Enhance iOS pipeline with Ruby, ccache support, and documentation#74
Closed
MusaMisto wants to merge 3 commits into
Closed
Enhance iOS pipeline with Ruby, ccache support, and documentation#74MusaMisto wants to merge 3 commits into
MusaMisto wants to merge 3 commits into
Conversation
📝 WalkthroughWalkthroughThe iOS TestFlight workflow receives optional toolchain support for Ruby/Bundler and ccache compilation caching. Workflow input defaults disable react-native-cli and simplify9 setup by default. CocoaPods dependency caching is refactored into separate spec repo and project Pods caches, and pod installation switches to deployment mode with optional bundler integration. Documentation describes the optimization pipeline and caller requirements. ChangesiOS CI Optimization Pipeline
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/generic-ios-testflight.yml (1)
40-54:⚠️ Potential issue | 🟠 Major | ⚡ Quick winThese default flips are a breaking API change for existing callers.
Changing
install-react-native-clianduse-simplify9-xcode-setupfromtruetofalsealters behavior for any caller that relied on the previous defaults, so this is not backward-compatible. Keep the old defaults or ship this behind a versioned workflow/update callers explicitly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/generic-ios-testflight.yml around lines 40 - 54, The change flips the default values of the workflow inputs install-react-native-cli and use-simplify9-xcode-setup from true to false which is a breaking API change; to fix this, restore their defaults to the previous values (set install-react-native-cli: default: true and use-simplify9-xcode-setup: default: true) in the workflow inputs, or alternatively implement a versioned workflow or new input flag so existing callers keep the original behavior; refer to the input keys install-react-native-cli and use-simplify9-xcode-setup to locate and update the defaults.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/generic-ios-testflight.yml:
- Around line 499-514: The step "Install CocoaPods (deployment mode)" currently
injects inputs directly into the bash script (inputs.use-bundler and
inputs.ruby-version) which can lead to command injection; instead, stop
expanding workflow inputs inline and expose them as environment variables or
move the conditional into the step-level if expression. Concretely, set env
variables (e.g., USE_BUNDLER and RUBY_VERSION) using GitHub expressions and
reference those safe env vars inside the run block, or use the step-level if
(e.g., if: ${{ inputs.use-bundler == 'true' && inputs.ruby-version != '' }}) to
choose which step to run; update the "Install CocoaPods (deployment mode)" step
to use USE_BUNDLER / RUBY_VERSION rather than ${ { inputs.* } } in the script to
eliminate direct input interpolation.
In `@IOS_OPTIMIZATION.md`:
- Around line 40-42: The paragraph under "bundler (`use-bundler: true`)" is
stale: update it to reflect that when both use-bundler and ruby-version are set
the workflow runs CocoaPods via bundle exec (i.e., uses `bundle exec pod
install`) so the Gemfile/Gemfile.lock can control the CocoaPods version; remove
the statement that pod install remains unchanged and instead explain that
callers will get the bundle-managed pod install and should override
`install-command` only if they want a different behavior or provide their own
pod install path.
---
Outside diff comments:
In @.github/workflows/generic-ios-testflight.yml:
- Around line 40-54: The change flips the default values of the workflow inputs
install-react-native-cli and use-simplify9-xcode-setup from true to false which
is a breaking API change; to fix this, restore their defaults to the previous
values (set install-react-native-cli: default: true and
use-simplify9-xcode-setup: default: true) in the workflow inputs, or
alternatively implement a versioned workflow or new input flag so existing
callers keep the original behavior; refer to the input keys
install-react-native-cli and use-simplify9-xcode-setup to locate and update the
defaults.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0cfdd4d3-6810-4e38-92de-2223eea8b88d
📒 Files selected for processing (2)
.github/workflows/generic-ios-testflight.ymlIOS_OPTIMIZATION.md
Comment on lines
+499
to
+514
| - name: Install CocoaPods (deployment mode) | ||
| if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }} | ||
| shell: bash | ||
| working-directory: ${{ inputs.ios-dir }} | ||
| run: | | ||
| set -euo pipefail | ||
| echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)" | ||
| if [[ "${{ inputs.use-bundler }}" == "true" && "${{ inputs.ruby-version }}" != "" ]]; then | ||
| echo "→ Running: bundle exec pod install --deployment" | ||
| bundle exec pod install --deployment | ||
| else | ||
| echo "→ Running: pod install --deployment" | ||
| pod install --deployment | ||
| fi | ||
| echo "✅ CocoaPods installed (deployment mode)" | ||
| echo "::endgroup::" |
There was a problem hiding this comment.
Avoid expanding workflow inputs directly into this shell script.
Line 506 injects inputs.ruby-version and inputs.use-bundler into bash source before parsing. Because those values come from the caller, a crafted input can break the conditional and execute arbitrary shell in a job that already has signing secrets available.
🔒 Suggested hardening
- name: Install CocoaPods (deployment mode)
if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }}
shell: bash
working-directory: ${{ inputs.ios-dir }}
+ env:
+ USE_BUNDLER: ${{ inputs.use-bundler }}
+ RUBY_VERSION_INPUT: ${{ inputs.ruby-version }}
run: |
set -euo pipefail
echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)"
- if [[ "${{ inputs.use-bundler }}" == "true" && "${{ inputs.ruby-version }}" != "" ]]; then
+ if [[ "${USE_BUNDLER}" == "true" && -n "${RUBY_VERSION_INPUT}" ]]; then
echo "→ Running: bundle exec pod install --deployment"
bundle exec pod install --deployment
else
echo "→ Running: pod install --deployment"
pod install --deployment📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - name: Install CocoaPods (deployment mode) | |
| if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }} | |
| shell: bash | |
| working-directory: ${{ inputs.ios-dir }} | |
| run: | | |
| set -euo pipefail | |
| echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)" | |
| if [[ "${{ inputs.use-bundler }}" == "true" && "${{ inputs.ruby-version }}" != "" ]]; then | |
| echo "→ Running: bundle exec pod install --deployment" | |
| bundle exec pod install --deployment | |
| else | |
| echo "→ Running: pod install --deployment" | |
| pod install --deployment | |
| fi | |
| echo "✅ CocoaPods installed (deployment mode)" | |
| echo "::endgroup::" | |
| - name: Install CocoaPods (deployment mode) | |
| if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }} | |
| shell: bash | |
| working-directory: ${{ inputs.ios-dir }} | |
| env: | |
| USE_BUNDLER: ${{ inputs.use-bundler }} | |
| RUBY_VERSION_INPUT: ${{ inputs.ruby-version }} | |
| run: | | |
| set -euo pipefail | |
| echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)" | |
| if [[ "${USE_BUNDLER}" == "true" && -n "${RUBY_VERSION_INPUT}" ]]; then | |
| echo "→ Running: bundle exec pod install --deployment" | |
| bundle exec pod install --deployment | |
| else | |
| echo "→ Running: pod install --deployment" | |
| pod install --deployment | |
| fi | |
| echo "✅ CocoaPods installed (deployment mode)" | |
| echo "::endgroup::" |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 506-506: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/generic-ios-testflight.yml around lines 499 - 514, The
step "Install CocoaPods (deployment mode)" currently injects inputs directly
into the bash script (inputs.use-bundler and inputs.ruby-version) which can lead
to command injection; instead, stop expanding workflow inputs inline and expose
them as environment variables or move the conditional into the step-level if
expression. Concretely, set env variables (e.g., USE_BUNDLER and RUBY_VERSION)
using GitHub expressions and reference those safe env vars inside the run block,
or use the step-level if (e.g., if: ${{ inputs.use-bundler == 'true' &&
inputs.ruby-version != '' }}) to choose which step to run; update the "Install
CocoaPods (deployment mode)" step to use USE_BUNDLER / RUBY_VERSION rather than
${ { inputs.* } } in the script to eliminate direct input interpolation.
Comment on lines
+40
to
+42
| ### bundler (`use-bundler: true`) | ||
| Setting `use-bundler: true` (alongside a non-empty `ruby-version`) causes `ruby/setup-ruby` to run `bundle install` and cache gems. This requires a **Gemfile** (and ideally a `Gemfile.lock`) in the caller repository. The `pod install` commands in this workflow remain unchanged — they do **not** automatically use `bundle exec pod install`. To get a reproducible CocoaPods version from the Gemfile, the caller must either override `install-command` or configure their own pod install path. | ||
|
|
There was a problem hiding this comment.
Update this paragraph to match the workflow’s new bundler path.
This says the workflow does not automatically use bundle exec pod install, but Lines 506-508 in .github/workflows/generic-ios-testflight.yml now do exactly that when use-bundler and ruby-version are set. Please align the docs so callers are not configuring around stale behavior.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@IOS_OPTIMIZATION.md` around lines 40 - 42, The paragraph under "bundler
(`use-bundler: true`)" is stale: update it to reflect that when both use-bundler
and ruby-version are set the workflow runs CocoaPods via bundle exec (i.e., uses
`bundle exec pod install`) so the Gemfile/Gemfile.lock can control the CocoaPods
version; remove the statement that pod install remains unchanged and instead
explain that callers will get the bundle-managed pod install and should override
`install-command` only if they want a different behavior or provide their own
pod install path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request makes significant improvements to the
generic-ios-testflight.ymlGitHub Actions workflow for iOS CI/CD, focusing on faster, more reliable builds through enhanced caching, optional Ruby and Bundler setup, and opt-in compiler caching with ccache. It also documents the optimization phases and requirements in a newIOS_OPTIMIZATION.mdfile. These changes are backward-compatible, with all new features defaulting to off.Key improvements:
Caching and build performance enhancements:
~/.cocoapods/repos), and cache the project Pods directory (ios/Pods) only when not doing a clean reinstall, reducing redundant downloads and speeding up builds.enable-ccacheinput. [1] [2]Ruby and Bundler integration:
ruby-versionanduse-bundler, and a conditional step to set up Ruby and Bundler for reproducible CocoaPods installs, supporting workflows that require specific Ruby environments or Gemfile-based dependency management. [1] [2]CocoaPods install improvements:
pod install --deployment(optionally via Bundler) when not using the composite xcode-setup action and not doing a clean reinstall, ensuring CI installs exactly match the lockfile for reliability and speed.Default behavior changes:
install-react-native-clianduse-simplify9-xcode-setupinputs fromtruetofalseto give callers more explicit control over these steps. [1] [2]Documentation:
IOS_OPTIMIZATION.md, documenting the optimization phases, new inputs, caching logic, and caller prerequisites for enabling ccache and Bundler.These changes collectively reduce CI build times, make dependency management more robust, and provide opt-in performance optimizations for advanced users.
Summary by CodeRabbit
New Features
Documentation