From a94151800eb1f77c9738684dbe52a68c46005850 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonas=20Bj=C3=B6rkert?= Date: Sat, 3 Oct 2026 09:50:36 +0200 Subject: [PATCH 1/3] Update fastlane to 2.240.1 and move workflows off ubuntu-latest and macos-26 The Gemfile pins fastlane 2.240.1, which brings rubyzip and json onto version ranges without open security advisories. Jobs that ran on ubuntu-latest now run on ubuntu-26.04, since the ubuntu-latest label is about to move to Ubuntu 26 and GitHub posts a notice about it on every run. The build job runs on the xcode-27 runner image and selects Xcode 27.0. That image only ships Xcode 27, so the xcode-select path points at Xcode_27.0.app. --- .github/workflows/auto_version_dev.yml | 2 +- .github/workflows/build_LoopFollow.yml | 8 +-- .github/workflows/lint.yml | 2 +- .github/workflows/tag_on_main.yml | 2 +- .github/workflows/validate_secrets.yml | 2 +- .github/workflows/warn_main_pr.yml | 2 +- Gemfile | 2 +- Gemfile.lock | 94 +++++++++++++++----------- 8 files changed, 65 insertions(+), 49 deletions(-) diff --git a/.github/workflows/auto_version_dev.yml b/.github/workflows/auto_version_dev.yml index a2adf3c3d..1ae91da8f 100644 --- a/.github/workflows/auto_version_dev.yml +++ b/.github/workflows/auto_version_dev.yml @@ -36,7 +36,7 @@ on: jobs: bump-version: if: ${{ !github.event.repository.fork }} - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 steps: - name: Checkout repository diff --git a/.github/workflows/build_LoopFollow.yml b/.github/workflows/build_LoopFollow.yml index e6e1a5dda..dfb110d7f 100644 --- a/.github/workflows/build_LoopFollow.yml +++ b/.github/workflows/build_LoopFollow.yml @@ -16,7 +16,7 @@ env: jobs: # use a single runner for these sequential steps check_status: - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 name: Check status to decide whether to build permissions: contents: write @@ -154,7 +154,7 @@ jobs: cancel_when_no_build: needs: check_status name: Cancel run when there is nothing to build - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 permissions: actions: write if: | @@ -189,7 +189,7 @@ jobs: build: name: Build needs: [check_certs, check_status] - runs-on: macos-26 + runs-on: xcode-27 permissions: contents: write if: @@ -199,7 +199,7 @@ jobs: (vars.SCHEDULED_SYNC != 'false' && needs.check_status.outputs.NEW_COMMITS == 'true' ) steps: - name: Select Xcode version - run: "sudo xcode-select --switch /Applications/Xcode_26.2.app/Contents/Developer" + run: "sudo xcode-select --switch /Applications/Xcode_27.0.app/Contents/Developer" - name: Checkout Repo for building uses: actions/checkout@v5 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 9d5005aa1..9da63a7b1 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -22,7 +22,7 @@ jobs: # Run on open/sync/reopen always; on 'edited' only when the base branch # actually changed, so routine title/description edits don't re-lint. if: ${{ github.event.action != 'edited' || github.event.changes.base != null }} - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 container: swift:6.0 steps: - name: Checkout diff --git a/.github/workflows/tag_on_main.yml b/.github/workflows/tag_on_main.yml index 388a2b537..24ab348f1 100644 --- a/.github/workflows/tag_on_main.yml +++ b/.github/workflows/tag_on_main.yml @@ -25,7 +25,7 @@ on: jobs: tag: if: ${{ !github.event.repository.fork }} - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 permissions: contents: write diff --git a/.github/workflows/validate_secrets.yml b/.github/workflows/validate_secrets.yml index 415ba0019..f65523073 100644 --- a/.github/workflows/validate_secrets.yml +++ b/.github/workflows/validate_secrets.yml @@ -5,7 +5,7 @@ on: [workflow_call, workflow_dispatch] jobs: validate-access-token: name: Access - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 env: GH_PAT: ${{ secrets.GH_PAT }} GH_TOKEN: ${{ secrets.GH_PAT }} diff --git a/.github/workflows/warn_main_pr.yml b/.github/workflows/warn_main_pr.yml index 3f918f8f8..867c4ffbb 100644 --- a/.github/workflows/warn_main_pr.yml +++ b/.github/workflows/warn_main_pr.yml @@ -9,7 +9,7 @@ on: jobs: warn: if: ${{ !github.event.repository.fork }} - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 permissions: pull-requests: write diff --git a/Gemfile b/Gemfile index 502d6331b..599db6eab 100644 --- a/Gemfile +++ b/Gemfile @@ -1,2 +1,2 @@ source "https://rubygems.org" -gem "fastlane", "2.237.0" +gem "fastlane", "2.240.1" diff --git a/Gemfile.lock b/Gemfile.lock index 8e70830ea..93511b5ac 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -30,6 +30,7 @@ GEM base64 (0.3.0) benchmark (0.5.0) bigdecimal (4.1.2) + cgi (0.5.2) claide (1.1.0) colored (1.2) colored2 (3.1.2) @@ -42,38 +43,26 @@ GEM domain_name (0.6.20240107) dotenv (2.8.1) emoji_regex (3.2.3) + erb (6.0.7) excon (1.5.0) logger - faraday (1.10.6) - faraday-em_http (~> 1.0) - faraday-em_synchrony (~> 1.0) - faraday-excon (~> 1.1) - faraday-httpclient (~> 1.0) - faraday-multipart (~> 1.0) - faraday-net_http (~> 1.0) - faraday-net_http_persistent (~> 1.0) - faraday-patron (~> 1.0) - faraday-rack (~> 1.0) - faraday-retry (~> 1.0) - ruby2_keywords (>= 0.0.4) + faraday (2.14.4) + faraday-net_http (>= 2.0, < 3.5) + json + logger faraday-cookie_jar (0.0.8) faraday (>= 0.8.0) http-cookie (>= 1.0.0) - faraday-em_http (1.0.0) - faraday-em_synchrony (1.0.1) - faraday-excon (1.1.0) - faraday-httpclient (1.0.1) + faraday-follow_redirects (0.5.0) + faraday (>= 1, < 3) faraday-multipart (1.2.0) multipart-post (~> 2.0) - faraday-net_http (1.0.2) - faraday-net_http_persistent (1.2.0) - faraday-patron (1.0.0) - faraday-rack (1.0.0) - faraday-retry (1.0.4) - faraday_middleware (1.2.1) - faraday (~> 1.0) + faraday-net_http (3.4.4) + net-http (~> 0.5) + faraday-retry (2.4.0) + faraday (~> 2.0) fastimage (2.4.1) - fastlane (2.237.0) + fastlane (2.240.1) CFPropertyList (>= 2.3, < 5.0.0) abbrev (~> 0.1) addressable (>= 2.9.0, < 3.0.0) @@ -83,24 +72,27 @@ GEM base64 (~> 0.2) benchmark (>= 0.1.0) bundler (>= 2.4.0, < 5.0.0) + cgi (~> 0.4) colored (~> 1.2) commander (~> 4.6) csv (~> 3.3) dotenv (>= 2.1.1, < 3.0.0) emoji_regex (>= 0.1, < 4.0) excon (>= 0.71.0, < 2.0.0) - faraday (~> 1.0) - faraday-cookie_jar (~> 0.0.6) - faraday_middleware (~> 1.0) + faraday (~> 2.7) + faraday-cookie_jar (~> 0.0.8) + faraday-follow_redirects (~> 0.3) + faraday-multipart (~> 1.0) + faraday-retry (~> 2.0) fastimage (>= 2.1.0, < 3.0.0) fastlane-sirp (>= 1.1.0) gh_inspector (>= 1.1.2, < 2.0.0) - google-apis-androidpublisher_v3 (~> 0.3) + google-apis-androidpublisher_v3 (~> 0.99) google-apis-playcustomapp_v1 (~> 0.1) - google-cloud-env (>= 1.6.0, < 2.3.0) + google-cloud-env (>= 1.6.0, < 2.4.0) google-cloud-storage (~> 1.31) highline (~> 2.0) - http-cookie (~> 1.0.5) + irb (>= 1.8) json (< 3.0.0) jwt (>= 2.10.3, < 4) logger (>= 1.6, < 2.0) @@ -113,11 +105,11 @@ GEM optparse (>= 0.1.1, < 1.0.0) ostruct (>= 0.1.0) plist (>= 3.1.0, < 4.0.0) - rubyzip (>= 2.0.0, < 3.0.0) - security (= 0.1.5) + rubyzip (>= 3.4.0, < 4.0.0) + security (~> 0.3) simctl (~> 1.6.3) terminal-notifier (>= 2.0.0, < 3.0.0) - terminal-table (~> 3) + terminal-table (~> 4) tty-screen (>= 0.6.3, < 1.0.0) tty-spinner (>= 0.8.0, < 1.0.0) word_wrap (~> 1.0.0) @@ -172,6 +164,12 @@ GEM domain_name (~> 0.5) httpclient (2.9.0) mutex_m + io-console (0.9.4) + irb (1.18.0) + pp (>= 0.6.0) + prism (>= 1.3.0) + rdoc (>= 4.0.0) + reline (>= 0.4.2) jmespath (1.6.2) json (2.20.0) jwt (3.2.0) @@ -184,14 +182,31 @@ GEM mutex_m (0.3.0) nanaimo (0.4.0) naturally (2.3.0) + net-http (0.9.1) + uri (>= 0.11.1) nkf (0.3.0) optparse (0.8.1) os (1.1.4) ostruct (0.6.3) plist (3.7.2) + pp (0.6.4) + prettyprint + prettyprint (0.2.0) + prism (1.9.0) pstore (0.2.1) public_suffix (7.0.5) rake (13.4.2) + rbs (4.2.0) + logger + prism (>= 1.6.0) + tsort + rdoc (8.1.0) + erb + prism (>= 1.6.0) + rbs (>= 4.0.0) + tsort + reline (0.7.0) + io-console (~> 0.5) representable (3.2.0) declarative (< 0.1.0) trailblazer-option (>= 0.1.1, < 0.2.0) @@ -199,9 +214,8 @@ GEM retriable (3.8.0) rexml (3.4.4) rouge (3.28.0) - ruby2_keywords (0.0.5) - rubyzip (2.4.1) - security (0.1.5) + rubyzip (3.7.0) + security (0.3.0) signet (0.22.0) addressable (~> 2.8) faraday (>= 0.17.5, < 3.a) @@ -210,15 +224,17 @@ GEM CFPropertyList naturally terminal-notifier (2.0.0) - terminal-table (3.0.2) - unicode-display_width (>= 1.1.1, < 3) + terminal-table (4.0.0) + unicode-display_width (>= 1.1.1, < 4) trailblazer-option (0.1.2) + tsort (0.2.0) tty-cursor (0.7.1) tty-screen (0.8.2) tty-spinner (0.9.3) tty-cursor (~> 0.7) uber (0.1.0) unicode-display_width (2.6.0) + uri (1.1.1) word_wrap (1.0.0) xcodeproj (1.28.1) CFPropertyList (>= 2.3.3, < 4.0) @@ -239,7 +255,7 @@ PLATFORMS ruby DEPENDENCIES - fastlane (= 2.237.0) + fastlane (= 2.240.1) BUNDLED WITH 4.0.12 From 71b57ee45c2fde202ac1863886f8f0af8431165e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonas=20Bj=C3=B6rkert?= Date: Sat, 3 Oct 2026 09:53:34 +0200 Subject: [PATCH 2/3] Run all macOS jobs on macos-26 The build job stays on Xcode 26.2. The certificate, identifier and secret validation jobs move from macos-15 to macos-26, so every workflow runs on either macos-26 or ubuntu-26.04. --- .github/workflows/add_identifiers.yml | 2 +- .github/workflows/build_LoopFollow.yml | 4 ++-- .github/workflows/create_certs.yml | 4 ++-- .github/workflows/validate_secrets.yml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/add_identifiers.yml b/.github/workflows/add_identifiers.yml index 702e7a91d..a8799a151 100644 --- a/.github/workflows/add_identifiers.yml +++ b/.github/workflows/add_identifiers.yml @@ -12,7 +12,7 @@ jobs: identifiers: name: Add Identifiers needs: validate - runs-on: macos-15 + runs-on: macos-26 steps: # Checks-out the repo - name: Checkout Repo diff --git a/.github/workflows/build_LoopFollow.yml b/.github/workflows/build_LoopFollow.yml index dfb110d7f..d86352bb4 100644 --- a/.github/workflows/build_LoopFollow.yml +++ b/.github/workflows/build_LoopFollow.yml @@ -189,7 +189,7 @@ jobs: build: name: Build needs: [check_certs, check_status] - runs-on: xcode-27 + runs-on: macos-26 permissions: contents: write if: @@ -199,7 +199,7 @@ jobs: (vars.SCHEDULED_SYNC != 'false' && needs.check_status.outputs.NEW_COMMITS == 'true' ) steps: - name: Select Xcode version - run: "sudo xcode-select --switch /Applications/Xcode_27.0.app/Contents/Developer" + run: "sudo xcode-select --switch /Applications/Xcode_26.2.app/Contents/Developer" - name: Checkout Repo for building uses: actions/checkout@v5 diff --git a/.github/workflows/create_certs.yml b/.github/workflows/create_certs.yml index c284e397a..0b5f8115a 100644 --- a/.github/workflows/create_certs.yml +++ b/.github/workflows/create_certs.yml @@ -20,7 +20,7 @@ jobs: create_certs: name: Certificates needs: validate - runs-on: macos-15 + runs-on: macos-26 outputs: new_certificate_needed: ${{ steps.set_output.outputs.new_certificate_needed }} @@ -92,7 +92,7 @@ jobs: nuke_certs: name: Nuke certificates needs: [validate, create_certs] - runs-on: macos-15 + runs-on: macos-26 if: ${{ (needs.create_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }} steps: - name: Output from step id 'check_certs' diff --git a/.github/workflows/validate_secrets.yml b/.github/workflows/validate_secrets.yml index f65523073..38b3b5ebf 100644 --- a/.github/workflows/validate_secrets.yml +++ b/.github/workflows/validate_secrets.yml @@ -105,7 +105,7 @@ jobs: validate-fastlane-secrets: name: Fastlane needs: [validate-access-token] - runs-on: macos-15 + runs-on: macos-26 env: GH_PAT: ${{ secrets.GH_PAT }} GH_TOKEN: ${{ secrets.GH_PAT }} From 8cd3c558211cc5ebb216ba47f94bf86b5076ef26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonas=20Bj=C3=B6rkert?= Date: Sat, 3 Oct 2026 10:25:46 +0200 Subject: [PATCH 3/3] Run all macOS jobs on the xcode-27 runner image The build job selects Xcode 27.0, which is the default on that image. The certificate, identifier and secret validation jobs run on the same image, so every workflow runs on either xcode-27 or ubuntu-26.04. --- .github/workflows/add_identifiers.yml | 2 +- .github/workflows/build_LoopFollow.yml | 4 ++-- .github/workflows/create_certs.yml | 4 ++-- .github/workflows/validate_secrets.yml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/add_identifiers.yml b/.github/workflows/add_identifiers.yml index a8799a151..4ebd4b26a 100644 --- a/.github/workflows/add_identifiers.yml +++ b/.github/workflows/add_identifiers.yml @@ -12,7 +12,7 @@ jobs: identifiers: name: Add Identifiers needs: validate - runs-on: macos-26 + runs-on: xcode-27 steps: # Checks-out the repo - name: Checkout Repo diff --git a/.github/workflows/build_LoopFollow.yml b/.github/workflows/build_LoopFollow.yml index d86352bb4..dfb110d7f 100644 --- a/.github/workflows/build_LoopFollow.yml +++ b/.github/workflows/build_LoopFollow.yml @@ -189,7 +189,7 @@ jobs: build: name: Build needs: [check_certs, check_status] - runs-on: macos-26 + runs-on: xcode-27 permissions: contents: write if: @@ -199,7 +199,7 @@ jobs: (vars.SCHEDULED_SYNC != 'false' && needs.check_status.outputs.NEW_COMMITS == 'true' ) steps: - name: Select Xcode version - run: "sudo xcode-select --switch /Applications/Xcode_26.2.app/Contents/Developer" + run: "sudo xcode-select --switch /Applications/Xcode_27.0.app/Contents/Developer" - name: Checkout Repo for building uses: actions/checkout@v5 diff --git a/.github/workflows/create_certs.yml b/.github/workflows/create_certs.yml index 0b5f8115a..2f8bde21b 100644 --- a/.github/workflows/create_certs.yml +++ b/.github/workflows/create_certs.yml @@ -20,7 +20,7 @@ jobs: create_certs: name: Certificates needs: validate - runs-on: macos-26 + runs-on: xcode-27 outputs: new_certificate_needed: ${{ steps.set_output.outputs.new_certificate_needed }} @@ -92,7 +92,7 @@ jobs: nuke_certs: name: Nuke certificates needs: [validate, create_certs] - runs-on: macos-26 + runs-on: xcode-27 if: ${{ (needs.create_certs.outputs.new_certificate_needed == 'true' && vars.ENABLE_NUKE_CERTS == 'true') || vars.FORCE_NUKE_CERTS == 'true' }} steps: - name: Output from step id 'check_certs' diff --git a/.github/workflows/validate_secrets.yml b/.github/workflows/validate_secrets.yml index 38b3b5ebf..0c87b7d29 100644 --- a/.github/workflows/validate_secrets.yml +++ b/.github/workflows/validate_secrets.yml @@ -105,7 +105,7 @@ jobs: validate-fastlane-secrets: name: Fastlane needs: [validate-access-token] - runs-on: macos-26 + runs-on: xcode-27 env: GH_PAT: ${{ secrets.GH_PAT }} GH_TOKEN: ${{ secrets.GH_PAT }}