appstore-precheck 1.8.0 → 1.10.0

package/CHANGELOG.md

@@ -5,6 +5,83 @@ All notable changes to this project are documented here. Versioning follows
 
 ## [Unreleased]
 
+## [1.10.0] - 2026-07-02
+
+Roadmap #4: **SARIF output + opt-in GitHub PR annotations** — read-only, no auto-fix.
+
+The scanner can now emit its deterministic findings as **SARIF 2.1.0**
+(`scan.sh --format sarif`, also `npx appstore-precheck --format sarif`), built from
+the same structured findings as `--format json` with pure `jq` (no new dependency).
+`results[]` contains the non-suppressed FAIL and WARN findings (FAIL → `error`,
+WARN → `warning`); PASS and suppressed findings are excluded; findings that carry a
+`file`/`line` become SARIF `physicalLocation`s so GitHub can anchor annotations. Only
+the deterministic scan findings are included — the agent-mode Pierre deep-review
+findings are not (SARIF is a deterministic CI artifact).
+
+The GitHub Action gains two **opt-in** inputs (both default `false`, so existing
+usage is unchanged): `sarif` uploads the SARIF to code-scanning via `upload-sarif`
+(PR annotations + Security tab; needs `permissions: security-events: write`), and
+`annotations` emits inline `::error`/`::warning` PR annotations. Both run even when
+the scan verdict fails, and neither modifies the project.
+
+### Added
+- **`skills/appstore-precheck/scripts/sarif.sh`** — `render_sarif()`, a SARIF 2.1.0
+  writer over the findings buffer (pure `jq`).
+- **`scan.sh --format sarif`** (and `bin/cli.js --format text|json|sarif`).
+- **`action.yml`** opt-in inputs `sarif` and `annotations` (default off): SARIF
+  upload via `github/codeql-action/upload-sarif@v3` and inline PR annotations.
+- Tests: `tests/test-sarif.sh` and `tests/test-action-sarif.sh`.
+
+### Notes
+- Read-only preserved: the scanner writes only to stdout; the Action redirects SARIF
+  to a CI workspace file. No auto-fix. Default `--format text`/`--format json` output
+  and the Action's default behavior are byte-identical to before.
+
+## [1.9.0] - 2026-07-02
+
+Smarter analysis (roadmap #2a): **screenshot vision**, in two layers.
+
+**Layer 1 (deterministic, offline, zero-dependency).** The static scanner now
+reads each in-repo screenshot's file format and, for PNGs, its pixel dimensions —
+a new `screenshot-dimensions` check (catalog vector 42) under guideline 2.3.3. It
+WARNs on a file whose content does not match its extension, a truncated PNG, or a
+PNG whose dimensions match no known App Store screenshot size (either orientation).
+WARN-only: it never forces a RED verdict, and the offline scan stays
+byte-identical on inputs without real screenshots. Parsing uses only `bash`+`od`+
+`awk` — no new runtime dependency.
+
+**Layer 2 (agent-mode, non-blocking).** A dedicated structured screenshot vision
+review that uses the host model's vision capability to check screenshots for
+placeholder / dev-debug / empty-state content, text overflow / truncation, wrong
+device frame / aspect, misleading marketing (2.3.3 "show the app in use" / 2.3.10),
+and metadata mismatches. Like Pierre deep-review it is advisory (`REVIEW-FINDING`)
+and never changes the GREEN/YELLOW/RED verdict. It runs only in agent-skill mode
+(host vision model), never in the CLI / npx / GitHub-Action path.
+
+### Added
+- **`skills/appstore-precheck/scripts/image-dims.sh`** — zero-dependency PNG
+  magic-byte + IHDR pixel-dimension parser (pure `bash`+`od`+`awk`) and the Apple
+  accepted-screenshot-size table (verified against Apple's screenshot
+  specifications page).
+- **`scan.sh` §7b** — screenshot format + PNG-dimension validation (rule
+  `screenshot-dimensions`, catalog vector 42), WARN-only.
+- **`skills/appstore-precheck/references/screenshot-vision-review.md`** — agent-mode
+  structured screenshot vision checklist (5 checks), non-blocking, wired into
+  Pierre deep-review check #8 and SKILL.md Phase 4.
+- Tests: `tests/test-image-dims.sh` (parser unit tests) and
+  `tests/fixtures/screenshots-app/` (end-to-end fixture); `tests/make-png.py`
+  fixture generator.
+
+### Changed
+- Advertised deterministic rejection-vector count **41 → 42** (the new
+  screenshot-dimensions check) across README, SKILL.md, and methodology.
+- Existing screenshot test fixtures: replaced 1-byte placeholders with real
+  accepted-size PNGs (scan output byte-identical).
+
+### Notes
+- JPEG dimensions are not parsed in this release; JPEGs are format-validated
+  (magic bytes) and counted only.
+
 ## [1.8.0] - 2026-07-02
 
 Smarter analysis (roadmap #2c): a deterministic **semantic guideline-drift**

package/README.md

@@ -44,7 +44,7 @@ each, divided by horizontal rules), not one compressed sentence. The breakdown b
 
 ## What it checks
 
-41 rejection vectors across code, fastlane metadata, screenshots, `PrivacyInfo.xcprivacy`, and the paywall:
+42 rejection vectors across code, fastlane metadata, screenshots, `PrivacyInfo.xcprivacy`, and the paywall:
 
 | Guideline | Check |
 |-----------|-------|
@@ -56,6 +56,7 @@ each, divided by horizontal rules), not one compressed sentence. The breakdown b
 | **2.3.1** | Metadata length limits (name, subtitle, keywords, promo, description) |
 | **2.3.1** | Misleading marketing claims (iOS virus / malware scanners, fake speed boosters) in metadata |
 | **2.3.3** | At least one screenshot per locale |
+| **2.3.3** | Screenshot format + PNG dimensions match a known App Store screenshot size *(advisory, WARN-only)* |
 | **2.3.7** | Localized metadata parity across every locale |
 | **2.3.8** | "For Kids" / "For Children" wording outside the Kids Category |
 | **2.3.10** | No other-platform / competitor names in metadata |
@@ -146,7 +147,7 @@ how the app is built:
 
 | App type | Coverage |
 |----------|----------|
-| 🟢 **Native Swift / SwiftUI** | **Full.** All 41 vectors apply. |
+| 🟢 **Native Swift / SwiftUI** | **Full.** All 42 vectors apply. |
 | 🟡 **React Native / Flutter** | Metadata, privacy manifest, screenshots, and export compliance apply in full. The Swift-source checks (ATT, paywall links, private API, SDK detection, navigation) **under-detect rather than misfire**: that logic lives in JS/Dart, so they stay quiet instead of blocking. |
 
 ## Quick start
@@ -263,12 +264,35 @@ job on a RED verdict; set `fail-on: YELLOW` to be stricter:
 Both inputs are optional: with none set, the action scans the repo root and fails the job only on
 a RED verdict. No App Store Connect credentials are needed; the action runs the static scan only.
 
+### SARIF & PR annotations (opt-in)
+
+The Action can surface findings as GitHub code-scanning results and inline PR annotations. Both are
+off by default; enable either or both:
+
+```yaml
+permissions:
+  contents: read
+  security-events: write   # required for SARIF upload
+jobs:
+  precheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: berkayturk/appstore-precheck@v1
+        with:
+          sarif: true         # upload SARIF to the Security tab + PR annotations
+          annotations: true   # also emit inline ::error/::warning annotations
+```
+
+Locally / via npx: `npx appstore-precheck --format sarif > results.sarif`. The scan stays read-only;
+nothing is auto-fixed.
+
 ## How it works
 
 | Phase | Step |
 |-------|------|
 | **0** | **Guideline drift**: diff the live App Store Review Guidelines against a tracked baseline. Never blocks. |
-| **1** | **Static scan**: `scan.sh` over the 41 vectors above. |
+| **1** | **Static scan**: `scan.sh` over the 42 vectors above. |
 | **2** | **`fastlane precheck`**: Apple's own metadata rule engine. |
 | **3** | **Pierre commentary**: explains **every** FAIL and WARN from Phases 0–2 in 2–3 sentences each. |
 | **4** | **Pierre deep review**: 28 semantic checks (22 Tier A + 6 Tier B v1 heuristic). Advisory only. |

package/bin/cli.js

@@ -36,6 +36,7 @@ function printHelp() {
     `Options:\n` +
     `  --dir <path>        Directory to scan (default: current directory)\n` +
     `  --fail-on <level>   Exit non-zero at RED (default) or YELLOW\n` +
+    `  --format <fmt>      Output format: text (default), json, or sarif\n` +
     `  -v, --version       Print the version and exit\n` +
     `  -h, --help          Show this help and exit\n` +
     `\n` +
@@ -53,7 +54,7 @@ function fail(message, code) {
 }
 
 function parseArgs(argv) {
-  const opts = { dir: process.cwd(), failOn: 'RED' };
+  const opts = { dir: process.cwd(), failOn: 'RED', format: 'text' };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '-h' || a === '--help') { printHelp(); process.exit(0); }
@@ -69,6 +70,12 @@ function parseArgs(argv) {
       opts.failOn = v;
       continue;
     }
+    if (a === '--format') {
+      const v = (argv[++i] || '').toLowerCase();
+      if (v !== 'text' && v !== 'json' && v !== 'sarif') fail('--format must be text, json, or sarif', 64);
+      opts.format = v;
+      continue;
+    }
     fail(`unknown option: ${a} (try --help)`, 64);
   }
   return opts;
@@ -84,7 +91,8 @@ function main() {
     fail(`not a directory: ${opts.dir}`, 64);
   }
 
-  const scan = spawnSync('bash', [SCAN], {
+  const scanArgs = opts.format === 'text' ? [SCAN] : [SCAN, '--format', opts.format];
+  const scan = spawnSync('bash', scanArgs, {
     cwd: opts.dir,
     encoding: 'utf8',
     maxBuffer: 32 * 1024 * 1024,
@@ -97,6 +105,10 @@ function main() {
   const scanOut = scan.stdout || '';
   process.stdout.write(scanOut);
 
+  if (opts.format !== 'text') {
+    process.exit(scan.status === 0 ? 0 : (scan.status || 0));
+  }
+
   const verdict = spawnSync('bash', [VERDICT], { input: scanOut, encoding: 'utf8' });
   if (verdict.error) fail(`failed to compute the verdict: ${verdict.error.message}`, 70);
   const summary = verdict.stdout || '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appstore-precheck",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "description": "Read-only iOS App Store pre-submission check, packaged as a portable Agent Skill with native Claude Code, Cursor, and Codex plugins, plus an npx CLI.",
   "license": "MIT",
   "author": "Berkay Turk (https://github.com/berkayturk)",

package/skills/appstore-precheck/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: appstore-precheck
-description: Read-only pre-submission check for an iOS app before App Store review. Scans Swift code, fastlane metadata, screenshots, PrivacyInfo.xcprivacy, and the paywall for 41 rejection vectors, wraps Apple's official `fastlane precheck`, watches for live App Store Review Guideline drift, has Pierre explain every FAIL and WARN, then runs 22 semantic deep-review checks (Tier A) plus 6 heuristic checks (Tier B v1) — 28 total. Emits a GREEN/YELLOW/RED verdict and a `.precheck-pass` token an upload guard can gate on. Use when preparing an iOS App Store submission (before Archive, before "Submit for Review", before TestFlight, or before any `fastlane deliver/pilot/release`), or when the user mentions App Store rejection, app review, or fastlane upload.
+description: Read-only pre-submission check for an iOS app before App Store review. Scans Swift code, fastlane metadata, screenshots, PrivacyInfo.xcprivacy, and the paywall for 42 rejection vectors, wraps Apple's official `fastlane precheck`, watches for live App Store Review Guideline drift, has Pierre explain every FAIL and WARN, then runs 22 semantic deep-review checks (Tier A) plus 6 heuristic checks (Tier B v1) — 28 total. Emits a GREEN/YELLOW/RED verdict and a `.precheck-pass` token an upload guard can gate on. Use when preparing an iOS App Store submission (before Archive, before "Submit for Review", before TestFlight, or before any `fastlane deliver/pilot/release`), or when the user mentions App Store rejection, app review, or fastlane upload.
 license: MIT
 metadata:
   author: Berkay Turk
-  version: 1.8.0
+  version: 1.10.0
 allowed-tools: Bash Read Grep Glob WebFetch
 ---
 
@@ -116,7 +116,7 @@ check(s). It is non-blocking and never runs in the offline user scan; the finger
 bash skills/appstore-precheck/scripts/scan.sh
 ```
 
-Emits `FAIL:` / `WARN:` / `PASS:` lines covering 41 rejection vectors: Privacy Manifest /
+Emits `FAIL:` / `WARN:` / `PASS:` lines covering 42 rejection vectors: Privacy Manifest /
 Required Reason API parity (5.1.1), purpose strings (5.1.1), ATT (5.1.2), other-platform mentions
 (2.3.10), metadata limits (2.3.1), localized parity (2.3.7), screenshots (2.3.3), trial &
 auto-renew disclosures (3.1.2), Restore/Terms/Privacy links (3.1.2), private API (2.5.1), minimum
@@ -133,9 +133,10 @@ NetworkExtension usage (5.4), a demo account for a login-gated app (2.1), execut
 / native hot-patching (2.5.2), unused background modes (2.5.4), cryptocurrency wallet/mining
 (3.1.5(a)), thin WKWebView wrappers (4.2.3), remote-desktop apps (4.2.7), Safari extensions
 (4.4.2), account creation without in-app deletion (5.1.1(v) Account Sign-In), kids audience with
-third-party ads/analytics (5.1.4), real-money gambling copy (5.3.4), and MDM signals (5.5). The
-IAP checks (8–10) are skipped automatically when no in-app-purchase signals are present, and the
-signal-gated advisory checks (16–41) stay silent unless their triggering signal is found. The
+third-party ads/analytics (5.1.4), real-money gambling copy (5.3.4), MDM signals (5.5), and
+screenshot format/dimension mismatches (2.3.3). The IAP checks (8–10) are skipped automatically
+when no in-app-purchase signals are present, and the signal-gated advisory checks (16–42) stay
+silent unless their triggering signal is found. The
 full check table is in
 [`references/methodology.md`](references/methodology.md#phase-1-rejection-vectors).
 
@@ -226,7 +227,9 @@ After Phase 3, Pierre runs the **Review Simulator**: 28 read-only, evidence-base
 static scanner cannot fully judge (**22 Tier A** + **6 Tier B v1** heuristic — marked † below).
 The full checklist, per-check procedure, and output format live in
 [`references/pierre-deep-review.md`](references/pierre-deep-review.md) — read it before starting
-Phase 4.
+Phase 4. When screenshots are present, also run the structured screenshot vision review in
+[`references/screenshot-vision-review.md`](references/screenshot-vision-review.md) (non-blocking;
+host vision model; never changes the verdict).
 
 **What Pierre does:** read Swift, metadata, entitlements, xcstrings, paywall views, review notes,
 screenshot/preview assets; fetch privacy and support URLs; cross-check claims vs code, policy vs

package/skills/appstore-precheck/references/methodology.md

@@ -11,6 +11,7 @@ whole file to run the skill.
 - [Phase 4: Pierre deep review (28 checks)](#phase-4-pierre-deep-review-28-semantic-checks)
 - [Auto-detection rules](#auto-detection-rules)
 - [Verdict thresholds](#verdict-thresholds)
+- [SARIF output](#sarif-output---format-sarif)
 - [Pre-submit manual checklist](#pre-submit-manual-checklist)
 
 ---
@@ -108,11 +109,31 @@ baseline the same deliberate way, with `guideline-drift.sh --reconcile`.
 | 39 | **5.1.4 Kids** *(advisory)* | Metadata targets a child audience **and** a third-party ads/analytics SDK is linked; Kids Category apps may not include third-party ads/analytics and need a parental gate |
 | 40 | **5.3.4 Gambling** *(advisory)* | Real-money gaming language in metadata (casino, sportsbook, real money, wager); real-money gambling needs licensing, geo-restriction, and must be free on the store |
 | 41 | **5.5 MDM** *(advisory)* | A Mobile Device Management signal (`DeviceManagement`, managed-app-config, `com.apple.mdm`); MDM apps need a commercial enterprise/education entity and purpose-limited data use |
+| 42 | **2.3.3 Screenshot format/dimensions** *(advisory)* | Reads each in-repo screenshot's magic bytes and, for PNGs, its IHDR pixel dimensions; WARNs on a file whose content does not match its extension, a truncated PNG, or a PNG whose size matches no known App Store screenshot size (either orientation). JPEG dimensions are not parsed (format-checked only). WARN-only — never forces a RED verdict. |
 
 Vectors 8–10 only run when in-app-purchase signals are detected (StoreKit / RevenueCat import,
-or a paywall view). Otherwise the scanner emits a single PASS and skips them. Vectors 16–41 are
+or a paywall view). Otherwise the scanner emits a single PASS and skips them. Vectors 16–42 are
 signal-gated advisory WARNs: each emits nothing unless its triggering signal is present.
 
+### Screenshot format + dimensions (§7b, 2.3.3)
+
+Vector 7 (above) checks that every locale has at least one screenshot. §7b goes one layer deeper,
+purely with zero-dependency byte reads (`image-dims.sh`, pure bash + `od`/`awk`): for every
+in-repo screenshot it reads the file's magic bytes to confirm the content actually matches its
+extension (`.png`/`.jpg`/`.jpeg`), and for PNGs it also parses the IHDR chunk for pixel width and
+height and checks that pair against a table of known App Store screenshot sizes (tried in both
+orientations, sourced from Apple's [screenshot specifications
+page](https://developer.apple.com/help/app-store-connect/reference/screenshot-specifications/)).
+JPEG dimensions are not parsed — JPEGs are format-checked only (magic-byte match), not size-checked.
+
+This is **WARN-only, never FAIL**: the accepted-size table can drift as Apple adds device sizes,
+and the scanner has no way to know which display slot (iPhone 6.9", iPad 13", …) a given file is
+meant to target, so a size that matches nothing in the table is a prompt to verify against the
+current spec, not proof of a rejection. A mismatched-format file (e.g. a renamed JPEG saved as
+`.png`) or an unreadable/truncated PNG WARNs the same way. Findings surface under
+`rule_id == "screenshot-dimensions"` (catalog vector 42) with messages beginning
+`WARN: 2.3.3 Screenshot …`.
+
 **Scope by app type.** The metadata, privacy-manifest, screenshots, and export-compliance checks
 apply to any iOS app regardless of how it is built. The code-level checks grep the app's Swift
 source (`*.swift`, plus `*.m`/`*.h` and `*.entitlements` where relevant), so they are most accurate
@@ -201,6 +222,18 @@ blocks, but it can be the fifth WARN that tips GREEN into YELLOW.
 
 ---
 
+## SARIF output (`--format sarif`)
+
+`scan.sh --format sarif` emits a SARIF 2.1.0 log built from the same structured findings as
+`--format json` (pure `jq`, no new dependency). `results[]` contains the non-suppressed FAIL and
+WARN findings (FAIL → `error`, WARN → `warning`); PASS and suppressed findings are excluded. Findings
+that carry a `file`/`line` become SARIF `physicalLocation`s so GitHub can anchor PR annotations. Only
+the deterministic scan findings are included — the agent-mode Pierre deep-review findings are not
+(SARIF is a deterministic CI artifact). The GitHub Action uploads this via `upload-sarif` and/or
+emits inline `::error`/`::warning` annotations, both opt-in.
+
+---
+
 ## Pre-submit manual checklist
 
 Things the scanner cannot verify; confirm by hand before you submit:

package/skills/appstore-precheck/references/pierre-deep-review.md

@@ -147,6 +147,9 @@ REVIEW-PASS: <guideline> — not applicable (<reason>)
 1. Open ≥1 screenshot per primary locale.
 2. List visible features (tabs, paywall, login, maps, etc.).
 3. Flag screenshots showing features absent from the build or metadata.
+4. For the full structured screenshot vision review (placeholder/empty-state, text overflow,
+   wrong device frame, misleading marketing, metadata mismatch), follow
+   `references/screenshot-vision-review.md`.
 
 ### 9 — 2.3.6 Pricing language
 

package/skills/appstore-precheck/references/screenshot-vision-review.md

@@ -0,0 +1,69 @@
+# Screenshot vision review (agent-mode, non-blocking)
+
+Deepens Pierre deep-review check #8 (2.3.5) into a dedicated, structured screenshot review.
+This is the **vision layer** of the Review Simulator: the host model reads the actual screenshot
+images and cross-checks their content against the metadata and the shipped app.
+
+**Identity:** this runs ONLY in agent-skill mode (Claude Code / Codex / …), using the host LLM's
+vision capability — exactly like Pierre reads code and the drift phase fetches URLs. It is NOT a
+bundled dependency and does NOT run in the offline CLI / npx / GitHub-Action path.
+
+**This phase does not change the GREEN/YELLOW/RED verdict** (verdict comes only from scan
+`FAIL:`/`WARN:` counts). It emits `REVIEW-PASS:` / `REVIEW-FINDING: … WARN` lines, like Pierre
+deep-review.
+
+## Rules
+
+- Read-only. Never modify project files.
+- Evidence-based: cite the screenshot **filename** (and locale) for every finding. If you cannot
+  read an image, say so — do not invent findings.
+- Read at least one screenshot per primary locale; when several are present, scan them all.
+- All five checks, every run: report each as `REVIEW-PASS:` or `REVIEW-FINDING: … WARN`.
+- If there are no in-repo screenshots, report each check as
+  `REVIEW-PASS: <guideline> — not applicable (no in-repo screenshots; managed in App Store Connect)`.
+- Severity is always WARN (advisory). Cautious language ("may trigger review questions").
+- Write Pierre's 2–3 sentence explanations in the user's conversation language.
+
+## The 5 checks
+
+| # | Guideline | Question |
+|---|-----------|----------|
+| S1 | 2.3.3 / 2.3.7 | Placeholder / dev-debug / empty-state content: Lorem ipsum, debug overlays or logs, visible TODO/FIXME, empty lists or skeleton loaders shown as content, simulator status bar with placeholder carrier/time. |
+| S2 | 2.3.3 | Text overflow / truncation / clipping: clipped or overlapping labels, cut-off buttons, text running off-screen. |
+| S3 | 2.3.5 | Wrong device frame / aspect: an iPad screenshot in an iPhone slot (or vice-versa), letterboxing, obviously stretched/squished aspect. |
+| S4 | 2.3.3 / 2.3.10 | Misleading marketing: 2.3.3 "show the app in use" — the shot is a splash/title/logo/pure marketing art, not actual app UI; 2.3.10 — a feature is depicted that the app does not ship. |
+| S5 | 2.3.5 | Metadata ↔ screenshot claim mismatch: visible UI text/features contradict the description, keywords, or promo text. |
+
+## Per-check procedure
+
+### S1 — Placeholder / dev-debug / empty-state
+1. Open each screenshot; read visible text and UI state.
+2. Flag Lorem ipsum, debug HUDs, log text, "TODO"/"FIXME", empty/skeleton content presented as real, or a simulator status bar with placeholder carrier/time.
+3. Cite the filename. Not applicable if no screenshots.
+
+### S2 — Text overflow / truncation
+1. Inspect labels, buttons, and headings for clipping, overlap, or off-screen text.
+2. Flag any truncation that suggests an unfinished or broken layout.
+
+### S3 — Wrong device frame / aspect
+1. Compare each screenshot's aspect to its locale/slot (iPhone vs iPad).
+2. Flag an iPad-aspect image in an iPhone slot (or vice-versa), letterboxing, or stretched aspect.
+
+### S4 — Misleading marketing
+1. Determine whether each screenshot shows the app actually in use (real UI) vs pure title/splash/logo art.
+2. Flag shots that are marketing art rather than the app in use (2.3.3), or that depict a feature absent from the build (2.3.10).
+
+### S5 — Metadata ↔ screenshot mismatch
+1. Read the visible UI text/features and compare to the description, keywords, and promo text.
+2. Flag direct contradictions (a feature/claim in the screenshot not in metadata, or vice-versa).
+
+## Output format
+
+```
+REVIEW-PASS: <guideline> — <one-line why it looks OK, with screenshot filename>
+```
+or
+```
+REVIEW-FINDING: <guideline> WARN — <one-line concrete issue, with screenshot filename>
+Pierre: <2–3 sentences: why Apple cares, what you saw, what to fix or verify>
+```

package/skills/appstore-precheck/scripts/findings.sh

@@ -26,7 +26,8 @@ rule_slug() {
     35) echo webview-wrapper ;;                36) echo remote-desktop ;;
     37) echo safari-extension ;;               38) echo account-no-delete ;;
     39) echo kids-ads-analytics ;;             40) echo realmoney-gambling ;;
-    41) echo mdm ;;                            *) echo "" ;;
+    41) echo mdm ;;                            42) echo screenshot-dimensions ;;
+    *) echo "" ;;
   esac
 }
 

package/skills/appstore-precheck/scripts/image-dims.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# image-dims.sh — zero-dependency image format + PNG dimension helpers for scan.sh.
+# Pure bash + od + awk; bash 3.2 compatible; sourced, no side effects, no output on load.
+
+# img_format <file> -> "png" | "jpeg" | "unknown"
+img_format() {
+  local f="$1" sig
+  [[ -r "$f" ]] || { echo unknown; return; }
+  sig="$(od -An -tx1 -N8 "$f" 2>/dev/null | tr -d ' \n')"
+  case "$sig" in
+    89504e470d0a1a0a*) echo png ;;
+    ffd8ff*)           echo jpeg ;;
+    *)                 echo unknown ;;
+  esac
+}
+
+# png_dims <file> -> "W H" (decimal) and return 0, or return 1 with no output.
+# IHDR width = big-endian bytes 16-19, height = 20-23 (8-byte signature + 4-byte
+# length + "IHDR" tag precede the 8 dimension bytes at offset 16).
+png_dims() {
+  local f="$1"
+  [[ "$(img_format "$f")" == png ]] || return 1
+  local b
+  read -r -a b < <(od -An -tu1 -j16 -N8 "$f" 2>/dev/null)
+  [[ "${#b[@]}" -ge 8 ]] || return 1
+  local w=$(( b[0]*16777216 + b[1]*65536 + b[2]*256 + b[3] ))
+  local h=$(( b[4]*16777216 + b[5]*65536 + b[6]*256 + b[7] ))
+  printf '%s %s\n' "$w" "$h"
+}
+
+# ACCEPTED_SIZES — Apple App Store screenshot pixel sizes (portrait "W H").
+# The matcher tries both orientations. This table is intentionally generous
+# (includes current + legacy device sizes) because this check is WARN-only.
+# Verified against Apple's official page:
+# https://developer.apple.com/help/app-store-connect/reference/screenshot-specifications/
+ACCEPTED_SIZES="
+1260 2736
+1290 2796
+1320 2868
+1284 2778
+1242 2688
+1179 2556
+1206 2622
+1170 2532
+1125 2436
+1080 2340
+1242 2208
+750 1334
+640 1096
+640 1136
+640 920
+640 960
+2064 2752
+2048 2732
+1488 2266
+1668 2420
+1668 2388
+1640 2360
+1668 2224
+1536 2008
+1536 2048
+768 1004
+768 1024
+"
+
+# dims_match_accepted <W> <H> -> return 0 if W×H or H×W is an accepted size.
+dims_match_accepted() {
+  local w="$1" h="$2" aw ah
+  while read -r aw ah; do
+    [[ -z "$aw" ]] && continue
+    if { [[ "$w" == "$aw" && "$h" == "$ah" ]]; } || { [[ "$w" == "$ah" && "$h" == "$aw" ]]; }; then
+      return 0
+    fi
+  done <<< "$ACCEPTED_SIZES"
+  return 1
+}

package/skills/appstore-precheck/scripts/sarif.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# sarif.sh — SARIF 2.1.0 output layer for scan.sh. Sourced; pure jq over the
+# findings buffer. No side effects, no output on load. bash 3.2 compatible.
+
+: "${PRECHECK_VERSION:=dev}"
+
+# render_sarif -> prints a SARIF 2.1.0 log built from the FINDINGS_TMP buffer.
+# results[] = non-suppressed FAIL/WARN only (PASS + suppressed excluded);
+# level: FAIL->error, WARN->warning. rules[] = distinct non-empty ruleIds present.
+render_sarif() {
+  local buf="${FINDINGS_TMP:-/dev/null}"
+  local uri="https://github.com/berkayturk/appstore-precheck"
+  local help="https://github.com/berkayturk/appstore-precheck/blob/main/skills/appstore-precheck/references/methodology.md"
+  if [[ ! -s "$buf" ]]; then
+    jq -nc --arg v "$PRECHECK_VERSION" --arg u "$uri" '
+      {"$schema":"https://json.schemastore.org/sarif-2.1.0.json", "version":"2.1.0",
+       "runs":[{"tool":{"driver":{"name":"appstore-precheck","version":$v,"informationUri":$u,"rules":[]}},"results":[]}]}'
+    return 0
+  fi
+  jq -s --arg v "$PRECHECK_VERSION" --arg u "$uri" --arg help "$help" '
+    (map(select(.suppressed==false and (.severity=="FAIL" or .severity=="WARN")))) as $issues
+    | ($issues
+        | map({id:.rule_id, text:.guideline})
+        | map(select(.id != "" and .id != null))
+        | unique_by(.id)
+        | map({id:.id, name:.id, shortDescription:{text:.text}, helpUri:$help})) as $rules
+    | ($issues | map(
+        ( (if (.rule_id // "") == "" then {} else {ruleId:.rule_id} end)
+          + {level:(if .severity=="FAIL" then "error" else "warning" end),
+             message:{text:.message}}
+          + (if .file != null
+               then {locations:[{physicalLocation:(
+                       {artifactLocation:{uri:.file}}
+                       + (if .line != null then {region:{startLine:.line}} else {} end))}]}
+               else {locations:[]} end) )
+      )) as $results
+    | {"$schema":"https://json.schemastore.org/sarif-2.1.0.json", "version":"2.1.0",
+       "runs":[{"tool":{"driver":{"name":"appstore-precheck","version":$v,"informationUri":$u,"rules":$rules}},"results":$results}]}
+  ' "$buf"
+}

package/skills/appstore-precheck/scripts/scan.sh

@@ -15,6 +15,8 @@ cd "$ROOT" || { echo "FAIL: repo-root — could not enter repository root"; exit
 source "$(dirname "${BASH_SOURCE[0]}")/findings.sh"
 source "$(dirname "${BASH_SOURCE[0]}")/suppress.sh"
 source "$(dirname "${BASH_SOURCE[0]}")/project-model.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/image-dims.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/sarif.sh"
 FINDINGS_TMP="$(mktemp)"; export FINDINGS_TMP
 trap 'rm -f "$FINDINGS_TMP"' EXIT
 FORMAT="text"
@@ -27,13 +29,13 @@ PRECHECK_VERSION="$(grep -m1 -E '^[[:space:]]*version:' "$(dirname "${BASH_SOURC
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --format)
-      if [[ $# -lt 2 ]]; then echo "scan.sh: --format needs a value (text|json)" >&2; exit 64; fi
+      if [[ $# -lt 2 ]]; then echo "scan.sh: --format needs a value (text|json|sarif)" >&2; exit 64; fi
       FORMAT="$2"; shift 2 ;;
     --format=*) FORMAT="${1#*=}"; shift ;;
     *) shift ;;
   esac
 done
-[[ "$FORMAT" == json || "$FORMAT" == text ]] || { echo "scan.sh: --format must be text|json" >&2; exit 64; }
+[[ "$FORMAT" == json || "$FORMAT" == text || "$FORMAT" == sarif ]] || { echo "scan.sh: --format must be text|json|sarif" >&2; exit 64; }
 
 CONFIG="${APPSTORE_PRECHECK_CONFIG:-.appstore-precheck.json}"
 have_jq() { command -v jq >/dev/null 2>&1; }
@@ -201,7 +203,7 @@ SUB_KEY="$(cfg '.disclosureKeys.subscription' 'subscription_disclosure')"
 TRIAL_KEY="$(cfg '.disclosureKeys.trial' 'subscription_trial_disclosure')"
 CHECK_FAMILY="$(cfg_bool '.optionalChecks.familyControls')"
 
-if [[ "$FORMAT" == json ]]; then exec 4>&1 1>/dev/null; fi
+if [[ "$FORMAT" != text ]]; then exec 4>&1 1>/dev/null; fi
 
 echo "PASS: layout — ios='${IOS_DIR:-?}' metadata='${META_DIR:-?}' xcstrings='${XCSTRINGS:-?}' locales=${#LOCALES[@]}"
 
@@ -395,6 +397,42 @@ else
   pass "2.3.3 Screenshots — no in-repo screenshots dir; assumed managed in App Store Connect (set .screenshotsDir to check in-repo)"
 fi
 
+# ===================================================================
+# §7b — 2.3.3 Screenshot format + PNG dimensions (deterministic; PNG dims,
+# JPEG format only). WARN-only: the accepted-size table can drift, and we
+# cannot know which display slot a file targets, so mismatches never FAIL.
+# ===================================================================
+if [[ -n "$SCREEN_DIR" && -d "$SCREEN_DIR" ]]; then
+  set_rule "screenshot-dimensions"
+  while IFS= read -r img; do
+    [[ -z "$img" ]] && continue
+    fmt="$(img_format "$img")"
+    case "$img" in
+      *.png)
+        if [[ "$fmt" != png ]]; then
+          warn "2.3.3 Screenshot $img is not a valid PNG (file content does not match .png extension)" "$img"
+          continue
+        fi
+        dims="$(png_dims "$img")"
+        if [[ -z "$dims" ]]; then
+          warn "2.3.3 Screenshot $img — could not read PNG dimensions (possibly truncated)" "$img"
+        else
+          w="${dims% *}"; h="${dims#* }"
+          if ! dims_match_accepted "$w" "$h"; then
+            warn "2.3.3 Screenshot $img is ${w}x${h}, which matches no known App Store screenshot size — verify against the current spec" "$img"
+          fi
+        fi
+        ;;
+      *.jpg|*.jpeg)
+        if [[ "$fmt" != jpeg ]]; then
+          warn "2.3.3 Screenshot $img is not a valid JPEG (file content does not match extension)" "$img"
+        fi
+        ;;
+    esac
+  done < <(find "$SCREEN_DIR" -maxdepth 3 -type f \( -name '*.png' -o -name '*.jpg' -o -name '*.jpeg' \) 2>/dev/null | sort)
+  set_rule ""
+fi
+
 # ===================================================================
 # In-app purchase gate — only run 3.1.2 checks if IAP signals exist
 # ===================================================================
@@ -403,7 +441,7 @@ grep -rqE 'SKPaymentQueue|SKProduct|SKMutablePayment|Product\.products|Product\(
 [[ -n "$SUB_VIEW" ]] && iap_detected=1
 
 if [[ -z "$iap_detected" ]]; then
-  # Not one of the 41 catalog sections — clear the rule_id so this PASS doesn't
+  # Not one of the 42 catalog sections — clear the rule_id so this PASS doesn't
   # inherit §7's "screenshots-per-locale" slug in the JSON output.
   set_rule ""
   pass "3.1.2 IAP — no in-app purchase / subscription signals detected, skipping paywall checks"
@@ -974,4 +1012,5 @@ echo "---END-OF-SCAN---"
 if [[ "$FORMAT" == text && "${_SUPPRESSED_COUNT:-0}" -gt 0 ]]; then
   printf '(%s finding(s) suppressed via .precheck-ignore)\n' "$_SUPPRESSED_COUNT"
 fi
-if [[ "$FORMAT" == json ]]; then exec 1>&4 4>&-; render_json; fi
+if [[ "$FORMAT" == json ]]; then exec 1>&4 4>&-; render_json;
+elif [[ "$FORMAT" == sarif ]]; then exec 1>&4 4>&-; render_sarif; fi