Apple project workflows
Read Package.swift, Makefile, .github/workflows/, scripts, and references/project-contract.md. Use for targets, dependencies, deployment versions, bundle metadata, entitlements, build scripts, rename/icon changes, or CI policy.
Source-of-truth contract
Package.swift defines the AppCore library, Starter executable, deployment version, and tests.Resources/Info.plist and Config/Starter.entitlements define macOS bundle metadata and capabilities.scripts/build-macos-app.sh assembles and signs the SwiftPM executable as a macOS .app; release mode also preserves private symbols, strips the copied Mach-O, and verifies hardening.Makefile is the documented front door.- No Xcode project, XcodeGen,
xcodebuild, or package-manager bootstrap is part of the build contract.
Workflow
- Identify which source of truth owns the requested change.
- Keep reusable code in
AppCore and scene/process ownership in the executable target.
- Build/test with SwiftPM before assembling the app bundle.
- Update metadata, entitlements, rename/icon/static-check scripts together.
- Run a rename simulation in a disposable copy after template-identity changes.
- Update README, AGENTS, docs, skills, and workflows together.
- Run
make validate, make workflow-test, SwiftPM tests/build, macOS bundle assembly, and make hardening-check as the host permits; distinguish their evidence.
Guardrails
- Do not add an Xcode project or a speculative iPadOS target before that product phase exists.
- Do not commit build output, profiles, certificates, keychains, or secrets.
- Keep scripts compatible with macOS system Bash.
- Sign the complete
.app; permissions/TCC attach to bundle identity rather than the raw SwiftPM executable.
- Entitlements are minimal by default; each capability needs product justification and a denied/restricted path.
- GitHub Actions remain permanently disabled in this template; keep every workflow example suffixed
.disabled and reject active .yml/.yaml files.
- Report SwiftPM compilation, app assembly, launch, signing, and notarisation as distinct checks.
1---2name: apple-project-workflows3description: Maintain the Swift package, Make targets, macOS app bundle assembly, rename/icon helpers, disabled CI examples and policy, signing capabilities, and build-source contract.4license: MIT5---67# Apple project workflows89Read `Package.swift`, `Makefile`, `.github/workflows/`, scripts, and `references/project-contract.md`. Use for targets, dependencies, deployment versions, bundle metadata, entitlements, build scripts, rename/icon changes, or CI policy.1011## Source-of-truth contract1213- `Package.swift` defines the `AppCore` library, `Starter` executable, deployment version, and tests.14- `Resources/Info.plist` and `Config/Starter.entitlements` define macOS bundle metadata and capabilities.15- `scripts/build-macos-app.sh` assembles and signs the SwiftPM executable as a macOS `.app`; release mode also preserves private symbols, strips the copied Mach-O, and verifies hardening.16- `Makefile` is the documented front door.17- No Xcode project, XcodeGen, `xcodebuild`, or package-manager bootstrap is part of the build contract.1819## Workflow20211. Identify which source of truth owns the requested change.222. Keep reusable code in `AppCore` and scene/process ownership in the executable target.233. Build/test with SwiftPM before assembling the app bundle.244. Update metadata, entitlements, rename/icon/static-check scripts together.255. Run a rename simulation in a disposable copy after template-identity changes.266. Update README, AGENTS, docs, skills, and workflows together.277. Run `make validate`, `make workflow-test`, SwiftPM tests/build, macOS bundle assembly, and `make hardening-check` as the host permits; distinguish their evidence.2829## Guardrails3031- Do not add an Xcode project or a speculative iPadOS target before that product phase exists.32- Do not commit build output, profiles, certificates, keychains, or secrets.33- Keep scripts compatible with macOS system Bash.34- Sign the complete `.app`; permissions/TCC attach to bundle identity rather than the raw SwiftPM executable.35- Entitlements are minimal by default; each capability needs product justification and a denied/restricted path.36- GitHub Actions remain permanently disabled in this template; keep every workflow example suffixed `.disabled` and reject active `.yml`/`.yaml` files.37- Report SwiftPM compilation, app assembly, launch, signing, and notarisation as distinct checks.
rcarmo