ci: add early arm64 builds and SwiftLint checks (#2)

scripts/check-local.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+set -euo pipefail
+
+usage() {
+    echo "Usage: scripts/check-local.sh /absolute/path/to/validation-directory [primary|macos15]"
+}
+
+if [[ "${1:-}" == --help || "${1:-}" == -h ]]; then
+    usage
+    exit 0
+fi
+if [[ $# -lt 1 || $# -gt 2 ]]; then
+    usage >&2
+    exit 2
+fi
+
+validation_root="$1"
+profile="${2:-primary}"
+case "$validation_root" in
+    /*) ;;
+    *) echo "The validation directory must be an absolute path." >&2; exit 2 ;;
+esac
+case "$profile" in
+    primary) toolchain=(27.1 27A9275 27.0 27) ;;
+    macos15) toolchain=(26.3 17C529 26.2 15) ;;
+    *) echo "Profile must be primary or macos15." >&2; exit 2 ;;
+esac
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$repo_root"
+trap 'status=$?; echo "Local checks failed (exit $status)." >&2; exit "$status"' ERR
+
+echo "Checking toolchain ($profile)..."
+scripts/verify-toolchain.sh "${toolchain[@]}"
+
+echo "Checking shell syntax and Git whitespace..."
+for script in scripts/*.sh; do
+    bash -n "$script"
+done
+git diff --check
+git diff --cached --check
+
+echo "Running SwiftLint..."
+scripts/lint.sh "$validation_root/tools"
+
+for configuration in Debug Release; do
+    echo "Building $configuration..."
+    scripts/build.sh "$validation_root/build" "$configuration"
+done
+
+echo "Checking application binaries and signatures..."
+scripts/verify-build.sh "$validation_root/build"
+
+echo "Local checks passed ($profile): lint, Debug, Release, arm64, macOS 15.0 minimum and signatures."
+echo "Hosted workflow execution and manual application checks remain separate."

scripts/lint.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+set -euo pipefail
+
+tools_root="${1:?Usage: scripts/lint.sh /absolute/path/to/tools-directory}"
+case "$tools_root" in
+    /*) ;;
+    *) echo "The tools directory must be an absolute path." >&2; exit 2 ;;
+esac
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+version="0.65.1"
+checksum="c1e429b0599cf1b516f369a2d9ec04eaf0e436f3c12b637df8851fa52ff694d0"
+install_root="$tools_root/swiftlint-$version"
+binary="$install_root/swiftlint"
+
+if [[ ! -x "$binary" ]]; then
+    mkdir -p "$tools_root"
+    download_root="$(mktemp -d "$tools_root/swiftlint-download.XXXXXX")"
+    trap 'rm -rf "$download_root"' EXIT
+    curl --fail --location --silent --show-error --retry 3 \
+        --proto '=https' --proto-redir '=https' \
+        "https://github.com/realm/SwiftLint/releases/download/$version/portable_swiftlint.zip" \
+        --output "$download_root/portable_swiftlint.zip"
+    printf '%s  %s\n' "$checksum" "$download_root/portable_swiftlint.zip" | shasum -a 256 -c -
+    mkdir "$download_root/extracted"
+    unzip -q "$download_root/portable_swiftlint.zip" -d "$download_root/extracted"
+    mkdir -p "$install_root"
+    cp "$download_root/extracted/swiftlint" "$binary"
+    chmod +x "$binary"
+fi
+
+if [[ "$("$binary" version)" != "$version" ]]; then
+    echo "Expected SwiftLint $version. Remove $install_root and retry." >&2
+    exit 1
+fi
+
+cd "$repo_root"
+"$binary" lint --strict --no-cache --config .swiftlint.yml

scripts/verify-build.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -euo pipefail
+
+build_root="${1:?Usage: scripts/verify-build.sh /absolute/path/to/build-directory}"
+case "$build_root" in
+    /*) ;;
+    *) echo "The build directory must be an absolute path." >&2; exit 2 ;;
+esac
+
+for configuration in Debug Release; do
+    app="$build_root/DerivedData/Build/Products/$configuration/Traccar Client macOS.app"
+    executable="$app/Contents/MacOS/Traccar Client macOS"
+    echo "Verifying $configuration..."
+    test "$(lipo -archs "$executable")" = arm64
+    test "$(xcrun vtool -show-build "$executable" | awk '/minos/ {print $2}')" = 15.0
+    codesign --verify --strict "$app"
+done

scripts/verify-toolchain.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+set -euo pipefail
+
+expected_version="${1:?Usage: scripts/verify-toolchain.sh XCODE_VERSION XCODE_BUILD SDK_VERSION OS_MAJOR}"
+expected_build="${2:?Missing Xcode build}"
+expected_sdk="${3:?Missing macOS SDK version}"
+expected_os="${4:?Missing macOS major version}"
+
+[[ "$(uname -m)" == arm64 ]] || { echo "An arm64 host is required." >&2; exit 1; }
+[[ "$(sw_vers -productVersion | cut -d . -f 1)" == "$expected_os" ]] || {
+    echo "Expected macOS $expected_os." >&2; exit 1;
+}
+
+actual_xcode="$(xcodebuild -version)"
+printf '%s\n' "$actual_xcode"
+[[ "$actual_xcode" == "$(printf 'Xcode %s\nBuild version %s' "$expected_version" "$expected_build")" ]] || {
+    echo "Unexpected Xcode version/build." >&2; exit 1;
+}
+
+actual_sdk="$(xcrun --sdk macosx --show-sdk-version)"
+[[ "$actual_sdk" == "$expected_sdk" ]] || {
+    echo "Expected macOS SDK $expected_sdk; found $actual_sdk." >&2; exit 1;
+}
+
+sw_vers
+xcrun swift --version
+printf 'Architecture: %s\nmacOS SDK: %s\n' "$(uname -m)" "$actual_sdk"