Merge remote-tracking branch 'origin/trunk' into foundation

# Conflicts:
#	CHANGELOG.md

Author: jkmassel

CHANGELOG.md

@@ -10,7 +10,7 @@ _None_
 
 ### New Features
 
-- Added `find_or_create_pull_request` action and `GithubHelper#find_pull_request`: returns the URL of the open Pull Request for a head branch, creating one only if none exists yet. Useful for "rolling" automations (e.g. a daily translations or dependency-update job) that force-push the same head branch on every run. [#733]
+_None_
 
 ### Bug Fixes
 
@@ -20,12 +20,27 @@ _None_
 - `L10nHelper.merge_strings` now applies the key prefix via a comment-aware tokenizer, so it correctly prefixes unquoted keys containing `. - $ : /`, lines with an *unquoted* value (e.g. `CFBundleName = WordPress;`), and keys sitting behind an inter-token `.strings` comment (e.g. `CFBundleName /* note */ = WordPress;`) — matching the grammar `plutil` accepts. Previously the line-based matcher left those keys written to the merged file without the prefix while still bookkeeping them *with* it, leaving the output inconsistent with the reported keys (which could resurface the very collisions the prefix avoids and break downstream key extraction). [#741]
 - `StringsFileValidationHelper.find_duplicated_keys` (and `scan_for_duplicate_keys`) now tokenize dictionary- and array-valued entries (`"k" = { … };`, `"k" = ( … );`, nesting allowed), skipping the container body — so a `:text` file that uses them is scanned for duplicate *top-level* keys instead of returning `:unscannable`. [#750]
 - `L10nHelper.merge_strings` now prefixes the outer key of a dictionary/array-valued entry and copies the value through verbatim, instead of crashing on it — valid input `plutil` accepts that the flat-`.strings` tokenizer previously couldn't rewrite. If a file still holds a construct the tokenizer can't rewrite, its lines are copied through unprefixed with a `UI.important` warning (and its keys are bookkept unprefixed to match, so a genuine cross-file collision is still reported rather than silently collapsed) instead of aborting the whole merge. [#750]
+- Bump `faraday` and `nokogiri` to address security vulnerabilities. [#749]
+- Bump `concurrent-ruby` to address CVE-2026-54904 / GHSA-h8w8-99g7-qmvj. [#751]
 
 ### Internal Changes
 
 - Centralized `.strings` duplicate-key detection behind `StringsFileValidationHelper.scan_for_duplicate_keys`, which detects the file format and returns a `[:scanned | :unsupported_format | :unscannable, payload]` tri-state that callers map to their own policy (warn-and-skip vs fail-closed). `ios_lint_localizations` now uses it. [#741]
 - `L10nHelper.strings_file_type` (and `StringsFileValidationHelper.scan_for_duplicate_keys`) accept `assume_valid:` to skip a redundant `plutil -lint` when the caller has already parsed the file. [#741]
 
+## 14.9.0
+
+### New Features
+
+- `upload_github_release_assets` action: uploads assets on an existing GitHub release without disturbing unrelated assets. If assets exists already, it replaces them. [#743]
+
+## 14.8.0
+
+### New Features
+
+- `find_or_create_pull_request` action: returns the URL of the open Pull Request for a head branch, creating one only if none exists yet. [#733]
+- `ContinuousBuildCodeFormatter`: derives an Android Play Store `versionCode` for a "continuous trunk" release model as `(major * 10 + minor) * 10^build_digits + build_number` (default `build_digits: 6`). [#735]
+
 ## 14.7.0
 
 ### New Features

Gemfile

@@ -10,6 +10,8 @@ gem 'danger-dangermattic', '~> 1.0'
 gem 'webmock', require: false
 gem 'yard'
 
-# Security: https://github.com/lostisland/faraday/pull/1665
+# Security:
+# - https://github.com/lostisland/faraday/pull/1665
+# - https://github.com/lostisland/faraday/pull/1681
 # Faraday 2.0 is not compatible with Fastlane
-gem 'faraday', '~> 1.10', '>= 1.10.5'
+gem 'faraday', '~> 1.10', '>= 1.10.6'

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    fastlane-plugin-wpmreleasetoolkit (14.7.0)
+    fastlane-plugin-wpmreleasetoolkit (14.9.0)
       buildkit (~> 1.5)
       chroma (= 0.2.0)
       diffy (~> 3.3)
@@ -11,7 +11,7 @@ PATH
       git (~> 1.3)
       google-cloud-storage (~> 1.31)
       java-properties (~> 0.3.0)
-      nokogiri (~> 1.19, >= 1.19.3)
+      nokogiri (~> 1.19, >= 1.19.4)
       octokit (~> 6.1)
       parallel (~> 1.14)
       plist (~> 3.1)
@@ -83,7 +83,7 @@ GEM
     colored2 (3.1.2)
     commander (4.6.0)
       highline (~> 2.0.0)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
     cork (0.3.0)
       colored2 (~> 3.1)
@@ -127,7 +127,7 @@ GEM
     emoji_regex (3.2.3)
     erubi (1.13.1)
     excon (0.112.0)
-    faraday (1.10.5)
+    faraday (1.10.6)
       faraday-em_http (~> 1.0)
       faraday-em_synchrony (~> 1.0)
       faraday-excon (~> 1.1)
@@ -298,7 +298,7 @@ GEM
     nap (1.1.0)
     naturally (2.3.0)
     nkf (0.2.0)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     observer (0.1.2)
@@ -439,7 +439,7 @@ DEPENDENCIES
   bundler (~> 2.0)
   codecov
   danger-dangermattic (~> 1.0)
-  faraday (~> 1.10, >= 1.10.5)
+  faraday (~> 1.10, >= 1.10.6)
   fastlane (~> 2.210)
   fastlane-plugin-wpmreleasetoolkit!
   pry (~> 0.12.2)

fastlane-plugin-wpmreleasetoolkit.gemspec

@@ -34,7 +34,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'gettext', '~> 3.5'
   spec.add_dependency 'git', '~> 1.3'
   spec.add_dependency 'java-properties', '~> 0.3.0'
-  spec.add_dependency 'nokogiri', '~> 1.19', '>= 1.19.3'
+  spec.add_dependency 'nokogiri', '~> 1.19', '>= 1.19.4'
   spec.add_dependency 'octokit', '~> 6.1'
   spec.add_dependency 'parallel', '~> 1.14'
   spec.add_dependency 'plist', '~> 3.1'

lib/fastlane/plugin/wpmreleasetoolkit/actions/common/upload_github_release_assets_action.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require 'fastlane/action'
+require_relative '../../helper/github_helper'
+
+module Fastlane
+  module Actions
+    class UploadGithubReleaseAssetsAction < Action
+      def self.run(params)
+        repository = params[:repository]
+        version = params[:version]
+        assets = params[:release_assets]
+        replace_existing = params[:replace_existing]
+
+        UI.message("Uploading #{assets.count} GitHub Release asset(s) to #{repository} #{version}.")
+
+        github_helper = Fastlane::Helper::GithubHelper.new(github_token: params[:github_token])
+        url = github_helper.upload_release_assets(
+          repository: repository,
+          version: version,
+          assets: assets,
+          replace_existing: replace_existing
+        )
+
+        UI.success("Successfully uploaded GitHub Release assets. You can see the release at '#{url}'")
+        url
+      end
+
+      def self.description
+        'Uploads assets to an existing GitHub Release'
+      end
+
+      def self.authors
+        ['Automattic']
+      end
+
+      def self.return_value
+        'The URL of the GitHub Release'
+      end
+
+      def self.details
+        'Uploads assets to an existing GitHub Release. By default, existing release assets with matching filenames are replaced; when replace_existing is false, matching assets cause the action to fail.'
+      end
+
+      def self.available_options
+        [
+          FastlaneCore::ConfigItem.new(key: :repository,
+                                       description: 'The slug (`<org>/<repo>`) of the GitHub repository containing the release',
+                                       optional: false,
+                                       type: String,
+                                       verify_block: proc do |value|
+                                         UI.user_error!('Repository cannot be empty') if value.to_s.empty?
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :version,
+                                       description: 'The version of the release. Used as the git tag name',
+                                       optional: false,
+                                       type: String,
+                                       verify_block: proc do |value|
+                                         UI.user_error!('Version cannot be empty') if value.to_s.empty?
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :release_assets,
+                                       description: 'Assets to upload',
+                                       type: Array,
+                                       optional: false,
+                                       verify_block: proc do |value|
+                                         UI.user_error!('You must provide at least one release asset') if value.nil? || value.empty?
+                                         value.each do |asset|
+                                           UI.user_error!('release_assets must contain file paths') unless asset.is_a?(String) && !asset.empty?
+                                         end
+                                       end),
+          FastlaneCore::ConfigItem.new(key: :replace_existing,
+                                       description: 'True to delete existing release assets with matching filenames before uploading. False to fail if a matching asset exists',
+                                       optional: true,
+                                       default_value: true,
+                                       type: Boolean),
+          Fastlane::Helper::GithubHelper.github_token_config_item,
+        ]
+      end
+
+      def self.is_supported?(platform)
+        true
+      end
+    end
+  end
+end

lib/fastlane/plugin/wpmreleasetoolkit/helper/github_helper.rb

@@ -192,6 +192,58 @@ def create_release(repository:, version:, description:, assets:, prerelease:, is
         release[:html_url]
       end
 
+      # Returns the GitHub release matching a given tag/version, including draft releases.
+      #
+      # @param [String] repository The repository to fetch the GitHub release from. Typically a repo slug (<org>/<repo>).
+      # @param [String] version The release version/tag to fetch.
+      # @return [Sawyer::Resource] The matching GitHub Release.
+      # @raise [Fastlane::UI::Error] UI.user_error! if the release does not exist.
+      #
+      def get_release(repository:, version:)
+        release = client.releases(repository).find { |candidate| candidate.tag_name == version }
+        return release unless release.nil?
+
+        UI.user_error!("Could not find GitHub Release for tag #{version} in #{repository}")
+      end
+
+      # Uploads assets to an existing GitHub release, optionally replacing matching filenames.
+      #
+      # @param [String] repository The repository to upload the GitHub release assets to. Typically a repo slug (<org>/<repo>).
+      # @param [String] version The release version/tag to upload assets to.
+      # @param [Array<String>] assets List of local file paths to attach as release assets.
+      # @param [TrueClass|FalseClass] replace_existing Delete existing same-filename assets before uploading. When false, fail if a matching asset exists.
+      # @return [String] URL of the corresponding GitHub Release.
+      # @raise [Fastlane::UI::Error] UI.user_error! if the release or any local asset file does not exist.
+      #
+      def upload_release_assets(repository:, version:, assets:, replace_existing: true)
+        asset_paths = validate_release_assets!(assets)
+        release = get_release(repository: repository, version: version)
+        existing_assets = client.release_assets(release.url)
+
+        asset_paths.each do |file_path|
+          file_name = File.basename(file_path)
+          matching_assets = existing_assets.select { |asset| asset.name == file_name }
+
+          unless matching_assets.empty?
+            if replace_existing
+              matching_assets.each do |asset|
+                UI.message("Deleting existing GitHub Release asset #{asset.name}")
+                client.delete_release_asset(asset.url)
+              end
+              existing_assets -= matching_assets
+            else
+              UI.user_error!("GitHub Release #{version} already has an asset named #{file_name}. Set replace_existing: true to replace it.")
+            end
+          end
+
+          UI.message("Uploading #{file_path} to GitHub Release #{version}")
+          uploaded_asset = client.upload_asset(release.url, file_path, content_type: 'application/octet-stream')
+          existing_assets << uploaded_asset unless uploaded_asset.nil?
+        end
+
+        release.html_url
+      end
+
       # Use the GitHub API to generate release notes based on the list of PRs between current tag and previous tag.
       # @note This API uses the `.github/release.yml` config file to classify the PRs by category in the generated list according to PR labels.
       #
@@ -368,6 +420,26 @@ def set_branch_protection(repository:, branch:, **options)
         client.protect_branch(repository, branch, options)
       end
 
+      def validate_release_assets!(assets)
+        asset_paths = Array(assets)
+        UI.user_error!('You must provide at least one release asset') if asset_paths.empty?
+
+        asset_paths.each do |file_path|
+          UI.user_error!('release_assets must contain file paths') unless file_path.is_a?(String) && !file_path.empty?
+        end
+
+        file_names = asset_paths.map { |file_path| File.basename(file_path) }
+        UI.user_error!('release_assets must not contain duplicate filenames') if file_names.uniq.length != file_names.length
+
+        asset_paths.each do |file_path|
+          UI.user_error!("Can't find file #{file_path}!") unless File.file?(file_path)
+        end
+
+        asset_paths
+      end
+
+      private :validate_release_assets!
+
       # Convert a response from the `/branch-protection` API endpoint into a Hash
       # suitable to be returned and/or reused to pass to a subsequent `/branch-protection` API request
       # @param [Sawyer::Resource] response The API response returned by `#get_branch_protection` or `#set_branch_protection`

lib/fastlane/plugin/wpmreleasetoolkit/version.rb

@@ -3,6 +3,6 @@
 module Fastlane
   module Wpmreleasetoolkit
     NAME = 'fastlane-plugin-wpmreleasetoolkit'
-    VERSION = '14.7.0'
+    VERSION = '14.9.0'
   end
 end