Harden CI and update vulnerable gems - #109
Merged
andiwand merged 2 commits intoJul 26, 2026
Merged
Conversation
The pipeline only ever built the simulator slice of one configuration, so anything that breaks in Release or on device surfaced at deploy time. It also rebuilt every conan package from scratch on every run. - add a build job that compiles both flavors for iphoneos in their release configurations. Signing needs secrets this workflow does not have, so it builds with CODE_SIGNING_ALLOWED=NO and only proves things compile and link - cache ~/.conan2/p keyed on the conan-odr-index commit plus conanfile and profiles, restored before the recipe export so current recipes win over stale ones from the archive - ruby/setup-ruby with bundler-cache instead of installing bundler and all gems from scratch every run - macos-14 and Xcode 16.2 were about two Xcode majors behind. Pinned to Xcode 26.0.1 on macos-26, matching what this was verified against locally - bundle update, which clears the four open dependabot alerts: addressable 2.8.7 -> 2.9.0, excon 0.112.0 -> 1.6.0, faraday 1.10.5 -> 1.10.6, jwt 2.10.1 -> 3.2.0, pulling fastlane 2.227.2 -> 2.237.0 - pin fastlane, add .ruby-version and the runner platforms to the lockfile - add dependabot config so gems and actions stay current The tests lane no longer clears derived data or resets the simulator. CI runners start clean and locally it only threw away the incremental build of a C++ heavy project.
ruby/setup-ruby installs with frozen mode on. The lockfile still carried a RUBY VERSION entry from an earlier iteration of the Gemfile, so bundler wanted to rewrite it and refused. The clean conan cache steps also ran on failure, where conan is not installed yet, turning any earlier failure into a confusing 'conan: command not found'.
This was referenced Jul 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #108.
CI only ever built the simulator slice of one configuration, so Release-only and device-only breakage surfaced at deploy time. It also rebuilt every conan package from scratch on every run.
Changes
Coverage
buildjob compiles both flavors foriphoneosin their release configurations (ODR Full/Release,ODR Lite/Release Lite). Signing needs secrets this workflow does not have, so it runs withCODE_SIGNING_ALLOWED=NOand only proves the device slice compiles and links.Speed
~/.conan2/p, keyed on theconan-odr-indexcommit plusconan/conanfile.pyand the profiles. Restored before the recipe export so current recipes win over stale ones from the archive, andconan cache clean "*"runs before the save — same shape droid uses.ruby/setup-rubywithbundler-cache: trueinstead ofgem install bundler && bundle installcold every run.testslane no longer callsclear_derived_dataorreset_simulator. Runners start clean anyway, and locally it just threw away the incremental build of a C++-heavy project.Currency
macos-14+ Xcode 16.2 →macos-26+ Xcode 26.0.1. Pinned to 26.0.1 specifically because that is the Xcode this stack was verified against locally; bumping further is a one-line change.bundle update, clearing all four open dependabot alerts:fastlane goes 2.227.2 → 2.237.0 as a result, which regenerates
fastlane/README.md.Pin fastlane in the Gemfile, add
.ruby-version, add the runner platforms to the lockfile.Add
.github/dependabot.yml(bundler, github-actions, cocoapods).Verification
bundle exec fastlane testslocally on fastlane 2.237.0: 1 test, 0 failures.buildjob invokes them:ODR Full/Release andODR Lite/Release Lite for-sdk iphoneos→ BUILD SUCCEEDED.Not included
SwiftLint. Adding it now would either fail on the existing code or be configured so loosely nobody reads it — it lands after the code cleanup PR later in this stack.