCODE_VERSION }}
 
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze Swift
@@ -120,3 +124,21 @@ jobs:
           sarif_file: sarif
           category: /language:actions
           wait-for-processing: true
+
+  upload-gate:
+    name: Code scanning uploads
+    needs: [upload-analyze, upload-analyze-actions]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Require every analysis upload to succeed
+        env:
+          SWIFT_UPLOAD_RESULT: ${{ needs.upload-analyze.result }}
+          ACTIONS_UPLOAD_RESULT: ${{ needs.upload-analyze-actions.result }}
+        run: |
+          if [[ "$SWIFT_UPLOAD_RESULT" != "success" ]] || [[ "$ACTIONS_UPLOAD_RESULT" != "success" ]]; then
+            printf 'Code scanning upload failed or was skipped: swift=%s; actions=%s\n' "$SWIFT_UPLOAD_RESULT" "$ACTIONS_UPLOAD_RESULT" >&2
+            exit 1
+          fi

From 3a24b26962df6a505eba88d73061f1f9a743d92b Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:56:16 -0700
Subject: [PATCH 4/9] Disable database publication and keep instructions scoped

---
 .github/workflows/codeql.yml |  6 ++++--
 AGENTS.md                    | 14 ++------------
 2 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bf89fa6..f771d5b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -45,7 +45,8 @@ jobs:
             -derivedDataPath "$RUNNER_TEMP/dd" build
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
-          upload: false
+          upload: never
+          upload-database: false
           output: ${{ runner.temp }}/codeql-sarif
           category: "/language:swift"
       - name: Upload SARIF artifact
@@ -72,7 +73,8 @@ jobs:
           build-mode: none
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
-          upload: false
+          upload: never
+          upload-database: false
           output: ${{ runner.temp }}/codeql-sarif
           category: /language:actions
       - name: Upload SARIF artifact
diff --git a/AGENTS.md b/AGENTS.md
index 6c94b10..54c9a84 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,15 +1,4 @@
-# Repository instructions
-
-## Git and GitHub
-
-- Verify the canonical checkout, applicable overrides, branch, origin, revision, index, and dirty files before Git changes. Preserve unrelated work; isolate conflicting work in a worktree.
-- Use a focused codex/ branch for a reviewable change. Keep uncommitted work available for user review unless a commit is authorized.
-- Commit, push, PR creation, merge, tag, release, deployment, visibility changes, and deletion require authorization covering the operation and target. Honor an existing scoped authorization; do not infer publication from implementation approval.
-- Stage explicit paths or approved hunks, review the complete staged diff, and keep private evidence and secrets out of GitHub.
-- Merge only after applicable checks and conversations are satisfied for the latest candidate revision. Preserve required checks and prefer merge commits over rebase or squash when compatible with repository rules.
-- Pin external Actions to upstream-verified full commit SHAs. Run PR code with read-only tokens. Give security-events write only to separate upload jobs that execute pinned Actions without repository scripts; publishing jobs require the protected github-release environment.
-
-## Repository workflow
+# Repository workflow
 
 - Follow CONTRIBUTING.md, SECURITY.md, and docs/release-verification.md.
 - Preserve the five required main checks: Swift package tests; App build, UI tests, and layout; Real simulator end-to-end test; Release packaging; Analyze Swift.
@@ -17,3 +6,4 @@
 - Verify a successful Swift CodeQL analysis at the candidate revision. An older scan or successful Actions analysis does not validate new Swift code.
 - Releases are version 1.x or later from main. Confirm the tag, ToolkitVersion.current, MARKETING_VERSION, and exact candidate revision before publishing.
 - A v[1-9]* tag push starts release publication through .github/workflows/release.yml; obtain authorization covering publication before pushing it, and retain owner approval on github-release.
+- Source extraction and analysis use read-only tokens with upload: never and upload-database: false. Separate upload-only jobs publish SARIF; Code scanning uploads must succeed for every configured language.

From f25c260aa7394865944ede6aea795e9042b586ef Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 22:56:56 -0700
Subject: [PATCH 5/9] Reject incomplete Swift extraction and avoid incompatible
 modules

---
 .github/workflows/codeql.yml | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f771d5b..932c984 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,16 +39,43 @@ jobs:
           build-mode: manual
       - name: Build the package and the app
         run: |
-          swift build
+          swift build --arch arm64
           xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
             -configuration Debug -destination 'platform=macOS' \
-            -derivedDataPath "$RUNNER_TEMP/dd" build
+            -derivedDataPath "$RUNNER_TEMP/dd" \
+            ARCHS=arm64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO build
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           upload: never
           upload-database: false
           output: ${{ runner.temp }}/codeql-sarif
           category: "/language:swift"
+      - name: Reject Swift extraction errors
+        env:
+          SARIF_FILE: ${{ runner.temp }}/codeql-sarif/swift.sarif
+        run: |
+          if [[ ! -s "$SARIF_FILE" ]]; then
+            printf 'Swift SARIF is missing or empty.\n' >&2
+            exit 1
+          fi
+          error_count="$(jq -er '
+            if type != "object" or (.runs | type) != "array" or (.runs | length) == 0 then
+              error("Invalid Swift SARIF runs")
+            elif any(.runs[]; type != "object" or (.invocations | type) != "array" or (.invocations | length) == 0) then
+              error("Invalid Swift SARIF invocations")
+            elif any(.runs[].invocations[]; type != "object" or (.toolExecutionNotifications | type) != "array") then
+              error("Invalid Swift SARIF notifications")
+            elif any(.runs[].invocations[].toolExecutionNotifications[]; type != "object" or (.descriptor | type) != "object" or (.descriptor.id | type) != "string") then
+              error("Invalid Swift SARIF notification descriptor")
+            else
+              [.runs[].invocations[].toolExecutionNotifications[] | select(.descriptor.id == "swift/diagnostics/extraction-errors")] | length
+            end
+          ' "$SARIF_FILE")"
+          if [[ "$error_count" != "0" ]]; then
+            printf 'Swift extraction reported %s compiler diagnostics; inspect the analysis diagnostics before publishing SARIF.\n' "$error_count" >&2
+            exit 1
+          fi
+          printf 'Swift extraction compiler diagnostics: 0\n'
       - name: Upload SARIF artifact
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:

From 65caaecd9d55ca01cb58a495db3e6e3d199d7ff8 Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 23:08:49 -0700
Subject: [PATCH 6/9] Retain Swift SARIF when the extraction gate fails

---
 .github/workflows/codeql.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 932c984..99b63f0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -77,6 +77,7 @@ jobs:
           fi
           printf 'Swift extraction compiler diagnostics: 0\n'
       - name: Upload SARIF artifact
+        if: success() || failure()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: codeql-swift

From b159cb32c0cfc967fa8c6fb86b48e10944cc0def Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 23:26:23 -0700
Subject: [PATCH 7/9] Select the ARM destination for Swift source analysis

---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 99b63f0..a1c4074 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,7 +41,7 @@ jobs:
         run: |
           swift build --arch arm64
           xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
-            -configuration Debug -destination 'platform=macOS' \
+            -configuration Debug -destination 'platform=macOS,arch=arm64' \
             -derivedDataPath "$RUNNER_TEMP/dd" \
             ARCHS=arm64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO build
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4

From 553646ebe47641e0feeb6ddd8081b81f0938fcd8 Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Thu, 8 Oct 2026 23:52:36 -0700
Subject: [PATCH 8/9] Use the available Intel architecture for traced Swift
 builds

---
 .github/workflows/codeql.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a1c4074..10b8741 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,11 +39,11 @@ jobs:
           build-mode: manual
       - name: Build the package and the app
         run: |
-          swift build --arch arm64
+          swift build --arch x86_64
           xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
-            -configuration Debug -destination 'platform=macOS,arch=arm64' \
+            -configuration Debug -destination 'platform=macOS,arch=x86_64' \
             -derivedDataPath "$RUNNER_TEMP/dd" \
-            ARCHS=arm64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO build
+            ARCHS=x86_64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO build
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           upload: never

From a567c2784cb4fa1f121ae5c622cd9b3c3275f4f8 Mon Sep 17 00:00:00 2001
From: hideouts-io <83608068+hideouts-io@users.noreply.github.com>
Date: Fri, 9 Oct 2026 00:21:52 -0700
Subject: [PATCH 9/9] Apply documented CodeQL Xcode driver and cache settings

---
 .github/workflows/codeql.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 10b8741..9dba436 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -43,7 +43,10 @@ jobs:
           xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit \
             -configuration Debug -destination 'platform=macOS,arch=x86_64' \
             -derivedDataPath "$RUNNER_TEMP/dd" \
-            ARCHS=x86_64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO build
+            ARCHS=x86_64 ONLY_ACTIVE_ARCH=YES SWIFT_ENABLE_EXPLICIT_MODULES=NO \
+            CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO \
+            COMPILATION_CACHE_ENABLE_CACHING=NO SWIFT_ENABLE_COMPILE_CACHE=NO \
+            SWIFT_USE_INTEGRATED_DRIVER=NO build
       - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           upload: never