Repository navigation
Patch rubyzip CVE, repair CI Ruby, and rewrite the README - #50
Merged
Merged
Conversation
Ruby 3.2 reached end of life in March 2026, and the current fastlane dependency tree no longer installs on it: excon 1.7.1 and rbs 4.2.0 require Ruby >= 3.3. That is exactly why Dependabot's fastlane 2.240.0 PR failed CI at "Ruby + Fastlane (cached)". Move every workflow to Ruby 3.4 so the security upgrade in the next commit can install and run. Only the interpreter version changes. Triggers, environments, secrets and the manual TestFlight/App Store gates are untouched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves Dependabot alert #2 (GHSA-47m2-wp7j-p9vc / CVE-2026-85396, high): rubyzip < 3.4.0 can write outside the extraction directory. fastlane 2.239.0 pinned rubyzip < 3.0, which is why Dependabot's own rubyzip security update could not resolve. fastlane 2.240.1 moves to rubyzip >= 3.4, so the lockfile now resolves rubyzip 3.7.0. The Gemfile and Gemfile.lock are identical to Dependabot PR #49, so merging this lets Dependabot close #49 as applied. Verified locally that the locked bundle installs, loads fastlane 2.240.1 with rubyzip 3.7.0, and lists every lane. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The offline release-tooling suite read the Fastfile, a workflow file and release notes with the process default encoding. Under a non-UTF-8 locale (LANG=C, as in many minimal shells) 24 of 41 tests errored with "invalid byte sequence in US-ASCII" because those files contain non-ASCII punctuation. Pass encoding: "UTF-8" explicitly, matching the description read that already did. The suite now passes 41/41 under both C and en_US.UTF-8. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A full-history secret scan found nothing committed, but the ignore list only covered .p8 keys. Add the other Apple signing formats (.p12, .cer, CSRs, provisioning profiles), .env files (keeping .env.example trackable), xcresult bundles and local Ruby/Node/SwiftPM/Supabase CLI state so none of them can be committed by accident. No tracked file matches the new patterns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The README links CI-SETUP.md and TESTFLIGHT.md as the operator docs, so they need to match the workflows that exist today: - PR and main runs also compile Release and run the StoreKit journeys, not only the unit tests. - Build numbers follow the project.yml marketing version and floor, not marketing version 1.0. - The screenshot upload guard compares SOURCE_SHA with the release_source_sha input and requires ancestry; it does not refuse every existing set or require SOURCE_SHA to equal the checkout. - Drop references to one machine's toolchain and to absolute paths on a private laptop; point submission at the Preflight / Submit workflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The old README undersold the project ("tested native build through a
manual TestFlight lane") and carried claims that no longer matched the
code. The rewrite is built from what the repository and public records
show:
- Status: version 1.2 is live on the App Store (iTunes lookup, released
2026-09-05); build 48 was uploaded by the manual TestFlight lane from
261d633. A dynamic shields.io badge reads the live store version.
- Screenshots from the committed promo set, with provenance linked.
- Architecture: app layers, the on-device geospatial pipeline
(LocationHeadingProvider, BearingProjector, ScannerRanking, Vision,
ARKit geo coverage), and the Supabase boundary (hand-written REST
client, RLS-scoped user rows, Edge Functions, private photo bucket,
quarantined functions directory).
- Privacy: when-in-use location only, no coordinates sent to Lore's
servers, visits store a place ID, one-frame opt-in image match with
per-use confirmation, no tracking SDKs.
- Build/test commands that were run locally, the 236-test suite, and a
CI/release table taken from each workflow's triggers.
- License stated plainly as source-available, all rights reserved.
Removed: the claim that MapLibre is part of the shipped stack (it is
linked behind a disabled flag), the statement that image matching is not
a scanner control (it ships as an opt-in Lore+ action), and the Actions
status badges, whose links 404 while Actions is disabled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security fix, CI toolchain repair and a rewritten README. No Swift source, bundle IDs, signing, provisioning, secrets or repository settings change.
Changes
984c0c8in all five workflows) so it can close as applied.excon 1.7.1,rbs 4.2.0). That is why Dependabot's fastlane 2.240.0 PR failed at "Ruby + Fastlane (cached)" on 2026-09-18. Onlyruby-versionchanges.rubyzip < 3.0, so Dependabot's own rubyzip update could not resolve. The lockfile now resolves rubyzip 3.7.0.Gemfile/Gemfile.lockare byte-identical to Dependabot #49.LANG=C). Explicitencoding: "UTF-8"makes the suite locale-independent..p12,.cer, CSRs, provisioning profiles,.env*(keeps.env.example),*.xcresultand local Ruby/Node/SwiftPM/Supabase CLI state. No tracked file matches.CI-SETUP.mdandTESTFLIGHT.mddescribed marketing version 1.0, a unit-test-only PR gate, a screenshot guard that no longer exists, and absolute paths on a private laptop.261d633), screenshots, features, architecture (app layers, on-device geospatial pipeline, Supabase boundary), privacy and location handling, verified build/test commands, the CI/release pipeline and the license status. Removes claims the code no longer supports (MapLibre as the shipped map, image matching as "not a scanner control") and the Actions badges, whose links 404 while Actions is disabled.Dependabot PRs
main.Verification (all local; Actions is disabled)
Xcode 27.0 (27A266a), dedicated simulators created for this run.
xcodegen generate: OKnode scripts/verify-edge-function-contracts.mjs: OKLore, iPhone 17 Pro iOS 26.5: 236/236 passedLore, iPhone 18 Pro iOS 27.0: 236/236 passedrun_tests(scan) with the locked bundle: 236 tests, 0 failuresCODE_SIGNING_ALLOWED=NO): BUILD SUCCEEDED; replayed the workflow's version/device-family Info.plist checks: passed (1.2 / 48, app and widget agree, iPhone + iPad, iPad landscape)ruby fastlane/spec/lore_release_tooling_test.rb: 41 runs, 0 failures, under bothLANG=Canden_US.UTF-8bundle installwithBUNDLE_FROZEN=trueresolves the lockfile; fastlane 2.240.1 loads rubyzip 3.7.0 and lists all 11 lanes (local Ruby is 4.0.6; CI will use 3.4)plutil -linton both privacy manifests: OKLoreStoreKitTests. StoreKitTest refused to activate its local engine on iOS 26.5 and hung on the first purchase on iOS 27.0 under Xcode 27. No app code changes in this PR; the job last passed in CI on Xcode 26.3 (2026-09-18).gitleaksover all 298 commits on every branch plus a pattern scan for Apple/Supabase/GitHub/AWS/Google/Stripe/private-key formats. Two hits, both non-secrets: a prose false positive in an old README, and the Supabase anon (publishable) JWT inConfig.swift. No.p8,.p12, provisioning profile,.envor service-role key has ever been committed.Workflows this PR runs (from each
on:block)ios-testflight.yml(pull_request):validateandstorekit-journeysonly.release-testflightrequiresworkflow_dispatchwithupload_to_testflight, so it is skipped.release-tooling-tests.yml(pull_request): offline Minitest only.app-store-preflight.yml,screenshots.yml,screenshots-upload.yml:workflow_dispatchonly, so none of them run.Merging to
maintriggers the same two validation workflows (push: main). Nothing in this PR uploads to TestFlight or touches App Store Connect. (While Actions is disabled, nothing runs at all.)Notes for the owner
testflightandapp-store-productionenvironments have no protection rules, and the five release secrets are repository-level. Moving them into a protected environment with a required reviewer and amain-only branch policy would make the manual gates enforceable rather than procedural.not-configured.🤖 Generated with Claude Code