T-13: Manual E2E QA + accessibility + security checklist

[kirich1409]

Description

Manual E2E QA pass following docs/testplans/15-github-integration.md (from T-16).

(1) Happy path (5 TC)

• Launch → Preferences → Sign in → web flow → callback → @username displayed
• Open project with GitHub origin + active CI → badge pending with pulse
• CI completes → badge turns green within 15s
• Click badge → popover with jobs
• Click job → browser opens the correct GitHub Actions run URL

(2) Edge cases (7 TC)

• Non-GitHub origin → badge hidden
• Branch without PR → popover "No PR", "Create PR on GitHub" deep link works
• Network offline → error banner + Retry
• Token revoked on github.com → "Session expired" banner + Sign-in button restores flow
• SAML org without SSO auth → "SSO authorization required" banner + deep link
• Rate limit (simulated x-ratelimit-remaining: 0) → stale overlay + countdown
• Minimize window → polling pauses (verified via log stream)

(3) Accessibility (3 TC)

• VoiceOver reads each badge state label correctly
• Popover navigable via Tab / Shift-Tab; Esc closes
• Dynamic Type XL doesn't break layout in Preferences / Popover

(4) Security checklist (manual)

• log stream --subsystem com.relay.github over full sign-in + polling cycle — zero lines with token, code_verifier, state value, Bearer header value
• Simulated crash — crash report does NOT contain token
• Keychain Access.app shows one item under com.relay.github
• GitHubOAuthConfig.clientID present in binary (OK — public identifier)

(5) Report

Test plan execution → PR description (one checkbox per TC). Skipped TCs with reasons. Found bugs filed as linked GitHub Issues.

Spec reference

See swarm-report/github-integration-decomposition.md#t-13.

Relationships

• Parent issue: EPIC: GitHub Integration MVP (read-only CI status + popover + OAuth) #214
• Blocked by: T-12, T-16
• Blocks: (epic closes when this closes)
• Related: none

Acceptance criteria

• Test plan executed, results in PR description (15 TCs checked or skipped-with-reason)
• Security checklist — every item PASS (4 items)
• VoiceOver report attached (transcript or recording)
• Known bugs filed as issues, linked in PR
• Wave gate criteria (per CLAUDE.md): backend N/A; frontend checklist PASS (swiftlint strict, xcodebuild build, xcodebuild test)

Complexity

M

Suggested agent

developer-workflow:manual-tester

Module / Layer

Cross-cutting / QA