fix: SwiftPM checksum is SHA-256, smoke extracts only Quick start

.github/workflows/sdk-examples-smoke-test.yml

@@ -24,11 +24,21 @@ jobs:
 
       - name: Extract README quickstart
         run: |
-          # PILOT-197: extract the first ```swift fenced block.
+          # PILOT-197: extract the ```swift fenced block under the
+          # `## Quick start` heading. The README has multiple ```swift
+          # blocks (the install-instructions Package.swift snippet
+          # being the first); concatenating them with a naive `awk`
+          # produced invalid code that swiftc couldn't compile.
           mkdir -p /tmp/smoke
-          awk '/^```swift$/{flag=1;next}/^```$/{flag=0}flag' README.md > /tmp/smoke/main.swift
+          awk '
+            /^## Quick start/    { in_section = 1; next }
+            in_section && /^## / { in_section = 0; next }
+            in_section && /^```swift$/ { flag = 1; next }
+            in_section && flag && /^```$/ { flag = 0; exit }
+            in_section && flag
+          ' README.md > /tmp/smoke/main.swift
           if [ ! -s /tmp/smoke/main.swift ]; then
-            echo "::error::no quickstart code block found in README.md"
+            echo "::error::no quickstart code block found under '## Quick start' in README.md"
             exit 1
           fi
 
@@ -39,8 +49,13 @@ jobs:
         run: |
           # Wrap the snippet in a tiny SwiftPM project that depends on
           # the just-built SDK and runs the README block as @main.
+          # The heredoc is UNQUOTED so the shell expands
+          # $GITHUB_WORKSPACE into the absolute path — using the
+          # quoted form `<<'PKG'` (as the original did) leaves the
+          # literal string in Package.swift and SwiftPM throws
+          # "The folder $GITHUB_WORKSPACE doesn't exist".
           cd /tmp/smoke
-          cat > Package.swift <<'PKG'
+          cat > Package.swift <<PKG
           // swift-tools-version:5.9
           import PackageDescription
           let p = Package(

Package.swift

@@ -21,7 +21,12 @@ let package = Package(
         .binaryTarget(
             name: "PilotC",
             url: "https://github.com/pilot-protocol/sdk-swift/releases/download/v0.2.0/Pilot.xcframework.zip",
-            checksum: "2a39465af3d9e77eed750b494272c690251824198f6d5b68cfa2d60f4bbc9b02a600976380d24f7911b396872fc83e8d6e748d71f176fbdb8075141447e67020"
+            // SwiftPM binaryTarget checksums are SHA-256 (64 hex chars).
+            // The previous value was 128 hex (a SHA-512), which SwiftPM
+            // accepted at parse time but rejected at fetch:
+            // "checksum of downloaded artifact … does not match …".
+            // Recomputed via `swift package compute-checksum`.
+            checksum: "a59c9b99061d1078cc6f5e7ae1261af90144e2177cdb1b932fbcf3979578a25e"
         ),
         .testTarget(
             name: "PilotTests",