Skip to content

Update nightly schedules to weekdays and fix security issues #4047

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brandonpage merged 1 commit into from
May 29, 2026
Merged

Update nightly schedules to weekdays and fix security issues #4047

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions .github/workflows/nightly.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,13 @@ name: Nightly Tests

on:
schedule:
- cron: "0 5 * * 3,5" # cron is UTC, this translates to 10 PM PST Tues and Thur.
- cron: "0 5 * * 2-6" # cron is UTC; 9 PM PT every weekday (Mon-Fri).
Copy link
Copy Markdown
Contributor

@wmathurin wmathurin May 29, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we do Sunday to Thursday instead (so always followed by a working day the next morning) ?

Copy link
Copy Markdown
Contributor Author

@brandonpage brandonpage May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does running it Sunday night vs Friday night make any difference? I'm not working over the weekend 😄

Copy link
Copy Markdown
Contributor Author

@brandonpage brandonpage May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it is checking the work from today vs having a fresh run for tomorrow. I think we care more about our code changes than environment issues that could be introduced over the weekend.

Copy link
Copy Markdown
Contributor

@wmathurin wmathurin May 29, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does running it Sunday night vs Friday night make any difference? I'm not working over the weekend 😄

True but Claude might ;-)

# This lets us trigger the workflow from a browser.
workflow_dispatch:

permissions:
contents: read

jobs:
ios-nightly:
strategy:
Expand All @@ -19,11 +22,16 @@ jobs:
- ios: ^18
xcode: ^16
uses: ./.github/workflows/reusable-test-workflow.yaml
permissions:
contents: read
pull-requests: write
with:
lib: ${{ matrix.lib }}
ios: ${{ matrix.ios }}
xcode: ${{ matrix.xcode }}
secrets: inherit
secrets:
TEST_CREDENTIALS: ${{ secrets.TEST_CREDENTIALS }}
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

native-samples-nightly:
strategy:
Expand All @@ -37,8 +45,9 @@ jobs:
- ios: ^18
xcode: ^16
uses: ./.github/workflows/reusable-build-workflow.yaml
permissions:
contents: read
with:
app: ${{ matrix.app }}
ios: ${{ matrix.ios }}
xcode: ${{ matrix.xcode }}
secrets: inherit
74 changes: 53 additions & 21 deletions .github/workflows/pr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,36 +1,49 @@
name: Pull Request

on:
pull_request_target:
# pull_request_target is used so secrets are available to fork PRs.
# Mitigated by per-job Member Check (see "Check Write Permission" / "Validate Write Permission").
pull_request_target: # zizmor: ignore[dangerous-triggers]
branches: [dev, master]

permissions:
contents: read

jobs:
static-analysis:
runs-on: macos-latest
permissions:
contents: read
pull-requests: write
env:
BUNDLE_GEMFILE: ${{ github.workspace }}/.github/DangerFiles/Gemfile
steps:
- name: Check Write Permission
uses: octokit/request-action@v2.x
uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
id: check_permissions
with:
route: GET /repos/${{ github.repository }}/collaborators/${{ github.triggering_actor }}/permission
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Debug Permission Response
env:
PERMISSION_DATA: ${{ steps.check_permissions.outputs.data }}
run: |
echo "Permission raw response: ${{ steps.check_permissions.outputs.data }}"
echo "Permission raw response: $PERMISSION_DATA"
- name: Validate Write Permission
env:
PERMISSION: ${{ fromJson(steps.check_permissions.outputs.data).permission }}
ACTOR: ${{ github.triggering_actor }}
run: |
permission=$(echo "${{ fromJson(steps.check_permissions.outputs.data).permission }}")
echo "User ${{ github.triggering_actor }} has permission: $permission"
if [[ "$permission" != "write" && "$permission" != "admin" ]]; then
echo "User ${{ github.triggering_actor }} does not have sufficient permission (write or admin) to proceed. Someone from the team needs to rerun this workflow AFTER it has been deemed safe."
echo "User $ACTOR has permission: $PERMISSION"
if [[ "$PERMISSION" != "write" && "$PERMISSION" != "admin" ]]; then
echo "User $ACTOR does not have sufficient permission (write or admin) to proceed. Someone from the team needs to rerun this workflow AFTER it has been deemed safe."
exit 1
fi
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false
# We need a sufficient depth or Danger will occasionally run into issues checking which files were modified.
fetch-depth: 100
# This is dangerous without the member check
Expand All @@ -45,7 +58,7 @@ jobs:
run:
xcodebuild analyze -workspace SalesforceMobileSDK.xcworkspace -scheme MobileSync -sdk 'iphonesimulator' \
CLANG_ANALYZER_OUTPUT=plist-html CLANG_ANALYZER_OUTPUT_DIR=./clangReport RUN_CLANG_STATIC_ANALYZER=YES
- uses: ruby/setup-ruby@v1
- uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
with:
ruby-version: '3.3'
bundler-cache: true
Expand All @@ -56,37 +69,45 @@ jobs:

test-orchestrator:
runs-on: macos-latest
permissions:
contents: read
pull-requests: write
env:
BUNDLE_GEMFILE: ${{ github.workspace }}/.github/DangerFiles/Gemfile
outputs:
libs: ${{ steps.test-orchestrator.outputs.libs }}
steps:
- name: Check Write Permission
uses: octokit/request-action@v2.x
uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
id: check_permissions
with:
route: GET /repos/${{ github.repository }}/collaborators/${{ github.triggering_actor }}/permission
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Debug Permission Response
env:
PERMISSION_DATA: ${{ steps.check_permissions.outputs.data }}
run: |
echo "Permission raw response: ${{ steps.check_permissions.outputs.data }}"
echo "Permission raw response: $PERMISSION_DATA"
- name: Validate Write Permission
env:
PERMISSION: ${{ fromJson(steps.check_permissions.outputs.data).permission }}
ACTOR: ${{ github.triggering_actor }}
run: |
permission=$(echo "${{ fromJson(steps.check_permissions.outputs.data).permission }}")
echo "User ${{ github.triggering_actor }} has permission: $permission"
if [[ "$permission" != "write" && "$permission" != "admin" ]]; then
echo "User ${{ github.triggering_actor }} does not have sufficient permission (write or admin) to proceed. Someone from the team needs to rerun this workflow AFTER it has been deemed safe."
echo "User $ACTOR has permission: $PERMISSION"
if [[ "$PERMISSION" != "write" && "$PERMISSION" != "admin" ]]; then
echo "User $ACTOR does not have sufficient permission (write or admin) to proceed. Someone from the team needs to rerun this workflow AFTER it has been deemed safe."
exit 1
fi
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
persist-credentials: false
# We need a sufficient depth or Danger will occasionally run into issues checking which files were modified.
fetch-depth: 100
# This is dangerous without the member check
ref: ${{ github.event.pull_request.head.sha }}
- uses: ruby/setup-ruby@v1
- uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
with:
ruby-version: '3.3'
bundler-cache: true
Expand All @@ -109,12 +130,17 @@ jobs:
- ios: ^18
xcode: ^16
uses: ./.github/workflows/reusable-test-workflow.yaml
permissions:
contents: read
pull-requests: write
with:
lib: ${{ matrix.lib }}
ios: ${{ matrix.ios }}
xcode: ${{ matrix.xcode }}
is_pr: true
secrets: inherit
secrets:
TEST_CREDENTIALS: ${{ secrets.TEST_CREDENTIALS }}
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

native-samples-pr:
needs: [test-orchestrator]
Expand All @@ -127,14 +153,15 @@ jobs:
- ios: ^26
xcode: ^26
- ios: ^18
xcode: ^16
xcode: ^16
uses: ./.github/workflows/reusable-build-workflow.yaml
permissions:
contents: read
with:
app: ${{ matrix.app }}
ios: ${{ matrix.ios }}
xcode: ${{ matrix.xcode }}
is_pr: true
secrets: inherit

ui-tests-pr:
needs: [test-orchestrator]
Expand All @@ -148,11 +175,16 @@ jobs:
- ios: ^18
xcode: ^16
uses: ./.github/workflows/reusable-ui-test-workflow.yaml
permissions:
contents: read
pull-requests: write
with:
is_pr: true
ios: ${{ matrix.ios }}
xcode: ${{ matrix.xcode }}
pr_test: "AuthFlowTesterUITests/LegacyLoginTests/testCAOpaque_DefaultScopes_WebServerFlow"
short_timeout: "2"
long_timeout: "7"
secrets: inherit
secrets:
UI_TEST_CONFIG: ${{ secrets.UI_TEST_CONFIG }}
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
22 changes: 19 additions & 3 deletions .github/workflows/reusable-build-workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,21 +20,27 @@ on:
type: boolean
default: false

permissions:
contents: read

jobs:
build-sample-app:
runs-on: ${{ inputs.macos }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
if: ${{ inputs.is_pr }}
with:
persist-credentials: false
ref: ${{ github.event.pull_request.head.sha }}
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
if: ${{ !inputs.is_pr }}
with:
persist-credentials: false
ref: ${{ github.head_ref }}
- name: Install Dependencies
run: ./install.sh
- uses: mxcl/xcodebuild@v3
- uses: mxcl/xcodebuild@d3ee9b419c1be9a988086c58fe0988f32d99cfc5 # v3.6.0
id: build
with:
xcode: ${{ inputs.xcode }}
platform: iOS
Expand All @@ -43,3 +49,13 @@ jobs:
scheme: ${{ inputs.app }}
action: 'build'
verbosity: xcbeautify
- name: Archive build logs on failure
if: failure() && steps.build.outcome == 'failure'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: xcode-build-logs-${{ inputs.app }}-ios${{ inputs.ios }}
path: |
~/Library/Developer/Xcode/DerivedData/**/Logs/Build/*.xcactivitylog
~/Library/Logs/DiagnosticReports/**
if-no-files-found: ignore
retention-days: 14
37 changes: 30 additions & 7 deletions .github/workflows/reusable-test-workflow.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,26 +19,37 @@ on:
is_pr:
type: boolean
default: false
secrets:
TEST_CREDENTIALS:
required: true
CODECOV_TOKEN:
required: true

permissions:
contents: read
pull-requests: write

jobs:
test-ios:
runs-on: ${{ inputs.macos }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
if: ${{ inputs.is_pr }}
with:
persist-credentials: false
ref: ${{ github.event.pull_request.head.sha }}
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
if: ${{ !inputs.is_pr }}
with:
persist-credentials: false
ref: ${{ github.head_ref }}
- name: Install Dependencies
env:
TEST_CREDENTIALS: ${{ secrets.TEST_CREDENTIALS }}
run: |
./install.sh
echo $TEST_CREDENTIALS > ./shared/test/test_credentials.json
- uses: mxcl/xcodebuild@v3
- uses: mxcl/xcodebuild@d3ee9b419c1be9a988086c58fe0988f32d99cfc5 # v3.6.0
id: xcodebuild
with:
xcode: ${{ inputs.xcode }}
Expand All @@ -50,11 +61,23 @@ jobs:
verbosity: xcbeautify
- name: Parse test results
if: success() || failure()
env:
LIB: ${{ inputs.lib }}
IOS: ${{ inputs.ios }}
run: |
brew install xcresultparser
xcresultparser -o junit test.xcresult > test-results-${{ inputs.lib }}-ios${{ inputs.ios }}.xml
xcresultparser -o junit test.xcresult > "test-results-${LIB}-ios${IOS}.xml"
- name: Archive xcodebuild logs on build failure
if: failure() && steps.xcodebuild.outcome == 'failure'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: xcodebuild-logs-${{ inputs.lib }}-ios${{ inputs.ios }}
path: |
~/Library/Developer/Xcode/DerivedData/**/Logs/Build/*.xcactivitylog
if-no-files-found: ignore
retention-days: 14
- name: Test Report
uses: mikepenz/action-junit-report@v5
uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
if: success() || failure()
with:
check_name: ${{ inputs.lib }} iOS ${{ inputs.ios }} Test Results
Expand All @@ -66,15 +89,15 @@ jobs:
comment: true
job_summary: ${{ steps.xcodebuild.outcome == 'failure' }}
report_paths: 'test-results-${{ inputs.lib }}-ios${{ inputs.ios }}.xml'
- uses: codecov/codecov-action@v4
- uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
if: success() || failure()
with:
flags: ${{ inputs.lib }}
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
- name: Upload test results artifact
if: success() || failure()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: test-results-${{ inputs.lib }}-ios${{ inputs.ios }}
path: test-results-${{ inputs.lib }}-ios${{ inputs.ios }}.xml
Loading
Loading