Bump swift-actions/setup-swift from 2.4.0 to 3

[dependabot]

Bumps swift-actions/setup-swift from 2.4.0 to 3.

Release notes

Sourced from swift-actions/setup-swift's releases.

3.0.0 Beta 1

Beta 1 of using Swiftly to setup Swift

• Now uses Swiftly to set up Swift
• Added flag skip-verify-signature to disable GPG verification checks

Features

• Setup Swift more Swiftly 🚀 (setup-swift 3.0) (#710) @​fwal

Commits

• 364295d Bump build
• 7ef546c Update readme
• 3273319 Bump swiftly
• a90d258 Pass skip flag
• ded451b Update workflows
• 0dad4e4 Merge pull request #710 from swift-actions/next
• 4abecca Build
• 0c75150 Formatting
• 7849873 Update gpg handling
• 9005990 Merge branch 'main' into next
• Additional commits viewable in compare view

[dj4oC]

Dependabot bump: swift-actions/setup-swift 2.4.0 → 3 (GitHub Actions ecosystem, covered by .github/dependabot.yml, excluded from the minor-and-patch group since it's a major bump).

Findings

Stability (1 finding, not auto-merged)

• This is a major version bump, not a patch/minor bump — does not qualify for the Dependabot fast-lane. Upstream v3 is explicitly labeled "Beta 1" and describes a rewrite ("now uses Swiftly to set up Swift") plus a new skip-verify-signature flag that can disable GPG verification checks — a security-relevant behavior change in the action itself if that flag is ever enabled. CI passed on this branch (the pull-transifex.yml build step ran against the bumped version successfully), so the new action works for this repo's current usage, but a human should confirm the Swiftly-based toolchain resolution doesn't affect build reproducibility and that skip-verify-signature is never set.
• Security: no findings beyond the above (no CVE, but adopting a beta release of a supply-chain action for CI toolchain setup warrants a deliberate decision, not an automatic one).
• Performance: no findings.
• Coverage: N/A — CI-only dependency bump, no Swift/UIKit code touched.

Note

Build verification skipped (Xcode not available in cloud review environment). Code analysis only.

Verdict

Commenting — holding for human review due to major/beta version bump with upstream-documented behavioral changes. This mirrors the equivalent PR in ios-app (#1554), which is also held for the same reason.

🤖 Automated review by Claude Code (security · stability · performance · coverage)

---

Generated by Claude Code

[dj4oC]

• Security: no findings
• Stability: 1 finding — see review
• Performance: no findings
• Test coverage: N/A (CI-only dependency bump, no app code)
• TODOs found: none
• Dependency touched: yes — confirmed in .github/dependabot.yml (github-actions ecosystem)
• CI status: all green (ran against the bumped version already)
• Stale review: no

🤖 Automated review by Claude Code (security · stability · performance · coverage)

---

Generated by Claude Code

[DeepDiver1975]

Dependabot bump; CI green. Approving.

[DeepDiver1975]

Dependabot bump; CI green. Approving.

[DeepDiver1975]

@dependabot rebase