Add CI workflows for building and running the example app

[devin-ai-integration]

Add CI workflows for building and running the example app

Summary

Updates the existing build workflow (ci.yml) and adds a new run workflow (run.yml) for the hello-macos project, following the same pattern as hello-android PR #13.

ci.yml changes:

• Pins actions/checkout to SHA with version comment (v4.2.2)
• Adds version comment to existing pinned setup-xcode SHA (v1.6.0)
• Adds -workspace 'hello-macos.xcworkspace' to the xcodebuild command
• Removes the schedule cron trigger (preserves feat/** branch triggers)
• Renames job from macos-build to build

run.yml (new):

• Fetches mobile key and flag key from AWS SSM via release-secrets
• Injects credentials into source files via sed (using | delimiter for safety)
• Builds the app with xcodebuild
• Launches the app with open, waits 15s, then uses AppleScript (osascript) to read the window text and grep for "feature flag evaluates to true"

Action versions used

Action	Version	SHA	Reference
actions/checkout	v4.2.2	11bd71901bbe5b1630ceea73d27597364c9af683	release
maxim-lobanov/setup-xcode	v1.6.0	60606e260d2fc5762a71e64e74b2174e8ea3c8bd	release
launchdarkly/gh-actions/actions/release-secrets	release-secrets-v1.2.0	bbbbbda684f500766264e7fe327668094ba83d1c	release

Updates since last revision

• Restored feat/** branch triggers in ci.yml for both push and pull_request (per reviewer feedback).
• Switched sed delimiter from / to | in both key injection commands for safer substitution (per reviewer feedback).

Review & Testing Checklist for Human

CI is currently green (build, run, and semgrep all pass), but the following items warrant manual verification:

• AppleScript reliability across runner updates: The run.yml verification uses osascript with System Events to read UI text. While this passed CI on macos-14, it relies on the runner granting accessibility permissions to the shell. If GitHub updates runner configurations this could break. This is the highest-risk item.
• Process name in AppleScript: The script references process "hello-macos" — confirm this consistently matches the actual process name when the .app bundle is launched. It may vary across Xcode/macOS versions.
• Verify SHA pins: Confirm each SHA in the table above matches the stated version tag on the corresponding action's releases page.
• Intentional removal of schedule cron trigger: The original ci.yml had a daily cron schedule (0 9 * * *). This was removed to align with the hello-android pattern. Confirm this is desired.

Suggested test plan: Trigger the run.yml workflow manually 2–3 times to confirm the AppleScript-based verification is stable and not flaky due to timing or permissions.

Notes

• Unlike Android, this does not require an emulator — the macOS app runs natively on the macos-14 runner.
• The 15-second sleep before reading the window text may need tuning if SDK initialization takes longer in CI.
• SDK key retrieval follows the same release-secrets pattern used in other hello-app repos.

---

Link to Devin Session: https://app.devin.ai/sessions/cea1bda349b740048511ed04e7be5c61
Requested by: rlamb@launchdarkly.com

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring