feat: Enhance release proof validation by adding checks for command token and date format; implement tests for invalid scenarios

Author: MarlonJD

Tests/LiveKitNativeTests/ReleaseReadinessScriptTests.swift

@@ -81,6 +81,9 @@ final class ReleaseReadinessScriptTests: XCTestCase {
         XCTAssertTrue(script.contains("release_proof_is_known_gate \"$gate\""))
         XCTAssertTrue(script.contains("--artifact <path>"))
         XCTAssertTrue(script.contains("Missing required --gate, --output, --command, or --artifact."))
+        XCTAssertTrue(script.contains("release_proof_required_command_token_for_gate"))
+        XCTAssertTrue(script.contains("Proof command must include '$required_command_token'"))
+        XCTAssertTrue(script.contains("Proof date must be UTC ISO-8601"))
         XCTAssertTrue(script.contains("gate: %s"))
         XCTAssertTrue(script.contains("status: passed"))
         XCTAssertTrue(script.contains("date: %s"))
@@ -175,6 +178,47 @@ final class ReleaseReadinessScriptTests: XCTestCase {
         XCTAssertTrue(invalidDateResult.output.contains("date must be UTC ISO-8601"))
     }
 
+    func testReleaseProofWriterRejectsInvalidCommandTokenAndDate() throws {
+        let temporaryDirectory = URL(fileURLWithPath: NSTemporaryDirectory())
+            .appendingPathComponent("LiveKitNativeReleaseProofWriter-\(UUID().uuidString)")
+        try FileManager.default.createDirectory(at: temporaryDirectory, withIntermediateDirectories: true)
+        defer { try? FileManager.default.removeItem(at: temporaryDirectory) }
+
+        let artifact = temporaryDirectory.appendingPathComponent("simulcast.log")
+        try "ok\n".write(to: artifact, atomically: true, encoding: .utf8)
+
+        let validOutput = temporaryDirectory.appendingPathComponent("simulcast.proof")
+        let validResult = try runReleaseProofWriter(
+            gate: "simulcast",
+            output: validOutput,
+            command: "LIVEKIT_NATIVE_RUN_INTEGRATION=1 LIVEKIT_NATIVE_RUN_SIMULCAST=1 swift test",
+            artifact: artifact,
+            date: "2026-05-19T00:00:00Z"
+        )
+        XCTAssertEqual(validResult.status, 0, validResult.output)
+        XCTAssertTrue(FileManager.default.fileExists(atPath: validOutput.path))
+
+        let missingTokenResult = try runReleaseProofWriter(
+            gate: "simulcast",
+            output: temporaryDirectory.appendingPathComponent("simulcast-missing-token.proof"),
+            command: "LIVEKIT_NATIVE_RUN_INTEGRATION=1 swift test",
+            artifact: artifact,
+            date: "2026-05-19T00:00:00Z"
+        )
+        XCTAssertNotEqual(missingTokenResult.status, 0)
+        XCTAssertTrue(missingTokenResult.output.contains("Proof command must include 'LIVEKIT_NATIVE_RUN_SIMULCAST=1'"))
+
+        let invalidDateResult = try runReleaseProofWriter(
+            gate: "simulcast",
+            output: temporaryDirectory.appendingPathComponent("simulcast-invalid-date.proof"),
+            command: "LIVEKIT_NATIVE_RUN_INTEGRATION=1 LIVEKIT_NATIVE_RUN_SIMULCAST=1 swift test",
+            artifact: artifact,
+            date: "2026-05-19"
+        )
+        XCTAssertNotEqual(invalidDateResult.status, 0)
+        XCTAssertTrue(invalidDateResult.output.contains("Proof date must be UTC ISO-8601"))
+    }
+
     func testReleaseProofDocsMatchRequiredProofSpecs() throws {
         let gates = try String(contentsOf: repositoryRoot.appendingPathComponent("scripts/release_proof_gates.sh"))
         let docs = try String(contentsOf: repositoryRoot.appendingPathComponent("docs/RELEASE_PROOFS.md"))
@@ -355,6 +399,41 @@ final class ReleaseReadinessScriptTests: XCTestCase {
         return (process.terminationStatus, String(data: data, encoding: .utf8) ?? "")
     }
 
+    private func runReleaseProofWriter(
+        gate: String,
+        output: URL,
+        command: String,
+        artifact: URL,
+        date: String
+    ) throws -> (status: Int32, output: String) {
+        let process = Process()
+        let capturedOutput = Pipe()
+        process.executableURL = URL(fileURLWithPath: "/bin/bash")
+        process.currentDirectoryURL = repositoryRoot
+        process.arguments = [
+            repositoryRoot.appendingPathComponent("scripts/write_release_proof.sh").path,
+            "--gate",
+            gate,
+            "--output",
+            output.path,
+            "--command",
+            command,
+            "--artifact",
+            artifact.path,
+            "--runner",
+            "unit-test",
+            "--date",
+            date,
+        ]
+        process.standardOutput = capturedOutput
+        process.standardError = capturedOutput
+        try process.run()
+        process.waitUntilExit()
+
+        let data = capturedOutput.fileHandleForReading.readDataToEndOfFile()
+        return (process.terminationStatus, String(data: data, encoding: .utf8) ?? "")
+    }
+
     private func strictProductionFlags(in script: String) -> [String] {
         guard let start = script.range(of: "for required_strict_flag in \\") else {
             XCTFail("Expected strict flag loop in check_release_readiness.sh.")