ci: pin tooling and streamline verified builds

[steipete]

Developer checks built and ran the Swift suite twice, and CI inherited the runner's old default Xcode. Pin Xcode 26.0.1 (Swift 6.2, the documented source floor), Node 26.8.2 and pnpm 12.4.1, pin Actions to verified release commits, and run the existing coverage suite once. The universal build still compiles arm64 and x86_64; a native CLI smoke test replaces the redundant extra release build.

Extract the existing weighted coverage calculation into a Python script, retain its 90% threshold and include/exclude overrides, and test threshold, weighting and empty-scope failures. SwiftPM supplies the exact report path instead of a filesystem search. The docs Pages workflow tracks the Node pin.

Replace automatic CodeQL build discovery with an explicit Swift build after dependency resolution, using the same default queries and all existing language scans (Swift, JavaScript/TypeScript, Actions). The baseline automatic scan spent almost eight minutes before fetching dependencies and about fifteen minutes overall. The repository's default-setup setting will be replaced by this versioned workflow; no security language or query suite is removed.

Dependency audit: Commander 0.2.4 is already latest (July 15). Node 26.8.2 (September 9), pnpm 12.4.1 (September 10, 17:06 UTC), checkout 7.0.1, setup-node 7.0.0, configure-pages 6.0.0, upload-pages-artifact 5.0.0, deploy-pages 5.0.1 and CodeQL Action 4.38.0 all predate the 48-hour cutoff. The existing app-token 3.2.0 SHA is current. No product version or platform floor changes.

Local validation: make check passes strict Swift/shell/workflow lint, all 92 Swift tests and three independent coverage-gate tests; RemindCore coverage is 94.0% (958/1019). make build, make docs-site, make release-harness, and pnpm install --lockfile-only pass. The pinned package manager reports 12.4.1. Local builds used the available Swift 6.4 compiler in Swift 6 language mode; CI explicitly exercises the documented Swift 6.2 toolchain.

Live proof: the rebuilt CLI passed synthetic EventKit create/read/edit/all output modes/complete/delete checks, including read/write snapshot equality and alarm preservation. The disposable list was deleted.

Isolated Codex autoreview is scoped-clean through P2. Default CodeQL setup is switched off in favor of the reviewed advanced workflow in this PR; merging requires successful exact-head scans for all three languages.

The pinned pnpm CLI rejects the legacy global -s alias. Internal script calls now use its supported pnpm run --reporter=silent syntax; frozen installation and the real pnpm check path pass, including all tests and the unchanged 94.0% coverage result. This compatibility follow-up also passed isolated P2 autoreview.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 13, 2026, 2:55 AM ET / 06:55 UTC.

ClawSweeper review

What this changes

Pins build tooling and GitHub Actions, removes duplicate Swift test execution, adds coverage-calculation tests, and checks the universal CLI alongside explicit CodeQL scans.

Merge readiness

✅ Ready for maintainer review

The PR remains useful: current main still runs duplicate developer test passes and lacks the proposed tooling pins and explicit CodeQL workflow. No blocking patch defect was found. The collaborator-authored PR is also exempt from automatic closure.

Priority: P3
Reviewed head: 53d633b2f55c3b424ebd5f43e608cd86b683045e

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused tooling improvement with preserved coverage semantics, targeted tests, verified action pins, and no blocking finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: The contributor-proof gate is exempt for this collaborator-authored PR. The supplied body reports successful real pnpm checks and rebuilt CLI use; exact-head job metadata confirms coverage, universal packaging, and native smoke completion, while raw logs were unavailable for independent inspection.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The contributor-proof gate is exempt for this collaborator-authored PR. The supplied body reports successful real pnpm checks and rebuilt CLI use; exact-head job metadata confirms coverage, universal packaging, and native smoke completion, while raw logs were unavailable for independent inspection.
Evidence reviewed	13 items	Policy and checkout inspection: The checkout matches the pinned PR head. No AGENTS.md or maintainer-notes directory was found, and git status remained clean. Current-main necessity and release boundary: At the pinned main revision, Makefile check invokes both make test and check-coverage.sh, each running Swift tests. The reviewed delta contains 13 files, with no intervening base changes. GitHub still reports this PR unmerged; the latest release is v0.3.6 at 972357d. The bounded recent-PR listing did not identify a replacement for this work. Coverage behavior preserved: Read the old inline calculator and the complete extracted script: weighted line totals, inclusion/exclusion rules, 90% default threshold, and failure exit codes are preserved. The shell entrypoint synchronizes version files before its single coverage-enabled Swift test run. Three added tests cover the threshold, weighted failure, and empty selection.
Findings	None	None.
Security	None	None.

How this fits together

remindctl’s developer and CI workflows turn Swift source into a macOS command-line app and build its documentation. Coverage checks, artifact checks, and security scans validate those outputs before release.

flowchart TD
  A[Source changes] --> B[Pinned build tooling]
  B --> C[Swift tests and coverage gate]
  B --> D[Universal macOS build]
  D --> E[Native CLI smoke checks]
  A --> F[CodeQL language scans]
  B --> G[Documentation site]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Developer Swift test passes	2 → 1 per check invocation	Both Make and pnpm retain the coverage gate while removing the redundant suite run.
Coverage-script line delta	production tooling −1 net line; tests +49 lines; application source unchanged	The calculator extraction adds focused regression coverage without growing the application implementation.

Technical review

Best possible solution:

Keep one coverage-enabled developer test pass, preserve both release architectures, and use the versioned three-language CodeQL workflow with successful checks as the landing gate.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a product bug reproduction; current-main source directly establishes the duplicate test invocations, and no introduced failure was identified.

Is this the best way to solve the issue?

Yes. Reusing the existing coverage gate and universal packaging path is a focused approach, and the extracted calculator preserves the previous behavior.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 3734cbe9d09b.

Labels

Label changes:

• add P3: This is bounded build and developer-workflow cleanup without a demonstrated urgent user-facing failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor-proof gate is exempt for this collaborator-authored PR. The supplied body reports successful real pnpm checks and rebuilt CLI use; exact-head job metadata confirms coverage, universal packaging, and native smoke completion, while raw logs were unavailable for independent inspection.

Label justifications:

• P3: This is bounded build and developer-workflow cleanup without a demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor-proof gate is exempt for this collaborator-authored PR. The supplied body reports successful real pnpm checks and rebuilt CLI use; exact-head job metadata confirms coverage, universal packaging, and native smoke completion, while raw logs were unavailable for independent inspection.

Evidence

What I checked:

• Policy and checkout inspection: The checkout matches the pinned PR head. No AGENTS.md or maintainer-notes directory was found, and git status remained clean. (53d633b2f55c)
• Current-main necessity and release boundary: At the pinned main revision, Makefile check invokes both make test and check-coverage.sh, each running Swift tests. The reviewed delta contains 13 files, with no intervening base changes. GitHub still reports this PR unmerged; the latest release is v0.3.6 at 972357d. The bounded recent-PR listing did not identify a replacement for this work. (Makefile:32, 3734cbe9d09b)
• Coverage behavior preserved: Read the old inline calculator and the complete extracted script: weighted line totals, inclusion/exclusion rules, 90% default threshold, and failure exit codes are preserved. The shell entrypoint synchronizes version files before its single coverage-enabled Swift test run. Three added tests cover the threshold, weighted failure, and empty selection. (scripts/check-coverage.sh:15, 53d633b2f55c)
• Universal build and exact-head validation: The existing build-macos-universal.sh still builds arm64 and x86_64 release binaries and verifies both slices. GitHub job 103687829454 reports success at the pinned head for coverage, the release harness, universal packaging, and native CLI smoke checks. This establishes completed workflow steps, not independently inspected runtime output: the raw-log download was blocked by the artifact host allowlist. No local builds or tests were executed. (.github/workflows/ci.yml:46, 53d633b2f55c)
• CodeQL scope and discussion: The complete supplied body says default setup was disabled in favor of advanced setup and requires all three scans to succeed. The workflow explicitly retains Actions, JavaScript/TypeScript, and Swift, with dependency resolution before Swift analysis. Exact-head Actions and JavaScript/TypeScript jobs succeeded; Swift preparation and initialization succeeded, with its build still running at inspection. Repository setting inspection was unavailable, so the setting transition remains an author-reported fact. (.github/workflows/codeql.yml:26, 53d633b2f55c)
• Checkout pin provenance: GitHub's v7.0.1 tag resolves to the exact checkout commit used throughout the patch. (3d3c42e5aac5)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.