feat: allow localhost testing (#233)

TestApp allow access to localhost

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Changes are limited to the test app ATS flag, CI validation, and
publish log verbosity with no production runtime or auth impact.
> 
> **Overview**
> **TestApp** can hit **local backends** during development by enabling
**`NSAllowsLocalNetworking`** under App Transport Security in
`TestApp/Info.plist`, so HTTP to localhost works with the existing
`otlpEndpoint` / `backendUrl` build settings.
> 
> **CI** adds a **`lint-pods`** job on PRs that runs **`pod lib lint`**
on `LaunchDarklyObservability.podspec` and
`LaunchDarklySessionReplay.podspec` (with `--include-podspecs` for the
dependency). **Publish** drops **`--verbose`** from `pod trunk push` for
both pods.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
0f8e330. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: abelonogov-ld

.github/actions/publish/action.yml

@@ -10,9 +10,9 @@ runs:
     - name: Push LaunchDarklyObservability to CocoaPods
       if: ${{ inputs.dry_run == 'false' }}
       shell: bash
-      run: pod trunk push LaunchDarklyObservability.podspec --allow-warnings --synchronous --verbose
+      run: pod trunk push LaunchDarklyObservability.podspec --allow-warnings --synchronous
 
     - name: Push LaunchDarklySessionReplay to CocoaPods
       if: ${{ inputs.dry_run == 'false' }}
       shell: bash
-      run: pod trunk push LaunchDarklySessionReplay.podspec --allow-warnings --synchronous --verbose
+      run: pod trunk push LaunchDarklySessionReplay.podspec --allow-warnings --synchronous

.github/workflows/test-pr.yml

@@ -14,3 +14,22 @@ jobs:
       - uses: ./.github/actions/test-swiftpm
         with:
           ios-sim: 'platform=iOS Simulator,name=iPhone 16,OS=latest'
+
+  lint-pods:
+    name: Validate Podspecs
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v6
+
+      # Lint against the local sources (pod lib lint) rather than the remote
+      # tag (pod spec lint), since a PR's version tag isn't published yet.
+      - name: Lint LaunchDarklyObservability podspec
+        run: pod lib lint LaunchDarklyObservability.podspec --allow-warnings
+
+      # SessionReplay depends on LaunchDarklyObservability, which isn't
+      # published at this version, so include the local podspec for resolution.
+      - name: Lint LaunchDarklySessionReplay podspec
+        run: |
+          pod lib lint LaunchDarklySessionReplay.podspec \
+            --allow-warnings \
+            --include-podspecs=LaunchDarklyObservability.podspec

TestApp/Info.plist

@@ -8,5 +8,10 @@
 	<string>$(otlpEndpoint)</string>
 	<key>backendUrl</key>
 	<string>$(backendUrl)</string>
+	<key>NSAppTransportSecurity</key>
+	<dict>
+		<key>NSAllowsLocalNetworking</key>
+		<true/>
+	</dict>
 </dict>
 </plist>