feat: ship Installory 1.4 audit campaign

.github/workflows/test.yml

@@ -13,11 +13,14 @@ jobs:
   test:
     name: InstalloryCore
     # Package.swift declares swift-tools-version 6.1, which needs Xcode 16.3+.
-    # The macos-14 image ships an older toolchain and cannot resolve the manifest.
+    # The macOS 15 image supplies a compatible Xcode toolchain.
     runs-on: macos-15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+
+      - name: Check product invariants
+        run: ./scripts/check-invariants.sh
 
       - name: Show toolchain
         run: swift --version
@@ -26,6 +29,63 @@ jobs:
         working-directory: Installory
         run: swift build
 
-      - name: Test
+      - name: Test XCTest
+        working-directory: Installory
+        run: swift test --no-parallel --disable-swift-testing
+
+      - name: Test Swift Testing
         working-directory: Installory
-        run: swift test
+        run: swift test --no-parallel --disable-xctest
+
+  app:
+    name: InstalloryApp
+    runs-on: macos-15
+    env:
+      XCODEGEN_VERSION: "2.45.4"
+      XCODEGEN_SHA256: "090ec29491aad50aec10631bf6e62253fed733c50f3aab0f5ffc86bc170bdbef"
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Show Xcode toolchain
+        run: xcodebuild -version
+
+      - name: Install pinned XcodeGen
+        run: |
+          archive="$RUNNER_TEMP/xcodegen.zip"
+          curl --fail --location --silent --show-error \
+            "https://github.com/yonaskolb/XcodeGen/releases/download/${XCODEGEN_VERSION}/xcodegen.zip" \
+            --output "$archive"
+          echo "${XCODEGEN_SHA256}  ${archive}" | shasum -a 256 --check
+          unzip -q "$archive" -d "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/xcodegen/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/xcodegen/bin/xcodegen" --version
+
+      - name: Regenerate Xcode project
+        run: ./scripts/regenerate-xcode.sh
+
+      - name: Verify generated product invariants
+        run: ./scripts/check-invariants.sh
+
+      - name: Test app (Debug)
+        run: >-
+          xcodebuild
+          -project Installory.xcodeproj
+          -scheme Installory
+          -configuration Debug
+          -destination 'platform=macOS'
+          -parallel-testing-enabled NO
+          CODE_SIGNING_ALLOWED=NO
+          CODE_SIGNING_REQUIRED=NO
+          test
+
+      - name: Build app (Release)
+        run: >-
+          xcodebuild
+          -project Installory.xcodeproj
+          -scheme Installory
+          -configuration Release
+          -destination 'platform=macOS'
+          CODE_SIGNING_ALLOWED=NO
+          CODE_SIGNING_REQUIRED=NO
+          build

.gitignore

@@ -30,6 +30,10 @@ Installory.xcodeproj/
 *.log
 *.tmp
 
+# Python build-tool caches
+__pycache__/
+*.pyc
+
 # Personal/project-tool artifacts
 .claude/settings.local.json
 

App/Info.plist

@@ -15,9 +15,11 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.3.1</string>
+	<string>1.4.0</string>
 	<key>CFBundleVersion</key>
-	<string>9</string>
+	<string>10</string>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
 	<key>LSApplicationCategoryType</key>
 	<string>public.app-category.developer-tools</string>
 </dict>

App/Installory.entitlements

@@ -6,7 +6,7 @@
 	<true/>
 	<key>com.apple.security.files.bookmarks.app-scope</key>
 	<true/>
-	<key>com.apple.security.files.user-selected.read-only</key>
+	<key>com.apple.security.files.user-selected.read-write</key>
 	<true/>
 </dict>
 </plist>

App/Resources/ThirdPartyNotices.txt

@@ -0,0 +1,66 @@
+Installory Third-Party Notices
+===============================
+
+GRDB.swift
+----------
+
+https://github.com/groue/GRDB.swift
+
+Copyright (C) 2015-2025 Gwendal Roué
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+
+Bootstrap Icons — Search glyph
+--------------------------------
+
+The search glyph used in the Installory app icon is from Bootstrap Icons.
+https://icons.getbootstrap.com/icons/search/
+
+The MIT License (MIT)
+
+Copyright (c) 2019-2024 The Bootstrap Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+
+SVG Repo — Open Box glyph
+--------------------------
+
+The open-box glyph used in the Installory app icon was sourced from SVG Repo.
+https://www.svgrepo.com/svg/441686/open-box
+
+SVG Repo identifies this glyph as licensed under CC0 1.0 Universal.
+https://creativecommons.org/publicdomain/zero/1.0/