ci: expand validation and add green-main macos tip nightly

.github/actionlint.yaml

@@ -0,0 +1,17 @@
+# actionlint 1.7.10 predates GitHub's hosted xcode-27 label.
+# https://github.com/actions/runner-images/blob/main/README.md
+paths:
+  .github/workflows/apple-validation.yml:
+    ignore:
+      - 'label "xcode-27" is unknown'
+  .github/workflows/macos-tip-nightly.yml:
+    ignore:
+      - 'label "xcode-27" is unknown'
+  # These inherited workflow snippets are valid shell; actionlint cannot see
+  # step env declarations or intentionally literal jq/summary strings.
+  .github/workflows/cli-release.yml:
+    ignore:
+      - 'shellcheck reported issue in this script: SC2153:'
+  .github/workflows/server-deploy.yml:
+    ignore:
+      - 'shellcheck reported issue in this script: SC2016:'

.github/workflows/apple-validation.yml

@@ -0,0 +1,126 @@
+name: Apple Validation
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: apple-validation-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contracts:
+    name: Apple source, scripts, and Swift protocol
+    runs-on: xcode-27
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: '1.4.0'
+      - run: bun install --frozen-lockfile
+      - name: Verify host and source contracts
+        run: |
+          test "$(sw_vers -productVersion | cut -d. -f1)" -ge 27
+          xcodebuild -version
+          xcrun swift --version
+          bash scripts/apple/run-ci-checks.sh --lint-only
+      - name: Test Apple build and release scripts
+        run: bun test scripts/apple scripts/macos
+      - name: Verify generated Swift protocol
+        run: |
+          cd scripts
+          bun run proto:generate-swift
+          cd ..
+          git diff --exit-code -- apple/InlineKit/Sources/InlineProtocol
+          test -z "$(git ls-files --others --exclude-standard apple/InlineKit/Sources/InlineProtocol)"
+
+  swift-main:
+    name: Swift packages (main)
+    runs-on: xcode-27
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/cache@v4
+        with:
+          path: ~/Library/Caches/org.swift.swiftpm
+          key: swiftpm-xcode27-${{ hashFiles('apple/**/Package.resolved') }}
+      - name: Build and test four main packages
+        env:
+          APPLE_CI_SKIP_SOURCE_CHECKS: '1'
+          APPLE_CI_REPORT_DIR: ${{ runner.temp }}/swift-main-reports
+        run: bash scripts/apple/run-ci-checks.sh InlineKit InlineUI InlineIOSUI InlineMacUI
+      - uses: actions/upload-artifact@v4
+        if: always()
+        continue-on-error: true
+        with:
+          name: swift-main-reports
+          path: ${{ runner.temp }}/swift-main-reports/
+          retention-days: 7
+
+  swift-utilities:
+    name: Swift packages (utilities)
+    runs-on: xcode-27
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/cache@v4
+        with:
+          path: ~/Library/Caches/org.swift.swiftpm
+          key: swiftpm-xcode27-${{ hashFiles('apple/**/Package.resolved') }}
+      - name: Verify macOS 27 host
+        run: test "$(sw_vers -productVersion | cut -d. -f1)" -ge 27
+      - name: Build and test eight utility packages
+        env:
+          APPLE_CI_SKIP_SOURCE_CHECKS: '1'
+          APPLE_CI_REPORT_DIR: ${{ runner.temp }}/swift-utility-reports
+        run: bash scripts/apple/run-ci-checks.sh InlineRealtimeCore InlineMacSidebarModel InlineThumbnailing InlineSyntaxHighlighting InlineMacScripting InlineMath MemojiKit InlineDevCompanion
+      - uses: actions/upload-artifact@v4
+        if: always()
+        continue-on-error: true
+        with:
+          name: swift-utility-reports
+          path: ${{ runner.temp }}/swift-utility-reports/
+          retention-days: 7
+
+  macos-app:
+    name: macOS app Debug and Release
+    runs-on: xcode-27
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build unsigned macOS app
+        env:
+          APPLE_CI_REPORT_DIR: ${{ runner.temp }}/macos-app-reports
+        run: bash scripts/apple/build-ci-app.sh macos
+      - uses: actions/upload-artifact@v4
+        if: always()
+        continue-on-error: true
+        with:
+          name: macos-app-build-logs
+          path: ${{ runner.temp }}/macos-app-reports/
+          retention-days: 7
+
+  ios-app:
+    name: iOS device app Debug and Release
+    runs-on: xcode-27
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build unsigned generic iOS device app
+        env:
+          APPLE_CI_REPORT_DIR: ${{ runner.temp }}/ios-app-reports
+        run: bash scripts/apple/build-ci-app.sh ios
+      - uses: actions/upload-artifact@v4
+        if: always()
+        continue-on-error: true
+        with:
+          name: ios-app-build-logs
+          path: ${{ runner.temp }}/ios-app-reports/
+          retention-days: 7