From 94a88e308403b51aa6252c1b1d772c00fcb7c17d Mon Sep 17 00:00:00 2001 From: Tomas Psota Date: Wed, 14 Oct 2026 12:31:31 +0200 Subject: [PATCH] ci: verify XCFramework is complete in npm package Every file sealed in TalsecRuntime.xcframework's _CodeSignature must be published, otherwise Xcode fails signature collection when archiving. Dot-files such as .jbroot/libRHProbe.dat are excluded by default and only ship thanks to the negation in .npmignore, so guard it in CI by diffing the npm package file list against the tracked XCFramework files. Ref talsec/Free-RASP-Cordova#77 Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/ci.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6236beb..fe044cd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,6 +56,31 @@ jobs: exit 1 fi + verify-npm-package: + timeout-minutes: 10 + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Setup Node.js + uses: actions/setup-node@v6 + with: + node-version: "24" + + # Every file sealed in the XCFramework's _CodeSignature must ship, + # otherwise Xcode fails signature collection when archiving. + - name: Verify XCFramework is complete in npm package + run: | + git ls-files ios/Plugin/TalsecRuntime.xcframework | sort > "$RUNNER_TEMP/expected.txt" + npm pack --dry-run --json --ignore-scripts \ + | node -e 'const [p] = JSON.parse(require("fs").readFileSync(0)); p.files.forEach(f => console.log(f.path))' \ + | grep '^ios/Plugin/TalsecRuntime.xcframework/' | sort > "$RUNNER_TEMP/packed.txt" + if ! diff "$RUNNER_TEMP/expected.txt" "$RUNNER_TEMP/packed.txt"; then + echo "::error::npm package does not contain the complete TalsecRuntime.xcframework. Check .npmignore." + exit 1 + fi + build-android: name: Build Android Example runs-on: ubuntu-latest