ci(swift-sdk): isolate fork builds from self-hosted runner

[QuantumExplorer]

Issue being fixed or feature implemented

Fork pull requests could route attacker-controlled code onto the persistent self-hosted macOS runner: the Swift SDK build job ran for any PR that touched packages/swift-sdk, regardless of where the PR came from.

Recreates #4102 on top of the current v4.1-dev (the original PR's diff view was polluted by a stale merge base after a base-update merge, so it was closed). All round-2 review fixes from #4102 are included.

What was done?

• Require pull requests to originate from dashpay/platform — or a trusted thepastaclaw-owned fork, matching the policy of the sibling self-hosted workflows (tests-rs-wallet.yml, tests-rs-workspace.yml) — before invoking the reusable Swift workflow.
• Repeat the same check on the reusable workflow job before runner allocation, protecting future callers.
• Add a focused policy check that verifies both guards and the self-hosted execution boundary, and run it on the GitHub-hosted changes job (pull requests, pushes to v*-dev, and the nightly schedule).
• Document that the in-repo guards are defense in depth: for pull_request events GitHub evaluates workflow YAML from the PR merge commit, so a malicious fork can edit the guards and the checker together. The authoritative trust boundary is the server-side Actions approval requirement for outside-collaborator workflow runs; the guards and checker protect trusted runs against accidental regressions.

Review fixes carried over from #4102

• Added the established thepastaclaw trusted-fork exception to the caller guard, the callee guard, and the checker, for consistency with the sibling self-hosted workflows.
• Rewrote the policy checker on structured YAML parsing (PyYAML, preinstalled on GitHub's Ubuntu runner images) instead of indentation-sensitive regexes, so semantically neutral reformatting can no longer break CI while any semantic change to the guards still fails the check.
• Documented the fork-controlled-content limitation (see above) in the workflow guard comment and the checker docstring.

How Has This Been Tested?

• The policy checker passes against this branch and fails against unpatched v4.1-dev (both guards reported missing).
• Regression probes confirm an appended || true bypass is rejected on both the caller and the callee guard.
• A reformat probe (collapsing the folded guard to a single line with irregular spacing) still passes, confirming the checker is robust to harmless YAML reformatting.
• actionlint passes for both modified workflows.
• git diff --check passes.

Breaking Changes

None. Same-repository pull requests, pushes, schedules, and manual runs preserve their existing eligibility, as do trusted thepastaclaw-owned fork PRs. Other fork pull requests no longer allocate the persistent Swift self-hosted runner.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
• I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

[thepastaclaw]

🕓 Ready for review — 57 ahead in queue (commit df775a7)
Queue position: 58/72 · 2 reviews active
ETA: start ~09:21 UTC · complete ~09:50 UTC (median 28m across 30 recent reviews; 2 slots)
Queued 4h 4m ago · Last checked: 2026-07-22 19:40 UTC

[coderabbitai]

Warning

Review limit reached

@QuantumExplorer, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e1c2d7d5-93a5-4075-bf40-38a52efa13c7

📥 Commits

Reviewing files that changed from the base of the PR and between 267e1cb and df775a7.

📒 Files selected for processing (3)

• .github/scripts/check-swift-self-hosted-runner.py
• .github/workflows/swift-sdk-build.yml
• .github/workflows/tests.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/swift-runner-fork-guard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.51%. Comparing base (4559b6f) to head (df775a7).
⚠️ Report is 298 commits behind head on v4.1-dev.

Additional details and impacted files

@@            Coverage Diff             @@
##           v4.1-dev    #4202    +/-   ##
==========================================
  Coverage     87.50%   87.51%            
==========================================
  Files          2666     2667     +1     
  Lines        336721   336972   +251     
==========================================
+ Hits         294659   294902   +243     
- Misses        42062    42070     +8     

Components	Coverage Δ
dpp	88.47% <ø> (ø)
drive	86.24% <ø> (ø)
drive-abci	89.58% <ø> (+0.02%)	⬆️
sdk	∅ <ø> (∅)
dapi-client	∅ <ø> (∅)
platform-version	∅ <ø> (∅)
platform-value	92.90% <ø> (ø)
platform-wallet	∅ <ø> (∅)
drive-proof-verifier	49.79% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.