feat: Onboard mobiledevops/xcode-select-version-action action

.github/workflows/actions_release.yml

@@ -0,0 +1,27 @@
+name: Release GitHub Actions
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag for the release"
+        required: true
+      node_version:
+        description: "Node.js version to use"
+        required: false
+        default: "24"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+
+    uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1
+    with:
+      tag: "${{ github.event.inputs.tag }}"
+      node_version: "${{ github.event.inputs.node_version || '24' }}"

.github/workflows/audit_package.yml

@@ -0,0 +1,33 @@
+name: NPM Audit Fix Run
+
+on:
+  workflow_dispatch:
+    inputs:
+      force:
+        description: "Use --force flag for npm audit fix?"
+        required: true
+        type: boolean
+      base_branch:
+        description: "Specify a base branch"
+        required: false
+        default: "main"
+      node_version:
+        description: "Node.js version to use"
+        required: false
+        default: "24"
+  schedule:
+    - cron: "0 0 * * 1"
+
+jobs:
+  audit-fix:
+    uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@v1
+    with:
+      force: ${{ inputs.force || false }}
+      base_branch: ${{ inputs.base_branch || 'main' }}
+      node_version: ${{ inputs.node_version || '24' }}
+
+permissions:
+  contents: write
+  pull-requests: write
+  packages: read
+  issues: write

.github/workflows/check-dist.yml

@@ -0,0 +1,52 @@
+name: Check dist/
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check-dist:
+    name: Check dist/
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: 'package.json'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Rebuild dist/
+        run: npm run build
+
+      - name: Compare dist/ with the committed bundle
+        run: |
+          if [ -n "$(git status --porcelain -- dist/)" ]; then
+            echo "dist/ is out of date. Run 'npm run build' and commit the result."
+            git --no-pager diff --stat -- dist/
+            exit 1
+          fi
+          echo "dist/ matches src/."

.github/workflows/test.yml

@@ -0,0 +1,121 @@
+name: Test
+
+# Exercises the committed dist/ on real runner images. The unit tests in
+# check-dist.yml mock the filesystem and the process spawn, so they cannot catch
+# a wrong bundle path or a sudo that is not permitted; only a real macOS runner
+# can. Every version below is deliberately not the image default, so a step that
+# silently did nothing would leave the developer directory unchanged and fail
+# the assertion.
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  select:
+    name: ${{ matrix.runner }} / Xcode ${{ matrix.version }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(github.actor == 'dependabot[bot]' && '[{"runner":"macos-15","version":"16.2"}]' || '[{"runner":"macos-15","version":"16.2"},{"runner":"macos-15","version":"26.0.1"},{"runner":"macos-26","version":"26.5"},{"runner":"macos-26","version":"26.4"}]') }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Record the image default
+        id: before
+        run: echo "path=$(xcode-select -p)" >> "$GITHUB_OUTPUT"
+
+      - name: Select Xcode ${{ matrix.version }}
+        uses: ./
+        with:
+          xcode-select-version: ${{ matrix.version }}
+
+      - name: Assert the developer directory moved to the requested Xcode
+        env:
+          VERSION: ${{ matrix.version }}
+          BEFORE: ${{ steps.before.outputs.path }}
+        run: |
+          expected="/Applications/Xcode_${VERSION}.app/Contents/Developer"
+          actual="$(xcode-select -p)"
+
+          echo "before:   $BEFORE"
+          echo "expected: $expected"
+          echo "actual:   $actual"
+
+          if [ "$actual" != "$expected" ]; then
+            echo "::error::developer directory is $actual, expected $expected"
+            exit 1
+          fi
+
+          if [ "$actual" = "$BEFORE" ]; then
+            echo "::error::developer directory never changed, so the test proves nothing"
+            exit 1
+          fi
+
+      - name: Assert the toolchain a later step sees is the selected one
+        env:
+          VERSION: ${{ matrix.version }}
+        run: |
+          xcodebuild -version
+
+          # This step is a plain `run`, so it proves the switch is visible to
+          # everything after the action, not just inside it.
+          reported="$(xcodebuild -version | head -1 | awk '{print $2}')"
+          echo "requested: $VERSION"
+          echo "reported:  $reported"
+
+          # A prefix match, because an alias resolves to the bundle it points
+          # at: asking for 26.4 legitimately reports 26.4.1.
+          case "$reported" in
+            "$VERSION"*) ;;
+            *)
+              echo "::error::xcodebuild reports $reported, which is not $VERSION"
+              exit 1
+              ;;
+          esac
+
+  reject-missing-version:
+    name: Absent version fails the step
+    runs-on: macos-15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Request a version no image ships
+        id: absent
+        continue-on-error: true
+        uses: ./
+        with:
+          xcode-select-version: "0.0-does-not-exist"
+
+      - name: Assert the step failed rather than passing silently
+        env:
+          OUTCOME: ${{ steps.absent.outcome }}
+        run: |
+          echo "outcome: $OUTCOME"
+          if [ "$OUTCOME" != "failure" ]; then
+            echo "::error::expected failure for an uninstalled version, got $OUTCOME"
+            exit 1
+          fi
+
+      - name: Assert the failed step left the developer directory alone
+        run: |
+          # A failure must not have run xcode-select at all; the image default
+          # has to survive intact.
+          actual="$(xcode-select -p)"
+          echo "developer directory: $actual"
+          case "$actual" in
+            *0.0-does-not-exist*)
+              echo "::error::a failed selection still changed the developer directory"
+              exit 1
+              ;;
+          esac

.gitignore

@@ -0,0 +1,4 @@
+node_modules
+.idea
+.vscode
+.DS_Store

.npmrc

@@ -0,0 +1 @@
+min-release-age=3

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 StepSecurity
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

README.md

@@ -1 +1,61 @@
-# xcode-select-version-action
+[![StepSecurity Maintained Action](https://raw.githubusercontent.com/step-security/maintained-actions-assets/main/assets/maintained-action-banner.png)](https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions)
+
+# Xcode Select Version
+
+Points a macOS runner at a specific Xcode installation, so every later step in
+the job compiles against the version you named instead of the image default.
+
+This is a StepSecurity maintained action: a secure drop-in replacement for
+`mobiledevops/xcode-select-version-action`, with the same inputs and the same
+behaviour.
+
+## Usage
+
+```yaml
+jobs:
+  build:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: step-security/xcode-select-version-action@v1
+        with:
+          xcode-select-version: "16.4"
+
+      - run: xcodebuild -version
+```
+
+## Inputs
+
+| Name                   | Required | Description                                        |
+| ---------------------- | -------- | -------------------------------------------------- |
+| `xcode-select-version` | yes      | Version of an Xcode already installed on the image |
+
+There are no outputs. The action changes the runner's active developer
+directory, which subsequent steps pick up automatically.
+
+## Choosing a version
+
+Only versions already present on the runner image can be selected; this action
+installs nothing. The version you pass has to match the image's own naming
+exactly, because it resolves to `/Applications/Xcode_<version>.app`. That means
+`16.4` and `16.4.0` are different bundles, and only one of them exists.
+
+Quote the value in YAML. Unquoted, `16.40` and `16.4` are both parsed as the
+number `16.4`, and a trailing zero you meant to keep disappears.
+
+The available versions change as images are updated, so check the
+[runner images documentation](https://github.com/actions/runner-images/tree/main/images/macos)
+for the image you target rather than relying on a list here. The
+`xcodebuild -version` step in the example above records what the job actually
+used.
+
+## Failure modes
+
+The step fails if the requested version is not installed, reporting
+`Xcode <version> not installed`. It also fails if `xcode-select` itself refuses
+the switch, in which case its own error is passed through.
+
+## Licence
+
+MIT. See [LICENSE](LICENSE).

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities to security@stepsecurity.io

__tests__/contract.spec.ts

@@ -0,0 +1,45 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+/**
+ * Guards the parts of `action.yml` that callers depend on.
+ *
+ * This action is a drop-in replacement, so its interface is fixed by the
+ * action it replaces rather than by our own preference. A rename, an added
+ * required input, or a stray output would silently break callers that pin us
+ * as a substitute, and no unit test of the implementation would notice.
+ */
+const manifestPath = fileURLToPath(new URL("../action.yml", import.meta.url));
+const manifest = readFileSync(manifestPath, "utf8");
+
+describe("action.yml", () => {
+  it("declares exactly one input, named xcode-select-version", () => {
+    const inputs = manifest
+      .split(/^inputs:$/m)[1]!
+      .split(/^runs:$/m)[0]!
+      .split("\n")
+      .filter((line) => /^ {2}\S+:/.test(line))
+      .map((line) => line.trim().replace(/:$/, ""));
+
+    expect(inputs).toEqual(["xcode-select-version"]);
+  });
+
+  it("keeps that input required", () => {
+    expect(manifest).toMatch(/xcode-select-version:[\s\S]*?required: true/);
+  });
+
+  it("declares no outputs", () => {
+    expect(manifest).not.toMatch(/^outputs:$/m);
+  });
+
+  it("runs on the node24 runtime", () => {
+    expect(manifest).toMatch(/using: ['"]node24['"]/);
+  });
+
+  it("points at the committed bundle", () => {
+    // The runtime performs no install, so the entrypoint has to be the
+    // self-contained bundle rather than a source file with bare imports.
+    expect(manifest).toMatch(/main: ['"]dist\/index\.js['"]/);
+  });
+});