fix(deps): clear fast-uri HIGH advisories with 4.1.4 (ports upstream #136700) #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Shared OpenClawKit Periphery | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, converted_to_draft] | |
| workflow_dispatch: | |
| concurrency: | |
| group: shared-openclawkit-periphery-${{ github.event.pull_request.number || github.sha }} | |
| cancel-in-progress: true | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| permissions: | |
| contents: read | |
| jobs: | |
| scope: | |
| name: Detect shared OpenClawKit scan scope | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| should-scan: ${{ steps.scope.outputs.should-scan }} | |
| steps: | |
| - name: Checkout | |
| if: github.event_name == 'pull_request' && github.event.pull_request.draft == false | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 2 | |
| fetch-tags: false | |
| persist-credentials: false | |
| submodules: false | |
| - name: Detect changed paths | |
| id: scope | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | |
| with: | |
| script: | | |
| if (context.eventName === "workflow_dispatch") { | |
| core.setOutput("should-scan", "true"); | |
| return; | |
| } | |
| if (context.payload.pull_request?.draft) { | |
| core.setOutput("should-scan", "false"); | |
| return; | |
| } | |
| // pull_request checks out GitHub's synthetic merge commit. Its first | |
| // parent is the exact base tree used to produce the tested result. | |
| const result = await exec.getExecOutput("git", [ | |
| "diff", | |
| "--quiet", | |
| "HEAD^1", | |
| "HEAD", | |
| "--", | |
| "apps/ios/", | |
| "apps/macos/", | |
| "apps/shared/OpenClawKit/", | |
| ".github/workflows/shared-openclawkit-periphery.yml", | |
| "scripts/periphery-intersection.mjs", | |
| "scripts/ios-configure-signing.sh", | |
| "scripts/ios-write-swift-filelist.mjs", | |
| "scripts/ios-write-swift-filelist.mts", | |
| "scripts/ios-write-version-xcconfig.sh", | |
| "test/scripts/periphery-intersection.test.ts", | |
| ], { ignoreReturnCode: true, silent: true }); | |
| if (result.exitCode !== 0 && result.exitCode !== 1) { | |
| throw new Error(`git diff failed with exit code ${result.exitCode}`); | |
| } | |
| core.setOutput("should-scan", String(result.exitCode === 1)); | |
| scan-ios: | |
| name: Scan shared kit from iOS | |
| needs: scope | |
| if: ${{ needs.scope.outputs.should-scan == 'true' }} | |
| runs-on: ${{ (github.event_name == 'workflow_dispatch' || github.run_attempt > 1) && 'macos-26' || (github.repository == 'openclaw/openclaw' && 'blacksmith-12vcpu-macos-26' || 'macos-26') }} | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| fetch-tags: false | |
| persist-credentials: false | |
| submodules: false | |
| - name: Verify Xcode | |
| run: | | |
| set -euo pipefail | |
| for xcode_app in /Applications/Xcode_26.6.app /Applications/Xcode-26.6.0.app; do | |
| if [ -d "$xcode_app/Contents/Developer" ]; then | |
| sudo xcode-select -s "$xcode_app/Contents/Developer" | |
| break | |
| fi | |
| done | |
| xcodebuild -version | |
| xcode_version="$(xcodebuild -version | awk 'NR == 1 { print $2 }')" | |
| if [[ "$xcode_version" != 26.6* ]]; then | |
| echo "error: expected Xcode 26.6, got $xcode_version" >&2 | |
| exit 1 | |
| fi | |
| swift --version | |
| - name: Setup Node environment | |
| uses: ./.github/actions/setup-node-env | |
| with: | |
| cache-mode: restore | |
| install-bun: "false" | |
| - name: Install iOS scan tooling | |
| run: | | |
| brew update | |
| brew install periphery | |
| swift_tools_dir="$RUNNER_TEMP/openclaw-swift-tools" | |
| # Homebrew's xcodegen bottle can arrive corrupted on runner images; | |
| # use the repo's pinned, checksummed release installer like ci.yml. | |
| ./scripts/install-xcodegen.sh "$swift_tools_dir" | |
| "$swift_tools_dir/xcodegen" --version | |
| ./scripts/install-swift-tools.sh "$swift_tools_dir" | |
| echo "$swift_tools_dir" >> "$GITHUB_PATH" | |
| "$swift_tools_dir/swiftformat" --version | |
| "$swift_tools_dir/swiftlint" version | |
| - name: Generate iOS project | |
| run: | | |
| set -euo pipefail | |
| ./scripts/ios-configure-signing.sh | |
| ./scripts/ios-write-version-xcconfig.sh | |
| node scripts/ios-write-swift-filelist.mjs | |
| cd apps/ios | |
| xcodegen generate | |
| - name: Scan shared kit | |
| run: | | |
| set -euo pipefail | |
| output_dir="$RUNNER_TEMP/shared-periphery-ios" | |
| mkdir -p "$output_dir" | |
| cd apps/ios | |
| set +e | |
| periphery scan \ | |
| --config .periphery.yml \ | |
| --clean-build \ | |
| --format json \ | |
| --report-include '../shared/OpenClawKit/Sources/**' \ | |
| --retain-files '../shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift' \ | |
| --write-results "$output_dir/periphery.json" \ | |
| >"$output_dir/periphery.stdout.json" \ | |
| 2>"$output_dir/periphery.stderr.log" | |
| periphery_status="$?" | |
| set -e | |
| printf '%s\n' "$periphery_status" >"$output_dir/periphery.status" | |
| if [ ! -s "$output_dir/periphery.json" ]; then | |
| cp "$output_dir/periphery.stdout.json" "$output_dir/periphery.json" | |
| fi | |
| # Failed-job reruns retain successful producer artifacts from the original attempt. | |
| # Keep artifact slots run-scoped; rerun producers overwrite their slot. | |
| - name: Upload iOS consumer report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: shared-periphery-ios-${{ github.run_id }} | |
| path: ${{ runner.temp }}/shared-periphery-ios | |
| if-no-files-found: error | |
| retention-days: 14 | |
| overwrite: true | |
| scan-macos: | |
| name: Scan shared kit from macOS | |
| needs: scope | |
| if: ${{ needs.scope.outputs.should-scan == 'true' }} | |
| runs-on: ${{ (github.event_name == 'workflow_dispatch' || github.run_attempt > 1) && 'macos-26' || (github.repository == 'openclaw/openclaw' && 'blacksmith-12vcpu-macos-26' || 'macos-26') }} | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| fetch-tags: false | |
| persist-credentials: false | |
| submodules: false | |
| - name: Verify Xcode | |
| run: | | |
| set -euo pipefail | |
| for xcode_app in /Applications/Xcode_26.6.app /Applications/Xcode-26.6.0.app; do | |
| if [ -d "$xcode_app/Contents/Developer" ]; then | |
| sudo xcode-select -s "$xcode_app/Contents/Developer" | |
| break | |
| fi | |
| done | |
| xcodebuild -version | |
| xcode_version="$(xcodebuild -version | awk 'NR == 1 { print $2 }')" | |
| if [[ "$xcode_version" != 26.6* ]]; then | |
| echo "error: expected Xcode 26.6, got $xcode_version" >&2 | |
| exit 1 | |
| fi | |
| swift --version | |
| - name: Install Periphery | |
| run: | | |
| brew update | |
| brew install periphery | |
| - name: Scan shared kit | |
| run: | | |
| set -euo pipefail | |
| output_dir="$RUNNER_TEMP/shared-periphery-macos" | |
| mkdir -p "$output_dir" | |
| cd apps/macos | |
| set +e | |
| periphery scan \ | |
| --config .periphery.yml \ | |
| --clean-build \ | |
| --format json \ | |
| --report-include '../shared/OpenClawKit/Sources/**' \ | |
| --retain-files '../shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift' \ | |
| --write-results "$output_dir/periphery.json" \ | |
| >"$output_dir/periphery.stdout.json" \ | |
| 2>"$output_dir/periphery.stderr.log" | |
| periphery_status="$?" | |
| set -e | |
| printf '%s\n' "$periphery_status" >"$output_dir/periphery.status" | |
| if [ ! -s "$output_dir/periphery.json" ]; then | |
| cp "$output_dir/periphery.stdout.json" "$output_dir/periphery.json" | |
| fi | |
| - name: Upload macOS consumer report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: shared-periphery-macos-${{ github.run_id }} | |
| path: ${{ runner.temp }}/shared-periphery-macos | |
| if-no-files-found: error | |
| retention-days: 14 | |
| overwrite: true | |
| intersect: | |
| name: Intersect shared OpenClawKit dead code | |
| needs: [scope, scan-ios, scan-macos] | |
| if: ${{ always() && needs.scope.outputs.should-scan == 'true' && needs.scan-ios.result != 'cancelled' && needs.scan-macos.result != 'cancelled' }} | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| fetch-tags: false | |
| persist-credentials: false | |
| submodules: false | |
| - name: Download iOS consumer report | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: shared-periphery-ios-${{ github.run_id }} | |
| path: ${{ runner.temp }}/shared-periphery-ios | |
| - name: Download macOS consumer report | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: shared-periphery-macos-${{ github.run_id }} | |
| path: ${{ runner.temp }}/shared-periphery-macos | |
| - name: Intersect exact Swift identities | |
| run: | | |
| node scripts/periphery-intersection.mjs \ | |
| --ios-results "$RUNNER_TEMP/shared-periphery-ios/periphery.json" \ | |
| --ios-status "$RUNNER_TEMP/shared-periphery-ios/periphery.status" \ | |
| --macos-results "$RUNNER_TEMP/shared-periphery-macos/periphery.json" \ | |
| --macos-status "$RUNNER_TEMP/shared-periphery-macos/periphery.status" \ | |
| --output "$RUNNER_TEMP/shared-periphery-intersection/periphery.json" | |
| - name: Upload shared intersection | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: shared-periphery-intersection-${{ github.run_id }} | |
| path: ${{ runner.temp }}/shared-periphery-intersection | |
| if-no-files-found: warn | |
| retention-days: 14 | |
| overwrite: true |