Add iOS App Attest verifier and refresh endpoints

.github/workflows/ci.yml

@@ -86,6 +86,9 @@ jobs:
       - name: Measure coverage
         id: coverage
         shell: bash
+        env:
+          # Keep report text free of ANSI so TOTAL extraction is reliable.
+          CARGO_TERM_COLOR: never
         run: |
           set +e
           cargo llvm-cov --all-targets --all-features --no-report
@@ -99,7 +102,18 @@ jobs:
 
           cargo llvm-cov report --lcov --output-path lcov.info
           cargo llvm-cov report --text --summary-only > coverage-summary.txt
-          grep -E '^(Filename|TOTAL|-{5,})' coverage-summary.txt > coverage-table.txt || cp coverage-summary.txt coverage-table.txt
+
+          # PR comments are capped at 65 KiB. Keep only the TOTAL line(s) —
+          # never fall back to the full per-file summary (that is what blew
+          # up once ANSI-colored headers stopped matching the Filename grep).
+          {
+            grep -E '^Filename' coverage-summary.txt | head -n 1 || true
+            grep -E '^-{5,}' coverage-summary.txt | head -n 1 || true
+            grep -E '^TOTAL' coverage-summary.txt || true
+          } > coverage-table.txt
+          if [[ ! -s coverage-table.txt ]]; then
+            tail -n 5 coverage-summary.txt > coverage-table.txt
+          fi
 
           set +e
           cargo llvm-cov report \
@@ -125,18 +139,14 @@ jobs:
             echo
             echo "${status}"
             echo
-            echo "<details>"
-            echo "<summary>Summary</summary>"
-            echo
             echo '```'
             cat coverage-table.txt
             echo '```'
-            echo
-            echo "</details>"
           } > coverage-comment.md
 
       - name: Post coverage comment
         if: github.event_name == 'pull_request'
+        continue-on-error: true
         uses: marocchino/sticky-pull-request-comment@v2
         with:
           header: coverage

.gitignore

@@ -12,6 +12,9 @@ secrets/
 config/local.toml
 config/*.local.toml
 
+# Public Apple App Attest root CA bundled for local verification
+!config/apple_app_attestation_root_ca.pem
+
 # OS / editor
 .DS_Store
 *.swp