feat(menu-icon): cờ VN dùng chính glyph emoji 🇻🇳 của Apple #362
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Security-scan hardening (2026-08-11): this workflow only reads the repo and runs | |
| # tests/builds — it never needs to write anything (no releases published from CI, | |
| # see Scripts/make-release.sh which runs locally). Declaring the ceiling explicitly | |
| # means a future step that DOES need write access has to opt in visibly, instead of | |
| # silently inheriting whatever broad default the repo/org has configured. | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: ["docs/**", "**/*.md", "assets/**"] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| jobs: | |
| test: | |
| name: TelexCore tests | |
| runs-on: macos-26 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: swift test | |
| run: cd TelexCore && swift test | |
| - name: Terminal harness unit tests | |
| run: | | |
| python3 -m unittest Scripts/test_pty_reader.py | |
| python3 -m json.tool Scripts/terminal-regression-cases.json >/dev/null | |
| swiftc -typecheck Scripts/stress-typing.swift | |
| - name: Benchmarks + zero-alloc (release) | |
| run: cd TelexCore && swift test -c release --filter 'Benchmark|ZeroAllocation' | |
| # The keystroke gate is an ABSOLUTE µs ceiling, and these runners are shared: the | |
| # same commit measured 0.2055 / 0.2108 µs on two runs and 0.4784 µs on a third whose | |
| # diff touched only Info.plist + stable.json (2026-07-27). min-of-5 inside the test | |
| # does not help — a noisy window covers the whole test. So retry the whole PROCESS a | |
| # few times and fail only if every attempt is over the ceiling: a real regression is | |
| # reproducible, a noisy neighbour is not. Keeps the ceiling tight instead of raising | |
| # it to swallow the noise (see KeystrokePerfTests for the ratchet rules). | |
| - name: Keystroke perf gate (release, 3 attempts) | |
| run: | | |
| cd TelexCore | |
| for attempt in 1 2 3; do | |
| echo "── perf gate attempt $attempt/3" | |
| if swift test -c release --filter KeystrokePerf; then | |
| exit 0 | |
| fi | |
| echo "── attempt $attempt over the ceiling; re-measuring in a fresh process" | |
| done | |
| echo "::error::keystroke perf gate failed 3 independent runs — this is a real regression, not runner noise" | |
| exit 1 | |
| build: | |
| name: Build app (unsigned) | |
| runs-on: macos-26 | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Install XcodeGen | |
| # Unpinned (security-scan finding 2026-08-11, low): resolves whatever the | |
| # CURRENT Homebrew formula is. Low priority while this workflow builds | |
| # UNSIGNED, unpublished artifacts only — pin to a specific formula/release | |
| # if CI ever starts producing anything that ships. | |
| run: brew install xcodegen | |
| - name: Generate project | |
| run: xcodegen generate | |
| - name: xcodebuild | |
| run: | | |
| xcodebuild -project VietTelex.xcodeproj -scheme VietTelex \ | |
| -configuration Release -destination 'platform=macOS' \ | |
| CODE_SIGNING_ALLOWED=NO CODE_SIGN_IDENTITY= build |