ci: pin third-party steps, lint workflows, guard empty test runs

.githooks/pre-commit

@@ -3,11 +3,11 @@
 # Enable once per clone:  git config core.hooksPath .githooks
 #
 # Requires gitleaks:  brew install gitleaks
-# If gitleaks isn't installed, the hook warns and lets the commit through — CI
-# (.github/workflows/gitleaks.yml) is the non-bypassable backstop.
+# If gitleaks isn't installed, the hook warns and lets the commit through. No CI
+# job scans for secrets, so this hook is the only secret scan before a push.
 
 if ! command -v gitleaks >/dev/null 2>&1; then
-    echo "⚠️  gitleaks not installed — skipping local secret scan (CI will still check)."
+    echo "⚠️  gitleaks not installed — skipping local secret scan."
     echo "    Install with: brew install gitleaks"
     exit 0
 fi

.github/PULL_REQUEST_TEMPLATE.md

@@ -31,4 +31,5 @@
 - [ ] Nothing in this PR (files, commit messages, branch name, description, comments, attachments, linked issues) holds customer data, unfixed vulnerability detail, secrets, or step-by-step attack detail against keys, PIN or encryption; such content is left out and handled privately with the maintainers ([ADR-0001, rule 2](https://github.com/dashpay/dashwallet-ios/blob/develop/docs/adr/0001-record-architecture-decisions-as-adrs.md))
 
 **For repository code-owners and collaborators only**
-- [ ] I have assigned this pull request to a milestone
+- [ ] I have assigned this pull request to a milestone
+- [ ] If workflow-lint warned that a release-only step or `.xcode-version` changed, or a `.platform-ref` bump changed platform's Rust version, I ran the affected workflow by hand from this branch on the final commit (`release-dashpay-testflight.yml` with `wallet_ref` = that commit and `release_channel: internal-only`; `appstore-schema-release.yml` with `dry_run: true`) and linked the run here; a later push needs a new run

.github/actions/select-xcode/action.yml

@@ -0,0 +1,71 @@
+name: Select Xcode
+description: >-
+  Select the Xcode version named in .xcode-version: from the checkout being
+  built, else from the fallback checkout. Fails before the build when the file
+  is missing or that Xcode is not installed on the runner image.
+
+inputs:
+  app-path:
+    description: The checkout being built; its .xcode-version is read first.
+    required: true
+  fallback-path:
+    description: >-
+      A checkout whose .xcode-version is read when app-path has none (the
+      release tooling checkout, for app branches older than the file).
+    required: false
+    default: ""
+
+outputs:
+  version:
+    description: The selected Xcode version, as in /Applications/Xcode_<version>.app.
+    value: ${{ steps.select.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Select Xcode
+      id: select
+      shell: bash
+      env:
+        APP_PATH: ${{ inputs.app-path }}
+        FALLBACK_PATH: ${{ inputs.fallback-path }}
+      run: |
+        set -euo pipefail
+        version=""
+        source=""
+        candidates=("$APP_PATH/.xcode-version")
+        if [ -n "$FALLBACK_PATH" ]; then
+          candidates+=("$FALLBACK_PATH/.xcode-version")
+        fi
+        for candidate in "${candidates[@]}"; do
+          if [ -f "$candidate" ]; then
+            version="$(tr -d '[:space:]' < "$candidate")"
+            if [ -n "$version" ]; then
+              source="$candidate"
+              break
+            fi
+          fi
+        done
+        if [ -z "$version" ]; then
+          echo "::error::select_xcode.version_file_missing: .xcode-version is missing or empty in ${candidates[*]}. Rule: CI builds with the Xcode version named in .xcode-version at the repository root."
+          exit 1
+        fi
+        if [ "$source" != "${candidates[0]}" ]; then
+          echo "Read Xcode $version from $source (fallback: $APP_PATH has no .xcode-version)"
+        else
+          echo "Read Xcode $version from $source"
+        fi
+
+        developer_dir="/Applications/Xcode_${version}.app/Contents/Developer"
+        if [ ! -d "$developer_dir" ]; then
+          available=""
+          for app in /Applications/Xcode_*.app; do
+            [ -d "$app" ] || continue
+            name="${app##*/Xcode_}"
+            available="${available:+$available, }${name%.app}"
+          done
+          echo "::error::select_xcode.not_installed: Xcode $version from $source is not installed. Available: ${available:-none}"
+          exit 1
+        fi
+        sudo xcode-select -s "$developer_dir"
+        echo "version=$version" >> "$GITHUB_OUTPUT"

.github/workflows/accessibility.yml

@@ -49,9 +49,11 @@ jobs:
     name: VoiceOver / Dynamic Type audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
 

.github/workflows/appstore-schema-release.yml

@@ -33,10 +33,10 @@
     timeout-minutes: 15
     environment: testflight
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # v1
         with:
           ruby-version: '3.3'
       - name: Observe published builds

.github/workflows/core-drain-tests.yml

@@ -19,7 +19,7 @@ jobs:
   recovery:
     runs-on: macos-26
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
       - name: Test durable markers and form recovery