chore(openiap): apply security improvement pass

.github/workflows/ci-expo-iap.yml

@@ -32,7 +32,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.1.38"
+          bun-version: 1.3.13
 
       - uses: actions/cache@v5
         with:
@@ -41,7 +41,7 @@ jobs:
           restore-keys: ${{ runner.os }}-bun-
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Type check
         run: bun run lint:tsc
@@ -57,7 +57,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: "1.1.38"
+          bun-version: 1.3.13
 
       - uses: actions/cache@v5
         with:
@@ -66,7 +66,7 @@ jobs:
           restore-keys: ${{ runner.os }}-bun-
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Build plugin
         run: bun run build:plugin
@@ -76,4 +76,3 @@ jobs:
 
       - name: Test plugin
         run: bun run test:plugin
-

.github/workflows/ci-flutter-iap.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: subosito/flutter-action@v2
         with:
           channel: stable
-          flutter-version: "3.x"
+          flutter-version: "3.41.9"
           cache: true
 
       - name: Install dependencies

.github/workflows/ci-maui-iap.yml

@@ -34,6 +34,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  XCODE_VERSION: 16.4
+  XCODEGEN_VERSION: 2.45.4
+  XCODEGEN_SHA256: 090ec29491aad50aec10631bf6e62253fed733c50f3aab0f5ffc86bc170bdbef
+
 jobs:
   compile-check:
     name: Compile Check (net9.0 shared)
@@ -115,13 +120,18 @@ jobs:
 
   ios-binding:
     name: iOS binding (net9.0-ios + maccatalyst)
-    runs-on: macos-latest
+    runs-on: macos-15
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
+      - name: Set up Xcode
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: ${{ env.XCODE_VERSION }}
+
       - name: Setup .NET 9 SDK
         uses: actions/setup-dotnet@v5
         with:
@@ -131,7 +141,7 @@ jobs:
         run: dotnet workload install maui --skip-sign-check
 
       - name: Install xcodegen
-        run: brew install xcodegen
+        run: bash scripts/install-xcodegen.sh "$XCODEGEN_VERSION"
 
       # The iOS binding csproj consumes packages/apple/.build/xcframework/OpenIAP.xcframework.
       # Build it via the wrapper Xcode project produced from packages/apple/wrapper/project.yml.

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+env:
+  XCODE_VERSION: 16.4
+
 jobs:
   # Detect which packages have changes
   changes:
@@ -98,7 +101,7 @@ jobs:
         run: |
           # Retry bun install up to 3 times to handle transient registry errors
           for i in 1 2 3; do
-            bun install && break
+            bun install --frozen-lockfile && break
             [ $i -eq 3 ] && exit 1
             echo "Attempt $i failed. Retrying..."
             sleep 5
@@ -169,7 +172,7 @@ jobs:
         run: |
           # Retry bun install up to 3 times to handle transient registry errors
           for i in 1 2 3; do
-            bun install && break
+            bun install --frozen-lockfile && break
             [ $i -eq 3 ] && exit 1
             echo "Attempt $i failed. Retrying..."
             sleep 5
@@ -197,13 +200,18 @@ jobs:
 
   test-ios:
     name: Test iOS
-    runs-on: macos-latest
+    runs-on: macos-15
     needs: changes
     if: needs.changes.outputs.ios == 'true'
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Set up Xcode
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: ${{ env.XCODE_VERSION }}
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -213,7 +221,7 @@ jobs:
         run: |
           # Retry bun install up to 3 times to handle transient registry errors
           for i in 1 2 3; do
-            bun install && break
+            bun install --frozen-lockfile && break
             [ $i -eq 3 ] && exit 1
             echo "Attempt $i failed. Retrying..."
             sleep 5
@@ -249,7 +257,7 @@ jobs:
         run: |
           # Retry bun install up to 3 times to handle transient registry errors
           for i in 1 2 3; do
-            bun install && break
+            bun install --frozen-lockfile && break
             [ $i -eq 3 ] && exit 1
             echo "Attempt $i failed. Retrying..."
             sleep 5
@@ -290,7 +298,7 @@ jobs:
         run: |
           # Retry bun install up to 3 times to handle transient registry errors
           for i in 1 2 3; do
-            bun install && break
+            bun install --frozen-lockfile && break
             [ $i -eq 3 ] && exit 1
             echo "Attempt $i failed. Retrying..."
             sleep 5

.github/workflows/publish-flutter.yml

@@ -8,10 +8,12 @@ on:
 
 permissions:
   contents: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      contents: write
+      id-token: write
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -24,12 +26,34 @@ jobs:
         uses: subosito/flutter-action@v2
         with:
           channel: "stable"
-          flutter-version: "3.x"
+          flutter-version: "3.41.9"
 
       - name: Install dependencies
         run: flutter pub get
 
+      - name: Check if pub.dev package already published
+        id: check_pub
+        run: |
+          VERSION=$(awk '/^version:/{print $2; exit}' pubspec.yaml)
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pub.dev/api/packages/flutter_inapp_purchase/versions/$VERSION" || true)
+          HTTP_STATUS="${HTTP_STATUS:-000}"
+          case "$HTTP_STATUS" in
+            200)
+              echo "exists=true" >> "$GITHUB_OUTPUT"
+              echo "⚠️ flutter_inapp_purchase $VERSION already exists on pub.dev"
+              ;;
+            404)
+              echo "exists=false" >> "$GITHUB_OUTPUT"
+              echo "✓ flutter_inapp_purchase $VERSION does not exist, will publish"
+              ;;
+            *)
+              echo "❌ Unable to verify flutter_inapp_purchase $VERSION on pub.dev (HTTP $HTTP_STATUS)"
+              exit 1
+              ;;
+          esac
+
       - name: Publish to pub.dev
+        if: steps.check_pub.outputs.exists == 'false'
         run: |
           OIDC_TOKEN=$(curl -sLS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://pub.dev" \
             -H "User-Agent: actions/oidc-client" \