From 4c7d8c6f2eff750f5cda631e761cd99c3a042006 Mon Sep 17 00:00:00 2001 From: Jeppe B <2jepp9350@gmail.com> Date: Wed, 22 Jul 2026 19:43:57 +0200 Subject: [PATCH] Consolidate verified CI and Fastlane upgrades (#214) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Consolidate the intended changes from #194–#199 onto current master. - Upgrade checkout 7.0.1, upload-artifact 7.0.1, setup-android 4.0.1, setup-java 5.6.0, github-script 9.0.0, and Fastlane 2.237.0. - Pin every upgraded workflow action to its verified immutable commit SHA. - Exclude the abandoned dependency-aware test-graph ancestor entirely. ## Verification - All five action families matched live upstream tag commits (`github-script` uses the peeled annotated-tag commit). - Workflow YAML parse passed. - AI workflow generated-output check passed. - 22 focused mobile/Playwright workflow unit tests passed. - `git diff --check` passed. - Ruby/Bundler is unavailable locally; Linux/macOS Fastlane resolution remains a required CI gate. --- .github/workflows/app-store-readiness.yml | 4 +- .github/workflows/code_quality.yml | 2 +- .github/workflows/ios-app-store-candidate.yml | 4 +- .github/workflows/ios-credential-health.yml | 2 +- .github/workflows/ios-device-debug.yml | 6 +- .github/workflows/ios-testflight.yml | 8 +- .github/workflows/mobile-artifacts.yml | 8 +- .github/workflows/release.yml | 14 +-- .github/workflows/tests.yml | 16 ++-- Gemfile | 2 +- Gemfile.lock | 93 +++++++++++-------- 11 files changed, 86 insertions(+), 73 deletions(-) diff --git a/.github/workflows/app-store-readiness.yml b/.github/workflows/app-store-readiness.yml index fd92f153..5110bbdc 100644 --- a/.github/workflows/app-store-readiness.yml +++ b/.github/workflows/app-store-readiness.yml @@ -24,7 +24,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout repository - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -48,7 +48,7 @@ jobs: - name: Preserve a generated lock for review if: steps.fastlane-lock.outcome == 'failure' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: generated-fastlane-lock path: Gemfile.lock diff --git a/.github/workflows/code_quality.yml b/.github/workflows/code_quality.yml index fdb66584..6578ee9b 100644 --- a/.github/workflows/code_quality.yml +++ b/.github/workflows/code_quality.yml @@ -33,7 +33,7 @@ jobs: steps: - name: Checkout repository # v5.0.1 - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} fetch-depth: 0 diff --git a/.github/workflows/ios-app-store-candidate.yml b/.github/workflows/ios-app-store-candidate.yml index 1f2395d9..9e53b0d2 100644 --- a/.github/workflows/ios-app-store-candidate.yml +++ b/.github/workflows/ios-app-store-candidate.yml @@ -25,7 +25,7 @@ jobs: app_store_build_id: ${{ steps.manifest.outputs.app_store_build_id }} steps: - name: Checkout tagged source - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} fetch-depth: 0 @@ -119,7 +119,7 @@ jobs: APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }} steps: - name: Checkout exact candidate source - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ env.IOS_SOURCE_SHA }} persist-credentials: false diff --git a/.github/workflows/ios-credential-health.yml b/.github/workflows/ios-credential-health.yml index 033bf599..f105ff92 100644 --- a/.github/workflows/ios-credential-health.yml +++ b/.github/workflows/ios-credential-health.yml @@ -44,7 +44,7 @@ jobs: APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }} steps: - name: Checkout repository - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/ios-device-debug.yml b/.github/workflows/ios-device-debug.yml index e96334cb..3fb98152 100644 --- a/.github/workflows/ios-device-debug.yml +++ b/.github/workflows/ios-device-debug.yml @@ -63,7 +63,7 @@ jobs: fi - name: Checkout same-repository history - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -136,7 +136,7 @@ jobs: RESOLVED_SOURCE_SHA: ${{ needs.resolve.outputs.source_sha }} steps: - name: Checkout resolved source - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.resolve.outputs.source_sha }} fetch-depth: 1 @@ -596,7 +596,7 @@ jobs: echo "IOS_DEBUG_ARTIFACT_NAME=$artifact_name" >> "$GITHUB_ENV" - name: Upload device-debug artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.IOS_DEBUG_ARTIFACT_NAME }} path: ${{ env.IOS_DEBUG_ARTIFACT_DIR }} diff --git a/.github/workflows/ios-testflight.yml b/.github/workflows/ios-testflight.yml index ecc8ab2a..ffdfeb9b 100644 --- a/.github/workflows/ios-testflight.yml +++ b/.github/workflows/ios-testflight.yml @@ -41,7 +41,7 @@ jobs: current: ${{ steps.resolve.outputs.current }} steps: - name: Checkout repository history - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -111,7 +111,7 @@ jobs: APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }} steps: - name: Checkout verified source - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ env.IOS_SOURCE_SHA }} fetch-depth: 1 @@ -396,7 +396,7 @@ jobs: (cd "$artifact" && shasum -a 256 -- * > SHA256SUMS) - name: Upload signed IPA - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: truck-wash-ios-${{ env.IOS_SOURCE_SHA }} path: output/ios-release/*.ipa @@ -404,7 +404,7 @@ jobs: retention-days: 30 - name: Upload release manifest, dSYM, and checksums - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ios-release-manifest-${{ env.IOS_SOURCE_SHA }} path: | diff --git a/.github/workflows/mobile-artifacts.yml b/.github/workflows/mobile-artifacts.yml index 825da811..b75e3dbf 100644 --- a/.github/workflows/mobile-artifacts.yml +++ b/.github/workflows/mobile-artifacts.yml @@ -63,7 +63,7 @@ jobs: UPLOAD_ANDROID_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }} steps: - name: Checkout repository - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.sha }} persist-credentials: false @@ -118,14 +118,14 @@ jobs: - name: Setup Java if: steps.release-guard.outputs.current == 'true' - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: temurin java-version: 21 - name: Setup Android SDK if: steps.release-guard.outputs.current == 'true' - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3 + uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 - name: Install Android SDK packages if: steps.release-guard.outputs.current == 'true' @@ -215,7 +215,7 @@ jobs: - name: Upload Android artifact if: steps.release-guard.outputs.current == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.sha }} path: ${{ env.ANDROID_AAB_PATH }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9422a023..6df5d624 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,7 +40,7 @@ jobs: steps: - name: Check release commit is current id: branch-head - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ github.token }} script: | @@ -60,7 +60,7 @@ jobs: - name: Checkout tested commit if: steps.branch-head.outputs.current == 'true' - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -148,7 +148,7 @@ jobs: - name: Upload release package if: steps.branch-head.outputs.current == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ steps.package-names.outputs.artifact_name }} path: | @@ -184,7 +184,7 @@ jobs: RELEASE_POLL_INTERVAL_SECONDS: 5 steps: - name: Checkout tested commit - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -244,7 +244,7 @@ jobs: - name: Check release commit is still current id: branch-head - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: github-token: ${{ github.token }} script: | @@ -370,7 +370,7 @@ jobs: - name: Publish verified frontend release proof if: steps.branch-head.outputs.current == 'true' - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: frontend-release-proof-${{ env.RELEASE_COMMIT_SHA }} path: output/frontend-release-proof/frontend-release-proof.json @@ -380,7 +380,7 @@ jobs: - name: Upload Playwright report if: failure() && steps.branch-head.outputs.current == 'true' continue-on-error: true - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: frontend-release-playwright-${{ env.RELEASE_BUILD_ID }} path: output/playwright diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 6e6053f0..bfecdd6c 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -80,7 +80,7 @@ jobs: fi - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js uses: actions/setup-node@v5 @@ -122,7 +122,7 @@ jobs: fi - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js uses: actions/setup-node@v5 @@ -223,7 +223,7 @@ jobs: fi - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js uses: actions/setup-node@v5 @@ -347,7 +347,7 @@ jobs: - name: Upload Playwright report if: failure() || cancelled() continue-on-error: true - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: playwright-report-targeted-${{ matrix.project }} path: | @@ -399,7 +399,7 @@ jobs: fi - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -565,7 +565,7 @@ jobs: - name: Upload Playwright report if: failure() || cancelled() continue-on-error: true - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: playwright-report-pr-${{ matrix.suite }}-${{ matrix.project }} path: | @@ -659,7 +659,7 @@ jobs: fi - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js uses: actions/setup-node@v5 @@ -784,7 +784,7 @@ jobs: - name: Upload Playwright report if: failure() || cancelled() continue-on-error: true - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: playwright-report-full-${{ matrix.browser }}-${{ matrix.device }}-${{ matrix.role }}-shard-${{ matrix.shard_index }}-of-${{ (matrix.role == 'superuser' || matrix.role == 'admin') && 2 || 1 }} path: | diff --git a/Gemfile b/Gemfile index bef54c3e..f479271b 100644 --- a/Gemfile +++ b/Gemfile @@ -1,4 +1,4 @@ source "https://rubygems.org" ruby ">= 3.2", "< 3.5" -gem "fastlane", "2.229.1" +gem "fastlane", "2.237.0" diff --git a/Gemfile.lock b/Gemfile.lock index 80dc4c6c..baa8c896 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -27,7 +27,8 @@ GEM aws-sigv4 (1.12.1) aws-eventstream (~> 1, >= 1.0.2) babosa (1.0.4) - base64 (0.2.0) + base64 (0.3.0) + benchmark (0.5.0) bigdecimal (4.1.2) claide (1.1.0) colored (1.2) @@ -41,7 +42,8 @@ GEM domain_name (0.6.20240107) dotenv (2.8.1) emoji_regex (3.2.3) - excon (0.112.0) + excon (1.6.0) + logger faraday (1.10.6) faraday-em_http (~> 1.0) faraday-em_synchrony (~> 1.0) @@ -71,41 +73,45 @@ GEM faraday_middleware (1.2.1) faraday (~> 1.0) fastimage (2.4.1) - fastlane (2.229.1) - CFPropertyList (>= 2.3, < 4.0.0) - abbrev (~> 0.1.2) - addressable (>= 2.8, < 3.0.0) + fastlane (2.237.0) + CFPropertyList (>= 2.3, < 5.0.0) + abbrev (~> 0.1) + addressable (>= 2.9.0, < 3.0.0) artifactory (~> 3.0) - aws-sdk-s3 (~> 1.0) + aws-sdk-s3 (~> 1.197) babosa (>= 1.0.3, < 2.0.0) - base64 (~> 0.2.0) - bundler (>= 1.12.0, < 3.0.0) + base64 (~> 0.2) + benchmark (>= 0.1.0) + bundler (>= 2.4.0, < 5.0.0) colored (~> 1.2) commander (~> 4.6) csv (~> 3.3) dotenv (>= 2.1.1, < 3.0.0) emoji_regex (>= 0.1, < 4.0) - excon (>= 0.71.0, < 1.0.0) + excon (>= 0.71.0, < 2.0.0) faraday (~> 1.0) faraday-cookie_jar (~> 0.0.6) faraday_middleware (~> 1.0) fastimage (>= 2.1.0, < 3.0.0) - fastlane-sirp (>= 1.0.0) + fastlane-sirp (>= 1.1.0) gh_inspector (>= 1.1.2, < 2.0.0) google-apis-androidpublisher_v3 (~> 0.3) google-apis-playcustomapp_v1 (~> 0.1) - google-cloud-env (>= 1.6.0, < 2.0.0) + google-cloud-env (>= 1.6.0, < 2.3.0) google-cloud-storage (~> 1.31) highline (~> 2.0) http-cookie (~> 1.0.5) json (< 3.0.0) - jwt (>= 2.1.0, < 3) + jwt (>= 2.10.3, < 4) + logger (>= 1.6, < 2.0) mini_magick (>= 4.9.4, < 5.0.0) + multi_json (~> 1.12) multipart-post (>= 2.0.0, < 3.0.0) - mutex_m (~> 0.3.0) + mutex_m (~> 0.3) naturally (~> 2.2) - nkf (~> 0.2.0) + nkf (~> 0.2) optparse (>= 0.1.1, < 1.0.0) + ostruct (>= 0.1.0) plist (>= 3.1.0, < 4.0.0) rubyzip (>= 2.0.0, < 3.0.0) security (= 0.1.5) @@ -120,41 +126,46 @@ GEM xcpretty-travis-formatter (>= 0.0.3, < 2.0.0) fastlane-sirp (1.1.0) gh_inspector (1.1.3) - google-apis-androidpublisher_v3 (0.54.0) - google-apis-core (>= 0.11.0, < 2.a) - google-apis-core (0.11.3) + google-apis-androidpublisher_v3 (0.105.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-core (0.18.0) addressable (~> 2.5, >= 2.5.1) - googleauth (>= 0.16.2, < 2.a) - httpclient (>= 2.8.1, < 3.a) + googleauth (~> 1.9) + httpclient (>= 2.8.3, < 3.a) mini_mime (~> 1.0) + mutex_m representable (~> 3.0) retriable (>= 2.0, < 4.a) - rexml - google-apis-iamcredentials_v1 (0.17.0) - google-apis-core (>= 0.11.0, < 2.a) - google-apis-playcustomapp_v1 (0.13.0) - google-apis-core (>= 0.11.0, < 2.a) - google-apis-storage_v1 (0.31.0) - google-apis-core (>= 0.11.0, < 2.a) + google-apis-iamcredentials_v1 (0.28.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-playcustomapp_v1 (0.18.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-storage_v1 (0.65.0) + google-apis-core (>= 0.15.0, < 2.a) google-cloud-core (1.9.0) google-cloud-env (>= 1.0, < 3.a) google-cloud-errors (~> 1.0) - google-cloud-env (1.6.0) - faraday (>= 0.17.3, < 3.0) + google-cloud-env (2.2.2) + base64 (~> 0.2) + faraday (>= 1.0, < 3.a) google-cloud-errors (1.7.0) - google-cloud-storage (1.47.0) + google-cloud-storage (1.62.0) addressable (~> 2.8) digest-crc (~> 0.4) - google-apis-iamcredentials_v1 (~> 0.1) - google-apis-storage_v1 (~> 0.31.0) + google-apis-core (>= 0.18, < 2) + google-apis-iamcredentials_v1 (~> 0.18) + google-apis-storage_v1 (>= 0.42) google-cloud-core (~> 1.6) - googleauth (>= 0.16.2, < 2.a) + googleauth (~> 1.9) mini_mime (~> 1.0) - googleauth (1.8.1) - faraday (>= 0.17.3, < 3.a) - jwt (>= 1.4, < 3.0) - multi_json (~> 1.11) + google-logging-utils (0.2.0) + googleauth (1.17.1) + faraday (>= 1.0, < 3.a) + google-cloud-env (~> 2.2) + google-logging-utils (~> 0.1) + jwt (>= 1.4, < 4.0) os (>= 0.9, < 2.0) + pstore (~> 0.1) signet (>= 0.16, < 2.a) highline (2.0.3) http-cookie (1.0.8) @@ -163,7 +174,7 @@ GEM mutex_m jmespath (1.6.2) json (2.21.1) - jwt (2.10.3) + jwt (3.2.0) base64 logger (1.7.0) mini_magick (4.13.2) @@ -173,10 +184,12 @@ GEM mutex_m (0.3.0) nanaimo (0.4.0) naturally (2.3.0) - nkf (0.2.0) + nkf (0.3.0) optparse (0.8.1) os (1.1.4) + ostruct (0.6.3) plist (3.7.2) + pstore (0.2.1) public_suffix (7.0.5) rake (13.4.2) representable (3.2.0) @@ -226,7 +239,7 @@ PLATFORMS x86_64-linux DEPENDENCIES - fastlane (= 2.229.1) + fastlane (= 2.237.0) RUBY VERSION ruby 3.3.12p206