test: add XCTest foundation and CI coverage

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Maintainer review is required for changes that affect the app or its delivery.
+* @hnduy910

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/hnduy910/NetFlow/security/advisories/new
+    about: Please use a private security report instead of a public issue.

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: macos-15
@@ -22,3 +25,12 @@ jobs:
             -sdk iphonesimulator \
             CODE_SIGNING_ALLOWED=NO \
             build
+      - name: Run XCTest suite
+        run: |
+          xcodebuild \
+            -project NetFlow.xcodeproj \
+            -scheme NetFlow \
+            -configuration Debug \
+            -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' \
+            CODE_SIGNING_ALLOWED=NO \
+            test

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Swift
+    runs-on: macos-15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: swift
+          build-mode: autobuild
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4

.github/workflows/release.yml

@@ -1,7 +1,9 @@
 name: Build unsigned release IPA
 
 on:
-  push:
+  workflow_run:
+    workflows: [iOS CI]
+    types: [completed]
     branches: [main]
   workflow_dispatch:
 
@@ -10,9 +12,17 @@ permissions:
 
 jobs:
   release:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
     runs-on: macos-15
+    concurrency:
+      group: netflow-release-${{ github.event.workflow_run.head_sha || github.sha }}
+      cancel-in-progress: false
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
 
       - name: Resolve release version
         id: meta
@@ -62,14 +72,15 @@ jobs:
         if: steps.meta.outputs.exists != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          COMMIT: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
           BUILD="${{ steps.meta.outputs.build }}"
-          git tag "${TAG}" "$GITHUB_SHA"
+          git tag "${TAG}" "$COMMIT"
           git push origin "${TAG}"
           gh release create "${TAG}" \
-            --target "$GITHUB_SHA" \
+            --target "$COMMIT" \
             --title "NetFlow ${VERSION} (Build ${BUILD})" \
             --generate-notes \
             "NetFlow_Universal_${TAG}.ipa" \

.gitignore

@@ -0,0 +1,12 @@
+.DS_Store
+
+# Xcode user and build state
+build/
+.build/
+DerivedData/
+xcuserdata/
+*.xcuserstate
+
+# Local distribution artifacts belong in GitHub Releases, not source history.
+*.ipa
+*.ipa.sha256

CONTRIBUTING.md

@@ -18,6 +18,22 @@ Thank you for taking the time to improve NetFlow. Bug reports, documentation fix
 
 NetFlow uses Apple's native frameworks and does not require CocoaPods or third-party packages. Network values, Wi-Fi information, background refresh, and entitlements can behave differently on a Simulator; validate device-specific behavior on a physical device when needed.
 
+## Automated validation
+
+Run the static checks and XCTest suite before opening a pull request:
+
+```bash
+bash Tools/check_project.sh
+xcodebuild \
+  -project NetFlow.xcodeproj \
+  -scheme NetFlow \
+  -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' \
+  CODE_SIGNING_ALLOWED=NO \
+  test
+```
+
+The same checks run on GitHub Actions for pushes to `main` and pull requests. The CI workflow must pass before the release workflow can publish an unsigned IPA.
+
 ## Development workflow
 
 1. Fork the repository and create a focused branch from `main`.
@@ -28,6 +44,8 @@ NetFlow uses Apple's native frameworks and does not require CocoaPods or third-p
 6. Update the README or screenshots when a user-visible feature changes.
 7. Open a pull request with a concise summary, testing notes, and screenshots for UI changes.
 
+Please keep pull requests focused. A maintainer review is required for changes to app behavior, security-sensitive code, or release automation.
+
 ## Pull request checklist
 
 - [ ] The change is limited to the stated purpose.
@@ -40,4 +58,3 @@ NetFlow uses Apple's native frameworks and does not require CocoaPods or third-p
 ## Bug reports and feature requests
 
 Include the device or Simulator model, iOS version, Xcode version, exact steps to reproduce, and any relevant console output. Redact identifiers and private data before attaching logs or screenshots.
-