fastlane-security-patched 2.216.0

data/fastlane/lib/fastlane/actions/download_universal_apk_from_google_play.rb

@@ -0,0 +1,124 @@
+require 'supply'
+require 'supply/options'
+
+module Fastlane
+  module Actions
+    class DownloadUniversalApkFromGooglePlayAction < Action
+      def self.run(params)
+        package_name = params[:package_name]
+        version_code = params[:version_code]
+        destination = params[:destination]
+        cert_sha = params[:certificate_sha256_hash]
+
+        client = Supply::Client.make_from_config(params: params)
+
+        UI.message("Fetching the list of generated APKs from the Google API...")
+        all_universal_apks = client.list_generated_universal_apks(package_name: package_name, version_code: version_code)
+        matching_apks = all_universal_apks.select { |apk| cert_sha.nil? || apk.certificate_sha256_hash&.casecmp?(cert_sha) }
+
+        all_certs_printable_list = all_universal_apks.map { |apk| " - #{apk.certificate_sha256_hash}" }
+        if matching_apks.count > 1
+          message = <<~ERROR
+            We found multiple Generated Universal APK, with the following `certificate_sha256_hash`:
+            #{all_certs_printable_list.join("\n")}
+
+            Use the `certificate_sha256_hash` parameter to specify which one to download.
+          ERROR
+          UI.user_error!(message)
+        elsif matching_apks.empty?
+          # NOTE: if no APK was found at all to begin with, the client would already have raised a user_error!('Google Api Error ...')
+          message = <<~ERROR
+            None of the Universal APK(s) found for this version code matched the `certificate_sha256_hash` of `#{cert_sha}`.
+
+            We found #{all_universal_apks.count} Generated Universal APK(s), but with a different `certificate_sha256_hash`:
+            #{all_certs_printable_list.join("\n")}
+          ERROR
+          UI.user_error!(message)
+        end
+
+        UI.message("Downloading Generated Universal APK to `#{destination}`...")
+        FileUtils.mkdir_p(File.dirname(destination))
+        client.download_generated_universal_apk(generated_universal_apk: matching_apks.first, destination: destination)
+
+        UI.success("Universal APK successfully downloaded to `#{destination}`.")
+        destination
+      end
+
+      #####################################################
+      # @!group Documentation
+      #####################################################
+
+      def self.description
+        "Download the Universal APK of a given version code from the Google Play Console"
+      end
+
+      def self.details
+        <<~DETAILS
+        Download the universal APK of a given version code from the Google Play Console.
+
+        This uses _fastlane_ `supply` (and the `AndroidPublisher` Google API) to download the Universal APK
+        generated by Google after you uploaded an `.aab` bundle to the Play Console.
+
+        See https://developers.google.com/android-publisher/api-ref/rest/v3/generatedapks/list
+        DETAILS
+      end
+
+      def self.available_options
+        # Only borrow _some_ of the ConfigItems from https://github.com/fastlane/fastlane/blob/master/supply/lib/supply/options.rb
+        # So we don't have to duplicate the name, env_var, type, description, and verify_block of those here.
+        supply_borrowed_options = Supply::Options.available_options.select do |o|
+          %i[package_name version_code json_key json_key_data root_url timeout].include?(o.key)
+        end
+        # Adjust the description for the :version_code ConfigItem for our action's use case
+        supply_borrowed_options.find { |o| o.key == :version_code }&.description = "The versionCode for which to download the generated APK"
+
+        [
+          *supply_borrowed_options,
+
+          # The remaining ConfigItems below are specific to this action
+          FastlaneCore::ConfigItem.new(key: :destination,
+                                       env_name: 'DOWNLOAD_UNIVERSAL_APK_DESTINATION',
+                                       optional: false,
+                                       type: String,
+                                       description: "The path on disk where to download the Generated Universal APK",
+                                       verify_block: proc do |value|
+                                         UI.user_error!("The 'destination' must be a file path with the `.apk` file extension") unless File.extname(value) == '.apk'
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :certificate_sha256_hash,
+                                       env_name: 'DOWNLOAD_UNIVERSAL_APK_CERTIFICATE_SHA256_HASH',
+                                       optional: true,
+                                       type: String,
+                                       description: "The SHA256 hash of the signing key for which to download the Universal, Code-Signed APK for. " \
+                                       + "Use 'xx:xx:xx:…' format (32 hex bytes separated by colons), as printed by `keytool -list -keystore <keystorefile>`. " \
+                                       + "Only useful to provide if you have multiple signing keys configured on GPC, to specify which generated APK to download",
+                                       verify_block: proc do |value|
+                                         bytes = value.split(':')
+                                         next if bytes.length == 32 && bytes.all? { |byte| /^[0-9a-fA-F]{2}$/.match?(byte) }
+
+                                         UI.user_error!("When provided, the certificate sha256 must be in the 'xx:xx:xx:…:xx' (32 hex bytes separated by colons) format")
+                                       end)
+        ]
+      end
+
+      def self.output
+        # Define the shared values you are going to provide
+      end
+
+      def self.return_value
+        'The path to the downloaded Universal APK. The action will raise an exception if it failed to find or download the APK in Google Play'
+      end
+
+      def self.authors
+        ['Automattic']
+      end
+
+      def self.category
+        :production
+      end
+
+      def self.is_supported?(platform)
+        platform == :android
+      end
+    end
+  end
+end

data/fastlane/lib/fastlane/actions/dsym_zip.rb

@@ -0,0 +1,93 @@
+require 'plist'
+
+module Fastlane
+  module Actions
+    module SharedValues
+      DSYM_ZIP_PATH = :DSYM_ZIP_PATH
+    end
+
+    class DsymZipAction < Action
+      def self.run(params)
+        archive = params[:archive_path]
+        params[:dsym_path] ||= File.join("#{File.basename(archive, '.*')}.app.dSYM.zip")
+
+        dsym_folder_path = File.expand_path(File.join(archive, 'dSYMs'))
+        zipped_dsym_path = File.expand_path(params[:dsym_path])
+
+        Actions.lane_context[SharedValues::DSYM_ZIP_PATH] = zipped_dsym_path
+
+        if params[:all]
+          Actions.sh(%(cd "#{dsym_folder_path}" && zip -r "#{zipped_dsym_path}" "#{dsym_folder_path}"/*.dSYM))
+        else
+          plist = Plist.parse_xml(File.join(archive, 'Info.plist'))
+          app_name = Helper.test? ? 'MyApp.app' : File.basename(plist['ApplicationProperties']['ApplicationPath'])
+          dsym_name = "#{app_name}.dSYM"
+          Actions.sh(%(cd "#{dsym_folder_path}" && zip -r "#{zipped_dsym_path}" "#{dsym_name}"))
+        end
+      end
+
+      #####################################################
+      # @!group Documentation
+      #####################################################
+
+      def self.is_supported?(platform)
+        [:ios, :mac].include?(platform)
+      end
+
+      def self.description
+        'Creates a zipped dSYM in the project root from the .xcarchive'
+      end
+
+      def self.details
+        "You can manually specify the path to the xcarchive (not needed if you use `xcodebuild`/`xcarchive` to build your archive)"
+      end
+
+      def self.available_options
+        [
+          FastlaneCore::ConfigItem.new(key: :archive_path,
+                                       description: 'Path to your xcarchive file. Optional if you use the `xcodebuild` action',
+                                       default_value: Actions.lane_context[SharedValues::XCODEBUILD_ARCHIVE],
+                                       default_value_dynamic: true,
+                                       optional: true,
+                                       env_name: 'DSYM_ZIP_XCARCHIVE_PATH',
+                                       verify_block: proc do |value|
+                                         UI.user_error!("Couldn't find xcarchive file at path '#{value}'") if !Helper.test? && !File.exist?(value)
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :dsym_path,
+                                       description: 'Path for generated dsym. Optional, default is your apps root directory',
+                                       optional: true,
+                                       env_name: 'DSYM_ZIP_DSYM_PATH'),
+          FastlaneCore::ConfigItem.new(key: :all,
+                                       description: 'Whether or not all dSYM files are to be included. Optional, default is false in which only your app dSYM is included',
+                                       default_value: false,
+                                       optional: true,
+                                       type: Boolean,
+                                       env_name: 'DSYM_ZIP_ALL')
+        ]
+      end
+
+      def self.output
+        [
+          ['DSYM_ZIP_PATH', 'The named of the zipped dSYM']
+        ]
+      end
+
+      def self.author
+        'lmirosevic'
+      end
+
+      def self.example_code
+        [
+          'dsym_zip',
+          'dsym_zip(
+            archive_path: "MyApp.xcarchive"
+          )'
+        ]
+      end
+
+      def self.category
+        :misc
+      end
+    end
+  end
+end

data/fastlane/lib/fastlane/actions/echo.rb

@@ -0,0 +1,14 @@
+module Fastlane
+  module Actions
+    require 'fastlane/actions/puts'
+    class EchoAction < PutsAction
+      #####################################################
+      # @!group Documentation
+      #####################################################
+
+      def self.description
+        "Alias for the `puts` action"
+      end
+    end
+  end
+end

data/fastlane/lib/fastlane/actions/ensure_bundle_exec.rb

@@ -0,0 +1,59 @@
+module Fastlane
+  module Actions
+    module SharedValues
+    end
+
+    # Raises an exception and stop the lane execution if not using bundle exec to run fastlane
+    class EnsureBundleExecAction < Action
+      def self.run(params)
+        return if PluginManager.new.gemfile_path.nil?
+        if FastlaneCore::Helper.bundler?
+          UI.success("Using bundled fastlane ✅")
+        else
+          UI.user_error!("fastlane detected a Gemfile in the current directory. However, it seems like you didn't use `bundle exec`. Use `bundle exec fastlane #{ARGV.join(' ')}` instead.")
+        end
+      end
+
+      #####################################################
+      # @!group Documentation
+      #####################################################
+
+      def self.description
+        "Raises an exception if not using `bundle exec` to run fastlane"
+      end
+
+      def self.details
+        [
+          "This action will check if you are using `bundle exec` to run fastlane.",
+          "You can put it into `before_all` to make sure that fastlane is ran using the `bundle exec fastlane` command."
+        ].join("\n")
+      end
+
+      def self.available_options
+        []
+      end
+
+      def self.output
+        []
+      end
+
+      def self.author
+        ['rishabhtayal']
+      end
+
+      def self.example_code
+        [
+          "ensure_bundle_exec"
+        ]
+      end
+
+      def self.category
+        :misc
+      end
+
+      def self.is_supported?(platform)
+        true
+      end
+    end
+  end
+end

data/fastlane/lib/fastlane/actions/ensure_env_vars.rb

@@ -0,0 +1,54 @@
+module Fastlane
+  module Actions
+    class EnsureEnvVarsAction < Action
+      def self.run(params)
+        variables = params[:env_vars]
+        missing_variables = variables.select { |variable| ENV[variable].to_s.strip.empty? }
+
+        UI.user_error!("Missing environment variable(s) '#{missing_variables.join('\', \'')}'") unless missing_variables.empty?
+
+        is_one = variables.length == 1
+        UI.success("Environment variable#{is_one ? '' : 's'} '#{variables.join('\', \'')}' #{is_one ? 'is' : 'are'} set!")
+      end
+
+      def self.description
+        'Raises an exception if the specified env vars are not set'
+      end
+
+      def self.details
+        'This action will check if some environment variables are set.'
+      end
+
+      def self.available_options
+        [
+          FastlaneCore::ConfigItem.new(key: :env_vars,
+                                       description: 'The environment variables names that should be checked',
+                                       type: Array,
+                                       verify_block: proc do |value|
+                                         UI.user_error!('Specify at least one environment variable name') if value.empty?
+                                       end)
+        ]
+      end
+
+      def self.authors
+        ['revolter']
+      end
+
+      def self.example_code
+        [
+          'ensure_env_vars(
+            env_vars: [\'GITHUB_USER_NAME\', \'GITHUB_API_TOKEN\']
+          )'
+        ]
+      end
+
+      def self.category
+        :misc
+      end
+
+      def self.is_supported?(platform)
+        true
+      end
+    end
+  end
+end

data/fastlane/lib/fastlane/actions/ensure_git_branch.rb

@@ -0,0 +1,68 @@
+module Fastlane
+  module Actions
+    module SharedValues
+    end
+
+    # Raises an exception and stop the lane execution if the repo is not on a specific branch
+    class EnsureGitBranchAction < Action
+      def self.run(params)
+        branch = params[:branch]
+        branch_expr = /#{branch}/
+        if Actions.git_branch =~ branch_expr
+          UI.success("Git branch matches `#{branch}`, all good! 💪")
+        else
+          UI.user_error!("Git is not on a branch matching `#{branch}`. Current branch is `#{Actions.git_branch}`! Please ensure the repo is checked out to the correct branch.")
+        end
+      end
+
+      #####################################################
+      # @!group Documentation
+      #####################################################
+
+      def self.description
+        "Raises an exception if not on a specific git branch"
+      end
+
+      def self.details
+        [
+          "This action will check if your git repo is checked out to a specific branch.",
+          "You may only want to make releases from a specific branch, so `ensure_git_branch` will stop a lane if it was accidentally executed on an incorrect branch."
+        ].join("\n")
+      end
+
+      def self.available_options
+        [
+          FastlaneCore::ConfigItem.new(key: :branch,
+                                       env_name: "FL_ENSURE_GIT_BRANCH_NAME",
+                                       description: "The branch that should be checked for. String that can be either the full name of the branch or a regex e.g. `^feature\/.*$` to match",
+                                       default_value: 'master')
+        ]
+      end
+
+      def self.output
+        []
+      end
+
+      def self.author
+        ['dbachrach', 'Liquidsoul']
+      end
+
+      def self.example_code
+        [
+          "ensure_git_branch # defaults to `master` branch",
+          "ensure_git_branch(
+            branch: 'develop'
+          )"
+        ]
+      end
+
+      def self.category
+        :source_control
+      end
+
+      def self.is_supported?(platform)
+        true
+      end
+    end
+  end
+end

data/fastlane/lib/fastlane/actions/ensure_git_status_clean.rb

@@ -0,0 +1,130 @@
+module Fastlane
+  module Actions
+    module SharedValues
+      GIT_REPO_WAS_CLEAN_ON_START = :GIT_REPO_WAS_CLEAN_ON_START
+    end
+
+    # Raises an exception and stop the lane execution if the repo is not in a clean state
+    class EnsureGitStatusCleanAction < Action
+      def self.run(params)
+        # Build command
+        if params[:ignored]
+          ignored_mode = params[:ignored]
+          ignored_mode = 'no' if ignored_mode == 'none'
+          command = "git status --porcelain --ignored='#{ignored_mode}'"
+        else
+          command = "git status --porcelain"
+        end
+
+        # Don't log if manually ignoring files as it will emulate output later
+        print_output = params[:ignore_files].nil?
+        repo_status = Actions.sh(command, log: print_output)
+
+        # Manual post processing trying to ignore certain file paths
+        if (ignore_files = params[:ignore_files])
+          repo_status = repo_status.lines.reject do |line|
+            path = line.split(' ').last
+            was_found = ignore_files.include?(path)
+
+            UI.message("Ignoring '#{path}'") if was_found
+
+            was_found
+          end.join("")
+
+          # Emulate the output format of `git status --porcelain`
+          UI.command(command)
+          repo_status.lines.each do |line|
+            UI.message("▸ " + line.chomp.magenta)
+          end
+        end
+
+        repo_clean = repo_status.empty?
+
+        if repo_clean
+          UI.success('Git status is clean, all good! 💪')
+          Actions.lane_context[SharedValues::GIT_REPO_WAS_CLEAN_ON_START] = true
+        else
+          error_message = "Git repository is dirty! Please ensure the repo is in a clean state by committing/stashing/discarding all changes first."
+          error_message += "\nUncommitted changes:\n#{repo_status}" if params[:show_uncommitted_changes]
+          if params[:show_diff]
+            repo_diff = Actions.sh("git diff")
+            error_message += "\nGit diff: \n#{repo_diff}"
+          end
+          UI.user_error!(error_message)
+        end
+      end
+
+      def self.description
+        "Raises an exception if there are uncommitted git changes"
+      end
+
+      def self.details
+        [
+          "A sanity check to make sure you are working in a repo that is clean.",
+          "Especially useful to put at the beginning of your Fastfile in the `before_all` block, if some of your other actions will touch your filesystem, do things to your git repo, or just as a general reminder to save your work.",
+          "Also needed as a prerequisite for some other actions like `reset_git_repo`."
+        ].join("\n")
+      end
+
+      def self.output
+        [
+          ['GIT_REPO_WAS_CLEAN_ON_START', 'Stores the fact that the git repo was clean at some point']
+        ]
+      end
+
+      def self.author
+        ["lmirosevic", "antondomashnev"]
+      end
+
+      def self.example_code
+        [
+          'ensure_git_status_clean'
+        ]
+      end
+
+      def self.available_options
+        [
+          FastlaneCore::ConfigItem.new(key: :show_uncommitted_changes,
+                                       env_name: "FL_ENSURE_GIT_STATUS_CLEAN_SHOW_UNCOMMITTED_CHANGES",
+                                       description: "The flag whether to show uncommitted changes if the repo is dirty",
+                                       optional: true,
+                                       default_value: false,
+                                       type: Boolean),
+          FastlaneCore::ConfigItem.new(key: :show_diff,
+                                       env_name: "FL_ENSURE_GIT_STATUS_CLEAN_SHOW_DIFF",
+                                       description: "The flag whether to show the git diff if the repo is dirty",
+                                       optional: true,
+                                       default_value: false,
+                                       type: Boolean),
+          FastlaneCore::ConfigItem.new(key: :ignored,
+                                       env_name: "FL_ENSURE_GIT_STATUS_CLEAN_IGNORED_FILE",
+                                       description: [
+                                         "The handling mode of the ignored files. The available options are: `'traditional'`, `'none'` (default) and `'matching'`.",
+                                         "Specifying `'none'` to this parameter is the same as not specifying the parameter at all, which means that no ignored file will be used to check if the repo is dirty or not.",
+                                         "Specifying `'traditional'` or `'matching'` causes some ignored files to be used to check if the repo is dirty or not (more info in the official docs: https://git-scm.com/docs/git-status#Documentation/git-status.txt---ignoredltmodegt)"
+                                       ].join(" "),
+                                       optional: true,
+                                       verify_block: proc do |value|
+                                         mode = value.to_s
+                                         modes = %w(traditional none matching)
+
+                                         UI.user_error!("Unsupported mode, must be: #{modes}") unless modes.include?(mode)
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :ignore_files,
+                                       env_name: "FL_ENSURE_GIT_STATUS_CLEAN_IGNORE_FILES",
+                                       description: "Array of files to ignore",
+                                       optional: true,
+                                       type: Array)
+        ]
+      end
+
+      def self.category
+        :source_control
+      end
+
+      def self.is_supported?(platform)
+        true
+      end
+    end
+  end
+end

data/fastlane/lib/fastlane/actions/ensure_no_debug_code.rb

@@ -0,0 +1,133 @@
+module Fastlane
+  module Actions
+    class EnsureNoDebugCodeAction < Action
+      def self.run(params)
+        command = "grep -RE '#{params[:text]}' '#{File.absolute_path(params[:path])}'"
+
+        extensions = []
+        extensions << params[:extension] unless params[:extension].nil?
+
+        if params[:extensions]
+          params[:extensions].each do |extension|
+            extension.delete!('.') if extension.include?(".")
+            extensions << extension
+          end
+        end
+
+        if extensions.count > 1
+          command << " --include=\\*.{#{extensions.join(',')}}"
+        elsif extensions.count > 0
+          command << " --include=\\*.#{extensions.join(',')}"
+        end
+
+        command << " --exclude #{params[:exclude]}" if params[:exclude]
+
+        if params[:exclude_dirs]
+          params[:exclude_dirs].each do |dir|
+            command << " --exclude-dir #{dir.shellescape}"
+          end
+        end
+
+        return command if Helper.test?
+
+        UI.important(command)
+        results = `#{command}` # we don't use `sh` as the return code of grep is wrong for some reason
+
+        # Example Output
+        #   ./fastlane.gemspec:  spec.add_development_dependency 'my_word'
+        #   ./Gemfile.lock:    my_word (0.10.1)
+
+        found = []
+        results.split("\n").each do |current_raw|
+          found << current_raw.strip
+        end
+
+        UI.user_error!("Found debug code '#{params[:text]}': \n\n#{found.join("\n")}") if found.count > 0
+        UI.message("No debug code found in code base 🐛")
+      end
+
+      #####################################################
+      # @!group Documentation
+      #####################################################
+
+      def self.description
+        "Ensures the given text is nowhere in the code base"
+      end
+
+      def self.details
+        [
+          "You don't want any debug code to slip into production.",
+          "This can be used to check if there is any debug code still in your codebase or if you have things like `// TO DO` or similar."
+        ].join("\n")
+      end
+
+      def self.available_options
+        [
+          FastlaneCore::ConfigItem.new(key: :text,
+                                       env_name: "FL_ENSURE_NO_DEBUG_CODE_TEXT",
+                                       description: "The text that must not be in the code base"),
+          FastlaneCore::ConfigItem.new(key: :path,
+                                       env_name: "FL_ENSURE_NO_DEBUG_CODE_PATH",
+                                       description: "The directory containing all the source files",
+                                       default_value: ".",
+                                       verify_block: proc do |value|
+                                         UI.user_error!("Couldn't find the folder at '#{File.absolute_path(value)}'") unless File.directory?(value)
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :extension,
+                                       env_name: "FL_ENSURE_NO_DEBUG_CODE_EXTENSION",
+                                       description: "The extension that should be searched for",
+                                       optional: true,
+                                       verify_block: proc do |value|
+                                         value.delete!('.') if value.include?(".")
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :extensions,
+                                       env_name: "FL_ENSURE_NO_DEBUG_CODE_EXTENSIONS",
+                                       description: "An array of file extensions that should be searched for",
+                                       optional: true,
+                                       type: Array),
+          FastlaneCore::ConfigItem.new(key: :exclude,
+                                       env_name: "FL_ENSURE_NO_DEBUG_CODE_EXCLUDE",
+                                       description: "Exclude a certain pattern from the search",
+                                       optional: true),
+          FastlaneCore::ConfigItem.new(key: :exclude_dirs,
+                                       env_name: "FL_ENSURE_NO_DEBUG_CODE_EXCLUDE_DIRS",
+                                       description: "An array of dirs that should not be included in the search",
+                                       optional: true,
+                                       type: Array)
+        ]
+      end
+
+      def self.output
+        []
+      end
+
+      def self.authors
+        ["KrauseFx"]
+      end
+
+      def self.example_code
+        [
+          'ensure_no_debug_code(text: "// TODO")',
+          'ensure_no_debug_code(text: "Log.v",
+                          extension: "java")',
+          'ensure_no_debug_code(text: "NSLog",
+                               path: "./lib",
+                          extension: "m")',
+          'ensure_no_debug_code(text: "(^#define DEBUG|NSLog)",
+                               path: "./lib",
+                          extension: "m")',
+          'ensure_no_debug_code(text: "<<<<<<",
+                         extensions: ["m", "swift", "java"])'
+        ]
+      end
+
+      def self.category
+        :misc
+      end
+
+      def self.is_supported?(platform)
+        true
+      end
+    end
+  end
+end