Auto install Cocoapods when Podfile.lock not exist#723
Open
attiasas wants to merge 18 commits into
Open
Conversation
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
orto17
reviewed
May 10, 2026
orto17
reviewed
May 10, 2026
orto17
reviewed
May 10, 2026
orto17
reviewed
May 10, 2026
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
| } | ||
| // Check if lock file exists, if not run 'pod install' | ||
| lockFilePath := filepath.Join(currentDir, lockFileName) | ||
| if _, err := os.Stat(lockFilePath); os.IsNotExist(err) { |
Contributor
There was a problem hiding this comment.
Error variable shadowing — permission errors silently swallowed
The os.Stat result uses := in an inner scope, so when Stat returns a non-IsNotExist error (e.g. permission denied), the else if err != nil branch reads the outer err (which is nil), silently dropping
the error. Fix by using a separate statErr variable.
| packageName := filepath.Base(currentDir) | ||
| packageInfo := fmt.Sprintf("%s:%s", packageName, VersionForMainModule) | ||
| _, _, err = getPodVersionAndExecPath() | ||
| _, podExecPath, err := getPodVersionAndExecPath() |
Contributor
There was a problem hiding this comment.
This is used only inside the 'if' and if !SkipAutoInstall
we can call it inside the 'if' statement and spare the call if not required
| // Check if lock file exists, if not run 'pod install' | ||
| lockFilePath := filepath.Join(currentDir, lockFileName) | ||
| if _, err := os.Stat(lockFilePath); os.IsNotExist(err) { | ||
| if params.SkipAutoInstall { |
Contributor
There was a problem hiding this comment.
No unit tests for the new auto-install / SkipAutoInstall code paths. Yarn and NuGet both test SkipAutoInstall at the unit level; at minimum, add a test asserting ErrProjectNotInstalled is returned
when SkipAutoInstall: true and no lock file exists.
|
|
||
| func GetDependenciesData(currentDir string) (string, error) { | ||
| _, err := os.Stat(filepath.Join(currentDir, "Podfile.lock")) | ||
| _, err := os.Stat(filepath.Join(currentDir, lockFileName)) |
Contributor
There was a problem hiding this comment.
Is this necessary? we called it and checked the existence of the lock file prior to the call to GetDependenciesData
|
|
||
| func testXrayAuditCocoapods(t *testing.T, format format.OutputFormat) string { | ||
| _, cleanUp := securityTestUtils.CreateTestProjectEnvAndChdir(t, filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), "projects", "package-managers", "cocoapods")) | ||
| func TestXrayAuditCocoapodsNoLockFile(t *testing.T) { |
Contributor
There was a problem hiding this comment.
TestXrayAuditCocoapodsNoLockFile will fail noisily on Linux CI without CocoaPods — add a pod binary availability skip guard.
eranturgeman
approved these changes
May 31, 2026
Contributor
eranturgeman
left a comment
eranturgeman
left a comment
There was a problem hiding this comment.
LGTM! see my comments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
devbranch.go vet ./....go fmt ./....Improvement(cocoapods): auto-install when Podfile.lock is missing
Summary
CocoaPods BOM / dependency-tree generation now detects a missing
Podfile.lockand runspod install(unlessSkipAutoInstallis enabled), so audits can proceed without a pre-generated lockfile. CocoaPods test fixtures are reorganized undercocoapods-project, and a newcocoapods-no-lock-filesample project supports integration coverage. The hiddenskip-auto-installflag documentation is generalized to reflect support beyond Yarn/NPM only.Running 'pod install' command to install dependencies and may produce lock files in the scanned directory
Changes
sca/bom/buildinfo/technologies/cocoapods: After resolving thepodexecutable, ifPodfile.lockis absent and auto-install is allowed, runpod install; if auto-install is skipped, return a clear error. IntroducedescriptorFileName/lockFileNameconstants; splitgetPodExecPathfromgetPodVersionAndExecPathand improve version-check error wrapping (podcommand.go,cocoapods.go).cli/docs/flags.go: WidenSkipAutoInstallhelp text to “some package managers.”Podfile/Podfile.lockundertests/testdata/.../cocoapods/cocoapods-project; addcocoapods-no-lock-filefixture (Podfile + minimal Xcode workspace files). Point unit tests at the new path (cocoapods_test.go). AddTestXrayAuditCocoapodsNoLockFileand parameterizetestXrayAuditCocoapodsby project name (audit_test.go).git_test.go: Adjust expected violation applicability / scan counts in two JAS-related git audit tests.Testing
TestXrayAuditCocoapods/TestXrayAuditCocoapodsNoLockFile(latter skipped on Windows in code), and fullgo test ./.../ CI as usual.Notes
podonPATHand a suitable host toolchain (the new audit test skips on Windows for that reason).SkipAutoInstallpreserves the previous strict behavior when no lockfile exists.git_test.goexpectation changes are included in this branch; confirm they match the intended Xray/JAS baseline for your environment if those tests are sensitive to server or graph versions.