Auto install Cocoapods when Podfile.lock not exist#723
Open
Auto install Cocoapods when Podfile.lock not exist#723
Conversation
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
improvement
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
Bot
removed
the
safe to test
orto17
reviewed
May 10, 2026
| err = fmt.Errorf("failed while retrieving pod path: %s", err.Error()) | ||
| return | ||
| } | ||
| // Check if lock file exists, if not run 'pod install' |
Contributor
There was a problem hiding this comment.
If os.Stat(lockFilePath) fails for a reason other than “not exist” (permissions, I/O), you skip the branch and fall through to GetDependenciesData. in those cases the failure mode may look like a missing lockfile. Consider returning a clearer error when err != nil && !os.IsNotExist(err).
orto17
reviewed
May 10, 2026
| lockFilePath := filepath.Join(currentDir, lockFileName) | ||
| if _, err := os.Stat(lockFilePath); os.IsNotExist(err) { | ||
| if params.SkipAutoInstall { | ||
| return nil, nil, fmt.Errorf("the Podfile.lock file was not found and skip auto install is enabled") |
Contributor
There was a problem hiding this comment.
can write "skip-auto-install" to be aligned with the real flag name.
orto17
reviewed
May 10, 2026
| if params.SkipAutoInstall { | ||
| return nil, nil, fmt.Errorf("the Podfile.lock file was not found and skip auto install is enabled") | ||
| } | ||
| if _, err = runPodCmd(podExecPath, currentDir, []string{"install"}); err != nil { |
Contributor
There was a problem hiding this comment.
Auto pod install writes into the project (Pods/, Podfile.lock). Worth a one-line note in the PR description or docs so users expect workspace mutation (similar to npm/yarn auto-install).
orto17
reviewed
May 10, 2026
| securityIntegrationTestUtils.InitAuditCocoapodsTest(t, scangraph.CocoapodsScanMinXrayVersion) | ||
| if coreutils.IsWindows() { | ||
| t.Skip("Skipping: CocoaPods auto-install (pod install) requires macOS/Linux with Xcode.") | ||
| return |
orto17
reviewed
May 10, 2026
| OutputDir: components.NewStringFlag(OutputDir, "Target directory to save partial results to.", components.SetHiddenStrFlag()), | ||
| UploadRepoPath: components.NewStringFlag(UploadRepoPath, "Artifactory repository name or path to upload the cyclonedx file to. If no name or path are provided, a local generic repository will be created which will automatically be indexed by Xray.", components.WithStrDefaultValue("import-cdx-scan-results")), | ||
| SkipAutoInstall: components.NewBoolFlag(SkipAutoInstall, "Set to true to skip auto-install of dependencies in un-built modules. Currently supported for Yarn and NPM only.", components.SetHiddenBoolFlag()), | ||
| SkipAutoInstall: components.NewBoolFlag(SkipAutoInstall, "Set to true to skip auto-install of dependencies in un-built modules. Currently supported only for some package managers.", components.SetHiddenBoolFlag()), |
Contributor
There was a problem hiding this comment.
“Some package managers” is vague for troubleshooting. Even for a hidden flag, naming Yarn, npm, and CocoaPods (or “including CocoaPods”) may be more useful .
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
devbranch.go vet ./....go fmt ./....Improvement(cocoapods): auto-install when Podfile.lock is missing
Summary
CocoaPods BOM / dependency-tree generation now detects a missing
Podfile.lockand runspod install(unlessSkipAutoInstallis enabled), so audits can proceed without a pre-generated lockfile. CocoaPods test fixtures are reorganized undercocoapods-project, and a newcocoapods-no-lock-filesample project supports integration coverage. The hiddenskip-auto-installflag documentation is generalized to reflect support beyond Yarn/NPM only.Changes
sca/bom/buildinfo/technologies/cocoapods: After resolving thepodexecutable, ifPodfile.lockis absent and auto-install is allowed, runpod install; if auto-install is skipped, return a clear error. IntroducedescriptorFileName/lockFileNameconstants; splitgetPodExecPathfromgetPodVersionAndExecPathand improve version-check error wrapping (podcommand.go,cocoapods.go).cli/docs/flags.go: WidenSkipAutoInstallhelp text to “some package managers.”Podfile/Podfile.lockundertests/testdata/.../cocoapods/cocoapods-project; addcocoapods-no-lock-filefixture (Podfile + minimal Xcode workspace files). Point unit tests at the new path (cocoapods_test.go). AddTestXrayAuditCocoapodsNoLockFileand parameterizetestXrayAuditCocoapodsby project name (audit_test.go).git_test.go: Adjust expected violation applicability / scan counts in two JAS-related git audit tests.Testing
TestXrayAuditCocoapods/TestXrayAuditCocoapodsNoLockFile(latter skipped on Windows in code), and fullgo test ./.../ CI as usual.Notes
podonPATHand a suitable host toolchain (the new audit test skips on Windows for that reason).SkipAutoInstallpreserves the previous strict behavior when no lockfile exists.git_test.goexpectation changes are included in this branch; confirm they match the intended Xray/JAS baseline for your environment if those tests are sensitive to server or graph versions.