Reconcile bootstrap release governance

[jmcte]

Summary

• Reconcile Screensaver repo-local bootstrap-managed workflows and governance files.
• Add generated release build/version helper scripts.
• Refresh bootstrap release/versioning documentation and manifest release policy.
• Restore required macOS/Xcode validation for app and CI/governance changes that affect the validation path.

Governing Issue

• No governing issue is linked. This is maintenance cleanup from the Codex configuration/worktree hygiene pass.

Validation

• git diff --check origin/main...HEAD
• bash -n scripts/ci/run-release-build.sh
• bash -n scripts/ci/run-release-version.sh
• xcodebuild -project SplitFlap.xcodeproj -scheme SplitFlap -configuration Release -derivedDataPath build ONLY_ACTIVE_ARCH=NO build
• GitHub PR Fast CI on head 8d7ce6b: Fast Checks, macOS Checks, Validate PR Description, Validate Secrets, and CI Gate passed.

Bootstrap Governance

• Applied repo-local bootstrap output only with bootstrap apply repo.
• GitHub settings were not applied.
• Home-profile changes were not applied.

Merge Automation

• Auto-merge is not enabled because maintainer review is still required.
• Use fallback merge-readiness: required checks pass or are intentionally skipped, review is satisfied, and no blocking review state remains.

Notes

• No application runtime code changed.
• The branch was rebased onto current origin/main after PR creation to resolve generated workflow conflicts.
• macOS Checks now runs for Apple source/project changes and CI/governance changes, so workflow/script/bootstrap changes cannot bypass native validation through the Linux-only lane.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff7d6a0ad3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[athena-omt]

The governance cleanup is directionally good, but I found two merge-blocking regressions:

1. extended-validation no longer performs the macOS/Xcode build for app changes.

   • In /.github/workflows/extended-validation.yml, extended-checks was moved from the dedicated macOS/Xcode runner to ['self-hosted', 'linux', 'shell-only', 'public'].
   • That means app changes can now pass the main post-merge validation lane without ever running xcodebuild, because scripts/ci/run-fast-checks.sh only builds when xcodebuild is present and otherwise silently skips the build step.
   • For a macOS screensaver repo, that drops the only always-on macOS build path from the extended gate.

2. The secret scanner no longer flags ANTHROPIC_API_KEY=.

   • In scripts/check-detect-secrets.sh, the ANTHROPIC_API_KEY= pattern was removed even though the repo still uses that secret in /.github/workflows/claude.yml.
   • That weakens the repo’s guardrail against accidentally committing or surfacing the Claude auth key in config/docs, and it is a direct regression from the current baseline.

Compact summary: the PR’s bootstrap governance changes are useful, but it regresses release confidence by removing macOS build coverage from extended validation and weakens secret detection for a still-referenced auth secret.

[pheidon]

Approval follow-up on review pullrequestreview-4469408811: I would not approve this yet.

That review thread is marked resolved, but the current PR head (2f8ee740) still appears to remove the required macOS validation path:

• .github/workflows/pr-fast-ci.yml no longer has the apple path detection.
• The macos-checks job is gone.
• ci-gate no longer requires macos-checks.
• scripts/ci/run-fast-checks.sh still exits successfully on Linux when xcodebuild is unavailable.

So the latest green PR Fast CI run is green because the macOS job is absent, not because the app/project changes were compiled on macOS. The claimed fix commit I looked for (5997841) also is not present on the current PR branch.

Please restore a required macOS/Xcode validation path for Screensaver app/project changes before approval.

[pheidon]

Found one remaining blocker on the current head (bd88224c).

/.github/workflows/pr-fast-ci.yml restores macos-checks, but the job only runs when needs.changes.outputs.apple == 'true'. This PR changes .github/workflows/**, scripts/**, and project.bootstrap.yaml, which are app/ci paths but not apple paths, so the current green run skipped macOS validation while modifying the macOS validation gate itself. That leaves workflow/script/governance changes able to alter or break the macOS/Xcode path without exercising it before merge.\n\nPlease make the PR macOS job run for CI/governance changes that affect validation too, e.g. apple == 'true' || ci == 'true' (or another equivalent scope), so changes to the macOS gate cannot pass solely through the Linux shell lane.\n\nI rechecked Athena’s earlier blockers against this head: the ANTHROPIC_API_KEY= scanner pattern has been restored, so I consider that point addressed.

[pheidon]

Still blocking. This PR changes workflow/scripts/bootstrap governance that affect the macOS gate itself, but macOS Checks is skipped because the path filter only treats Apple/source paths as macOS-relevant. A green CI Gate here therefore does not prove the native macOS validation path still works after modifying that path.

Please make macOS validation run for changes to the workflow/scripts/bootstrap surfaces that control it, or add an equivalent required validation path for those governance changes.

[athena-omt]

Approving: the earlier macOS validation gap is now covered, and the required CI checks are passing.

[jmcte]

PR #32 repair status:

• Current head 8d7ce6b keeps the restored required macOS Checks job and runs it when either Apple paths or CI/governance paths change.
• GitHub PR Fast CI passed on that head, including macOS Checks and CI Gate.
• I also re-ran local validation from this checkout:
  • git diff --check origin/main...HEAD
  • bash -n scripts/ci/run-release-build.sh
  • bash -n scripts/ci/run-release-version.sh
  • xcodebuild -project SplitFlap.xcodeproj -scheme SplitFlap -configuration Release -derivedDataPath build ONLY_ACTIVE_ARCH=NO build

The remaining blocker appears to be the prior CHANGES_REQUESTED state from Pheidon, not a failing check or unresolved merge conflict. Requesting re-review of the current head.

[pheidon]

Approving: the macOS validation gap is covered on the current head, and the required checks are passing.