From ff40140d456dc0696c768d5e716f2fb5f30e1c76 Mon Sep 17 00:00:00 2001 From: Tomas Psota Date: Wed, 14 Oct 2026 12:31:36 +0200 Subject: [PATCH] ci: verify XCFramework is complete in npm package Every file sealed in TalsecRuntime.xcframework's _CodeSignature must be published, otherwise Xcode fails signature collection when archiving. Dot-files such as .jbroot/libRHProbe.dat are excluded by default and only ship thanks to the negation in .npmignore, so guard it in CI by diffing the npm package file list against the tracked XCFramework files. Ref talsec/Free-RASP-Cordova#77 Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/ci.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c2329d8..48e1956 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,6 +47,30 @@ jobs: - name: Build package run: yarn prepack + verify-npm-package: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Setup Node.js + uses: actions/setup-node@v6 + with: + node-version: "24" + + # Every file sealed in the XCFramework's _CodeSignature must ship, + # otherwise Xcode fails signature collection when archiving. + - name: Verify XCFramework is complete in npm package + run: | + git ls-files ios/TalsecRuntime.xcframework | sort > "$RUNNER_TEMP/expected.txt" + npm pack --dry-run --json --ignore-scripts \ + | node -e 'const [p] = JSON.parse(require("fs").readFileSync(0)); p.files.forEach(f => console.log(f.path))' \ + | grep '^ios/TalsecRuntime.xcframework/' | sort > "$RUNNER_TEMP/packed.txt" + if ! diff "$RUNNER_TEMP/expected.txt" "$RUNNER_TEMP/packed.txt"; then + echo "::error::npm package does not contain the complete TalsecRuntime.xcframework. Check .npmignore." + exit 1 + fi + build-android: runs-on: ubuntu-latest needs: build-library