Skip to content

♻️ :: (#343) Fastlane 적용 #385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leejh08 merged 22 commits into from
Jan 1, 2026
Merged

♻️ :: (#343) Fastlane 적용 #385

Changes from 2 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
6467f8b
♻️ :: (#343) test ci
leejh08 Dec 30, 2025
50dbede
♻️ :: (#343) xcode cloud log
leejh08 Dec 30, 2025
10d6b13
♻️ :: (#343) ci post clone 파일 제거
leejh08 Dec 30, 2025
62d00b1
♻️ :: (#343) CI, CD 추가
leejh08 Dec 30, 2025
26f1e0a
♻️ :: (#343) ci 수정
leejh08 Dec 30, 2025
65bc384
♻️ :: (#343) tuist ci error
leejh08 Dec 30, 2025
62cb540
♻️ :: (#343) ci mac os version error
leejh08 Dec 30, 2025
0d22b53
♻️ :: (#343) tuist install -> fetch
leejh08 Dec 30, 2025
907690b
♻️ :: (#343) fastlane 경로 수정
leejh08 Dec 30, 2025
f3e2118
♻️ :: (#343) fastfile 절대경로 설정
leejh08 Dec 30, 2025
7502b01
♻️ :: (#343) Simulator destination
leejh08 Dec 30, 2025
58afbf4
♻️ :: (#343) SDK 방식으로 빌드 수정
leejh08 Dec 30, 2025
22ab67d
♻️ :: (#343) iOS 시뮬 설치
leejh08 Dec 30, 2025
0a71a02
♻️ :: (#343) Ci 테스트 제거
leejh08 Dec 30, 2025
26ff490
♻️ :: (#343) 단계 최소화
leejh08 Dec 30, 2025
f5ee08c
♻️ :: (#343) Tuist build 사용
leejh08 Dec 30, 2025
d550ce9
♻️ :: (#343) tuist 프로젝트 경로 이동
leejh08 Dec 30, 2025
ab8b736
♻️ :: (#343) 프로비저닝 세팅
leejh08 Jan 1, 2026
cd308bd
♻️ :: Move fastlane to private submodule for security
leejh08 Jan 1, 2026
dce9ed4
🔧 :: Update fastlane submodule (remove unnecessary files)
leejh08 Jan 1, 2026
7275db6
🔧 :: Update fastlane submodule (remove report.xml)
leejh08 Jan 1, 2026
5fd6605
🔧 :: Setup GitHub Actions workflows for CI/CD
leejh08 Jan 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 79 additions & 10 deletions ci_scripts/ci_post_clone.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,91 @@
#!/bin/sh
cd ../
#!/bin/bash

# Exit on error
set -e

# Enable debug output
set -x

# Store the original project directory
PROJECT_DIR="$(pwd)"
echo "Project directory: $PROJECT_DIR"
echo "Directory contents:"
ls -la

# Move to parent directory
cd ..

# Clone XCConfig repository
echo "Cloning JOBIS-v2-XCConfig..."
if [ -d "JOBIS-v2-XCConfig" ]; then
echo "JOBIS-v2-XCConfig already exists, removing..."
rm -rf JOBIS-v2-XCConfig
fi
git clone https://github.com/Team-return/JOBIS-v2-XCConfig.git
mv JOBIS-v2-XCConfig/XCConfig/ .
echo "Moving XCConfig to project root..."
cp -R JOBIS-v2-XCConfig/XCConfig/ "$PROJECT_DIR/"
rm -rf JOBIS-v2-XCConfig
Copy link

@coderabbitai coderabbitai bot Dec 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

cat -n ci_scripts/ci_post_clone.sh

Repository: Team-return/JOBIS-DSM-iOS-v2

Length of output: 3074

git clone 실패 시나리오에 대한 명시적 오류 처리 추가 필요

set -e가 있어 스크립트는 git clone 실패 시 종료되지만, 실패 원인을 명확히 파악하기 위해 명시적 오류 처리를 추가하는 것이 좋습니다. 24번 줄과 35번 줄의 두 git clone 명령 모두 동일한 문제가 있습니다:

-git clone https://github.com/Team-return/JOBIS-v2-XCConfig.git
+if ! git clone https://github.com/Team-return/JOBIS-v2-XCConfig.git; then
+    echo "❌ Failed to clone JOBIS-v2-XCConfig repository"
+    exit 1
+fi

JOBIS-GoogleInfo 클론도 같은 방식으로 처리하면 오류 발생 시 더 명확한 피드백을 제공할 수 있습니다.

🤖 Prompt for AI Agents 
In ci_scripts/ci_post_clone.sh around lines 18 to 27, the git clone call lacks
explicit error handling and should report a clear failure reason; modify both
git clone invocations (the one here and the other around line ~35 for
JOBIS-GoogleInfo) to check the clone command's exit status and, on failure,
print a descriptive error message including the repo URL and exit code or git
error output, then exit with a non-zero status so CI logs show the cause;
implement this by capturing the clone result (or using a conditional/||
handler), echoing the failure with context, and exiting immediately.


# Clone GoogleInfo repository
echo "Cloning JOBIS-GoogleInfo..."
if [ -d "JOBIS-GoogleInfo" ]; then
echo "JOBIS-GoogleInfo already exists, removing..."
rm -rf JOBIS-GoogleInfo
fi
git clone https://github.com/Team-return/JOBIS-GoogleInfo.git
mv JOBIS-GoogleInfo/FireBase/ Projects/App/Resources/

brew install make
echo "Moving FireBase config to project..."
mkdir -p "$PROJECT_DIR/Projects/App/Resources"
cp -R JOBIS-GoogleInfo/FireBase/ "$PROJECT_DIR/Projects/App/Resources/"
rm -rf JOBIS-GoogleInfo

curl https://mise.jdx.dev/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
eval "$(mise activate bash --shims)"
# Install make if not already installed
if ! command -v make &> /dev/null; then
echo "Installing make..."
brew install make
else
echo "make is already installed"
fi
Copy link

@coderabbitai coderabbitai bot Dec 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's read the ci_post_clone.sh file to see the full context
cat -n ci_scripts/ci_post_clone.sh

Repository: Team-return/JOBIS-DSM-iOS-v2

Length of output: 3074

🏁 Script executed:

# Check if there's any documentation or README that explains the CI environment
find . -type f \( -name "README*" -o -name "*.md" \) -path "*ci*" | head -20

Repository: Team-return/JOBIS-DSM-iOS-v2

Length of output: 54

🌐 Web query:

Xcode Cloud default environment tools pre-installed Homebrew

💡 Result:

Short answer: Apple does not document Homebrew as part of Xcode Cloud’s guaranteed preinstalled toolset. You should assume Homebrew is not reliably available by default and install/use it from your workflow scripts (note: Apple has reported occasional Homebrew install/update issues on certain macOS beta images). [1][2]

Sources:

  • Xcode Cloud release notes (Homebrew install/update known issue on macOS Tahoe beta; preinstalled tools are listed when Apple announces them, e.g., CocoaPods for specific Xcode beta images). [1]
  • Community guidance: Homebrew relies on Xcode Command Line Tools and is normally installed by CI scripts when needed (so CI users commonly install Homebrew in build scripts rather than rely on it being preinstalled). [2]

Homebrew 가용성에 대한 잘못된 가정

brew install make는 Homebrew가 이미 설치되어 있다고 가정하지만, Xcode Cloud의 기본 환경에서는 Homebrew가 보장되지 않습니다. Tuist 설치(49-57줄)와 달리 make 설치는 brew 실패 시 대체 방안이 없어서 스크립트가 실패할 수 있습니다. set -e(4줄)로 인해 brew가 없으면 즉시 스크립트가 종료됩니다. 오류 처리 또는 대체 메커니즘(예: curl을 통한 바이너리 다운로드)을 추가해야 합니다.


mise install [email protected]
# Install tuist via Homebrew
echo "Installing tuist..."
if ! command -v tuist &> /dev/null; then
echo "Tuist not found, installing via curl..."
curl -Ls https://install.tuist.io | bash
export PATH="$HOME/.tuist/bin:$PATH"
else
echo "Tuist is already installed"
fi
Copy link

@coderabbitai coderabbitai bot Dec 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

Tuist installation official documentation recommended method

💡 Result:

Tuist's official recommended installation method is to use Mise (a version manager) — with Homebrew offered as an alternative. See the Tuist install guide and the announcement about migrating from tuistenv to Mise. [1][2]

Sources:
[1] Tuist — Install Tuist (official docs).
[2] Tuist blog — deprecating tuistenv in favor of Mise.

🌐 Web query:

Tuist checksum verification installation security

💡 Result:

Short answer — Tuist provides a small set of integrity/authenticity checks for installs (and guidance to avoid unsafe install patterns):

  • Official install methods: Mise or Homebrew (recommended). Use those rather than random curl | bash. [1]
  • Verify installed binaries: Tuist publishes a verify script that checks the macOS code‑signing team ID (U6LC622NKF). Running curl -fsSL "https://docs.tuist.dev/verify.sh" | bash will check the certificate team of the installed binary. [1]
  • Security guidance: Tuist has a public security page (vulnerability reporting, SOC 2 mention) and blog posts that (a) describe signing/notarization for macOS CLIs and (b) explicitly recommend not piping unreviewed curl output into bash — instead include verification scripts in your repo or inspect them before running. [3][4][2]

Recommended practical steps

  • Install via Mise or Homebrew. Verify versions with those tools. [1]
  • After install, run the official verify script (or download/review it first) to confirm the team ID is U6LC622NKF. Don’t blindly pipe if you can’t inspect the script. [1][2]
  • Prefer reproducible tooling in CI (Mise) so you don’t rely on ad‑hoc remote scripts. [1][4]
  • If you need stronger guarantees, build from source and verify commits/tags, or ask Tuist for signed checksums/releases and verification guidance via their security contact. [3]

Sources
[1] Tuist install docs (verify.sh / install methods).
[2] Tuist blog — avoid piping curl|bash; include verification scripts in repo (install/security guidance).
[3] Tuist security page (reporting, policies, SOC2).
[4] Tuist blog on signing macOS CLIs (team ID / notarization details).

🌐 Web query:

Tuist Homebrew installation available

💡 Result:

Yes — Tuist is available via Homebrew.

Install (recommended formulas):

  • brew tap tuist/tuist. [1]
  • brew install --formula tuist
  • or install a specific major/minor: brew install --formula [email protected]. [1][2]

Cask option:

  • brew install --cask tuist. [3]

(Official install docs show the Homebrew commands and the official Homebrew formula repo.) [1][2][3]

보안 취약점: 미검증 원격 스크립트 설치 - Tuist 공식 권장사항 미준수

53번 줄의 curl -Ls https://install.tuist.io | bash 패턴은 Tuist 공식 문서에서 명시적으로 권장하지 않는 방식입니다. Tuist의 보안 페이지와 블로그에서 검증되지 않은 curl | bash 패턴을 파이프하지 말 것을 명확히 권고합니다.

권장 해결책 (우선순위 순서):

  1. Mise를 통한 설치 (Tuist 공식 권장):
# mise를 먼저 설치한 후
mise use tuist
  1. Homebrew를 통한 설치 (더 간단):
brew tap tuist/tuist
brew install tuist
  1. 설치 후 검증 (필요시):
    Tuist의 공식 검증 스크립트를 사용하여 macOS 코드 서명 확인:
curl -fsSL "https://docs.tuist.dev/verify.sh" | bash

(검증 스크립트는 팀 ID U6LC622NKF 확인)

현재 방식은 중간자(MITM) 공격에 취약하며, CI 환경에서는 특히 위험합니다. Mise 또는 Homebrew 방식으로 변경하세요.

🤖 Prompt for AI Agents 
ci_scripts/ci_post_clone.sh around lines 49-57: the script uses an unverified
"curl -Ls https://install.tuist.io | bash" pattern which is disallowed per Tuist
security guidance; replace this with a secure installation flow: prefer using
mise (run "mise use tuist" via the project's/tooling manager) or install via
Homebrew by tapping tuist/tuist then brew install tuist, and after installation
ensure PATH is updated; if you must run a remote script, fetch it first over
TLS, verify integrity/signature, then execute locally and run the official Tuist
verification step (the verify.sh) to confirm the macOS code signing/team ID
rather than piping curl directly to bash.


# Verify tuist installation
echo "Tuist version:"
tuist version

# Install specific tuist version if needed
REQUIRED_VERSION="3.40.0"
CURRENT_VERSION=$(tuist version 2>&1 | grep -o '[0-9]*\.[0-9]*\.[0-9]*' | head -1)
echo "Current tuist version: $CURRENT_VERSION"
echo "Required tuist version: $REQUIRED_VERSION"

if [ "$CURRENT_VERSION" != "$REQUIRED_VERSION" ]; then
echo "Installing tuist $REQUIRED_VERSION..."
tuist install $REQUIRED_VERSION
export PATH="$HOME/.tuist/bin:$PATH"
fi
Copy link

@coderabbitai coderabbitai bot Dec 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

cat -n ci_scripts/ci_post_clone.sh | head -80

Repository: Team-return/JOBIS-DSM-iOS-v2

Length of output: 2784

🌐 Web query:

tuist install command documentation tuist CLI

💡 Result:

Summary — tuist install (CLI)

  • Purpose: Installs remote project content (e.g., Swift Package Manager dependencies) required to work with a Tuist project. (docs.tuist.dev)
  • Basic usage:
    • tuist install
    • tuist install --path (or -p) — install for a subdirectory; env var TUIST_INSTALL_PATH. (docs.tuist.dev)
    • tuist install --update (or -u) / --no-update — update behavior; env var TUIST_INSTALL_UPDATE. (docs.tuist.dev)
    • tuist install [passthrough-arguments] — args forwarded to underlying swift package invocation; env var TUIST_INSTALL_PASSTHROUGH_ARGUMENTS. (docs.tuist.dev)
    • tuist install -h / --help — show help. (docs.tuist.dev)
  • Important note: In some Tuist versions/contexts the CLI also uses an "install" subcommand to install a Tuist binary (version argument), and there have been reported conflicts/behavior changes (see issue discussion). If a command behaves like "tuist install " or reports different options, check your Tuist version and the docs for that version. (github.com)

Documentation source: Tuist CLI install docs. (docs.tuist.dev)

Would you like the exact command examples copied from the docs or a link to the specific page for your Tuist version?

Citations:

🏁 Script executed:

# Check if tuist documentation or man pages exist locally
find . -type f -name "*tuist*" | grep -E "(doc|README|INSTALL|help)" | head -20

Repository: Team-return/JOBIS-DSM-iOS-v2

Length of output: 54

🏁 Script executed:

# Search for any references to tuist install or version in the repository
rg -A 3 "tuist\s+(install|version)" --type sh

Repository: Team-return/JOBIS-DSM-iOS-v2

Length of output: 1018

tuist 버전 관리 방식이 잘못되었습니다

라인 71의 tuist install $REQUIRED_VERSION 명령은 올바르지 않습니다. 공식 문서에 따르면 tuist install은 프로젝트 의존성(Swift Package Manager)을 설치하는 명령이며, tuist 자체의 버전을 관리하는 표준 방법이 아닙니다. 이 명령에 버전 인자를 사용하면 예상과 다르게 동작하거나 실패할 수 있습니다.

추가로:

  1. 버전 비교 로직 개선: 라인 69의 문자열 비교(!=)는 의미적 버전 비교를 지원하지 않아 3.40.0과 3.40.00을 다른 버전으로 인식할 수 있습니다.
  2. PATH 중복 내보내기: 라인 54에서 이미 PATH를 설정했는데 라인 72에서 다시 내보내는 것은 불필요합니다.

권장사항:

  • 라인 49-57의 curl 설치 스크립트에서 특정 버전을 지정하거나, Homebrew를 통한 버전 고정 방식으로 변경하세요. 버전 확인 후 버전이 맞지 않으면 재설치하되, 표준 설치 방법(curl/Homebrew)을 사용하세요.
  • 라인 65의 grep 패턴이 출력 형식 변경에 취약하므로, 더 견고한 방식으로 버전을 추출하세요.


# Navigate back to project directory
echo "Returning to project directory: $PROJECT_DIR"
cd "$PROJECT_DIR"

# Reset project
echo "Running make reset..."
make reset

# Fetch dependencies
echo "Fetching tuist dependencies..."
tuist fetch

# Generate project
echo "Generating Xcode project..."
TUIST_CI=1 tuist generate

echo "ci_post_clone.sh completed successfully!"