Patch rubyzip CVE, repair CI Ruby, and rewrite the README

.github/workflows/app-store-preflight.yml

@@ -63,9 +63,9 @@ jobs:
           fetch-depth: 0
 
       - name: Ruby + Fastlane (cached)
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.4"
           bundler-cache: true
 
       - name: Validate release guards before App Store access

.github/workflows/ios-testflight.yml

@@ -57,9 +57,9 @@ jobs:
         run: node scripts/verify-edge-function-contracts.mjs
 
       - name: Ruby + Fastlane (cached)
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.4"
           bundler-cache: true
 
       - name: Run Lore unit tests
@@ -158,9 +158,9 @@ jobs:
         run: xcodegen generate
 
       - name: Ruby + Fastlane (cached)
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.4"
           bundler-cache: true
 
       - name: Build and upload the validated commit to TestFlight

.github/workflows/release-tooling-tests.yml

@@ -18,9 +18,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Ruby
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.4"
 
       - name: Run offline release-tooling tests
         run: ruby fastlane/spec/lore_release_tooling_test.rb

.github/workflows/screenshots-upload.yml

@@ -39,9 +39,9 @@ jobs:
           fetch-depth: 0
 
       - name: Ruby + Fastlane (cached)
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.4"
           bundler-cache: true
 
       - name: Upload screenshots to App Store Connect

.github/workflows/screenshots.yml

@@ -42,9 +42,9 @@ jobs:
         run: xcrun simctl list devices available | grep -Ei "iphone|ipad" || true
 
       - name: Ruby + Fastlane (cached)
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
+        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1
         with:
-          ruby-version: "3.2"
+          ruby-version: "3.4"
           bundler-cache: true
 
       - name: Capture screenshots

.gitignore

@@ -27,3 +27,24 @@ fastlane/*.p8
 tools/narration/.venv/
 tools/narration/models/
 tools/narration/out/
+
+# Signing material and local credentials. Release signing comes only from
+# fastlane match and GitHub Actions secrets; none of these belong in the repo.
+*.p12
+*.cer
+*.certSigningRequest
+*.mobileprovision
+*.provisionprofile
+.env
+.env.*
+!.env.example
+
+# Local tool state
+*.xcresult
+.build/
+.swiftpm/
+.bundle/
+vendor/bundle/
+node_modules/
+supabase/.temp/
+supabase/.branches/

CI-SETUP.md

@@ -6,7 +6,8 @@ Expo/EAS is not part of this release lane.
 
 ## What publishes
 
-- A push to `main` or a pull request runs the unit-test gate only.
+- A push to `main` or a pull request runs validation only: unit tests, an
+  unsigned Release compile, and the StoreKit purchase journeys.
 - TestFlight upload requires an explicit **Run workflow** action with
   `upload_to_testflight` enabled.
 - The upload job tests the exact checkout before it archives, signs, and uploads.
@@ -86,6 +87,7 @@ assets into a throwaway CI keychain, archives Release, and uploads the IPA.
 - **No signing profile:** verify both app identifiers exist and the API key has
   sufficient Apple access; Match must create/fetch profiles for both targets.
 - **Duplicate build number:** rerun the workflow. The lane queries the latest
-  build for marketing version `1.0` and increments it.
+  TestFlight build for the marketing version in `project.yml` and uses one
+  above it, never below the project's `CURRENT_PROJECT_VERSION` floor.
 - **Upload passed but build is absent:** allow Apple processing time, then inspect
   App Store Connect processing errors and the workflow build logs.

Gemfile

@@ -1,3 +1,3 @@
 source "https://rubygems.org"
 
-gem "fastlane", "2.239.0"
+gem "fastlane", "2.240.1"