fix(release): shape the ios-spm manifest per channel and verify the real manifest

Author: NathanWalker

.github/workflows/npm_release.yml

@@ -27,7 +27,7 @@ permissions:
 # slim npm package only carries the Xcode project template + metadata generator.
 #
 # Flow: setup → build (ios, visionos) → test → github-release (assets) →
-#       spm-update (stamp + tag ios-spm) → publish (npm) → verify-spm
+#       spm-update (generate manifest + tag ios-spm) → publish (npm) → verify-spm
 #
 # The release half (github-release, spm-update, publish, verify-spm) is gated on
 # repo variable ENABLE_SPM_RELEASE. Until it is 'true' (and the ios-spm App
@@ -350,17 +350,24 @@ jobs:
           pattern: spm-artifacts-*
           path: spm-artifacts
           merge-multiple: true
-      - name: Stamp Package.swift
+      - name: Generate Package.swift
         run: |
+          # The generator emits the WHOLE manifest, shaped by the checksums it
+          # is given: "next" builds produce only checksums-ios.env, so the next
+          # manifest omits the visionOS product/targets whose Release assets
+          # don't exist (SwiftPM eagerly downloads every binaryTarget in a
+          # resolved manifest — an unshipped asset 404s for every consumer).
+          # Real releases pass --strict so a full release can never silently
+          # ship an iOS-only manifest.
           STRICT=""
-          if [ "$NPM_TAG" = "latest" ]; then STRICT="--strict"; fi
+          if [ "$NPM_TAG" != "next" ]; then STRICT="--strict"; fi
           CHECKSUM_ARGS=""
           for f in spm-artifacts/checksums-*.env; do
             [ -f "$f" ] && CHECKSUM_ARGS="$CHECKSUM_ARGS --checksums $f"
           done
           echo "Using checksum files:$CHECKSUM_ARGS"
           if [ -z "$CHECKSUM_ARGS" ]; then echo "No checksum files found" >&2; exit 1; fi
-          node ios/scripts/stamp-spm-release.mjs \
+          node ios/scripts/generate-spm-manifest.mjs \
             --package ios-spm/Package.swift \
             --version "$NPM_VERSION" \
             $CHECKSUM_ARGS $STRICT
@@ -448,13 +455,12 @@ jobs:
   # Post-publish smoke test: resolve ios-spm at the released tag and verify the
   # binary artifact downloads + checksum-validate against the real Release.
   #
-  # Channel-aware, mirroring the build/publish matrix: `next` builds iOS only, so
-  # its Release has no visionos assets. `swift package resolve` eagerly downloads
-  # EVERY binaryTarget in a resolved package (not just the ones a referenced
-  # product needs), so resolving the full ios-spm manifest on a `next` version
-  # would try to fetch the visionos zips and 404. For `next` we therefore probe
-  # an iOS-only package; only real releases (v* tag / manual version) resolve the
-  # full manifest and thus also verify the visionos artifacts.
+  # One probe for every channel, against the REAL released manifest. The
+  # manifest's target set is channel-shaped by generate-spm-manifest.mjs
+  # ("next" manifests only declare the iOS targets, because next Releases have
+  # no visionos assets), so resolving ios-spm at the released tag exercises
+  # exactly the artifact set a consumer's xcodebuild will download: iOS-only on
+  # next, iOS + visionos on real releases (v* tag / manual version).
   verify-spm:
     name: Verify SPM resolution
     runs-on: macos-14
@@ -470,95 +476,41 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version: 22
       - name: Assert ios-spm manifest pins this release
         run: |
-          # Guard against the manifest pointing at a STALE release — e.g. a stamp
-          # that no-ops and leaves a prior version's nsVersion + artifact
-          # URLs/checksums in place. Those still resolve and checksum-pass (they're
-          # internally consistent), so `swift package resolve` below won't catch
-          # it; this explicit version assertion does.
+          # Guard against the tag pointing at a STALE manifest — e.g. a
+          # commit/tag step that silently failed and left a prior version's
+          # nsVersion + artifact URLs/checksums in place. Those still resolve
+          # and checksum-pass (they're internally consistent), so `swift
+          # package resolve` below won't catch it; this explicit version
+          # assertion does.
           url="https://raw.githubusercontent.com/NativeScript/ios-spm/${NPM_VERSION}/Package.swift"
           manifest="$(curl -fsSL "$url")"
           if ! printf '%s\n' "$manifest" | grep -q "let nsVersion = \"${NPM_VERSION}\""; then
-            echo "::error::ios-spm@${NPM_VERSION} does not pin nsVersion=\"${NPM_VERSION}\" (stale stamp?). Found:" >&2
+            echo "::error::ios-spm@${NPM_VERSION} does not pin nsVersion=\"${NPM_VERSION}\" (stale manifest?). Found:" >&2
             printf '%s\n' "$manifest" | grep -n "nsVersion" >&2 || true
             exit 1
           fi
           echo "OK: ios-spm@${NPM_VERSION} pins nsVersion=\"${NPM_VERSION}\""
-      - name: Generate a probe package that depends on ios-spm (real releases)
-        # Real release (v* tag / manual version): the Release carries every asset,
-        # so probe the full ios-spm manifest. `swift package resolve` eagerly
-        # downloads all binaryTargets, exercising the iOS AND visionos artifacts.
-        if: ${{ needs.setup.outputs.npm_tag != 'next' }}
-        run: |
-          node -e '
-            const fs = require("fs");
-            const v = process.env.NPM_VERSION;
-            fs.mkdirSync("spmverify/Sources/Probe", { recursive: true });
-            fs.writeFileSync("spmverify/Package.swift",
-              "// swift-tools-version: 5.10\n" +
-              "import PackageDescription\n" +
-              "let package = Package(\n" +
-              "  name: \"Probe\",\n" +
-              "  platforms: [.iOS(.v13)],\n" +
-              "  dependencies: [.package(url: \"https://github.com/NativeScript/ios-spm.git\", exact: \"" + v + "\")],\n" +
-              "  targets: [.target(name: \"Probe\", dependencies: [.product(name: \"NativeScript\", package: \"ios-spm\")])]\n" +
-              ")\n");
-            fs.writeFileSync("spmverify/Sources/Probe/Probe.swift", "// probe\n");
-          '
-      - name: Generate an iOS-only probe package (next channel)
-        # The "next" Release has no visionos assets (build matrix is iOS-only for
-        # next), and `swift package resolve` would eagerly try to fetch every
-        # binaryTarget in the full ios-spm manifest -> 404 on the visionos zips.
-        # So probe an iOS-only package whose binaryTargets are the iOS artifacts
-        # from the stamped manifest (real Release URLs + real checksums): resolve
-        # still downloads and checksum-verifies exactly what a next consumer gets,
-        # and never touches visionos.
-        if: ${{ needs.setup.outputs.npm_tag == 'next' }}
-        run: |
-          url="https://raw.githubusercontent.com/NativeScript/ios-spm/${NPM_VERSION}/Package.swift"
-          curl -fsSL "$url" -o manifest.swift
-          node -e '
-            const fs = require("fs");
-            const v = process.env.NPM_VERSION;
-            const body = fs.readFileSync("manifest.swift", "utf8");
-            // Pull the checksum out of the binaryTarget whose url ends in the given
-            // artifact zip. The url is a Swift interpolation ("\(base)/<zip>"), so
-            // match up to the closing quote; anchoring on <zip>" keeps the iOS
-            // NativeScript slot from matching the visionos one (…visionos.xcframework.zip).
-            const ck = (artifact) => {
-              const re = new RegExp("url:\\s*\"[^\"]*" + artifact.replace(/\./g, "\\.") + "\"\\s*,\\s*checksum:\\s*\"([0-9a-f]{64})\"");
-              const m = body.match(re);
-              if (!m) { console.error("No iOS checksum for " + artifact + " in ios-spm@" + v); process.exit(1); }
-              return m[1];
-            };
-            const nsCk = ck("NativeScript.xcframework.zip");
-            const tkCk = ck("TKLiveSync.xcframework.zip");
-            fs.mkdirSync("spmverify/Sources/Probe", { recursive: true });
-            fs.writeFileSync("spmverify/Package.swift",
-              "// swift-tools-version: 5.10\n" +
-              "import PackageDescription\n" +
-              "let base = \"https://github.com/NativeScript/ios/releases/download/v" + v + "\"\n" +
-              "let package = Package(\n" +
-              "  name: \"Probe\",\n" +
-              "  platforms: [.iOS(.v13)],\n" +
-              "  targets: [\n" +
-              "    .binaryTarget(name: \"NativeScript\", url: \"\\(base)/NativeScript.xcframework.zip\", checksum: \"" + nsCk + "\"),\n" +
-              "    .binaryTarget(name: \"TKLiveSync\", url: \"\\(base)/TKLiveSync.xcframework.zip\", checksum: \"" + tkCk + "\"),\n" +
-              "    .target(name: \"Probe\", dependencies: [\"NativeScript\", \"TKLiveSync\"])\n" +
-              "  ]\n" +
-              ")\n");
-            fs.writeFileSync("spmverify/Sources/Probe/Probe.swift", "// probe\n");
-          '
+      - name: Generate a probe package that depends on ios-spm
+        # The probe pins ios-spm at the exact released version. Resolving it
+        # takes the same path a consumer's xcodebuild does, and the released
+        # manifest only declares targets whose assets exist (channel-shaped by
+        # generate-spm-manifest.mjs) — so this single probe is valid for every
+        # channel.
+        run: node scripts/generate-spm-probe.mjs --version "$NPM_VERSION" --dir spmverify
       - name: Resolve (downloads the xcframework zips and verifies their checksums)
         working-directory: spmverify
         run: |
           # Resolution fetches each binaryTarget's zip and verifies its SHA-256
-          # against the stamped checksum; a mismatch or a missing release asset
-          # fails the release here. For next this covers the iOS artifacts only;
-          # real releases resolve the full manifest and also cover visionos.
+          # against the manifest checksum; a mismatch or a missing release asset
+          # fails the release here. For next the manifest declares the iOS
+          # artifacts only; real releases also declare (and verify) visionos.
           swift package resolve
           echo "ios-spm@$NPM_VERSION resolved and checksum-verified."

build_spm_artifacts.sh

@@ -9,7 +9,7 @@
 # Usage: ./build_spm_artifacts.sh [ios|visionos]   (default: ios)
 #
 # These artifacts are uploaded to the GitHub Release and referenced by
-# github.com/NativeScript/ios-spm (see scripts/stamp-spm-release.mjs).
+# github.com/NativeScript/ios-spm (see scripts/generate-spm-manifest.mjs).
 set -e
 source "$(dirname "$0")/build_utils.sh"
 

scripts/generate-spm-manifest.mjs

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+// Generate ios-spm/Package.swift for a release.
+//
+// ensure binaryTarget whose Release asset was never uploaded breaks
+// resolution for every consumer of that version. Here, the visionOS
+// product/targets are emitted only when the visionOS checksums are provided.
+//
+// Checksums come from the KEY=sha256 env files produced by
+// build_spm_artifacts.sh (one file per platform). The iOS checksums are always
+// required. --strict additionally requires the visionOS checksums; pass it for
+// every non-"next" release so a real release can never silently ship an
+// iOS-only manifest.
+//
+// Usage:
+//   node scripts/generate-spm-manifest.mjs \
+//     --package /path/to/ios-spm/Package.swift \
+//     --version 9.1.0 \
+//     --checksums checksums-ios.env [--checksums checksums-visionos.env] \
+//     [--strict]
+import fs from "node:fs";
+
+const args = process.argv.slice(2);
+const opts = { checksums: [] };
+for (let i = 0; i < args.length; i++) {
+  const a = args[i];
+  if (a === "--package") opts.package = args[++i];
+  else if (a === "--version") opts.version = args[++i];
+  else if (a === "--checksums") opts.checksums.push(args[++i]);
+  else if (a === "--strict") opts.strict = true;
+  else {
+    console.error(`Unknown argument: ${a}`);
+    process.exit(1);
+  }
+}
+
+if (!opts.package || !opts.version || opts.checksums.length === 0) {
+  console.error(
+    "Usage: generate-spm-manifest.mjs --package <Package.swift> --version <v> --checksums <file> [--checksums <file>] [--strict]"
+  );
+  process.exit(1);
+}
+
+// The version is interpolated into Swift source and into a release URL; accept
+// semver (with optional prerelease) and nothing else.
+const VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+if (!VERSION_RE.test(opts.version)) {
+  console.error(`ERROR: "${opts.version}" is not a valid release version`);
+  process.exit(1);
+}
+
+const IOS_KEYS = ["NS_CHECKSUM_NATIVESCRIPT_IOS", "NS_CHECKSUM_TKLIVESYNC_IOS"];
+const VISION_KEYS = [
+  "NS_CHECKSUM_NATIVESCRIPT_VISIONOS",
+  "NS_CHECKSUM_TKLIVESYNC_VISIONOS",
+];
+const KNOWN_KEYS = new Set([...IOS_KEYS, ...VISION_KEYS]);
+
+// A binaryTarget checksum must be a 64-char lowercase hex SHA-256. Reject
+// anything else now (empty/truncated/uppercase) so we can't emit a manifest
+// that resolves to a checksum mismatch later.
+const SHA256_RE = /^[0-9a-f]{64}$/;
+const checksums = {};
+for (const file of opts.checksums) {
+  const text = fs.readFileSync(file, "utf8");
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    const value = trimmed.slice(eq + 1).trim();
+    if (!key) continue;
+    if (!KNOWN_KEYS.has(key)) {
+      console.error(`ERROR: unknown checksum key ${key} in ${file}`);
+      process.exit(1);
+    }
+    if (!SHA256_RE.test(value)) {
+      console.error(
+        `ERROR: ${key} in ${file} is not a valid SHA-256 checksum: "${value}"`
+      );
+      process.exit(1);
+    }
+    checksums[key] = value;
+  }
+}
+
+const missingIos = IOS_KEYS.filter((k) => !(k in checksums));
+if (missingIos.length) {
+  console.error(`ERROR: missing iOS checksums: ${missingIos.join(", ")}`);
+  process.exit(1);
+}
+
+const presentVision = VISION_KEYS.filter((k) => k in checksums);
+if (presentVision.length !== 0 && presentVision.length !== VISION_KEYS.length) {
+  const missing = VISION_KEYS.filter((k) => !(k in checksums));
+  console.error(
+    `ERROR: partial visionOS checksums — have ${presentVision.join(", ")} but missing ${missing.join(", ")}`
+  );
+  process.exit(1);
+}
+const includeVision = presentVision.length === VISION_KEYS.length;
+if (opts.strict && !includeVision) {
+  console.error(
+    "ERROR: --strict requires the visionOS checksums (a non-next release must ship the full manifest)"
+  );
+  process.exit(1);
+}
+
+const visionPlatform = includeVision ? `\n        .visionOS(.v1),` : "";
+const visionProduct = includeVision
+  ? `\n        // visionOS family (xros + xrsimulator)
+        .library(name: "NativeScriptVisionOS", targets: ["NativeScriptVisionOS", "TKLiveSyncVisionOS"]),`
+  : "";
+const visionTargets = includeVision
+  ? `
+        .binaryTarget(
+            name: "NativeScriptVisionOS",
+            url: "\\(releaseBase)/NativeScript.visionos.xcframework.zip",
+            checksum: "${checksums.NS_CHECKSUM_NATIVESCRIPT_VISIONOS}"
+        ),
+        .binaryTarget(
+            name: "TKLiveSyncVisionOS",
+            url: "\\(releaseBase)/TKLiveSync.visionos.xcframework.zip",
+            checksum: "${checksums.NS_CHECKSUM_TKLIVESYNC_VISIONOS}"
+        ),`
+  : "";
+
+const manifest = `// swift-tools-version: 5.10
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+//
+// GENERATED FILE — DO NOT EDIT BY HAND.
+// Emitted per release by scripts/generate-spm-manifest.mjs in
+// github.com/NativeScript/ios. The target set mirrors the assets the release
+// publishes: the rolling "next" channel builds iOS only, so its manifests omit
+// the visionOS product/targets (SwiftPM eagerly downloads every binaryTarget
+// in a resolved manifest, and a target without an uploaded asset would break
+// resolution for every consumer of that version).
+//
+// Copyright OpenJS Foundation and other contributors, https://openjsf.org
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+import PackageDescription
+
+let nsVersion = "${opts.version}"
+let releaseBase = "https://github.com/NativeScript/ios/releases/download/v\\(nsVersion)"
+
+let package = Package(
+    name: "NativeScriptSDK",
+    platforms: [
+        .iOS(.v13),
+        .macCatalyst(.v13),${visionPlatform}
+    ],
+    products: [
+        // iOS family (iphoneos + iphonesimulator + Mac Catalyst)
+        .library(name: "NativeScript", targets: ["NativeScript", "TKLiveSync"]),
+        // Backwards-compatible alias for the historical product name.
+        .library(name: "NativeScriptSDK", targets: ["NativeScript", "TKLiveSync"]),${visionProduct}
+    ],
+    dependencies: [],
+    targets: [
+        .binaryTarget(
+            name: "NativeScript",
+            url: "\\(releaseBase)/NativeScript.xcframework.zip",
+            checksum: "${checksums.NS_CHECKSUM_NATIVESCRIPT_IOS}"
+        ),
+        .binaryTarget(
+            name: "TKLiveSync",
+            url: "\\(releaseBase)/TKLiveSync.xcframework.zip",
+            checksum: "${checksums.NS_CHECKSUM_TKLIVESYNC_IOS}"
+        ),${visionTargets}
+    ]
+)
+`;
+
+fs.writeFileSync(opts.package, manifest);
+
+console.log(`Generated ${opts.package}`);
+console.log(`  version: ${opts.version}`);
+console.log(`  targets: iOS${includeVision ? " + visionOS" : " only (no visionOS checksums provided)"}`);