[PR #30] [MERGED] test: enforce SDK import boundary in-repo under swift test #31

New issue

Closed

opened 2026-10-26 22:34:10 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:34:10 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/comfy-swift-sdk/pull/30
Author: @mattmillerai
Created: 7/4/2026
Status: ✅ Merged
Merged: 7/5/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-2358-import-boundary-test

📝 Commits (2)

98e37db test: enforce SDK import boundary in-repo under swift test
252852e test(import-boundary): close import-parser evasion + false-positive gaps

📊 Changes

2 files changed (+533 additions, -0 deletions)

View changed files

📝 README.md (+1 -0)
➕ Tests/ComfySwiftSDKTests/ImportBoundaryTests.swift (+532 -0)

📄 Description

ELI-5

The SDK is supposed to stay tiny and UI-free — it should only ever import Foundation, CryptoKit, and os, and never a UI framework like SwiftUI/SwiftData (or Photos/Security). A single stray import SwiftUI slipping into a source file would silently pull a whole UI runtime into the SDK and break the "reusable anywhere" promise. This adds a test that reads the SDK's own source files and fails the build if any forbidden import shows up — so the rule is enforced automatically on every PR.

What this does

Adds Tests/ComfySwiftSDKTests/ImportBoundaryTests.swift, a Swift Testing suite that:

Scans every .swift file under Sources/ComfySwiftSDK/ (located via the #filePath anchor, climbing to the package root — no simulator, no DerivedData walk).
Fails if any source imports SwiftUI, SwiftData, Photos, or Security (four denylist tests).
Asserts every parsed import module is in the allowlist {Foundation, CryptoKit, os} — catching future drift like an accidental import Combine/UIKit/Network the denylist would miss.
Includes a sanity test that the scanner finds ≥ 1 source file, so a moved test tree can't cause a vacuous pass (a missing source dir throws a descriptive error instead).

The import parser is ported from the app-side enforcement and handles attributed imports (@_implementationOnly/@_exported/@preconcurrency/@testable), scoped imports (import struct Foundation.Date), trailing ;/// comments, and the import word boundary — comparing module names, never raw line text.

Why

This enforcement previously lived (CI-skipped) in the app's simulator test host. Moving it here runs it under the package's existing swift test --no-parallel CI, where the sources are definitionally present and no simulator/DerivedData machinery is needed. No workflow change is required — the existing test step picks it up automatically.

Testing

swift test --no-parallel passes (156 tests, 21 suites), including the 6 new boundary tests — current sources import only Foundation/CryptoKit/os.
Tripwire verified: temporarily adding import SwiftUI to a source file failed both the SwiftUI denylist test and the allowlist test, then reverted cleanly.

Notes

README gains a one-line note that the import boundary is enforced in-repo.
The test target stays dependency-free of the app; it only reads files under Sources/.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/comfy-swift-sdk/pull/30 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/4/2026 **Status:** ✅ Merged **Merged:** 7/5/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-2358-import-boundary-test` --- ### 📝 Commits (2) - [`98e37db`](https://github.com/Comfy-Org/comfy-swift-sdk/commit/98e37db7d755a2a6b094f9b74c46aa14f6a4afa5) test: enforce SDK import boundary in-repo under swift test - [`252852e`](https://github.com/Comfy-Org/comfy-swift-sdk/commit/252852eb88632fdfa9d3df2e43dba56c7df8e050) test(import-boundary): close import-parser evasion + false-positive gaps ### 📊 Changes **2 files changed** (+533 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+1 -0) ➕ `Tests/ComfySwiftSDKTests/ImportBoundaryTests.swift` (+532 -0) </details> ### 📄 Description ## ELI-5 The SDK is supposed to stay tiny and UI-free — it should only ever import `Foundation`, `CryptoKit`, and `os`, and never a UI framework like `SwiftUI`/`SwiftData` (or `Photos`/`Security`). A single stray `import SwiftUI` slipping into a source file would silently pull a whole UI runtime into the SDK and break the "reusable anywhere" promise. This adds a test that reads the SDK's own source files and fails the build if any forbidden import shows up — so the rule is enforced automatically on every PR. ## What this does Adds `Tests/ComfySwiftSDKTests/ImportBoundaryTests.swift`, a Swift Testing suite that: - Scans every `.swift` file under `Sources/ComfySwiftSDK/` (located via the `#filePath` anchor, climbing to the package root — no simulator, no DerivedData walk). - Fails if any source imports `SwiftUI`, `SwiftData`, `Photos`, or `Security` (four denylist tests). - Asserts every parsed import module is in the allowlist `{Foundation, CryptoKit, os}` — catching future drift like an accidental `import Combine`/`UIKit`/`Network` the denylist would miss. - Includes a sanity test that the scanner finds ≥ 1 source file, so a moved test tree can't cause a vacuous pass (a missing source dir throws a descriptive error instead). The import parser is ported from the app-side enforcement and handles attributed imports (`@_implementationOnly`/`@_exported`/`@preconcurrency`/`@testable`), scoped imports (`import struct Foundation.Date`), trailing `;`/`//` comments, and the `import` word boundary — comparing module names, never raw line text. ## Why This enforcement previously lived (CI-skipped) in the app's simulator test host. Moving it here runs it under the package's existing `swift test --no-parallel` CI, where the sources are definitionally present and no simulator/DerivedData machinery is needed. No workflow change is required — the existing test step picks it up automatically. ## Testing - `swift test --no-parallel` passes (156 tests, 21 suites), including the 6 new boundary tests — current sources import only `Foundation`/`CryptoKit`/`os`. - Tripwire verified: temporarily adding `import SwiftUI` to a source file failed both the `SwiftUI` denylist test and the allowlist test, then reverted cleanly. ## Notes - README gains a one-line note that the import boundary is enforced in-repo. - The test target stays dependency-free of the app; it only reads files under `Sources/`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 22:34:10 +00:00

bsakaguchi referenced this issue

2026-10-26 22:34:10 +00:00

[PR #31] [MERGED] feat(auth): parameterize OAuth client config + add callback state-verification helper #32

bsakaguchi closed this issue

2026-10-26 22:34:10 +00:00

bsakaguchi referenced this issue

2026-10-26 22:34:11 +00:00

[PR #32] [MERGED] feat(auth): ComfyTokenStore protocol + ComfyAuth.restoreClient / signOut #34