chore: CI simulator bump and project housekeeping#866
Conversation
Bumps the CI iOS simulator to iPhone 17, ignores Swift Package Manager build caches (.build/, .swiftpm/), picks up Flutter-generated xcscheme debug settings, and applies minor example_app cleanup. Extracted from the passkeys PR (#858) as unrelated maintenance.
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughThe PR updates the CI workflow to target iPhone 17 for iOS simulator tests and adds Swift Package Manager build cache directories ( ChangesBuild & CI Setup Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ping # Conflicts: # auth0_flutter/example/lib/example_app.dart
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Around line 28-29: The workflow’s active actions/checkout steps are still
persisting GITHUB_TOKEN in git config; update every checkout invocation in
main.yml to include the same with.persist-credentials: false setting. Apply this
consistently to each checkout step referenced by the workflow so the existing
checkout jobs no longer leave credentials available for later repo commands or
artifact uploads.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 3e0e7662-56e8-4bbb-9607-4be24471e1f9
📒 Files selected for processing (1)
.github/workflows/main.yml
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Around line 28-29: The workflow’s active actions/checkout steps are still
persisting GITHUB_TOKEN in git config; update every checkout invocation in
main.yml to include the same with.persist-credentials: false setting. Apply this
consistently to each checkout step referenced by the workflow so the existing
checkout jobs no longer leave credentials available for later repo commands or
artifact uploads.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 3e0e7662-56e8-4bbb-9607-4be24471e1f9
📒 Files selected for processing (1)
.github/workflows/main.yml
🛑 Comments failed to post (1)
.github/workflows/main.yml (1)
28-29: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable credential persistence on every checkout step.
These checkouts keep
GITHUB_TOKENin the local git config for the rest of each job. Since the same jobs later run repo-controlled commands and/or upload artifacts, that unnecessarily widens token exposure.Suggested fix
- name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + with: + persist-credentials: falseApply the same
with.persist-credentials: falseblock to every activeactions/checkoutstep in this workflow.Also applies to: 51-52, 82-83, 101-102, 135-136, 213-214, 278-279, 316-317, 525-526
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 28-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/main.yml around lines 28 - 29, The workflow’s active actions/checkout steps are still persisting GITHUB_TOKEN in git config; update every checkout invocation in main.yml to include the same with.persist-credentials: false setting. Apply this consistently to each checkout step referenced by the workflow so the existing checkout jobs no longer leave credentials available for later repo commands or artifact uploads.Source: Linters/SAST tools
4 participants
Summary
Extracts unrelated maintenance from the passkeys PR (#858).
iPhone 16→iPhone 17(.github/workflows/main.yml).build/and.swiftpm/(ios/macos/darwin.gitignore)example_app.dartcleanup (RegExpliteral + SSO idToken display)Context
These changes were bundled into #858 (passkeys) but are independent, low-risk maintenance unrelated to the passkeys feature.
Test plan
Summary by CodeRabbit