From 198a2e76b2109469412ccb37bd76a240b445bec7 Mon Sep 17 00:00:00 2001 From: Brandon McAnsh Date: Tue, 1 Sep 2026 18:14:25 -0400 Subject: [PATCH] ci(shared-core): resolve the framework over the unauthenticated download URL KMMBridge writes the release asset's API URL into `Package.swift`, and `api.github.com` rate limits unauthenticated callers to 60 requests an hour per IP. The 0.4.0 publish failed its own verify step on that limit: failed downloading '.../releases/assets/540211749.zip' which is required by binary target 'SharedCore': badResponseStatusCode(403) The repo is public, so `github.com/.../releases/download//...` serves the same bytes with no limit and no credentials. Rewrite the variable to that form after the upload, then check the URL is in the file and that it resolves. This step was written for the 0.3.1 publish but was only ever run from an unmerged branch, so `code/cash` has never had it. --- .github/workflows/publish-shared-core.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/publish-shared-core.yml b/.github/workflows/publish-shared-core.yml index aca60d2f4..df9b7e958 100644 --- a/.github/workflows/publish-shared-core.yml +++ b/.github/workflows/publish-shared-core.yml @@ -88,6 +88,20 @@ jobs: -PsharedCoreVersion=${{ inputs.version }} \ -PspmRepoDir=$GITHUB_WORKSPACE/spm-repo + # KMMBridge points the binary target at the release asset's *API* URL, which + # serves private repos but is rate limited to 60 requests an hour per IP for + # anyone unauthenticated. This repo is public, so the plain download URL fetches + # the same bytes with no limit and no credentials -- without this, a developer or + # a CI runner that has spent its anonymous quota fails to resolve the package. + - name: Point the binary target at the unauthenticated download URL + working-directory: spm-repo + run: | + set -euo pipefail + download="https://github.com/${SPM_REPO}/releases/download/${{ inputs.version }}/SharedCore.xcframework.zip" + perl -pi -e 's{^let remoteKotlinUrl = ".*"$}{let remoteKotlinUrl = "'"$download"'"}' Package.swift + grep -q "$download" Package.swift + curl -fsSLI "$download" > /dev/null + # The release asset is up by now but the tag still points at the old # Package.swift, so nothing consumes this build until the next step. Compiling # the Swift glue against the framework we just uploaded is the last moment a