xcode-cloud-single-track-ci — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited xcode-cloud-single-track-ci (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
ci_scripts/ci_post_clone.sh / ci_pre_xcodebuild.sh / ci_post_xcodebuild.sh.| Workflow | Trigger | Action |
|---|---|---|
| PR CI | PR open / push — Pull Request Changes start condition (Xcode Cloud merges the PR with the target branch before building) | Build + Test (unit / integration with fakes / snapshot) |
| Main CI | Merge to main | Build + Archive + upload to internal TestFlight; do not re-run tests (already verified by PR CI in pre-merged state) |
| Release | git tag v* | Build + upload to App Store Connect (manual submission for review) |
| Periodic / Manual | Scheduled + manual trigger | Project-specific batch jobs (nightly export, metadata updates, etc.) |
Scheduling granularity caveat: Xcode Cloud's "On a Schedule" start condition lets you specify the frequency, time, and branch (Apple's own example: "every business day at 10:00 p.m."); it does not expose arbitrary cron expressions. For a cadence the frequency picker can't express directly (e.g. monthly), pick the closest supported frequency and add a script-side date guard inside ci_post_clone.sh that early-exits when the date doesn't match the desired condition.foundations.md toolchain line.bin/mise wrapper (mise generate install-script --localize --write bin/mise, from mise-tool-management — requires mise ≥ 2026.8.11; on older mise run mise self-update, or use the old mise generate bootstrap --localize --write bin/mise, which newer mise keeps as a deprecated alias with removal planned for mise 2027.9.0) and call every tool inside ci_scripts/ through it (./bin/mise trust, ./bin/mise install, ./bin/mise exec -- <tool> <args>) instead of a bare mise invocation, which fails with "command not found".| Need | Setting / source | Where it's set | Action |
|---|---|---|---|
| User-visible version | MARKETING_VERSION (→ CFBundleShortVersionString) | Project build settings | Bump deliberately per release |
| Build number, new iOS app | CI_BUILD_NUMBER | Xcode Cloud (sequential integer per build, starting at 1, independent of CURRENT_PROJECT_VERSION) | Nothing — a version+build pair lower than a prior manually-numbered build is still valid on iOS, even though Apple's docs call that same pattern invalid for a Mac app (see next row; worked example: references/official-docs.md) |
| Build number, existing Mac app with a prior higher build | ASC's Xcode Cloud build-number counter | App Store Connect → app → Xcode Cloud tab → Settings → Build Number tab → Edit | Set the next build number above your last shipped one (macOS requires the build number to strictly increase across versions, not just be unique within one) |
Binary must carry the CI build number (e.g. crash-symbolication tooling that reads CURRENT_PROJECT_VERSION) | agvtool new-version -all "$CI_BUILD_NUMBER" in ci_post_clone.sh | Repo | Requires VERSIONING_SYSTEM = apple-generic (agvtool enabled) on the target |
Release tooling that mints versionString for the ASC API (→ asc-api-automation) should read this project's MARKETING_VERSION rather than track a second version counter — one SemVer source of truth.
Apple provides:
ci_post_clone.sh — runs right after clone, before any build resources are spent (secret scan, the `bin/mise` bootstrap go here, cheapest stage)ci_pre_xcodebuild.sh — before buildci_post_xcodebuild.sh — after buildMinimal ci_post_clone.sh, using the committed bin/mise wrapper (see Environment lock above):
#!/bin/sh
set -eu
cd "$CI_PRIMARY_REPOSITORY_PATH"
./bin/mise trust
./bin/mise install
./bin/mise exec -- swiftlint lintnektos/act to reproduce non-build jobs locallyStarting point: when one of the above real pain points appears, add a single workflow first, don't go dual-track in one shot.
When two PRs each pass pre-merge and merge back to back, their combined result was never tested.
foundations.md toolchain line.bin/mise is committed; ci_post_clone.sh starts with cd "$CI_PRIMARY_REPOSITORY_PATH", then runs ./bin/mise trust && ./bin/mise install, not a bare mise call.mise-tool-management: ci_scripts/ tools installed via mise.swift-testing-baseline: CI skips real-network integration tests.apple-public-repo-security: PR CI adds a gitleaks step as the second line of defence.apple-platform-targets: Xcode version lock.asc-api-automation: release-side versionString and changelog automation, once the build exists in ASC — reuses this project's MARKETING_VERSION / CI_BUILD_NUMBER.local-archive-export-upload: the manual fallback when Xcode Cloud is down or its quota is exhausted.references/official-docs.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.