[FSSDK-13238] ci: build all platforms on Xcode 16 and 27, check API breaks, harden workflows

.github/workflows/integration_tests.yml

@@ -9,13 +9,14 @@ jobs:
   integration_tests:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
       with:
         # You should create a personal access token and store it in your repository
         token: ${{ secrets.CI_USER_TOKEN }}
         repository: 'optimizely/ci-helper-tools'
         path: 'home/runner/ci-helper-tools'
         ref: 'master'
+        persist-credentials: false
     - name: set SDK Branch if PR
       env: 
         HEAD_REF: ${{ github.head_ref }}

.github/workflows/lint_markdown.yml

@@ -6,12 +6,13 @@ jobs:
   lint_markdown:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
-        ruby-version: '2.6'
-        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+        ruby-version: '3.3'
     - name: Install gem and Run tests
       run: |
         cd ../../

.github/workflows/source_clear_cron.yml

@@ -10,8 +10,11 @@ on:
 jobs:
   source_clear:
     runs-on: macos-15
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Source clear scan
         env:
           SRCCLR_API_TOKEN: ${{ secrets.SRCCLR_API_TOKEN }}

.github/workflows/swift.yml

@@ -10,28 +10,64 @@ on:
 permissions:
   contents: read
 
+# Cancel superseded runs of the same PR; push/manual runs get a unique group so none are queued or dropped
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
 
   lint_markdown_files:
-    uses: optimizely/swift-sdk/.github/workflows/lint_markdown.yml@master
+    uses: ./.github/workflows/lint_markdown.yml
 
   integration_tests:
     # ci-helper-tools' trigger script only understands push and pull_request events
     if: github.event_name != 'workflow_dispatch'
-    uses: optimizely/swift-sdk/.github/workflows/integration_tests.yml@master
+    uses: ./.github/workflows/integration_tests.yml
     secrets:
       CI_USER_TOKEN: ${{ secrets.CI_USER_TOKEN }}
 
-  package_validation:
+  # Compile the package for every platform in Package.swift, on the newest and oldest supported Xcode
+  build:
+    name: build (${{ matrix.xcode }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - xcode: Xcode_27.0
+            runner: xcode-27
+          - xcode: Xcode_16.0
+            runner: macos-15
+    env:
+      DEVELOPER_DIR: /Applications/${{ matrix.xcode }}.app/Contents/Developer
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+    - run: |
+        swift build
+        for target in iphoneos:arm64-apple-ios15.0 appletvos:arm64-apple-tvos15.0 watchos:arm64_32-apple-watchos9.0; do
+          sdk=${target%%:*}
+          echo "::group::$sdk"
+          swift build --scratch-path ".build-$sdk" --triple "${target#*:}" --sdk "$(xcrun --sdk "$sdk" --show-sdk-path)"
+          echo "::endgroup::"
+        done
+
+  # Fails when the PR breaks public API compared to its base branch (expected only for major releases)
+  api_breaking_changes:
+    if: github.event_name == 'pull_request'
     runs-on: xcode-27
+    timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+        persist-credentials: false
     - env:
-        SRCCLR_API_TOKEN: ${{ secrets.SRCCLR_API_TOKEN }}
-      run: |
-        swift package resolve
-        swift build
-        curl -sSL https://download.sourceclear.com/ci.sh | bash
+        BASE_REF: ${{ github.base_ref }}
+      run: swift package diagnose-api-breaking-changes "origin/$BASE_REF"
 
   unittests:
     uses: ./.github/workflows/unit_tests.yml

.github/workflows/unit_tests.yml

@@ -11,6 +11,7 @@ env:
 jobs:
   unittests:
     runs-on: xcode-27
+    timeout-minutes: 90 # up to 3 attempts of ~20-25 min each
     strategy:
       fail-fast: false
       matrix:
@@ -40,7 +41,9 @@ jobs:
             platform: "tvOS Simulator"
             os_type: "tvOS"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: set SDK Branch if PR
         env:
           BASE_REF: ${{ github.base_ref }}
@@ -77,7 +80,7 @@ jobs:
 
           exit 1
       - name: Check on failures (Archive Test Results)
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: steps.unit_tests.outcome != 'success'
         with:
           name: build-logs-${{ matrix.device }}-${{ matrix.os }}

Scripts/run_unit_tests.sh

@@ -7,4 +7,4 @@ set -euo pipefail
 #  $ ./run_unit_tests.sh
 #
 
-xcodebuild test -derivedDataPath "$COVERAGE_DIR" -project OptimizelySwiftSDK.xcodeproj -scheme "$SCHEME" -configuration Release CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO -sdk "$TEST_SDK" -destination "platform=$PLATFORM,OS=$OS,name=$NAME" ONLY_ACTIVE_ARCH=YES | tee buildoutput
+xcodebuild test -derivedDataPath "$COVERAGE_DIR" -project OptimizelySwiftSDK.xcodeproj -scheme "$SCHEME" -configuration Release CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO -sdk "$TEST_SDK" -destination "platform=$PLATFORM,OS=$OS,name=$NAME" ONLY_ACTIVE_ARCH=YES | xcbeautify --renderer github-actions