fastlane-plugin-pharen 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e730459c397f4e9585f12a2c687f6216c8fb2c1679c5a45a5e85e8649b1398a
-  data.tar.gz: 465ba4d2a4551dd462333f6e70d8e1e361d6642aafcb67d0505b84f7cb7f9e54
+  metadata.gz: dadecec8055f7967c935f9a8679dfd48f489f848f7ad7477bff1e1d6b87a4158
+  data.tar.gz: 4b0a0db3a15232e961f545a7264b94c89bc329c8ea25db487c0f575cffd93323
 SHA512:
-  metadata.gz: e6a0a84cfaa13a65a383e60cfe3cc0d55bc4996e66053fac349f7c5eb98fc4634dbde73395d8a1c417e994fde64b7e050e0fbf59870431f9a3767afe218c0eec
-  data.tar.gz: ba90879161e346e4b626a198de1824851a129407411bd03bd597b405847d337b37553393a30078fb6f67a5de50fd70f698ad28cc05a669906dc6e7ae9a0b960b
+  metadata.gz: b818317f1e4a81ea82160b707888e66db4ff15ae6f5882710112c4699460dee62e18d4b229916b37d307d6c56bf5b1f7434981fb6637b3c19ecffca157593042
+  data.tar.gz: b04d8bfc3b3e651938c00b5ad1dd4f0ddc9006de0f8b78f713b3f16c445d7af3c6f4b4f9a0fd93fed1da1614bbf4727db0cb7a95d9efd324bfaf3062e7046251

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to `fastlane-plugin-pharen` are documented here.
 
+## 0.3.0
+
+- Requires `@pharen-ai/cli` 0.4.0 or later. The plugin requests JSON explicitly and
+  works with CLI releases that print readable text by default.
+
 ## 0.2.0
 
 - **Requires `@pharen-ai/cli` 0.1.0 or later** (`npm install -g @pharen-ai/cli`). The
@@ -13,14 +18,27 @@ All notable changes to `fastlane-plugin-pharen` are documented here.
   `strict: false` (or `PHAREN_STRICT=false`) to warn and continue as 0.1.0 did. A build
   shipped without its symbols produces crashes that stay unreadable until they arrive,
   which a warning in a long lane log too easily hides.
+- **In strict mode, `pharen_release` checks its dSYMs before it registers the release.**
+  When none are found, a dSYM path does not exist, or a zip holds no `.dSYM`, the lane
+  fails before anything is sent; with `strict: true`, 0.1.0 registered the release first and
+  then failed at the symbols step, leaving a release with no build. A dSYM the CLI or the
+  server rejects at upload still fails the lane after the release is registered. With `strict: false` it warns and uploads the build, as before.
 - **`PHAREN_STRICT` takes `true` or `false`** (also `yes`/`no`, `on`/`off`, each in
   lowercase or all caps). Any other value, `1`, `0` and an empty one included, now fails
   the lane instead of being read as `true`; unset it to take the default.
 - **`pharen_release`'s closing line says what happened** — release registered or not,
   symbols uploaded or not — rather than claiming all three steps after one was skipped.
+- **GitLab CI signs in once per command.** A GitLab ID token signs in once, so a job
+  declares `PHAREN_ID_TOKEN_1`, `_2`, ... in its `id_tokens:` block, one per `pharen`
+  command, and the plugin hands each command the next in that command's own environment.
+  The plugin takes the tokens out of the process environment when fastlane loads it, so no
+  other action or build step inherits one, a lone `PHAREN_ID_TOKEN` included. `pharen_release`
+  (three commands, two with no dSYMs and `strict: false`) checks the count before it runs anything and fails the lane when the job is short
+  or declares a single `PHAREN_ID_TOKEN`. An exported `PHAREN_AUTH_TOKEN` turns this off.
 - **Credentials are the CLI's.** The CLI uses `PHAREN_AUTH_TOKEN` when it is exported, a
   CI job's own identity once its pipeline is bound, or the session `pharen auth login`
-  stored; the plugin still never reads, prints, or passes any of them.
+  stored; the plugin never reads, prints, or passes any of them, beyond handing a GitLab
+  job's ID tokens on one per command.
 
 ## 0.1.0 — initial release
 

data/README.md

@@ -5,6 +5,10 @@ Ship an iOS build to Pharen from your Fastfile. One action, `pharen_release`, ru
 uploads the build, and returns an OTA install link — with nothing to configure in the
 lane.
 
+[Continue with organization approval](https://console.pharen.ai/setup/application) to move beyond evaluation.
+Approved organizations can use test and live keys and upload matching dSYMs for readable
+crash stacks. Your paid plan determines which features and usage limits apply.
+
 The plugin is a thin wrapper over the `pharen` CLI. Authentication, `.pharen.yml`
 resolution, debug-id parsing, and server-side dedupe all live in the CLI; the plugin only
 derives what the CLI needs from the lane context and the built artifacts. It adds no
@@ -18,7 +22,7 @@ fastlane add_plugin pharen
 
 Once per repository, you also need:
 
-- the `pharen` CLI on `PATH` — `npm install -g @pharen-ai/cli` (or point
+- the `pharen` CLI (0.4.0 or later) on `PATH` — `npm install -g @pharen-ai/cli` (or point
   `pharen_binary:` / `PHAREN_BINARY` at it),
 - a committed `.pharen.yml` at the repo root (`org:` and `app:` — no secrets),
 - a credential the CLI can use — see [Configuration](#configuration).
@@ -38,6 +42,17 @@ from git. It registers the release, uploads every dSYM the archive produced, upl
 build, prints the OTA install link, and returns it (also available in
 `lane_context[SharedValues::PHAREN_INSTALL_URL]`).
 
+`pharen_release` is for tester builds: it always uploads the build for an install link. In
+a TestFlight or App Store lane, upload the symbols before the build leaves:
+
+```ruby
+lane :release do
+  build_app(scheme: "MyApp", export_method: "app-store")
+  pharen_upload_symbols
+  upload_to_testflight
+end
+```
+
 ## Actions
 
 ### `pharen_release`
@@ -94,10 +109,42 @@ Two things live outside the lane:
 - **A credential** — the CLI finds its own, in this order: `PHAREN_AUTH_TOKEN` when it is
   exported (a CI secret), then a CI job's own identity once an organization owner has
   bound that pipeline (no secret at all), then the session `pharen auth login` stored on
-  your machine. The plugin never reads, prints, or passes a credential, so none lands in a
-  log line or a process argument list. The [CLI reference](https://www.pharen.ai/docs/cli)
+  your machine. The plugin never prints a credential or puts one in a process argument
+  list, and passes none on except a GitLab job's ID tokens, one per command (below). The [CLI reference](https://www.pharen.ai/docs/cli)
   covers each.
 
+### GitLab CI
+
+On GitHub Actions, each `pharen` command asks GitHub for a fresh ID token, so a bound job
+needs nothing more. A GitLab ID token signs in once, and `pharen_release` runs three `pharen`
+commands, so a GitLab job declares one token per command and the plugin hands each command
+the next:
+
+```yaml
+beta:
+  id_tokens:
+    PHAREN_ID_TOKEN_1: { aud: 'https://api.pharen.ai' }
+    PHAREN_ID_TOKEN_2: { aud: 'https://api.pharen.ai' }
+    PHAREN_ID_TOKEN_3: { aud: 'https://api.pharen.ai' }
+  script:
+    - bundle exec fastlane beta
+```
+
+- **Count every action.** `pharen_release` spends three tokens (two when there are no dSYMs
+  to upload, or none could be prepared, and `strict` is false); `pharen_upload_build` and `pharen_upload_symbols` spend
+  one each. A job that runs a single one-command action may declare one `PHAREN_ID_TOKEN`
+  instead.
+- **The tokens stay out of the lane.** The plugin reads them when fastlane loads it and
+  takes them out of the environment, a lone `PHAREN_ID_TOKEN` included, so no other action
+  or build step inherits one. Each
+  command gets its token in its own environment, and none is printed.
+- **A short job fails up front.** `pharen_release` counts its tokens before it runs
+  anything, and fails the lane when the job holds too few or declares a single
+  `PHAREN_ID_TOKEN` instead, rather than registering the release and then being refused at
+  the upload. With `strict: false` it warns and skips all three steps.
+- **`PHAREN_AUTH_TOKEN` wins.** When it is exported, the CLI uses it and the tokens go
+  unspent.
+
 ## Failure posture
 
 The default is **strict**: if a step errors, the lane fails. A build that ships without
@@ -113,7 +160,9 @@ the lane rather than being guessed at. Unset it to take the default.
 Two things hold regardless of mode:
 
 - **Missing dSYMs are never quiet.** A build shipped without its symbols produces
-  crashes that stay unreadable until the symbols arrive. Uploading them later
+  crashes that stay unreadable until the symbols arrive. In strict mode, when no dSYM is
+  found, a dSYM path does not exist, or a zip holds no `.dSYM`, `pharen_release` stops
+  before it registers or uploads anything. Uploading them later
   re-symbolicates and re-groups recent crashes, at most the last seven days of them;
   older ones may stay as they first grouped. Archive with `DEBUG_INFORMATION_FORMAT=dwarf-with-dsym`
   so the dSYMs exist to upload with the build.

data/lib/fastlane/plugin/pharen/actions/pharen_release_action.rb

@@ -47,6 +47,47 @@ module Fastlane
           return nil
         end
 
+        dsym_inputs = params[:dsym_paths]
+        if dsym_inputs.nil? || Array(dsym_inputs).empty?
+          candidates = []
+          candidates << Actions.lane_context[SharedValues::DSYM_OUTPUT_PATH]
+          candidates.concat(Array(Actions.lane_context[SharedValues::DSYM_PATHS]))
+          dsym_inputs = candidates.compact.uniq
+        end
+
+        # The dSYMs are found and prepared before anything runs, so that in strict mode a
+        # lane with none, or with one that cannot be read, stops before the release is
+        # registered rather than leaving a release with no build. With strict: false the
+        # problem is a loud warning at the symbols step, and the build still uploads.
+        dsyms = nil
+        dsym_problem = nil
+        if Array(dsym_inputs).empty?
+          dsym_problem =
+            "pharen_release: no dSYMs in the lane context — crashes from this build " \
+            "stay unreadable until its dSYMs are uploaded. Archive with " \
+            "DEBUG_INFORMATION_FORMAT=dwarf-with-dsym, or pass dsym_paths:"
+        else
+          begin
+            dsyms = helper.expand_dsym_inputs(dsym_inputs)
+          rescue Helper::PharenHelper::Failure => e
+            dsym_problem = "pharen_release: #{e.message}"
+          end
+        end
+        if dsym_problem && params[:strict]
+          helper.fail_or_warn(params[:strict], dsym_problem)
+          return nil
+        end
+
+        # A GitLab job needs one ID token per command, counted before the first one runs:
+        # a job short of tokens would otherwise register the release and then be refused
+        # at the upload.
+        commands = dsyms ? 3 : 2
+        shortfall = helper.id_token_shortfall("pharen_release", commands)
+        if shortfall
+          helper.fail_or_warn(params[:strict], shortfall)
+          return nil
+        end
+
         # -- step 1: register the release (idempotent server-side; commit = provenance)
         release_args = ["releases", "create", "--platform", "ios", "--version", info[:version], "--build", info[:build]]
         sha = helper.git_commit_sha
@@ -62,33 +103,16 @@ module Fastlane
 
         # -- step 2: symbols (every dSYM the lane produced) ---------------------------
         symbols_ok = false
-        dsym_inputs = params[:dsym_paths]
-        if dsym_inputs.nil? || Array(dsym_inputs).empty?
-          candidates = []
-          candidates << Actions.lane_context[SharedValues::DSYM_OUTPUT_PATH]
-          candidates.concat(Array(Actions.lane_context[SharedValues::DSYM_PATHS]))
-          dsym_inputs = candidates.compact.uniq
-        end
-        if Array(dsym_inputs).empty?
-          helper.fail_or_warn(
-            params[:strict],
-            "pharen_release: no dSYMs in the lane context — crashes from this build " \
-              "stay unreadable until its dSYMs are uploaded. Archive with " \
-              "DEBUG_INFORMATION_FORMAT=dwarf-with-dsym, or pass dsym_paths:"
-          )
+        if dsym_problem
+          helper.fail_or_warn(params[:strict], dsym_problem)
         else
-          begin
-            dsyms = helper.expand_dsym_inputs(dsym_inputs)
-            symbols = helper.run_pharen(params[:pharen_binary], ["symbols", "upload", *dsyms])
-            if symbols[:ok]
-              symbols_ok = true
-              summary = symbols[:json].is_a?(Hash) ? symbols[:json]["summary"] : nil
-              UI.success("pharen_release: symbols — #{summary || "uploaded #{dsyms.length} dSYM(s)"}")
-            else
-              helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen symbols upload", symbols))
-            end
-          rescue Helper::PharenHelper::Failure => e
-            helper.fail_or_warn(params[:strict], "pharen_release: #{e.message}")
+          symbols = helper.run_pharen(params[:pharen_binary], ["symbols", "upload", *dsyms])
+          if symbols[:ok]
+            symbols_ok = true
+            summary = symbols[:json].is_a?(Hash) ? symbols[:json]["summary"] : nil
+            UI.success("pharen_release: symbols — #{summary || "uploaded #{dsyms.length} dSYM(s)"}")
+          else
+            helper.fail_or_warn(params[:strict], helper.cli_failure_message("pharen symbols upload", symbols))
           end
         end
 

data/lib/fastlane/plugin/pharen/helper/pharen_helper.rb

@@ -11,7 +11,12 @@
 #
 # SECURITY: the CLI resolves its own credential — the session `pharen auth login` stored, a
 # CI job's identity, or PHAREN_AUTH_TOKEN from the environment. This helper never reads,
-# prints, or passes one, so no command line ever contains it.
+# prints, or passes one, so no command line ever contains it. The one thing it hands on is
+# a GitLab job's ID tokens (PHAREN_ID_TOKEN_1, _2, ...): a GitLab ID token signs in once,
+# and a lane runs several pharen commands, so each command is given the next token in its
+# own environment only. The tokens are read when the plugin loads and taken out of the
+# process environment, so no other action or build step can spend one first, and none is
+# ever printed.
 
 require "fastlane_core/ui/ui"
 require "json"
@@ -33,6 +38,9 @@ module Fastlane
       # frameworks) never match.
       INFO_PLIST_ENTRY = %r{\APayload/[^/]+\.app/Info\.plist\z}
 
+      # A GitLab job's numbered ID tokens, one per pharen command (see SECURITY above).
+      ID_TOKEN_ENV = /\APHAREN_ID_TOKEN_(\d+)\z/
+
       class << self
         # -- IPA introspection ---------------------------------------------------------
 
@@ -97,17 +105,81 @@ module Fastlane
           found
         end
 
+        # -- GitLab ID tokens ------------------------------------------------------------
+
+        # Reads PHAREN_ID_TOKEN_1, _2, ... once, in numeric order, and removes every one of
+        # them from the process environment, so actions and build steps that run later
+        # inherit none. A job that declares a single PHAREN_ID_TOKEN instead holds a pool of
+        # one, taken out the same way: it signs in one command. Called when the plugin loads;
+        # later calls return the same pool.
+        def load_id_tokens
+          return if @id_tokens
+
+          names = ENV.keys.grep(ID_TOKEN_ENV).sort_by { |name| name[ID_TOKEN_ENV, 1].to_i }
+          @id_tokens = names.map { |name| ENV.delete(name) }.reject { |value| value.to_s.empty? }
+          @id_tokens_spent = 0
+          lone = ENV.delete("PHAREN_ID_TOKEN")
+          @lone_id_token = @id_tokens.empty? && !lone.to_s.empty?
+          @id_tokens = [lone] if @lone_id_token
+        end
+
+        # Forgets the loaded tokens so the next load_id_tokens reads the environment again.
+        def reset_id_tokens
+          @id_tokens = nil
+          @id_tokens_spent = 0
+          @lone_id_token = false
+        end
+
+        # True when each pharen command signs in with its own GitLab ID token. An exported
+        # PHAREN_AUTH_TOKEN turns this off: the CLI prefers it over a CI identity.
+        def per_command_id_tokens?
+          load_id_tokens
+          return false if @id_tokens_spent.zero? && @id_tokens.empty?
+          ENV["PHAREN_AUTH_TOKEN"].to_s.empty?
+        end
+
+        # Checks, before an action runs anything, that a GitLab job holds a token for each
+        # of the `count` pharen commands it is about to run. Returns nil when it does, or
+        # when the job is not signing in with GitLab ID tokens; otherwise the message to
+        # refuse with.
+        def id_token_shortfall(action, count)
+          return nil unless per_command_id_tokens?
+          return nil if @id_tokens.length >= count
+
+          if @lone_id_token
+            "#{action}: PHAREN_ID_TOKEN is one GitLab ID token, and one token signs in once. This " \
+              "action runs #{count} pharen commands: declare PHAREN_ID_TOKEN_1 through " \
+              "PHAREN_ID_TOKEN_#{count} in the job's id_tokens: block instead"
+          else
+            "#{action}: this action runs #{count} pharen command(s) and a GitLab ID token signs in " \
+              "once, but #{@id_tokens.length} unspent token(s) remain. Declare PHAREN_ID_TOKEN_1 " \
+              "through PHAREN_ID_TOKEN_#{@id_tokens_spent + count} in the job's id_tokens: block"
+          end
+        end
+
         # -- Pharen CLI invocation -----------------------------------------------------
 
-        # Run `<binary> <args...>` and interpret the CLI's contract: JSON on stdout,
+        # Run `<binary> --json <args...>` and interpret the CLI's contract: JSON on stdout,
         # exit 0 on success. `binary` is Shellwords-split so `pharen_binary` may carry a
         # command with arguments (e.g. "npx --yes @pharen-ai/cli"). Never raises on CLI
-        # failure — callers decide strict-vs-warn from the returned hash.
+        # failure — callers decide strict-vs-warn from the returned hash. On a GitLab job
+        # signing in with per-command ID tokens, the command is given the next one as
+        # PHAREN_ID_TOKEN in its own environment.
         def run_pharen(binary, args, chdir: nil)
-          argv = Shellwords.split(binary.to_s) + args.map(&:to_s)
+          argv = Shellwords.split(binary.to_s) + ["--json"] + args.map(&:to_s)
           dir = chdir || project_dir
+          env = {}
+          if per_command_id_tokens?
+            if @id_tokens.empty?
+              return { ok: false, status: nil, stdout: "", json: nil, no_id_token: true,
+                       stderr: "no GitLab ID token left for this command — declare PHAREN_ID_TOKEN_1 " \
+                               "through PHAREN_ID_TOKEN_#{@id_tokens_spent + 1} in the job's id_tokens: block" }
+            end
+            env["PHAREN_ID_TOKEN"] = @id_tokens.shift
+            @id_tokens_spent += 1
+          end
           UI.command(Shellwords.join(argv)) # never contains a credential (the CLI resolves its own)
-          out, err, status = capture(argv, chdir: dir)
+          out, err, status = capture(argv, chdir: dir, env: env)
           json = parse_json(out)
           { ok: status == 0, status: status, stdout: out, stderr: err, json: json }
         rescue Errno::ENOENT => e
@@ -120,7 +192,13 @@ module Fastlane
         def cli_failure_message(step, result)
           error = result[:json].is_a?(Hash) ? result[:json]["error"] : nil
           if error.is_a?(Hash) && error["message"]
+            if error["code"] == "command.unknown" && error["message"].to_s.start_with?("unknown command '--json ")
+              return "#{step} failed: this plugin needs Pharen CLI 0.4.0 or later. Update the CLI on PATH or point pharen_binary at a newer command."
+            end
+
             "#{step} failed: #{error['message']} (#{error['code']})"
+          elsif result[:no_id_token]
+            "#{step} failed: #{result[:stderr]}"
           elsif result[:not_found]
             "#{step} failed: #{result[:stderr]} — install the Pharen CLI with " \
               "`npm install -g @pharen-ai/cli` so `pharen` is on PATH, or set the pharen_binary option"
@@ -171,12 +249,13 @@ module Fastlane
 
         # -- plumbing (the single shell-out seam; specs stub exactly this) ---------------
 
-        # argv -> [stdout, stderr, exitstatus]; binmode because plists are binary.
-        def capture(argv, stdin: nil, chdir: nil)
+        # argv -> [stdout, stderr, exitstatus]; binmode because plists are binary. `env` is
+        # added to the child's environment only.
+        def capture(argv, stdin: nil, chdir: nil, env: {})
           options = { binmode: true }
           options[:stdin_data] = stdin unless stdin.nil?
           options[:chdir] = chdir unless chdir.nil?
-          out, err, status = Open3.capture3(*argv, **options)
+          out, err, status = Open3.capture3(env, *argv, **options)
           [out, err, status.exitstatus]
         end
 

data/lib/fastlane/plugin/pharen/version.rb

@@ -1,5 +1,5 @@
 module Fastlane
   module Pharen
-    VERSION = "0.2.0".freeze
+    VERSION = "0.3.0".freeze
   end
 end

data/lib/fastlane/plugin/pharen.rb

@@ -16,3 +16,7 @@ end
 Fastlane::Pharen.all_classes.each do |current|
   require current
 end
+
+# A GitLab job's ID tokens leave the environment before any lane runs, so no other action
+# or build step inherits one it could spend first.
+Fastlane::Helper::PharenHelper.load_id_tokens

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: fastlane-plugin-pharen
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Pharen
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-24 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fastlane
@@ -78,7 +77,6 @@ licenses:
 metadata:
   homepage_uri: https://www.pharen.ai/docs/fastlane
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -93,8 +91,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 4.0.20
 specification_version: 4
 summary: 'Pharen build distribution + crash symbols from your lane: pharen_release
   / pharen_upload_build / pharen_upload_symbols'