CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

Direct store API calls in a project's scripts: androidpublisher.googleapis.com, the googleapis androidpublisher client, api.appstoreconnect.apple.com, altool / Transporter in CI files and scripts; scan rule direct-store-api, check and release status warnings with file:line and the storebound command; storebound's own checkout skipped; test, pitfall 97

Browse source
This commit is contained in:
CRTkafa 2026-10-22 02:04:28 +08:00
parent 4f993a906a
commit 4fcee60ba6
7 changed files with 72 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
cli/check.ts
View file

@ -34,7 +34,7 @@ import { creativeNote } from './shots/creative';
import { type CapProject, capacitorProject, prebuildFor, staleMessage, webState } from './lib/web-assets';
import { iphoneDuoNote } from './shots/spec';
import { hitLine } from './lib/cross-store';
import { FASTLANE_FIX, findFastlaneTraces, traceLine } from './lib/fastlane-traces';
import { findFastlaneTraces, traceMessage } from './lib/fastlane-traces';
import { listingFileMentions } from './lib/listing-mentions';
/** The newest .ipa in a folder (apple build's export), or null. */
@ -97,7 +97,7 @@ export async function run(ctx: Ctx): Promise<void> {
return `${Object.keys(copy).length} locales`;
});
// fastlane uploads left next to storebound (pitfall 96)
try { const tr = findFastlaneTraces(dirname(path)); if (tr.length) for (const t of tr) note(`${traceLine(t)} · ${FASTLANE_FIX}`); } catch (e) { warn('check', `fastlane traces: ${(e as Error).message}`); }
try { const tr = findFastlaneTraces(dirname(path)); if (tr.length) for (const t of tr) note(traceMessage(t)); } catch (e) { warn('check', `fastlane traces: ${(e as Error).message}`); }
// other platforms named in a store's text: App Store 2.3.10 / Play Metadata, a blocker (pitfall 77)
try { for (const h of listingFileMentions(ctx.loaded)) problems.push(`other platform in ${hitLine(h)}`); } catch (e) { warn('check', `platform mentions: ${(e as Error).message}`); }
// listing translation drafts (storebound listing translate): fine to keep working on, not to push unreviewed

29
cli/lib/fastlane-traces.ts
View file

@ -10,16 +10,30 @@ export interface FastlaneTrace {
text: string;
/** play (supply, upload_to_play_store), apple (deliver, pilot, upload_to_app_store / testflight) or both (a file). */
store: 'apple' | 'play' | 'both';
/** fastlane, or a script that calls a store API / upload tool itself (no fastlane, same bypass). */
via?: 'api';
/** The storebound command that replaces it (api traces). */
fix?: string;
}
/** Store APIs and upload tools called by a project's own scripts: each with its storebound replacement. */
const DIRECT: { re: RegExp; store: 'apple' | 'play'; what: string; fix: string }[] = [
{ re: /androidpublisher\.googleapis\.com|\bandroidpublisher\s*\(|google\.androidpublisher|['"]androidpublisher['"]/, store: 'play', what: 'Google Play Developer API called directly',
fix: 'use storebound: play upload / play release (MCP play_release_testing), play images (play_images), play listing pull (play_listing_pull) (pitfall 97)' },
{ re: /api\.appstoreconnect\.apple\.com/, store: 'apple', what: 'App Store Connect API called directly',
fix: 'use storebound: apple upload / apple submit / apple listing / apple screenshots (MCP apple_* tools) (pitfall 97)' },
{ re: /\baltool\b|iTMSTransporter|\bTransporter\b/, store: 'apple', what: 'altool / Transporter upload',
fix: 'use storebound apple upload (MCP apple_upload) (pitfall 97)' },
];
const UPLOAD = /\b(supply|upload_to_play_store|deliver|upload_to_app_store|pilot|upload_to_testflight)\b/;
/** A fastlane command line in CI / scripts: `fastlane supply`, `bundle exec fastlane run deliver`, `fastlane pilot upload`. */
const CLI_CALL = /\bfastlane\s+(?:run\s+)?(supply|upload_to_play_store|deliver|upload_to_app_store|pilot|upload_to_testflight)\b/;
const PLAY = new Set(['supply', 'upload_to_play_store']);
const FASTLANE_DIRS = ['', 'ios', 'android', 'ios/App', 'android/app'];
const CI_FILES = ['Jenkinsfile', '.gitlab-ci.yml', 'bitrise.yml', 'codemagic.yaml', 'azure-pipelines.yml', 'Makefile', 'package.json', 'appcenter-post-build.sh'];
const CI_DIRS = ['.github/workflows', '.forgejo/workflows', '.gitea/workflows', '.circleci', 'scripts', 'ci', '.ci', 'tools'];
const SCRIPT_EXT = /\.(ya?ml|sh|bash|zsh|ps1|groovy|rb|mjs|js|ts|json)$/i;
const CI_DIRS = ['.github/workflows', '.forgejo/workflows', '.gitea/workflows', '.circleci', 'scripts', 'ci', '.ci', 'tools', 'bin', 'deploy', 'release', 'ops'];
const SCRIPT_EXT = /\.(ya?ml|sh|bash|zsh|ps1|groovy|rb|py|mjs|cjs|js|ts|json)$/i;
const storeOf = (m: string): 'apple' | 'play' => (PLAY.has(m) ? 'play' : 'apple');
@ -29,6 +43,8 @@ function lines(file: string): string[] {
export function findFastlaneTraces(root: string): FastlaneTrace[] {
const out: FastlaneTrace[] = [];
// storebound's own checkout calls the store APIs by design
try { if ((JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as { name?: string }).name === 'storebound') return out; } catch { /* no package.json */ }
const rel = (p: string) => relative(root, p).split(sep).join('/');
const seen = new Set<string>();
// Fastfile / Appfile (in fastlane/ or next to it): the file itself, plus each upload action it calls
@ -56,6 +72,10 @@ export function findFastlaneTraces(root: string): FastlaneTrace[] {
lines(f).forEach((l, i) => {
const m = CLI_CALL.exec(l);
if (m) out.push({ file: rel(f), line: i + 1, text: l.trim().slice(0, 200), store: storeOf(m[1]!) });
else if (!/package\.json$/.test(f) || /"[^"]*"\s*:\s*"/.test(l)) {
const d = DIRECT.find(x => x.re.test(l));
if (d) out.push({ file: rel(f), line: i + 1, text: l.trim().slice(0, 200), store: d.store, via: 'api', fix: d.fix });
}
});
}
return out;
@ -63,4 +83,7 @@ export function findFastlaneTraces(root: string): FastlaneTrace[] {
export const FASTLANE_FIX = 'uploads outside storebound skip its checks and overwrite its listing: run `storebound import fastlane` (MCP import_fastlane), then replace the call with the storebound command (play upload / apple upload) (pitfall 96)';
export const traceLine = (t: FastlaneTrace): string => `fastlane in ${t.file}:${t.line}${t.text ? `: ${t.text}` : ''}`;
export const traceLine = (t: FastlaneTrace): string => `${t.via === 'api' ? `${DIRECT.find(d => d.fix === t.fix)?.what ?? 'store API called directly'} in` : 'fastlane in'} ${t.file}:${t.line}${t.text ? `: ${t.text}` : ''}`;
/** The warning for one trace: where, and the storebound way. */
export const traceMessage = (t: FastlaneTrace): string => `${traceLine(t)} · ${t.fix ?? FASTLANE_FIX}`;

10
cli/lib/scan/index.ts
View file

@ -78,11 +78,19 @@ export async function runScan(dir: string, o: { config?: string } = {}): Promise
const traces = findFastlaneTraces(dir);
for (const store of ['apple', 'play'] as const) {
if (config && !config[store]) continue;
const ev = traces.filter(t => t.store === store || t.store === 'both');
const ev = traces.filter(t => !t.via && (t.store === store || t.store === 'both'));
if (ev.length && !(config?.scan?.ignore ?? []).some(i => i.rule === 'fastlane-upload'))
findings.push({ rule: 'fastlane-upload', guideline: 'storebound workflow', store, severity: 'medium', title: `fastlane still in the project (${ev.length} place${ev.length > 1 ? 's' : ''}); uploads there bypass storebound`,
evidence: ev.map(t => ({ file: t.file, line: t.line, text: t.text })), fix: FASTLANE_FIX, skill: 'migrate-from-fastlane', ref: 'https://git.crt.fyi/CRT/storebound/src/branch/main/skills/migrate-from-fastlane/SKILL.md' });
}
// the project's own scripts call a store API or upload tool (pitfall 97)
for (const store of ['apple', 'play'] as const) {
if (config && !config[store]) continue;
const ev = traces.filter(t => t.via === 'api' && t.store === store);
if (ev.length && !(config?.scan?.ignore ?? []).some(i => i.rule === 'direct-store-api'))
findings.push({ rule: 'direct-store-api', guideline: 'storebound workflow', store, severity: 'medium', title: `scripts call the ${store === 'play' ? 'Google Play' : 'App Store Connect'} API or an upload tool directly (${ev.length} place${ev.length > 1 ? 's' : ''}); they bypass storebound`,
evidence: ev.map(t => ({ file: t.file, line: t.line, text: t.text })), fix: ev[0]!.fix!, skill: 'store-api', ref: 'https://git.crt.fyi/CRT/storebound/src/branch/main/skills/store-api/SKILL.md' });
}
for (const f of findings) {
const action = f.accepted ? undefined : scanFixAction(f.rule, { configPath, declarationsChanged: declarations.changed });
if (action) f.action = action;

6
cli/release.ts
View file

@ -21,7 +21,7 @@ import { laneOf, laneText, type PlanStep, releasePlan, type ReleasePlan, sameVer
import type { Finding } from './lib/validate-rules';
import { findWorkspace, loadWorkspace, resolveApps, selectApps } from './lib/workspace';
import { appDir, appEnv, workspaceApps } from './workspace';
import { FASTLANE_FIX, findFastlaneTraces, traceLine } from './lib/fastlane-traces';
import { findFastlaneTraces, traceMessage } from './lib/fastlane-traces';
interface Target { name: string; dir: string; virtual: boolean; env: Record<string, string>; problems: string[] }
@ -95,7 +95,7 @@ async function status(args: Args): Promise<void> {
const read = await pool(list, concurrency, async t => ({ t, s: await readLive(t) }));
if (args.has('json')) {
printJson({ apps: read.map(({ t, s }) => ({
app: t.name, folder: t.virtual ? null : t.dir, errors: [...t.problems, ...s.errors], warnings: [...(s.warnings ?? []), ...(t.virtual ? [] : findFastlaneTraces(t.dir).map(f => `${traceLine(f)} · ${FASTLANE_FIX}`))], storeErrors: s.storeErrors,
app: t.name, folder: t.virtual ? null : t.dir, errors: [...t.problems, ...s.errors], warnings: [...(s.warnings ?? []), ...(t.virtual ? [] : findFastlaneTraces(t.dir).map(traceMessage))], storeErrors: s.storeErrors,
trains: trainsOf(s, all).map(({ which, train }) => ({ which, version: train.version, ios: train.ios, android: train.android,
lanes: { ios: laneOf('ios', train.ios), android: laneOf('android', train.android) } })),
})), at: new Date().toISOString() });
@ -107,7 +107,7 @@ async function status(args: Args): Promise<void> {
if (!trains.length) rows.push([t.name, '', '', s.errors[0] ? `error: ${s.errors[0]}` : unread ? 'not read (see the warnings)' : 'no version on either store yet', '']);
for (const { which, train } of trains) rows.push([t.name, train.version, which === 'other' ? '' : which, cell('ios', train, s), cell('android', train, s)]);
for (const w of s.warnings ?? []) warn('release', `${t.name}: ${w}`);
if (!t.virtual) for (const f of findFastlaneTraces(t.dir)) warn('release', `${t.name}: ${traceLine(f)} · ${FASTLANE_FIX}`);
if (!t.virtual) for (const f of findFastlaneTraces(t.dir)) warn('release', `${t.name}: ${traceMessage(f)}`);
for (const p of [...t.problems, ...s.errors.slice(trains.length ? 0 : 1), ...Object.entries(s.storeErrors).map(([k, v]) => `${k}: ${v}`)]) warn('release', `${t.name}: ${p}`);
}
console.log(textTable(['app', 'version', 'train', 'App Store', 'Google Play'], rows));