IPFM-2669 fix framework generation #25
Conversation
# Conflicts: # Sources/ApolloWebSocket/DefaultImplementation/WebSocket.swift
… instead of just Apollo, this change reduces the number of frameworks generated upstream when a Podfile uses both Apollo and the test support
![cycode-security[bot]](https://avatars.githubusercontent.com/in/39308?s=60&v=4){kind=small}
.circleci/config.yml
Outdated
| version: 2.1 | ||
|
|
||
| orbs: | ||
| secops: apollo/[email protected] |
There was a problem hiding this comment.
❗Cycode: Insecure CI/CD pipeline configuration issue: 'CircleCI workflows use uncertified CI/CD modules'.
Severity: Medium
Description
Enable this policy to be notified if your CI/CD workflows use reusable modules that are not certified by the service provider or created by a verified partner.
Cycode Remediation Guideline
Restrict - Do not allow the use of uncertified modules in this workflow, or in any workflow of this repository.
After this action has been applied, the workflow cannot run anymore, and new uncertified modules cannot be used.
Accept and Control - Map out the different modules that are used by workflows and evaluate their risk by examining their creator credibility, usage context, version etc.
To do this, use Cycode Knowledge Graph.
Tell us what to do with one of the following hashtags:
| Tag | Short Description |
|---|---|
| #cycode_ignore_insecure_pipeline_violation_here | Applies to this resource for this violation in this request only |
.github/workflows/pr-close.yml
Outdated
| name: Close and Comment PR | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: superbrothers/close-pull-request@v3 |
There was a problem hiding this comment.
❗Cycode: Insecure CI/CD pipeline configuration issue: 'GitHub workflows use uncertified CI/CD modules'.
Severity: Medium
Description
Enable this policy to be notified if your CI/CD workflows use reusable modules that are not certified by the service provider or created by a verified partner.
Company Remediation Guideline
The detected GitHub Action is using modules/components not certified by GitHub. It is provided by a third-party and is governed by separate terms of service, privacy policy, licensing, and or support.
Please use a certified GitHub Action, or consider writing your own to achieve the desired workflow.
For more information about writing your own GitHub Action(s), please see https://docs.github.com/en/actions/creating-actions
Please see the company guidelines here: https://thescore.atlassian.net/wiki/x/hwAPCQE
Tell us what to do with one of the following hashtags:
| Tag | Short Description |
|---|---|
| #cycode_ignore_insecure_pipeline_violation_here | Applies to this resource for this violation in this request only |
| github-token: ${{ secrets.PROMETHEUS_PROJECT_ACCESS_SECRET }} | ||
| - name: Set project variables | ||
| if: ${{ success() }} | ||
| uses: austenstone/project-update@v1 |
There was a problem hiding this comment.
❗Cycode: Insecure CI/CD pipeline configuration issue: 'GitHub workflows use uncertified CI/CD modules'.
Severity: Medium
Description
Enable this policy to be notified if your CI/CD workflows use reusable modules that are not certified by the service provider or created by a verified partner.
Company Remediation Guideline
The detected GitHub Action is using modules/components not certified by GitHub. It is provided by a third-party and is governed by separate terms of service, privacy policy, licensing, and or support.
Please use a certified GitHub Action, or consider writing your own to achieve the desired workflow.
For more information about writing your own GitHub Action(s), please see https://docs.github.com/en/actions/creating-actions
Please see the company guidelines here: https://thescore.atlassian.net/wiki/x/hwAPCQE
Tell us what to do with one of the following hashtags:
| Tag | Short Description |
|---|---|
| #cycode_ignore_insecure_pipeline_violation_here | Applies to this resource for this violation in this request only |
IPFM-2669
Recently the ApolloTestSupport podspec changed dependency from Apollo/Core to just Apollo. Cocoapods treats the Apollo dependency as a separate entity from Apollo/Core despite them containing the same sources.
In TSM, because we use both Apollo and ApolloTestSupport, we get duplicate generated frameworks in intermediates folder that confuse the linker at build time.
By changing the ApolloTestSupport dependency back to Apollo/Core, the dupe framework is no longer generated.