Skip to content

Enhance iOS pipeline with Ruby, ccache support, and documentation #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
MusaMisto wants to merge 3 commits into from
Closed

Enhance iOS pipeline with Ruby, ccache support, and documentation #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c0d4864
chore: enhance iOS pipeline with Ruby and ccache support, and documen…
Jun 1, 2026
41d627f
chore: update default value for use-simplify9-xcode-setup to false
Jun 1, 2026
44fba43
chore: update default value for install-react-native-cli to false
Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 98 additions & 25 deletions .github/workflows/generic-ios-testflight.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ on:
description: Install react-native-cli globally
required: false
type: boolean
default: true
default: false
xcode-version:
description: "Optional Xcode major or major.minor selector (for example: 26 or 16.4)"
required: false
Expand All @@ -51,7 +51,7 @@ on:
description: Use simplify9 xcode-setup composite action (pods + selected Xcode)
required: false
type: boolean
default: true
default: false
verify-cocoapods:
description: Run `pod --version` check
required: false
Expand Down Expand Up @@ -214,6 +214,23 @@ on:
type: boolean
default: false

ruby-version:
description: "Ruby version for bundler/CocoaPods setup. Empty disables Ruby setup."
required: false
type: string
default: ""
use-bundler:
description: "If true and ruby-version set, install gems via bundler (requires a Gemfile)."
required: false
type: boolean
default: false

enable-ccache:
description: "Enable ccache for Objective-C/C++ pod compilation (partial speedup; no Swift benefit)."
required: false
type: boolean
default: false

secrets:
ios-p12-base64:
description: Base64 encoded signing certificate (.p12)
Expand Down Expand Up @@ -275,6 +292,41 @@ jobs:
- name: Checkout
uses: actions/checkout@v6

- name: Setup Ruby (optional)
if: ${{ inputs.ruby-version != '' }}
uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ inputs.ruby-version }}
bundler-cache: ${{ inputs.use-bundler }}

- name: Install ccache (optional)
if: ${{ inputs.enable-ccache }}
shell: bash
run: |
set -euo pipefail
if ! command -v ccache >/dev/null 2>&1; then
brew install ccache
fi
ccache --version

- name: Cache ccache directory (optional)
if: ${{ inputs.enable-ccache }}
uses: actions/cache@v5
with:
path: ~/Library/Caches/ccache
key: ccache-ios-${{ runner.os }}-${{ hashFiles(format('{0}/Podfile.lock', inputs.ios-dir)) }}
restore-keys: |
ccache-ios-${{ runner.os }}-

- name: Configure ccache (optional)
if: ${{ inputs.enable-ccache }}
shell: bash
run: |
set -euo pipefail
ccache --max-size=2G
ccache --set-config=compression=true
echo "CCACHE_DIR=$HOME/Library/Caches/ccache" >> "$GITHUB_ENV"

- name: Initialize runtime paths
shell: bash
run: |
Expand Down Expand Up @@ -408,38 +460,58 @@ jobs:
shell: bash
run: npm install -g react-native-cli

# Cache CocoaPods dependencies.
# CocoaPods caching — split into two steps.
#
# Keyed on Podfile.lock (NOT Podfile): the lock file pins exact pod versions and
# source URLs; the Podfile only declares ranges. Key changes whenever `pod update`
# produces a new Podfile.lock commit.
#
# Path verification: the clean-reinstall-pods step does:
# cd "${{ inputs.ios-dir }}" && rm -rf Pods Podfile.lock
# confirming that ios-dir (default: ios) is the correct base path.
# The xcode-setup composite action hardcodes `cd ios` for pod install, so
# ios/Pods always applies when use-simplify9-xcode-setup=true.
#
# Interaction with clean-reinstall-pods: when that input is true, the caller
# explicitly requests pod deintegrate + reinstall. Restoring the pod cache before
# that step would add overhead and be immediately discarded. The condition below
# bypasses the cache entirely when clean-reinstall-pods=true.
# Why two steps?
# ~/.cocoapods/repos (the global spec repository, 1-3 GB) is safe to reuse even
# during a clean reinstall — the clean only removes the project's Pods dir and
# Podfile.lock, not the global spec repo. Caching it always eliminates the dominant
# time cost of `pod install --repo-update`.
#
# Note on ios/Pods vs ~/.cocoapods/repos: when use-simplify9-xcode-setup=true
# (the default), xcode-setup always deletes ios/Pods before reinstalling. The
# ios/Pods portion of this cache has limited value in that path, but
# ~/.cocoapods/repos (the spec repository, 1-3 GB) is always reused and is the
# dominant time saving.
- name: Cache CocoaPods
id: cache-pods
# The project Pods dir (ios/Pods) is only useful when NOT doing a clean reinstall;
# restoring it before pod deintegrate + reinstall adds overhead and is immediately
# discarded, so that cache is bypassed when clean-reinstall-pods=true.
- name: Cache CocoaPods spec repo
id: cache-pods-specs
uses: actions/cache@v5
with:
path: ~/.cocoapods/repos
key: cocoapods-specs-${{ runner.os }}-${{ hashFiles(format('{0}/Podfile.lock', inputs.ios-dir)) }}
restore-keys: |
cocoapods-specs-${{ runner.os }}-

# Project Pods dir cache — only when NOT doing a clean reinstall.
# A clean reinstall deletes ios/Pods, so caching it then is wasted.
- name: Cache CocoaPods Pods directory
id: cache-pods-dir
if: ${{ !inputs.clean-reinstall-pods }}
uses: actions/cache@v5
with:
path: |
${{ inputs.ios-dir }}/Pods
~/.cocoapods/repos
key: pods-${{ runner.os }}-${{ hashFiles(format('{0}/Podfile.lock', inputs.ios-dir)) }}
path: ${{ inputs.ios-dir }}/Pods
key: pods-dir-${{ runner.os }}-${{ hashFiles(format('{0}/Podfile.lock', inputs.ios-dir)) }}
restore-keys: |
pods-${{ runner.os }}-
pods-dir-${{ runner.os }}-

- name: Install CocoaPods (deployment mode)
if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }}
shell: bash
working-directory: ${{ inputs.ios-dir }}
run: |
set -euo pipefail
echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)"
if [[ "${{ inputs.use-bundler }}" == "true" && "${{ inputs.ruby-version }}" != "" ]]; then
echo "→ Running: bundle exec pod install --deployment"
bundle exec pod install --deployment
else
echo "→ Running: pod install --deployment"
pod install --deployment
fi
echo "✅ CocoaPods installed (deployment mode)"
echo "::endgroup::"
Comment on lines +499 to +514

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Avoid expanding workflow inputs directly into this shell script.

Line 506 injects inputs.ruby-version and inputs.use-bundler into bash source before parsing. Because those values come from the caller, a crafted input can break the conditional and execute arbitrary shell in a job that already has signing secrets available.

🔒 Suggested hardening 
       - name: Install CocoaPods (deployment mode)
         if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }}
         shell: bash
         working-directory: ${{ inputs.ios-dir }}
+        env:
+          USE_BUNDLER: ${{ inputs.use-bundler }}
+          RUBY_VERSION_INPUT: ${{ inputs.ruby-version }}
         run: |
           set -euo pipefail
           echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)"
-          if [[ "${{ inputs.use-bundler }}" == "true" && "${{ inputs.ruby-version }}" != "" ]]; then
+          if [[ "${USE_BUNDLER}" == "true" && -n "${RUBY_VERSION_INPUT}" ]]; then
             echo "→ Running: bundle exec pod install --deployment"
             bundle exec pod install --deployment
           else
             echo "→ Running: pod install --deployment"
             pod install --deployment
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Install CocoaPods (deployment mode)
if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }}
shell: bash
working-directory: ${{ inputs.ios-dir }}
run: |
set -euo pipefail
echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)"
if [[ "${{ inputs.use-bundler }}" == "true" && "${{ inputs.ruby-version }}" != "" ]]; then
echo "→ Running: bundle exec pod install --deployment"
bundle exec pod install --deployment
else
echo "→ Running: pod install --deployment"
pod install --deployment
fi
echo "✅ CocoaPods installed (deployment mode)"
echo "::endgroup::"
- name: Install CocoaPods (deployment mode)
if: ${{ !inputs.clean-reinstall-pods && !inputs.use-simplify9-xcode-setup }}
shell: bash
working-directory: ${{ inputs.ios-dir }}
env:
USE_BUNDLER: ${{ inputs.use-bundler }}
RUBY_VERSION_INPUT: ${{ inputs.ruby-version }}
run: |
set -euo pipefail
echo "::group::📦 [IOS] Installing CocoaPods (deployment mode)"
if [[ "${USE_BUNDLER}" == "true" && -n "${RUBY_VERSION_INPUT}" ]]; then
echo "→ Running: bundle exec pod install --deployment"
bundle exec pod install --deployment
else
echo "→ Running: pod install --deployment"
pod install --deployment
fi
echo "✅ CocoaPods installed (deployment mode)"
echo "::endgroup::"
🧰 Tools
🪛 zizmor (1.25.2)

[error] 506-506: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/generic-ios-testflight.yml around lines 499 - 514, The
step "Install CocoaPods (deployment mode)" currently injects inputs directly
into the bash script (inputs.use-bundler and inputs.ruby-version) which can lead
to command injection; instead, stop expanding workflow inputs inline and expose
them as environment variables or move the conditional into the step-level if
expression. Concretely, set env variables (e.g., USE_BUNDLER and RUBY_VERSION)
using GitHub expressions and reference those safe env vars inside the run block,
or use the step-level if (e.g., if: ${{ inputs.use-bundler == 'true' &&
inputs.ruby-version != '' }}) to choose which step to run; update the "Install
CocoaPods (deployment mode)" step to use USE_BUNDLER / RUBY_VERSION rather than
${ { inputs.* } } in the script to eliminate direct input interpolation.


- name: Xcode setup (simplify9 action)
if: ${{ inputs.use-simplify9-xcode-setup }}
Expand Down Expand Up @@ -753,6 +825,7 @@ jobs:
PROVISIONING_PROFILE_SPECIFIER="${{ steps.profile_meta.outputs.profile_name }}" \
OTHER_CODE_SIGN_FLAGS="--keychain ${KEYCHAIN_PATH}" \
COMPILER_INDEX_STORE_ENABLE=NO \
-quiet \
-showBuildTimingSummary
echo "CHECKPOINT_2_STATUS=✅ PASSED" >> "$GITHUB_ENV"
echo "✅ [CHECKPOINT 2/3] Archive created (manual xcodebuild) — PASSED: ${{ inputs.archive-path }}"
Expand Down
78 changes: 78 additions & 0 deletions IOS_OPTIMIZATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
# iOS Pipeline Optimization — Progress Tracker

## Status Legend
- [ ] Not started
- [~] In progress
- [x] Complete

## Phase 1 — Split CocoaPods cache (spec repo always cached)
- [x] Spec repo cache step (`Cache CocoaPods spec repo`, always runs, id: `cache-pods-specs`)
- [x] Pods dir cache step (`Cache CocoaPods Pods directory`, id: `cache-pods-dir`, only when not clean-reinstalling)

## Phase 2 — Ruby/bundler setup
- [x] New inputs: `ruby-version` (string, default `""`) and `use-bundler` (boolean, default `false`)
- [x] `Setup Ruby (optional)` step using `ruby/setup-ruby@v1`, gated on `ruby-version != ''`

## Phase 3 — ccache (optional, opt-in)
- [x] New input: `enable-ccache` (boolean, default `false`)
- [x] Three steps added (all gated on `enable-ccache`):
- `Install ccache (optional)` — installs via Homebrew if not present
- `Cache ccache directory (optional)` — caches `~/Library/Caches/ccache`
- `Configure ccache (optional)` — sets max-size=2G, compression=true, exports `CCACHE_DIR`

## Validation
- [x] `actionlint .github/workflows/generic-ios-testflight.yml` exits 0 with zero errors
- [x] No functional regression for existing callers (all new inputs default to inert values)

---

## Caller Prerequisites (do NOT overlook)

### ccache (`enable-ccache: true`)
Setting `enable-ccache: true` installs and caches ccache on the runner, but **does NOT automatically speed up compilation**. For ccache to intercept Xcode's compiler calls, the caller's **Podfile** must enable it — typically via the React Native post-install hook:

```ruby
react_native_post_install(installer, :ccache_enabled => true)
```

Without this Podfile change, ccache is present but never invoked. Document this requirement in the caller's README or Podfile comments.

### bundler (`use-bundler: true`)
Setting `use-bundler: true` (alongside a non-empty `ruby-version`) causes `ruby/setup-ruby` to run `bundle install` and cache gems. This requires a **Gemfile** (and ideally a `Gemfile.lock`) in the caller repository. The `pod install` commands in this workflow remain unchanged — they do **not** automatically use `bundle exec pod install`. To get a reproducible CocoaPods version from the Gemfile, the caller must either override `install-command` or configure their own pod install path.

Comment on lines +40 to +42

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update this paragraph to match the workflow’s new bundler path.

This says the workflow does not automatically use bundle exec pod install, but Lines 506-508 in .github/workflows/generic-ios-testflight.yml now do exactly that when use-bundler and ruby-version are set. Please align the docs so callers are not configuring around stale behavior.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@IOS_OPTIMIZATION.md` around lines 40 - 42, The paragraph under "bundler
(`use-bundler: true`)" is stale: update it to reflect that when both use-bundler
and ruby-version are set the workflow runs CocoaPods via bundle exec (i.e., uses
`bundle exec pod install`) so the Gemfile/Gemfile.lock can control the CocoaPods
version; remove the statement that pod install remains unchanged and instead
explain that callers will get the bundle-managed pod install and should override
`install-command` only if they want a different behavior or provide their own
pod install path.

---

## Phase 4 — Stop clean reinstalling pods, use deployment mode

### Changes made
- Added `Install CocoaPods (deployment mode)` step to
`generic-ios-testflight.yml` — runs when both
`clean-reinstall-pods=false` AND `use-simplify9-xcode-setup=false`
- Updated mealivery-customer-mobile caller:
`clean-reinstall-pods: false`, `ruby-version: "3.2"`,
`use-bundler: true`

### Expected impact
- Pod setup time: ~2.5 min → ~20-40 seconds on warm cache runs
- Run 1 (cold): populates spec repo cache and pods dir cache
- Run 2+ (warm): spec repo restored from cache,
`bundle exec pod install --deployment` runs in seconds

### How the caching chain now works
1. `Cache CocoaPods spec repo` — restores `~/.cocoapods/repos`
(always, even on clean reinstall paths)
2. `Cache CocoaPods Pods directory` — restores `ios/Pods`
(since clean-reinstall-pods=false)
3. `Setup Ruby (optional)` — installs Ruby 3.2 + caches gems
via bundler (since ruby-version="3.2" and use-bundler=true)
4. `Install CocoaPods (deployment mode)` — runs
`bundle exec pod install --deployment`, reads Podfile.lock,
installs exact pinned versions, fails fast if lock would change

### Note on `--deployment` flag
`pod install --deployment` is the CocoaPods equivalent of
`yarn install --frozen-lockfile`. It guarantees the installed
pods exactly match `Podfile.lock` and will fail the build if
any pod resolution would change the lock file. This is the
correct mode for CI.