Release v0.1.0

.github/workflows/build-baseline.yml

@@ -19,100 +19,298 @@ permissions:
   contents: read
 
 jobs:
-  build-windows:
-    name: gate / build / windows
-    runs-on: windows-latest
+  build-windows-native:
+    name: build / windows / amd64
+    runs-on: windows-2025
+    strategy:
+      fail-fast: false
     permissions:
       contents: read
+    env:
+      BANDSCOPE_ARTIFACT_OS: windows
+      BANDSCOPE_ARTIFACT_ARCH: amd64
+      BANDSCOPE_TARGET_TRIPLE: x86_64-pc-windows-msvc
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: npm
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
-      - uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "0.8.6"
       - name: Install Rust stable
-        shell: bash
         run: rustup toolchain install stable --profile minimal
+      - name: Add Windows target
+        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
+      - name: Verify Windows antivirus baseline
+        shell: pwsh
+        run: |
+          function Write-AntivirusEvidence($message) {
+            Write-Host $message
+            if ($env:GITHUB_STEP_SUMMARY) {
+              Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value $message
+            }
+          }
+
+          if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) {
+            $status = Get-MpComputerStatus
+            Write-AntivirusEvidence "Antivirus check: Defender status AntivirusEnabled=$($status.AntivirusEnabled) RealTimeProtectionEnabled=$($status.RealTimeProtectionEnabled)."
+            if ($status.AntivirusEnabled) {
+              return
+            }
+            Write-AntivirusEvidence "Antivirus check: Defender telemetry is present but antivirus is not reported as enabled on this hosted runner."
+          }
+
+          $products = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue
+          if ($products) {
+            Write-AntivirusEvidence "Antivirus check: SecurityCenter2 reported at least one antivirus product."
+            return
+          }
+
+          $defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
+          if ($defenderService -and $defenderService.Status -in @('Running', 'StartPending')) {
+            Write-AntivirusEvidence "Antivirus check: WinDefend service is present and active."
+            return
+          }
+
+          Write-AntivirusEvidence "Antivirus check: no explicit antivirus telemetry was available on this hosted runner."
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies
         run: uv sync --project services/analysis-engine --group dev --frozen
       - name: Build frontend
         run: npm run build --workspace @bandscope/desktop
       - name: Build native shell
-        run: cargo +stable build --manifest-path apps/desktop/src-tauri/Cargo.toml --release --locked
-      - name: Package Windows artifact
+        run: cargo +stable build --manifest-path apps/desktop/src-tauri/Cargo.toml --release --locked --target $env:BANDSCOPE_TARGET_TRIPLE
+      - name: Package Windows amd64 artifact
         run: python scripts/release/package_desktop_artifact.py
-      - name: Upload Windows artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - name: Upload Windows amd64 artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: bandscope-windows-${{ github.sha }}
+          name: bandscope-windows-amd64-${{ github.sha }}
           path: |
             artifacts/*.zip
             artifacts/*.sha256
             artifacts/*.manifest.txt
-  build-macos:
-    name: gate / build / macos
-    runs-on: macos-latest
+
+  build-windows-arm64:
+    name: build / windows / arm64
+    runs-on: windows-11-arm
+    strategy:
+      fail-fast: false
     permissions:
       contents: read
+    env:
+      BANDSCOPE_ARTIFACT_OS: windows
+      BANDSCOPE_ARTIFACT_ARCH: arm64
+      BANDSCOPE_TARGET_TRIPLE: aarch64-pc-windows-msvc
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: npm
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
-      - uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "0.8.6"
       - name: Install Rust stable
         run: rustup toolchain install stable --profile minimal
+      - name: Add Windows arm target
+        run: rustup target add $env:BANDSCOPE_TARGET_TRIPLE --toolchain stable
+      - name: Verify Windows antivirus baseline
+        shell: pwsh
+        run: |
+          function Write-AntivirusEvidence($message) {
+            Write-Host $message
+            if ($env:GITHUB_STEP_SUMMARY) {
+              Add-Content -Path $env:GITHUB_STEP_SUMMARY -Value $message
+            }
+          }
+
+          if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) {
+            $status = Get-MpComputerStatus
+            Write-AntivirusEvidence "Antivirus check: Defender status AntivirusEnabled=$($status.AntivirusEnabled) RealTimeProtectionEnabled=$($status.RealTimeProtectionEnabled)."
+            if ($status.AntivirusEnabled) {
+              return
+            }
+            Write-AntivirusEvidence "Antivirus check: Defender telemetry is present but antivirus is not reported as enabled on this hosted runner."
+          }
+
+          $products = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue
+          if ($products) {
+            Write-AntivirusEvidence "Antivirus check: SecurityCenter2 reported at least one antivirus product."
+            return
+          }
+
+          $defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
+          if ($defenderService -and $defenderService.Status -in @('Running', 'StartPending')) {
+            Write-AntivirusEvidence "Antivirus check: WinDefend service is present and active."
+            return
+          }
+
+          Write-AntivirusEvidence "Antivirus check: no explicit antivirus telemetry was available on this hosted runner."
       - name: Install node dependencies
         run: npm ci
       - name: Sync Python dependencies
         run: uv sync --project services/analysis-engine --group dev --frozen
       - name: Build frontend
         run: npm run build --workspace @bandscope/desktop
       - name: Build native shell
-        run: cargo +stable build --manifest-path apps/desktop/src-tauri/Cargo.toml --release --locked
-      - name: Package macOS artifact
+        run: cargo +stable build --manifest-path apps/desktop/src-tauri/Cargo.toml --release --locked --target $env:BANDSCOPE_TARGET_TRIPLE
+      - name: Package Windows arm64 artifact
+        run: python scripts/release/package_desktop_artifact.py
+      - name: Upload Windows arm64 artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bandscope-windows-arm64-${{ github.sha }}
+          path: |
+            artifacts/*.zip
+            artifacts/*.sha256
+            artifacts/*.manifest.txt
+
+  gate-windows:
+    name: gate / build / windows
+    runs-on: ubuntu-latest
+    needs:
+      - build-windows-native
+      - build-windows-arm64
+    steps:
+      - name: Confirm both Windows architectures built
+        run: true
+
+  build-macos-native:
+    name: build / macos / amd64
+    runs-on: macos-15-intel
+    strategy:
+      fail-fast: false
+    permissions:
+      contents: read
+    env:
+      BANDSCOPE_ARTIFACT_OS: macos
+      BANDSCOPE_ARTIFACT_ARCH: amd64
+      BANDSCOPE_TARGET_TRIPLE: x86_64-apple-darwin
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: 22
+          cache: npm
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: "0.8.6"
+      - name: Install Rust stable
+        run: rustup toolchain install stable --profile minimal
+      - name: Add macOS Intel target
+        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
+      - name: Install node dependencies
+        run: npm ci
+      - name: Sync Python dependencies
+        run: uv sync --project services/analysis-engine --group dev --frozen
+      - name: Build frontend
+        run: npm run build --workspace @bandscope/desktop
+      - name: Build native shell
+        run: cargo +stable build --manifest-path apps/desktop/src-tauri/Cargo.toml --release --locked --target "$BANDSCOPE_TARGET_TRIPLE"
+      - name: Package macOS amd64 artifact
+        run: python3 scripts/release/package_desktop_artifact.py
+      - name: Upload macOS amd64 artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bandscope-macos-amd64-${{ github.sha }}
+          path: |
+            artifacts/*.zip
+            artifacts/*.sha256
+            artifacts/*.manifest.txt
+
+  build-macos-arm64:
+    name: build / macos / arm64
+    runs-on: macos-15
+    strategy:
+      fail-fast: false
+    permissions:
+      contents: read
+    env:
+      BANDSCOPE_ARTIFACT_OS: macos
+      BANDSCOPE_ARTIFACT_ARCH: arm64
+      BANDSCOPE_TARGET_TRIPLE: aarch64-apple-darwin
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: 22
+          cache: npm
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: "0.8.6"
+      - name: Install Rust stable
+        run: rustup toolchain install stable --profile minimal
+      - name: Add macOS arm target
+        run: rustup target add "$BANDSCOPE_TARGET_TRIPLE" --toolchain stable
+      - name: Install node dependencies
+        run: npm ci
+      - name: Sync Python dependencies
+        run: uv sync --project services/analysis-engine --group dev --frozen
+      - name: Build frontend
+        run: npm run build --workspace @bandscope/desktop
+      - name: Build native shell
+        run: cargo +stable build --manifest-path apps/desktop/src-tauri/Cargo.toml --release --locked --target "$BANDSCOPE_TARGET_TRIPLE"
+      - name: Package macOS arm64 artifact
         run: python3 scripts/release/package_desktop_artifact.py
-      - name: Upload macOS artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - name: Upload macOS arm64 artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: bandscope-macos-${{ github.sha }}
+          name: bandscope-macos-arm64-${{ github.sha }}
           path: |
             artifacts/*.zip
             artifacts/*.sha256
             artifacts/*.manifest.txt
 
+  gate-macos:
+    name: gate / build / macos
+    runs-on: ubuntu-latest
+    needs:
+      - build-macos-native
+      - build-macos-arm64
+    steps:
+      - name: Confirm both macOS architectures built
+        run: true
+
   attach-windows-release-artifact:
     name: release-artifact / windows
     if: github.event_name == 'release'
     runs-on: ubuntu-latest
     needs:
-      - build-windows
+      - build-windows-native
+      - build-windows-arm64
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: bandscope-windows-${{ github.sha }}
+          pattern: bandscope-windows-*-${{ github.sha }}
           path: artifacts
-      - name: Attach Windows artifact to release
+          merge-multiple: true
+      - name: Attach Windows artifacts to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}
@@ -123,15 +321,17 @@ jobs:
     if: github.event_name == 'release'
     runs-on: ubuntu-latest
     needs:
-      - build-macos
+      - build-macos-native
+      - build-macos-arm64
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: bandscope-macos-${{ github.sha }}
+          pattern: bandscope-macos-*-${{ github.sha }}
           path: artifacts
-      - name: Attach macOS artifact to release
+          merge-multiple: true
+      - name: Attach macOS artifacts to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_TAG: ${{ github.event.release.tag_name }}

.github/workflows/ci.yml

@@ -15,12 +15,12 @@ jobs:
     name: ci / build-and-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: npm
-      - uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "0.8.6"
       - name: Install node dependencies
@@ -34,8 +34,8 @@ jobs:
     name: gate / ci / rust-check
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
           cache: npm

.github/workflows/codeql.yml

@@ -26,9 +26,9 @@ jobs:
           - javascript-typescript
           - python
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: github/codeql-action/init@820e3160e279568db735cee8ed8f8e77a6da7818 # v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@820e3160e279568db735cee8ed8f8e77a6da7818 # v3
-      - uses: github/codeql-action/analyze@820e3160e279568db735cee8ed8f8e77a6da7818 # v3
+      - uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+      - uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1

.github/workflows/dependency-review.yml

@@ -15,7 +15,7 @@ jobs:
     name: dependency-review
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0