ci(swift-sdk): take the schema freeze base from the default branch

.github/workflows/swift-sdk-freeze-release.yml

@@ -33,7 +33,8 @@ jobs:
       - name: Checkout reviewed worker
         uses: actions/checkout@v4
         with:
-          ref: v4.2-dev
+          # The default branch is the reviewed base; dispatch callers never choose it.
+          ref: ${{ github.event.repository.default_branch }}
           path: platform
           # Include immutable swift-schema-source/* tags and their history.
           fetch-depth: 0
@@ -53,10 +54,12 @@ jobs:
           RELEASE_ID: ${{ inputs.release_id }}
           DATA_COMMIT: ${{ inputs.data_commit }}
           DRY_RUN: ${{ inputs.dry_run }}
+          BASE_BRANCH: ${{ github.event.repository.default_branch }}
         working-directory: platform
         shell: bash
         run: |
           set -euo pipefail
-          args=(--release-id "$RELEASE_ID" --data-commit "$DATA_COMMIT" --data-repo ../release-data)
+          echo "Platform base branch: $BASE_BRANCH"
+          args=(--release-id "$RELEASE_ID" --data-commit "$DATA_COMMIT" --data-repo ../release-data --base-branch "$BASE_BRANCH")
           if [[ "$DRY_RUN" == true ]]; then args+=(--dry-run); fi
           python3 -I packages/swift-sdk/scripts/freeze_appstore_release.py "${args[@]}"

packages/swift-sdk/SCHEMA_RELEASES.md

@@ -180,7 +180,9 @@ and `data_commit`. The worker verifies that this commit belongs to the metadata
 branch, verifies the proof, build identity and artifact digests, and generates
 the snapshot from the manifest's Platform commit. It uses a temporary clone;
 the source checkout is unchanged.
-The generator executable is copied from the reviewed `v4.2-dev` base into a
+The base is the repository's default branch, read from repository metadata at
+run time, so renaming the development branch needs no code change. The
+generator executable is copied from that reviewed base into a
 separate temporary directory before the draft is checked out. It runs with an
 explicit target repository, isolated Python imports and a credential-free
 environment. Draft files are input/output data, including any edits to the
@@ -189,7 +191,7 @@ fetch/push processes receive the PAT, with ambient Git configuration and hooks
 disabled. Human changes on the draft remain available for review.
 
 The worker opens a draft PR on `codex/freeze-swift-schema-v<schema version>`,
-targeting `v4.2-dev`. The PR contains the generated snapshot, synthetic fixture
+targeting the default branch. The PR contains the generated snapshot, synthetic fixture
 and release association in `schema-releases.json`. Standard Swift SDK checks
 run on these same-repository draft branches. A maintainer must review and merge
 the PR; the worker never enables auto-merge or updates runtime model types.
@@ -199,9 +201,9 @@ all required releases, not merely a commit from before the snapshot merge.
 
 ## Setup and manual operation
 
-1. Deploy the generator, registry and worker to `v4.2-dev`, and register the
-   dispatch workflow on the repository's default branch. GitHub requires the
-   workflow to exist on the default branch for `workflow_dispatch`.
+1. Deploy the generator, registry, worker and dispatch workflow to the
+   repository's default branch. GitHub requires the workflow to exist on the
+   default branch for `workflow_dispatch`, and the worker uses it as its base.
 2. Configure `SCHEMA_RELEASE_TOKEN` in both repositories: a fine-grained PAT
    limited to `dashpay/platform` and `dashpay/dashwallet-ios`, with repository
    Contents, Actions and Pull requests permissions needed by the workflow.

packages/swift-sdk/scripts/freeze_appstore_release.py

@@ -2,6 +2,8 @@
 """Prepare a reviewed SwiftData snapshot from the iOS release-data branch.
 
 The caller supplies a release ID and a metadata commit, never a Platform ref.
+The base branch is the repository's default branch, which the workflow reads
+from repository metadata, so renaming the development branch needs no edit.
 Only the iOS monitor has Apple credentials; its publication proof is trusted
 only after proving it belongs to the fixed release-data branch. All Git writes
 take place in a temporary clone. --dry-run generates and checks the patch but
@@ -29,7 +31,6 @@
 
 IOS_REPO = "dashpay/dashwallet-ios"
 PLATFORM_REPO = "dashpay/platform"
-BASE_BRANCH = "v4.2-dev"
 DATA_BRANCH = "schema-release-data"
 SDK = "packages/swift-sdk"
 REGISTRY = f"{SDK}/schema-releases.json"
@@ -76,6 +77,17 @@ def require_string(value, pattern, label):
     return value
 
 
+def require_branch(value):
+    """Accept any branch name Git accepts, except one Git would parse as an option."""
+    if not isinstance(value, str) or not value or value.startswith("-"):
+        raise ReleaseError("Invalid Platform base branch")
+    try:
+        run(None, "git", "check-ref-format", f"refs/heads/{value}")
+    except ReleaseError:
+        raise ReleaseError("Invalid Platform base branch") from None
+    return value
+
+
 def read_blob(directory, commit, path, *, allow_executable=False):
     entry = git(directory, "ls-tree", commit, "--", path)
     modes = ("100644 blob ", "100755 blob ") if allow_executable else ("100644 blob ",)
@@ -219,11 +231,11 @@ def request(self, method, path, payload=None):
                 raise ReleaseError(f"GitHub {method} response could not be read or decoded; "
                                    "retry the workflow to reconcile its state") from error
 
-    def pull_requests(self, branch):
+    def pull_requests(self, branch, base):
         results = []
         page = 1
         while True:
-            query = urllib.parse.urlencode({"head": f"dashpay:{branch}", "base": BASE_BRANCH,
+            query = urllib.parse.urlencode({"head": f"dashpay:{branch}", "base": base,
                                             "state": "all", "sort": "created", "direction": "desc",
                                             "per_page": 100, "page": page})
             rows = self.request("GET", f"pulls?{query}")
@@ -309,11 +321,12 @@ def pr_body(proof, manifest, data_commit):
 """
 
 
-def prepare(repo, data_repo, release_id, data_commit, token, dry_run=False):
+def prepare(repo, data_repo, release_id, data_commit, token, dry_run=False, *, base_branch):
+    require_branch(base_branch)
     proof, manifest, fixture = validate_publication(data_repo, data_commit, release_id)
     branch = f"codex/freeze-swift-schema-v{manifest['schema']['schema_version']}"
     api = GitHub(token)
-    pulls = api.pull_requests(branch)
+    pulls = api.pull_requests(branch, base_branch)
     opened = [pr for pr in pulls if pr["state"] == "open"]
     if len(opened) > 1:
         raise ReleaseError("Multiple open snapshot pull requests need manual reconciliation")
@@ -325,18 +338,18 @@ def prepare(repo, data_repo, release_id, data_commit, token, dry_run=False):
         git(clone, "config", "user.name", "Dash schema release automation")
         git(clone, "config", "user.email", "41898282+github-actions[bot]@users.noreply.github.com")
         git(clone, "config", "commit.gpgsign", "false")
-        git(clone, "fetch", "origin", f"{BASE_BRANCH}:refs/remotes/origin/{BASE_BRANCH}", env=env)
+        git(clone, "fetch", "origin", f"{base_branch}:refs/remotes/origin/{base_branch}", env=env)
         # Read executable code only from the reviewed base. A contributor may
         # edit code on the draft branch; it must never become this worker's
         # generator, even when running a dry-run with no remote writes.
         trusted_generator = Path(temporary) / "trusted-freeze-schema-models.py"
-        trusted_generator.write_bytes(read_blob(clone, f"origin/{BASE_BRANCH}", GENERATOR,
+        trusted_generator.write_bytes(read_blob(clone, f"origin/{base_branch}", GENERATOR,
                                                 allow_executable=True))
 
         def generate(*args):
             run(temporary, sys.executable, "-I", str(trusted_generator), "--repo", str(clone), *args)
 
-        git(clone, "checkout", "--detach", f"origin/{BASE_BRANCH}")
+        git(clone, "checkout", "--detach", f"origin/{base_branch}")
         merged_registry = json_object((clone / REGISTRY).read_bytes(), "merged snapshot registry")
         if release_id in merged_registry.get("releases", {}):
             associate_release(merged_registry, release_id, release_entry(proof, manifest, data_commit))
@@ -358,9 +371,9 @@ def generate(*args):
             git(clone, "checkout", "-b", branch, f"origin/{branch}")
             # Merge with no commit so --dry-run never writes a commit. The
             # publication commit below includes the merge and generated patch.
-            git(clone, "merge", "--no-commit", "--no-ff", f"origin/{BASE_BRANCH}")
+            git(clone, "merge", "--no-commit", "--no-ff", f"origin/{base_branch}")
         else:
-            git(clone, "checkout", "-b", branch, f"origin/{BASE_BRANCH}")
+            git(clone, "checkout", "-b", branch, f"origin/{base_branch}")
         before_registry = json_object((clone / REGISTRY).read_bytes(), "snapshot registry")
         fetch_sources(clone, source_commits(before_registry) | {manifest["platform_sha"]}, env)
         generate("--check")
@@ -417,7 +430,7 @@ def generate(*args):
         else:
             created = api.request("POST", "pulls", {
                 "title": f"chore(swift-sdk): freeze App Store schema {manifest['schema']['schema_version']}",
-                "head": branch, "base": BASE_BRANCH, "draft": True,
+                "head": branch, "base": base_branch, "draft": True,
                 "body": pr_body(proof, manifest, data_commit)})
             print(f"Snapshot pull request: {created['html_url']}")
 
@@ -429,13 +442,15 @@ def main():
     parser.add_argument("--data-repo", required=True, type=Path)
     parser.add_argument("--repo", default=Path.cwd(), type=Path)
     parser.add_argument("--dry-run", action="store_true")
+    parser.add_argument("--base-branch", required=True,
+                        help="Platform default branch; the workflow reads it from repository metadata")
     args = parser.parse_args()
     token = os.environ.get("SCHEMA_RELEASE_TOKEN", "")
     if not token:
         parser.error("SCHEMA_RELEASE_TOKEN is required for read access, including dry runs")
     try:
         prepare(args.repo.resolve(), args.data_repo.resolve(), args.release_id,
-                args.data_commit, token, args.dry_run)
+                args.data_commit, token, args.dry_run, base_branch=args.base_branch)
     except (ReleaseError, OSError, sqlite3.Error) as error:
         print(f"Freeze stopped: {error}", file=sys.stderr)
         return 1

packages/swift-sdk/scripts/test_freeze_appstore_release.py

@@ -16,6 +16,9 @@
 
 import freeze_appstore_release as worker
 
+# Deliberately not the live Platform branch: the worker must take its base from the caller.
+BASE = "trunk-dev"
+
 
 def git(directory, *args):
     result = subprocess.run(["git", *args], cwd=directory, capture_output=True, text=True)
@@ -220,7 +223,8 @@ def test_does_not_repeat_writes_after_an_unreadable_response(self):
     def test_pr_listing_is_paginated(self):
         api = worker.GitHub("secret")
         api.request = mock.Mock(side_effect=[[{}] * 100, [{"number": 101}]])
-        self.assertEqual(len(api.pull_requests("codex/freeze-swift-schema-v2.0.0")), 101)
+        self.assertEqual(len(api.pull_requests("codex/freeze-swift-schema-v2.0.0", BASE)), 101)
+        self.assertIn("base=trunk-dev", api.request.call_args.args[1])
         self.assertIn("page=2", api.request.call_args.args[1])
         self.assertIn("sort=created", api.request.call_args.args[1])
         self.assertIn("direction=desc", api.request.call_args.args[1])
@@ -235,7 +239,7 @@ def setUp(self):
         PublicationTests.setUp(self)
         self.platform = self.root / "platform"
         self.platform.mkdir()
-        git(self.platform, "init", "-b", worker.BASE_BRANCH)
+        git(self.platform, "init", "-b", BASE)
         git(self.platform, "config", "user.name", "Test")
         git(self.platform, "config", "user.email", "[email protected]")
         git(self.platform, "config", "commit.gpgsign", "false")
@@ -284,7 +288,8 @@ def prepare(self, dry_run=False):
         with mock.patch.object(worker, "git", side_effect=self.redirected_git), \
              mock.patch.object(worker, "GitHub", return_value=self.api), \
              contextlib.redirect_stdout(io.StringIO()):
-            worker.prepare(self.platform, self.data, self.proof["release_id"], self.commit, "test-token", dry_run)
+            worker.prepare(self.platform, self.data, self.proof["release_id"], self.commit, "test-token", dry_run,
+                           base_branch=BASE)
 
     def test_dry_run_does_not_publish_or_modify_checkout(self):
         before = git(self.remote, "show-ref")
@@ -293,6 +298,18 @@ def test_dry_run_does_not_publish_or_modify_checkout(self):
         self.api.request.assert_not_called()
         self.assertEqual(git(self.platform, "status", "--porcelain"), "")
 
+    def test_unsafe_base_branch_is_rejected_before_git_or_api(self):
+        for base in ["", "../trunk-dev", "trunk dev", "-trunk"]:
+            with self.subTest(base=base), \
+                 mock.patch.object(worker, "git") as git_call, \
+                 mock.patch.object(worker, "GitHub") as github:
+                with self.assertRaisesRegex(worker.ReleaseError, "Platform base branch"):
+                    worker.prepare(self.platform, self.data, self.proof["release_id"], self.commit,
+                                   "test-token", base_branch=base)
+                git_call.assert_not_called()
+                github.assert_not_called()
+        self.assertEqual(worker.require_branch("release/v5.0"), "release/v5.0")
+
     def test_fixture_check_closes_connection_on_success_or_failure(self):
         for corrupt in (False, True):
             database = sqlite3.connect(self.store)
@@ -325,6 +342,7 @@ def test_newest_closed_unmerged_attempt_is_not_overridden_by_an_older_merge(self
     def test_push_then_retry_reuses_draft_pr_and_commit(self):
         self.prepare()
         self.assertTrue(self.api.request.call_args.args[2]["draft"])
+        self.assertEqual(self.api.request.call_args.args[2]["base"], BASE)
         branch = "codex/freeze-swift-schema-v2.0.0"
         before = git(self.remote, "rev-parse", branch)
         self.api.pull_requests.return_value = [{"state": "open", "html_url": "https://example.invalid/pr"}]
@@ -392,7 +410,7 @@ def test_ambient_git_hooks_never_receive_worker_credentials(self):
         (self.platform / ".gitattributes").write_text("* filter=capture\n")
         git(self.platform, "add", ".gitattributes")
         git(self.platform, "commit", "-m", "draft-controlled filter selection")
-        git(self.platform, "push", str(self.remote), worker.BASE_BRANCH)
+        git(self.platform, "push", str(self.remote), BASE)
         with mock.patch.dict(os.environ, {"GIT_CONFIG_GLOBAL": str(config),
                                          "SCHEMA_RELEASE_TOKEN": "synthetic-secret"}):
             self.prepare()
@@ -406,7 +424,7 @@ def unreachable_source(self, name):
         git(self.platform, "commit", "-m", name)
         commit = git(self.platform, "rev-parse", "HEAD")
         git(self.platform, "push", str(self.remote), f"HEAD:refs/heads/{name}")
-        git(self.platform, "checkout", worker.BASE_BRANCH)
+        git(self.platform, "checkout", BASE)
         git(self.platform, "branch", "-D", name)
         git(self.remote, "update-ref", "-d", f"refs/heads/{name}")
         return commit
@@ -418,7 +436,7 @@ def test_source_tag_retains_rewritten_history_for_fresh_clones_and_later_freezes
         self.prepare()
         self.assertEqual(git(self.remote, "rev-parse", worker.SOURCE_TAG_PREFIX + source), source)
         branch = "codex/freeze-swift-schema-v2.0.0"
-        git(self.remote, "update-ref", f"refs/heads/{worker.BASE_BRANCH}", git(self.remote, "rev-parse", branch))
+        git(self.remote, "update-ref", f"refs/heads/{BASE}", git(self.remote, "rev-parse", branch))
         git(self.remote, "reflog", "expire", "--expire=now", "--all")
         git(self.remote, "gc", "--prune=now")
         fresh = self.root / "fresh"
@@ -436,7 +454,7 @@ def test_source_tag_retains_rewritten_history_for_fresh_clones_and_later_freezes
         self.commit = self.save()
         without_tags = self.root / "checkout-without-source-tags"
         git(self.root, "clone", "--no-local", "--no-tags", "--single-branch", "--branch",
-            worker.BASE_BRANCH, str(self.remote), str(without_tags))
+            BASE, str(self.remote), str(without_tags))
         with self.assertRaisesRegex(RuntimeError, "Test git cat-file failed"):
             git(without_tags, "cat-file", "-t", source)
         self.platform = without_tags
@@ -467,7 +485,7 @@ def test_historical_schema_source_is_fetched_and_retained_like_release_sources(s
         write_json(self.platform / worker.REGISTRY, base_registry)
         git(self.platform, "add", ".")
         git(self.platform, "commit", "-m", "register historical source")
-        git(self.platform, "push", str(self.remote), f"{worker.BASE_BRANCH}:refs/heads/{worker.BASE_BRANCH}")
+        git(self.platform, "push", str(self.remote), f"{BASE}:refs/heads/{BASE}")
         ref = worker.SOURCE_TAG_PREFIX + source
         self.assertNotIn(ref, git(self.remote, "show-ref"))
         self.prepare(dry_run=True)
@@ -481,7 +499,7 @@ def test_conflicting_source_tag_is_never_rewritten(self):
         source = self.unreachable_source("released-source")
         self.manifest["platform_sha"] = source
         self.commit = self.save()
-        wrong = git(self.remote, "rev-parse", worker.BASE_BRANCH)
+        wrong = git(self.remote, "rev-parse", BASE)
         git(self.remote, "update-ref", worker.SOURCE_TAG_PREFIX + source, wrong)
         for dry_run in (True, False):
             with self.subTest(dry_run=dry_run), self.assertRaisesRegex(worker.ReleaseError, "different object"):
@@ -525,7 +543,7 @@ def test_closed_unmerged_pr_requires_intervention(self):
     def test_already_merged_release_creates_no_commit_or_pr(self):
         self.prepare()
         branch = "codex/freeze-swift-schema-v2.0.0"
-        git(self.remote, "update-ref", f"refs/heads/{worker.BASE_BRANCH}", git(self.remote, "rev-parse", branch))
+        git(self.remote, "update-ref", f"refs/heads/{BASE}", git(self.remote, "rev-parse", branch))
         self.api.pull_requests.return_value = [{"state": "closed", "merged_at": "2026-09-18"}]
         self.api.request.reset_mock()
         before = git(self.remote, "show-ref")
@@ -539,7 +557,7 @@ def test_already_merged_release_checks_source_tags_without_creating_missing_tags
         self.prepare()
         branch = "codex/freeze-swift-schema-v2.0.0"
         merged_commit = git(self.remote, "rev-parse", branch)
-        git(self.remote, "update-ref", f"refs/heads/{worker.BASE_BRANCH}", merged_commit)
+        git(self.remote, "update-ref", f"refs/heads/{BASE}", merged_commit)
         self.api.pull_requests.return_value = [{"state": "closed", "merged_at": "2026-09-18"}]
         self.api.request.reset_mock()
         ref = worker.SOURCE_TAG_PREFIX + self.manifest["platform_sha"]
@@ -559,7 +577,7 @@ def test_handled_release_survives_a_later_rejected_pr_and_still_repairs_source_t
         self.prepare()
         branch = "codex/freeze-swift-schema-v2.0.0"
         merged_commit = git(self.remote, "rev-parse", branch)
-        git(self.remote, "update-ref", f"refs/heads/{worker.BASE_BRANCH}", merged_commit)
+        git(self.remote, "update-ref", f"refs/heads/{BASE}", merged_commit)
         self.api.pull_requests.return_value = [
             {"state": "closed", "merged_at": None},
             {"state": "closed", "merged_at": "2026-09-18"},