Add FaceTime command flow and auto-approval improvements

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-deps:
+        patterns: ["*"]
+    commit-message:
+      prefix: "deps(go):"
+
+  - package-ecosystem: cargo
+    directory: /pkg/rustpushgo
+    schedule:
+      interval: weekly
+    groups:
+      rust-deps:
+        patterns: ["*"]
+    commit-message:
+      prefix: "deps(rust):"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci:"

.github/workflows/ci.yml

@@ -0,0 +1,226 @@
+name: CI
+
+on:
+  push:
+    branches: [master, refactor]
+  pull_request:
+    branches: [master, refactor]
+  # Manual trigger — useful when bumping third_party/rustpush-upstream.sha
+  # locally and wanting to re-run the full verify pipeline on a branch
+  # without pushing a test commit.
+  workflow_dispatch: {}
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ───────────────────────────────────────────────────────────────
+  # Lint – quick static analysis
+  # ───────────────────────────────────────────────────────────────
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: go vet (imessage)
+        run: go vet ./imessage/...
+
+      - name: go vet (bbctl)
+        run: go vet ./cmd/bbctl/...
+
+  # ───────────────────────────────────────────────────────────────
+  # Unit tests – pure-Go packages (no Rust/CGO bridge needed)
+  # ───────────────────────────────────────────────────────────────
+  test-imessage:
+    name: Test imessage/
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Run tests
+        run: go test -count=1 ./imessage/...
+
+  # NOTE: pkg/connector/ tests require the Rust static library (librustpushgo.a)
+  # and are run as part of the build jobs below (after `make build`).
+
+  # ───────────────────────────────────────────────────────────────
+  # Verify rustpush patches – clones OpenBubbles/rustpush at the pinned
+  # SHA (third_party/rustpush-upstream.sha) and asserts every Makefile
+  # sed-patch in `ensure-rustpush-source` actually applied. The sed
+  # patches are guarded by `grep -q '<original pattern>'`; if upstream
+  # rewords a guarded line, the sed is skipped silently and the build
+  # still goes green with the patch dropped on the floor. This job
+  # catches that case explicitly so a SHA-pin bump that breaks any
+  # patch fails CI before it ships.
+  # ───────────────────────────────────────────────────────────────
+  verify-rustpush-patches:
+    name: Verify rustpush patches apply
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Show pinned rustpush SHA
+        run: |
+          PIN_FILE=third_party/rustpush-upstream.sha
+          if [ ! -f "$PIN_FILE" ]; then
+            echo "::error::$PIN_FILE is missing"
+            exit 1
+          fi
+          PIN=$(tr -d '[:space:]' < "$PIN_FILE")
+          if [ -z "$PIN" ]; then
+            echo "::error::$PIN_FILE is empty"
+            exit 1
+          fi
+          echo "Pinned rustpush SHA: $PIN"
+
+      - name: Clone pinned rustpush + apply Makefile patches
+        run: make ensure-rustpush-source
+
+      - name: Verify every patch marker is present
+        run: |
+          BASE=third_party/rustpush-upstream
+          FAIL=0
+          check() {
+            local desc="$1" file="$2" marker="$3"
+            if ! grep -Fq "$marker" "$file"; then
+              echo "::error file=$file::patch '$desc' did not apply — marker not found (upstream may have moved out from under us at the pinned SHA)"
+              FAIL=1
+            else
+              echo "ok: $desc"
+            fi
+          }
+          check "activation pub"           "$BASE/src/lib.rs"                                       "pub mod activation;"
+          check "ids pub"                  "$BASE/src/lib.rs"                                       "pub mod ids;"
+          check "FetchedToken.token pub"   "$BASE/apple-private-apis/icloud-auth/src/client.rs"     "pub token: String,"
+          check "FetchedToken.expiration"  "$BASE/apple-private-apis/icloud-auth/src/client.rs"     "pub expiration: SystemTime,"
+          check "FetchedToken re-export"   "$BASE/apple-private-apis/icloud-auth/src/lib.rs"        "pub use client::{AppleAccount, FetchedToken,"
+          check "keychain self-exclusion"  "$BASE/src/icloud/keychain.rs"                           "Ignoring exclusion of ourselves"
+          check "register XML dump"        "$BASE/src/ids/user.rs"                                  "RUSTPUSH_LOG_REGISTER_BODY"
+          check "statuskit no-saved-channel softened"  "$BASE/src/statuskit.rs"                     "no saved channel for identifier — using last_msg_ns=0"
+          check "statuskit channel-not-found softened" "$BASE/src/statuskit.rs"                     "presence msg arrived before keysharing"
+          exit $FAIL
+
+  # ───────────────────────────────────────────────────────────────
+  # Full build – Rust + Go on macOS and Linux
+  # ───────────────────────────────────────────────────────────────
+  build-macos:
+    name: Build (macOS)
+    # Manual-dispatch only. macOS runs on the Apple Silicon GitHub-hosted
+    # runner; every push/PR doesn't need to burn a macOS slot since Linux
+    # already catches the vast majority of breakage. Trigger this job
+    # explicitly via Actions → CI → "Run workflow" when you want macOS
+    # parity coverage (e.g. after bumping third_party/rustpush-upstream.sha
+    # or touching platform-gated code in pkg/rustpushgo or local_config).
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: macos-14          # Apple Silicon (ARM64)
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: |
+          brew install libolm protobuf
+
+      - name: Cache Cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            pkg/rustpushgo/target
+          key: cargo-macos-arm64-${{ hashFiles('**/Cargo.lock', 'third_party/rustpush-upstream.sha') }}
+          restore-keys: cargo-macos-arm64-
+
+      - name: Verify pinned rustpush SHA file
+        run: |
+          PIN_FILE=third_party/rustpush-upstream.sha
+          if [ ! -f "$PIN_FILE" ]; then
+            echo "::error::$PIN_FILE is missing — refactor branch requires a pinned OpenBubbles/rustpush SHA"
+            exit 1
+          fi
+          PIN=$(tr -d '[:space:]' < "$PIN_FILE")
+          if [ -z "$PIN" ]; then
+            echo "::error::$PIN_FILE is empty"
+            exit 1
+          fi
+          echo "Pinned rustpush SHA: $PIN"
+
+      - name: Build
+        run: make build
+
+      - name: Test pkg/connector/
+        env:
+          CGO_CFLAGS: -I/opt/homebrew/include
+          CGO_LDFLAGS: -L/opt/homebrew/lib
+        run: go test -count=1 ./pkg/connector/...
+
+  build-linux:
+    name: Build (Linux)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq \
+            build-essential cmake pkg-config git curl \
+            libolm-dev libclang-dev libssl-dev libunicorn-dev \
+            protobuf-compiler sqlite3
+
+      - name: Cache Cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            pkg/rustpushgo/target
+          key: cargo-linux-${{ hashFiles('**/Cargo.lock', 'third_party/rustpush-upstream.sha') }}
+          restore-keys: cargo-linux-
+
+      - name: Verify pinned rustpush SHA file
+        run: |
+          PIN_FILE=third_party/rustpush-upstream.sha
+          if [ ! -f "$PIN_FILE" ]; then
+            echo "::error::$PIN_FILE is missing — refactor branch requires a pinned OpenBubbles/rustpush SHA"
+            exit 1
+          fi
+          PIN=$(tr -d '[:space:]' < "$PIN_FILE")
+          if [ -z "$PIN" ]; then
+            echo "::error::$PIN_FILE is empty"
+            exit 1
+          fi
+          echo "Pinned rustpush SHA: $PIN"
+
+      - name: Build
+        run: make build
+
+      - name: Test pkg/connector/
+        run: go test -count=1 ./pkg/connector/...