Skip to content

[#225] 테스트플라이트 자동 배포가 실패하는 현상을 해결한다 #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
opficdev merged 8 commits into from
Mar 9, 2026
Merged

[#225] 테스트플라이트 자동 배포가 실패하는 현상을 해결한다 #229

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8696137
style: 정확하게 테플이라는 이름 명시
opficdev Mar 9, 2026
6772079
refactor: 앱 빌드 시간 단축
opficdev Mar 9, 2026
d4fc32f
chore: fastlane/README.md 추적 끄기
opficdev Mar 9, 2026
1822757
test: lint 모듈 validation 스킵
opficdev Mar 9, 2026
e8dc7d4
fix: 내부 testflight 이름과 겹치는 현상 수정
opficdev Mar 9, 2026
c02c960
fix: export_method 수정
opficdev Mar 9, 2026
0c61521
chore: 테스트플라이트 CI 배포 서명 설정 수정
opficdev Mar 9, 2026
5958687
Merge branch 'develop' into fix/#225-fastlane
opficdev Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion fastlane/Fastfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
require "shellwords"

default_platform(:ios)

platform :ios do
Expand Down Expand Up @@ -36,11 +38,24 @@ platform :ios do
readonly: ENV["CI"] == "true"
)

matchProvisioningProfileMapping = lane_context[SharedValues::MATCH_PROVISIONING_PROFILE_MAPPING] || {}
provisioningProfileSpecifier = matchProvisioningProfileMapping["opfic.DevLog"].to_s.strip

UI.user_error!("Missing provisioning profile mapping for opfic.DevLog") if provisioningProfileSpecifier.empty?
Comment on lines +42 to +44
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

번들 식별자 opfic.DevLog가 하드코딩되어 있습니다. 이 값은 Matchfile에도 정의되어 있는데, 이렇게 중복으로 하드코딩하면 나중에 번들 ID가 변경될 때 실수가 발생할 수 있습니다. match 액션 실행 후 lane_context에 저장되는 MATCH_PROVISIONING_PROFILE_MAPPING에서 번들 ID를 동적으로 가져오도록 수정하면 유지보수성이 향상됩니다. 이 방법은 매핑에 키가 하나만 존재한다고 가정하고 첫 번째 키를 사용하는 방식입니다.

    bundle_identifier = matchProvisioningProfileMapping.keys.first
    provisioningProfileSpecifier = matchProvisioningProfileMapping[bundle_identifier].to_s.strip

    UI.user_error!("'#{bundle_identifier}'에 대한 프로비저닝 프로파일 매핑을 찾을 수 없습니다.") if provisioningProfileSpecifier.empty?


buildAppXcargs = [
"-skipPackagePluginValidation",
"CODE_SIGN_STYLE=Manual",
"DEVELOPMENT_TEAM=#{ENV["APP_STORE_TEAM_ID"]}",
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The environment variable ENV["APP_STORE_TEAM_ID"] is interpolated directly into the buildAppXcargs array without proper shell escaping. If an attacker can influence the value of this environment variable (e.g., through a compromised CI environment or a malicious configuration file), they could potentially inject arbitrary shell commands or manipulate the xcodebuild arguments.

While other variables like provisioningProfileSpecifier and even the hardcoded string "Apple Distribution" are correctly escaped using Shellwords.escape, this one is missed.

To remediate this, wrap the environment variable in Shellwords.escape() to ensure it is safely handled when the array is joined and executed as part of a shell command.

      "DEVELOPMENT_TEAM=#{Shellwords.escape(ENV["APP_STORE_TEAM_ID"])}",

"CODE_SIGN_IDENTITY=#{Shellwords.escape("Apple Distribution")}",
"PROVISIONING_PROFILE_SPECIFIER=#{Shellwords.escape(provisioningProfileSpecifier)}"
]

build_app(
project: "DevLog.xcodeproj",
scheme: "DevLog",
export_method: "app-store",
xcargs: "-skipPackagePluginValidation"
xcargs: buildAppXcargs.join(" ")
)

next api_key
Expand Down