chore: sync plus with upstream main (conflicts) #55
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| name: Close old issues that need reply | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: "0 0 * * *" | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Close old issues that need reply | ||
| uses: imhoffd/needs-reply@v2 | ||
| with: | ||
| repo-token: ${{ secrets.BOT_TOKEN }} | ||
| issue-label: 'needs reply' | ||
| days-before-close: 7 | ||
| close-message: | | ||
| It looks like this issue didn't get the information it needed, so I'll close it for now. If I made a mistake, sorry! I am just a bot. | ||
|
|
||
| Have a great day! | ||
| Ionitron 💙 | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,30 @@ | ||||||||||||||||||
| name: Publish Native iOS Library | ||||||||||||||||||
|
|
||||||||||||||||||
| on: | ||||||||||||||||||
| workflow_call: | ||||||||||||||||||
| secrets: | ||||||||||||||||||
| COCOAPODS_TRUNK_TOKEN: | ||||||||||||||||||
| required: true | ||||||||||||||||||
| workflow_dispatch: | ||||||||||||||||||
|
|
||||||||||||||||||
| jobs: | ||||||||||||||||||
| publish-ios: | ||||||||||||||||||
| runs-on: macos-15 | ||||||||||||||||||
| timeout-minutes: 30 | ||||||||||||||||||
| steps: | ||||||||||||||||||
| - run: sudo xcode-select --switch /Applications/Xcode_26.0.app | ||||||||||||||||||
| - run: xcrun simctl list > /dev/null | ||||||||||||||||||
| - run: xcodebuild -downloadPlatform iOS | ||||||||||||||||||
| - uses: actions/setup-node@v6 | ||||||||||||||||||
| with: | ||||||||||||||||||
| node-version: 22.x | ||||||||||||||||||
| - uses: actions/checkout@v5 | ||||||||||||||||||
| with: | ||||||||||||||||||
| fetch-depth: 0 | ||||||||||||||||||
| ref: 'main' | ||||||||||||||||||
|
Comment on lines
+21
to
+24
There was a problem hiding this comment. Do not hard-code checkout to Line [24] forces publishing from Proposed fix - uses: actions/checkout@v5
with:
fetch-depth: 0
- ref: 'main'
+ ref: ${{ github.sha }}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||
| - name: Install Cocoapods | ||||||||||||||||||
| run: gem install cocoapods | ||||||||||||||||||
| - name: Deploy to Cocoapods | ||||||||||||||||||
| run: sh ./scripts/native-podspec.sh publish | ||||||||||||||||||
| env: | ||||||||||||||||||
| COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }} | ||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
What commit SHA is currently referenced by thev2tag ofimhoffd/needs-reply, and what does GitHub’s official guidance recommend for pinning third-party GitHub Actions?💡 Result:
The v2 tag of imhoffd/needs-reply currently points to commit SHA unknown, as no sources explicitly state the full SHA. The repository has a latest release v2.0.0 from 2020-12-30, and the tag is used as imhoffd/needs-reply@v2 in workflows, likely resolving to the v2.0.0 tag commit since last push was 2024 but releases are old. GitHub's official guidance recommends pinning third-party GitHub Actions to a full-length commit SHA (e.g., owner/action@<40-char-sha>) rather than tags or branches. This is the only immutable way to use an action securely, preventing supply chain attacks where tags can be moved to malicious commits. Verify the SHA is from the original repository, not a fork. Tags are acceptable only if you fully trust the creator (e.g., verified creator badge), but SHA pinning is preferred. Use the repository's tag page to find the SHA for a tag.
Citations:
Harden third-party action usage before merge.
Line 12 uses a mutable tag (
@v2). Pin to a commit SHA instead, as GitHub's official guidance recommends—this is the only immutable way to prevent supply chain attacks. Line 14 passes a custom PAT secret into a third-party action; replace withgithub.tokenwith explicit permissions defined at the workflow level.Suggested hardening diff
name: Close old issues that need reply on: schedule: - cron: "0 0 * * *" +permissions: + issues: write + contents: read + jobs: build: runs-on: ubuntu-latest steps: - name: Close old issues that need reply - uses: imhoffd/needs-reply@v2 + uses: imhoffd/needs-reply@<pinned-commit-sha> with: - repo-token: ${{ secrets.BOT_TOKEN }} + repo-token: ${{ github.token }} issue-label: 'needs reply' days-before-close: 7🤖 Prompt for AI Agents