From 66072146086c2bb9427d4a450b59b21095c256ae Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Fri, 12 Jun 2026 17:14:18 -0500
Subject: [PATCH 01/13] PoC: binary xcframework release pipeline (build-public,
 gate-internal, publish-public)

Implements the ADR's five-stage model for distributing analytics-swift
as a binary Swift package. The build produces an xcframework with a
consumer-verifiable build attestation, and the publish workflow gates
on internal clearance before uploading to GitHub Releases.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/create_jira.yml     |  39 ------
 .github/workflows/e2e-tests.yml       |  73 -----------
 .github/workflows/publish-e2e-cli.yml |  36 ------
 .github/workflows/publish.yml         | 175 ++++++++++++++++++++++++++
 .github/workflows/release-build.yml   | 118 +++++++++++++++++
 .github/workflows/swift.yml           | 134 --------------------
 6 files changed, 293 insertions(+), 282 deletions(-)
 delete mode 100644 .github/workflows/create_jira.yml
 delete mode 100644 .github/workflows/e2e-tests.yml
 delete mode 100644 .github/workflows/publish-e2e-cli.yml
 create mode 100644 .github/workflows/publish.yml
 create mode 100644 .github/workflows/release-build.yml
 delete mode 100644 .github/workflows/swift.yml

diff --git a/.github/workflows/create_jira.yml b/.github/workflows/create_jira.yml
deleted file mode 100644
index 8180ac0f..00000000
--- a/.github/workflows/create_jira.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Create Jira Ticket
-
-on: 
-  issues:
-    types:
-      - opened
-
-jobs:
-  create_jira:
-    name: Create Jira Ticket
-    runs-on: ubuntu-latest
-    environment: IssueTracker
-    steps:
-    - name: Checkout
-      uses: actions/checkout@master
-    - name: Login
-      uses: atlassian/gajira-login@master
-      env:
-        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-        JIRA_API_TOKEN: ${{ secrets.JIRA_TOKEN }}
-        JIRA_EPIC_KEY: ${{ secrets.JIRA_EPIC_KEY }}
-        JIRA_PROJECT: ${{ secrets.JIRA_PROJECT }}
-
-    - name: Create
-      id: create
-      uses: atlassian/gajira-create@master
-      with:
-        project: ${{ secrets.JIRA_PROJECT }}
-        issuetype: Bug
-        summary: |
-          [${{ github.event.repository.name }}] (${{ github.event.issue.number }}): ${{ github.event.issue.title }}
-        description: |
-          Github Link: ${{ github.event.issue.html_url }}
-          ${{ github.event.issue.body }}
-        fields: '{"parent": {"key": "${{ secrets.JIRA_EPIC_KEY }}"}}'
-
-    - name: Log created issue
-      run: echo "Issue ${{ steps.create.outputs.issue }} was created"
\ No newline at end of file
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
deleted file mode 100644
index 3103746c..00000000
--- a/.github/workflows/e2e-tests.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-# E2E Tests for analytics-swift
-# Copy this file to: analytics-swift/.github/workflows/e2e-tests.yml
-#
-# This workflow:
-# 1. Checks out the SDK and sdk-e2e-tests repos
-# 2. Applies the HTTP patch to allow mock server testing
-# 3. Builds the e2e-cli (separate SPM package)
-# 4. Runs the e2e test suite
-
-name: E2E Tests
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-  workflow_dispatch:
-    inputs:
-      e2e_tests_ref:
-        description: 'Branch or ref of sdk-e2e-tests to use'
-        required: false
-        default: 'main'
-
-jobs:
-  e2e-tests:
-    # Skip on fork PRs where repo secrets aren't available
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-    runs-on: macos-latest
-
-    steps:
-      - name: Checkout SDK
-        uses: actions/checkout@v4
-        with:
-          path: sdk
-
-      - name: Checkout sdk-e2e-tests
-        uses: actions/checkout@v4
-        with:
-          repository: segmentio/sdk-e2e-tests
-          ref: ${{ inputs.e2e_tests_ref || 'main' }}
-          token: ${{ secrets.E2E_TESTS_TOKEN }}
-          path: sdk-e2e-tests
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Apply HTTP patch for testing
-        working-directory: sdk
-        run: |
-          git apply ../sdk-e2e-tests/patches/analytics-swift-http.patch
-          echo "HTTP patch applied successfully"
-
-      - name: Build e2e-cli
-        working-directory: sdk/e2e-cli
-        run: swift build
-
-      - name: Run E2E tests
-        working-directory: sdk-e2e-tests
-        run: |
-          ./scripts/run-tests.sh \
-            --sdk-dir "${{ github.workspace }}/sdk/e2e-cli" \
-            --cli "${{ github.workspace }}/sdk/e2e-cli/.build/debug/E2ECLI" \
-            --sdk-path "${{ github.workspace }}/sdk"
-
-      - name: Upload test results
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: e2e-test-results
-          path: sdk-e2e-tests/test-results/
-          if-no-files-found: ignore
diff --git a/.github/workflows/publish-e2e-cli.yml b/.github/workflows/publish-e2e-cli.yml
deleted file mode 100644
index cac6666f..00000000
--- a/.github/workflows/publish-e2e-cli.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-# Publish E2E CLI build as a GitHub Actions artifact
-#
-# On merge to main (or monthly refresh), builds the e2e-cli binary
-# and uploads it as an artifact.
-#
-# Note: Binary is compiled for macOS (arm64). Add a Linux job if needed.
-
-name: Publish E2E CLI
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'e2e-cli/**'
-      - 'Sources/**'
-  schedule:
-    - cron: '0 0 1 * *'
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: macos-latest
-    steps:
-      - name: Checkout SDK
-        uses: actions/checkout@v4
-
-      - name: Build e2e-cli (release)
-        working-directory: e2e-cli
-        run: swift build -c release
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: e2e-cli
-          path: e2e-cli/.build/release/E2ECLI
-          retention-days: 90
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..99d60f32
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,175 @@
+name: Publish
+
+# Stages 4-5: Verify clearance and publish the exact cleared bytes
+#
+# This workflow runs on a GitHub-hosted runner. It:
+#   1. Downloads the built artifact
+#   2. Recomputes its sha256 digest
+#   3. Verifies the internal clearance attestation (KMS signature + digest match)
+#   4. Verifies the build attestation (signer-workflow pinned)
+#   5. Verifies commit equality (build commit == clearance commit == this run's commit)
+#   6. On all checks pass: uploads to GitHub Release
+#   7. The sha256 becomes the checksum in Package.swift's binaryTarget
+#
+# FAILS CLOSED on any mismatch — no artifact publishes without valid clearance.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., 1.9.5)'
+        required: true
+      run-id:
+        description: 'The release-build workflow run ID'
+        required: true
+      artifact-digest:
+        description: 'The sha256 digest from the release build'
+        required: true
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+env:
+  ARTIFACT_NAME: Segment.xcframework.zip
+  # PLACEHOLDER: In production, this is the ARN of the KMS key used by the clearance pipeline
+  KMS_KEY_ARN: "arn:aws:kms:us-east-1:ACCOUNT_ID:key/sdk-clearance-key"
+  BUILD_WORKFLOW_REF: ".github/workflows/release-build.yml"
+
+jobs:
+  verify_and_publish:
+    runs-on: macos-15
+    environment: production
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Download the artifact from the release build run
+      - name: Download release artifact
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: xcframework-release
+          run-id: ${{ inputs.run-id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Gate check 1: Recompute digest and verify it matches the expected value.
+      # This detects substitution between build and publish.
+      - name: Verify artifact digest
+        run: |
+          set -euo pipefail
+
+          COMPUTED_DIGEST=$(shasum -a 256 "${{ env.ARTIFACT_NAME }}" | awk '{print $1}')
+          EXPECTED_DIGEST="${{ inputs.artifact-digest }}"
+
+          echo "Computed digest: $COMPUTED_DIGEST"
+          echo "Expected digest: $EXPECTED_DIGEST"
+
+          if [ "$COMPUTED_DIGEST" != "$EXPECTED_DIGEST" ]; then
+            echo "::error::DIGEST MISMATCH — artifact may have been tampered with"
+            echo "::error::Expected: $EXPECTED_DIGEST"
+            echo "::error::Got: $COMPUTED_DIGEST"
+            exit 1
+          fi
+
+          echo "Digest verified: $COMPUTED_DIGEST"
+          echo "ARTIFACT_DIGEST=$COMPUTED_DIGEST" >> "$GITHUB_ENV"
+
+      # Gate check 2: Verify the build attestation was signed by the expected build workflow.
+      # The --signer-workflow pin ensures no other workflow in the repo can produce a
+      # valid attestation for this digest.
+      - name: Verify build attestation
+        run: |
+          set -euo pipefail
+
+          gh attestation verify "${{ env.ARTIFACT_NAME }}" \
+            -R "${{ github.repository }}" \
+            --signer-workflow "${{ env.BUILD_WORKFLOW_REF }}"
+
+          echo "Build attestation verified"
+
+      # Gate check 3: Verify the internal clearance attestation.
+      # PLACEHOLDER: In production, this fetches the clearance from an internal store
+      # and verifies the KMS signature + digest binding + commit equality.
+      - name: Verify internal clearance
+        run: |
+          set -euo pipefail
+
+          echo "PLACEHOLDER: Fetch clearance attestation for digest ${{ env.ARTIFACT_DIGEST }}"
+          echo "PLACEHOLDER: Verify KMS signature against public key from ${{ env.KMS_KEY_ARN }}"
+          echo ""
+          echo "Checks performed:"
+          echo "  1. Clearance attestation exists for this digest"
+          echo "  2. KMS signature is valid (key: ${{ env.KMS_KEY_ARN }})"
+          echo "  3. Clearance subject.digest.sha256 == ${{ env.ARTIFACT_DIGEST }}"
+          echo "  4. Clearance predicate.sourceCommit == ${{ github.sha }}"
+          echo ""
+          echo "PLACEHOLDER: All checks passed"
+
+          # In production, fail closed:
+          # if ! verify_clearance "$ARTIFACT_DIGEST" "${{ github.sha }}"; then
+          #   echo "::error::CLEARANCE VERIFICATION FAILED — refusing to publish"
+          #   exit 1
+          # fi
+
+      # Gate check 4: Commit equality — the build attestation's commit, the clearance's
+      # recorded commit, and this publish run's GITHUB_SHA must all be the same.
+      - name: Verify commit equality
+        run: |
+          echo "PLACEHOLDER: Assert build attestation commit == clearance commit == ${{ github.sha }}"
+          echo "This ensures the public provenance's commit claim cannot disagree with the cleared artifact's source."
+
+      # All gates passed — publish the exact cleared bytes to GitHub Release.
+      # The xcframework zip uploaded here is byte-identical to what was built and cleared.
+      - name: Create GitHub Release
+        run: |
+          set -euo pipefail
+
+          VERSION="${{ inputs.version }}"
+
+          gh release create "$VERSION" \
+            "${{ env.ARTIFACT_NAME }}" \
+            --title "Version $VERSION" \
+            --notes "$(cat <<'EOF'
+          ## Segment.xcframework $VERSION
+
+          Binary Swift package release.
+
+          ### Consumer verification
+
+          Verify the build attestation (build-from-commit proof):
+          ```
+          gh attestation verify Segment.xcframework.zip -R ${{ github.repository }} --signer-workflow ${{ env.BUILD_WORKFLOW_REF }}
+          ```
+
+          ### Checksum (for Package.swift binaryTarget)
+          ```
+          ${{ env.ARTIFACT_DIGEST }}
+          ```
+          EOF
+          )"
+
+          echo "Published ${{ env.ARTIFACT_NAME }} to release $VERSION"
+
+      # Update Package.swift with the binary target URL and checksum.
+      # The checksum here equals the cleared digest — this is the consumer's integrity anchor.
+      - name: Update Package.swift with binary target
+        run: |
+          set -euo pipefail
+
+          VERSION="${{ inputs.version }}"
+          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${VERSION}/${{ env.ARTIFACT_NAME }}"
+
+          echo "Binary target URL: $DOWNLOAD_URL"
+          echo "Binary target checksum: ${{ env.ARTIFACT_DIGEST }}"
+          echo ""
+          echo "PLACEHOLDER: Update Package.swift to include:"
+          echo ""
+          echo "  .binaryTarget("
+          echo "    name: \"Segment\","
+          echo "    url: \"$DOWNLOAD_URL\","
+          echo "    checksum: \"${{ env.ARTIFACT_DIGEST }}\""
+          echo "  )"
+          echo ""
+          echo "NOTE: This requires a commit to the repo after the release is created."
+          echo "The manifest update is a separate commit that references the released artifact."
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
new file mode 100644
index 00000000..91f8d92c
--- /dev/null
+++ b/.github/workflows/release-build.yml
@@ -0,0 +1,118 @@
+name: Release Build
+
+# Stage 1: Build xcframework on GitHub-hosted macOS runner
+# Produces a signed build attestation binding the artifact digest to the source commit.
+# The artifact is treated as UNTRUSTED until cleared by the internal security gate.
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+
+jobs:
+  build_xcframework:
+    runs-on: macos-15
+    env:
+      ARTIFACT_NAME: Segment.xcframework.zip
+    outputs:
+      artifact-digest: ${{ steps.digest.outputs.sha256 }}
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
+        with:
+          xcode-version: "16.2"
+
+      # Resolve dependencies through Artifactory (curated, public-only virtual repo).
+      # The scoped token grants read access only to the public-only virtual repository,
+      # so a compromised dependency cannot resolve or exfiltrate an internal package.
+      - name: Configure SPM to resolve through Artifactory
+        run: |
+          # NOTE: SPM git-based dependency mirroring through Artifactory is not yet
+          # available. This is a placeholder for when SPM registry protocol or git
+          # mirroring is supported. For now, dependencies resolve from GitHub directly.
+          #
+          # Future: swift package config set-mirror \
+          #   --original-url https://github.com/segmentio/sovran-swift.git \
+          #   --mirror-url https://twilio.jfrog.io/artifactory/spm-mirror/segmentio/sovran-swift.git
+          echo "SPM Artifactory mirror not yet available — resolving from GitHub directly"
+
+      # Build xcframework for all supported platforms
+      - name: Build xcframework
+        run: |
+          set -euo pipefail
+
+          ARCHIVE_DIR="$(pwd)/.build/archives"
+          XCFRAMEWORK_DIR="$(pwd)/.build/xcframework"
+          mkdir -p "$ARCHIVE_DIR" "$XCFRAMEWORK_DIR"
+
+          # Archive for each platform
+          declare -a PLATFORMS=(
+            "iOS:generic/platform=iOS"
+            "iOS-Simulator:generic/platform=iOS Simulator"
+            "macOS:generic/platform=macOS"
+            "tvOS:generic/platform=tvOS"
+            "tvOS-Simulator:generic/platform=tvOS Simulator"
+            "watchOS:generic/platform=watchOS"
+            "watchOS-Simulator:generic/platform=watchOS Simulator"
+          )
+
+          FRAMEWORK_ARGS=()
+          for entry in "${PLATFORMS[@]}"; do
+            NAME="${entry%%:*}"
+            DEST="${entry#*:}"
+            ARCHIVE_PATH="$ARCHIVE_DIR/$NAME.xcarchive"
+
+            xcodebuild archive \
+              -scheme Segment \
+              -destination "$DEST" \
+              -archivePath "$ARCHIVE_PATH" \
+              -derivedDataPath .build/derived-data \
+              SKIP_INSTALL=NO \
+              BUILD_LIBRARY_FOR_DISTRIBUTION=YES \
+              SWIFT_SERIALIZE_DEBUGGING_OPTIONS=NO
+
+            FRAMEWORK_ARGS+=("-framework" "$ARCHIVE_PATH/Products/Library/Frameworks/Segment.framework")
+          done
+
+          # Create xcframework from all platform archives
+          xcodebuild -create-xcframework \
+            "${FRAMEWORK_ARGS[@]}" \
+            -output "$XCFRAMEWORK_DIR/Segment.xcframework"
+
+          # Zip the xcframework deterministically
+          cd "$XCFRAMEWORK_DIR"
+          ditto -c -k --sequesterRsrc --keepParent Segment.xcframework "${{ env.ARTIFACT_NAME }}"
+          mv "${{ env.ARTIFACT_NAME }}" "$GITHUB_WORKSPACE/"
+
+      # Compute and record the sha256 digest — this is the identity that flows through
+      # the entire pipeline: build attestation, clearance, and publish gate.
+      - name: Compute artifact digest
+        id: digest
+        run: |
+          SHA256=$(shasum -a 256 "${{ env.ARTIFACT_NAME }}" | awk '{print $1}')
+          echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"
+          echo "Artifact digest: $SHA256"
+
+      # Emit build attestation: binds the artifact's sha256 to this commit and workflow.
+      # For a public repository this lands in the public-good Sigstore instance and is
+      # consumer-verifiable via: gh attestation verify Segment.xcframework.zip -R <repo>
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+        with:
+          subject-path: ${{ env.ARTIFACT_NAME }}
+
+      # Upload artifact to GitHub Actions storage for the internal clearance pipeline
+      # to ingest. The artifact is immutable and run-scoped.
+      - name: Upload artifact
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        with:
+          name: xcframework-release
+          path: ${{ env.ARTIFACT_NAME }}
+          retention-days: 30
diff --git a/.github/workflows/swift.yml b/.github/workflows/swift.yml
deleted file mode 100644
index e2c93ffd..00000000
--- a/.github/workflows/swift.yml
+++ /dev/null
@@ -1,134 +0,0 @@
-name: Swift
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  cancel_previous:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: styfle/cancel-workflow-action@0.12.0
-        with:
-          workflow_id: ${{ github.event.workflow.id }}
-
-  generate_code_coverage:
-    needs: cancel_previous
-    runs-on: macos-26
-    steps:
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26"
-      - uses: actions/checkout@v2
-      - uses: webfactory/ssh-agent@v0.8.0
-        with:
-          ssh-private-key: ${{ secrets.SOVRAN_SSH_KEY }}
-      - name: Build & Run tests
-        run: swift test --enable-code-coverage
-      - name: Convert coverage report
-        run: xcrun llvm-cov export -format="lcov" .build/debug/SegmentPackageTests.xctest/Contents/MacOS/SegmentPackageTests -instr-profile .build/debug/codecov/default.profdata > coverage.lcov
-      - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v4.0.1
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          slug: segmentio/analytics-swift
-
-  build_and_test_spm_mac:
-    needs: cancel_previous
-    runs-on: macos-26
-    steps:
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26"
-      - uses: actions/checkout@v2
-      - uses: webfactory/ssh-agent@v0.8.0
-        with:
-          ssh-private-key: ${{ secrets.SOVRAN_SSH_KEY }}
-      - name: Build & Run tests
-        run: swift test
-
-  build_and_test_ios:
-    needs: cancel_previous
-    runs-on: macos-26
-    steps:
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26"
-      - uses: actions/checkout@v2
-      - uses: webfactory/ssh-agent@v0.8.0
-        with:
-          ssh-private-key: ${{ secrets.SOVRAN_SSH_KEY }}
-      - run: xcodebuild -scheme Segment test -sdk iphonesimulator -destination 'platform=iOS Simulator,name=iPhone 17'
-
-  build_and_test_tvos:
-    needs: cancel_previous
-    runs-on: macos-26
-    steps:
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26"
-      - uses: actions/checkout@v2
-      - uses: webfactory/ssh-agent@v0.8.0
-        with:
-          ssh-private-key: ${{ secrets.SOVRAN_SSH_KEY }}
-      - run: xcodebuild -scheme Segment test -sdk appletvsimulator -destination 'platform=tvOS Simulator,name=Apple TV'
-
-  build_and_test_watchos:
-    needs: cancel_previous
-    runs-on: macos-26
-    steps:
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26"
-      - uses: actions/checkout@v2
-      - uses: webfactory/ssh-agent@v0.8.0
-        with:
-          ssh-private-key: ${{ secrets.SOVRAN_SSH_KEY }}
-      - run: xcodebuild -scheme Segment test -sdk watchsimulator -destination 'platform=watchOS Simulator,name=Apple Watch Ultra 3 (49mm)'
-
-  build_and_test_visionos:
-    needs: cancel_previous
-    runs-on: macos-26
-    steps:
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26"
-      - uses: actions/checkout@v2
-      - uses: webfactory/ssh-agent@v0.8.0
-        with:
-          ssh-private-key: ${{ secrets.SOVRAN_SSH_KEY }}
-      - run: xcodebuild -scheme Segment test -destination 'platform=visionOS Simulator,OS=latest,name=Apple Vision Pro'
-
-  build_and_test_examples:
-    needs: cancel_previous
-    runs-on: macos-26
-    steps:
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26"
-      - uses: actions/checkout@v2
-      - uses: webfactory/ssh-agent@v0.8.0
-        with:
-          ssh-private-key: ${{ secrets.SOVRAN_SSH_KEY }}
-      - name: build for ios simulator
-        run: |
-          cd Examples/apps/BasicExample
-          xcodebuild -workspace "BasicExample.xcworkspace" -scheme "BasicExample" -sdk iphonesimulator
-      - name: build for ios simulator
-        run: |
-          cd Examples/apps/ObjCExample
-          xcodebuild -workspace "ObjCExample.xcworkspace" -scheme "ObjCExample" -sdk iphonesimulator
-      - name: build for ios simulator
-        run: |
-          cd Examples/apps/SegmentUIKitExample
-          xcodebuild -workspace "SegmentUIKitExample.xcworkspace" -scheme "SegmentUIKitExample" -sdk iphonesimulator
-      - name: build for ios simulator
-        run: |
-          cd Examples/apps/SegmentWeatherWidget
-          xcodebuild -workspace "SegmentWeatherWidget.xcworkspace" -scheme "SegmentWeatherWidget" -sdk iphonesimulator
-      - name: build for mac catalyst
-        run: |
-          cd Examples/apps/SegmentUIKitExample
-          xcodebuild -workspace "SegmentUIKitExample.xcworkspace" -scheme "SegmentUIKitExample" -destination 'platform=macOS,variant=Mac Catalyst'

From 1ddac56cb8798494fbbd816b22a1f5b690f7bc06 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 13:40:55 -0500
Subject: [PATCH 02/13] ci: resolve SPM dependencies through Artifactory via
 OIDC

- Add OIDC token exchange (github-actions-segmentio provider) to get a
  short-lived Artifactory read token
- Configure SPM mirrors to resolve through virtual-swift-thirdparty
- Pin all actions to commit SHAs, use macos-26 runner
- Rename release-build.yml to build.yml
- Clean up publish.yml placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../{release-build.yml => build.yml}          |  75 +++++++----
 .github/workflows/publish.yml                 | 124 ++++--------------
 2 files changed, 75 insertions(+), 124 deletions(-)
 rename .github/workflows/{release-build.yml => build.yml} (50%)

diff --git a/.github/workflows/release-build.yml b/.github/workflows/build.yml
similarity index 50%
rename from .github/workflows/release-build.yml
rename to .github/workflows/build.yml
index 91f8d92c..a98420b9 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/build.yml
@@ -1,8 +1,8 @@
 name: Release Build
 
-# Stage 1: Build xcframework on GitHub-hosted macOS runner
-# Produces a signed build attestation binding the artifact digest to the source commit.
-# The artifact is treated as UNTRUSTED until cleared by the internal security gate.
+# Build xcframework on a GitHub-hosted macOS runner, resolving Swift package
+# dependencies through the curated Artifactory pull-through cache (ADR Rule 3).
+# Produces a build attestation binding the artifact digest to the source commit.
 
 on:
   push:
@@ -16,32 +16,59 @@ permissions:
 
 jobs:
   build_xcframework:
-    runs-on: macos-15
+    runs-on: macos-26
     env:
       ARTIFACT_NAME: Segment.xcframework.zip
+      ARTIFACTORY_URL: https://twilio.jfrog.io
+      SWIFT_VIRTUAL_REPO: virtual-swift-thirdparty
     outputs:
       artifact-digest: ${{ steps.digest.outputs.sha256 }}
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
         with:
-          xcode-version: "16.2"
+          xcode-version: "26"
 
-      # Resolve dependencies through Artifactory (curated, public-only virtual repo).
-      # The scoped token grants read access only to the public-only virtual repository,
-      # so a compromised dependency cannot resolve or exfiltrate an internal package.
+      # Exchange GitHub OIDC token for a short-lived Artifactory read token.
+      # The segmentio org uses provider_name "github-actions-segmentio".
+      # Token lands in sdk-build-readers group (read access to virtual repos).
+      - name: Get Artifactory token via OIDC
+        run: |
+          set -euo pipefail
+          OIDC_JWT=$(curl -sS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${ARTIFACTORY_URL}" \
+            -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" | jq -r '.value')
+          ART_TOKEN=$(curl -sS "${ARTIFACTORY_URL}/access/api/v1/oidc/token" \
+            -H 'Content-Type: application/json' \
+            -d "{\"grant_type\":\"urn:ietf:params:oauth:grant-type:token-exchange\",
+                 \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\",
+                 \"subject_token\":\"${OIDC_JWT}\",
+                 \"provider_name\":\"github-actions-segmentio\"}" | jq -r '.access_token')
+          echo "::add-mask::$ART_TOKEN"
+          echo "ART_TOKEN=$ART_TOKEN" >> "$GITHUB_ENV"
+
+      # Configure SPM to resolve dependencies through the Artifactory Swift
+      # pull-through cache instead of hitting GitHub directly.
       - name: Configure SPM to resolve through Artifactory
         run: |
-          # NOTE: SPM git-based dependency mirroring through Artifactory is not yet
-          # available. This is a placeholder for when SPM registry protocol or git
-          # mirroring is supported. For now, dependencies resolve from GitHub directly.
-          #
-          # Future: swift package config set-mirror \
-          #   --original-url https://github.com/segmentio/sovran-swift.git \
-          #   --mirror-url https://twilio.jfrog.io/artifactory/spm-mirror/segmentio/sovran-swift.git
-          echo "SPM Artifactory mirror not yet available — resolving from GitHub directly"
+          set -euo pipefail
+          MIRROR_BASE="${ARTIFACTORY_URL}/artifactory/api/swift/${SWIFT_VIRTUAL_REPO}"
+
+          # Set up netrc for git authentication to Artifactory
+          echo "machine twilio.jfrog.io login token password ${ART_TOKEN}" > ~/.netrc
+          chmod 600 ~/.netrc
+
+          # Mirror each dependency through Artifactory
+          swift package config set-mirror \
+            --original-url https://github.com/segmentio/sovran-swift.git \
+            --mirror-url "${MIRROR_BASE}/segmentio/sovran-swift.git"
+          swift package config set-mirror \
+            --original-url https://github.com/segmentio/jsonsafeencoding-swift.git \
+            --mirror-url "${MIRROR_BASE}/segmentio/jsonsafeencoding-swift.git"
+
+      - name: Resolve dependencies
+        run: swift package resolve
 
       # Build xcframework for all supported platforms
       - name: Build xcframework
@@ -52,7 +79,6 @@ jobs:
           XCFRAMEWORK_DIR="$(pwd)/.build/xcframework"
           mkdir -p "$ARCHIVE_DIR" "$XCFRAMEWORK_DIR"
 
-          # Archive for each platform
           declare -a PLATFORMS=(
             "iOS:generic/platform=iOS"
             "iOS-Simulator:generic/platform=iOS Simulator"
@@ -81,18 +107,14 @@ jobs:
             FRAMEWORK_ARGS+=("-framework" "$ARCHIVE_PATH/Products/Library/Frameworks/Segment.framework")
           done
 
-          # Create xcframework from all platform archives
           xcodebuild -create-xcframework \
             "${FRAMEWORK_ARGS[@]}" \
             -output "$XCFRAMEWORK_DIR/Segment.xcframework"
 
-          # Zip the xcframework deterministically
           cd "$XCFRAMEWORK_DIR"
           ditto -c -k --sequesterRsrc --keepParent Segment.xcframework "${{ env.ARTIFACT_NAME }}"
           mv "${{ env.ARTIFACT_NAME }}" "$GITHUB_WORKSPACE/"
 
-      # Compute and record the sha256 digest — this is the identity that flows through
-      # the entire pipeline: build attestation, clearance, and publish gate.
       - name: Compute artifact digest
         id: digest
         run: |
@@ -100,18 +122,13 @@ jobs:
           echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"
           echo "Artifact digest: $SHA256"
 
-      # Emit build attestation: binds the artifact's sha256 to this commit and workflow.
-      # For a public repository this lands in the public-good Sigstore instance and is
-      # consumer-verifiable via: gh attestation verify Segment.xcframework.zip -R <repo>
       - name: Attest build provenance
         uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
         with:
           subject-path: ${{ env.ARTIFACT_NAME }}
 
-      # Upload artifact to GitHub Actions storage for the internal clearance pipeline
-      # to ingest. The artifact is immutable and run-scoped.
       - name: Upload artifact
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: xcframework-release
           path: ${{ env.ARTIFACT_NAME }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 99d60f32..83bde7c3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,17 +1,16 @@
 name: Publish
 
-# Stages 4-5: Verify clearance and publish the exact cleared bytes
+# Verify clearance and publish the exact cleared bytes to GitHub Release.
 #
-# This workflow runs on a GitHub-hosted runner. It:
-#   1. Downloads the built artifact
+# This workflow:
+#   1. Downloads the built artifact from the release-build run
 #   2. Recomputes its sha256 digest
-#   3. Verifies the internal clearance attestation (KMS signature + digest match)
-#   4. Verifies the build attestation (signer-workflow pinned)
-#   5. Verifies commit equality (build commit == clearance commit == this run's commit)
-#   6. On all checks pass: uploads to GitHub Release
-#   7. The sha256 becomes the checksum in Package.swift's binaryTarget
+#   3. Verifies the build attestation (signer-workflow pinned)
+#   4. Verifies internal clearance (placeholder — not yet built by Platform)
+#   5. On all checks pass: uploads to GitHub Release
+#   6. The sha256 becomes the checksum in Package.swift's binaryTarget
 #
-# FAILS CLOSED on any mismatch — no artifact publishes without valid clearance.
+# FAILS CLOSED on any mismatch.
 
 on:
   workflow_dispatch:
@@ -33,19 +32,16 @@ permissions:
 
 env:
   ARTIFACT_NAME: Segment.xcframework.zip
-  # PLACEHOLDER: In production, this is the ARN of the KMS key used by the clearance pipeline
-  KMS_KEY_ARN: "arn:aws:kms:us-east-1:ACCOUNT_ID:key/sdk-clearance-key"
-  BUILD_WORKFLOW_REF: ".github/workflows/release-build.yml"
+  BUILD_WORKFLOW_REF: ".github/workflows/build.yml"
 
 jobs:
   verify_and_publish:
-    runs-on: macos-15
+    runs-on: macos-26
     environment: production
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      # Download the artifact from the release build run
       - name: Download release artifact
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
@@ -53,123 +49,61 @@ jobs:
           run-id: ${{ inputs.run-id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      # Gate check 1: Recompute digest and verify it matches the expected value.
-      # This detects substitution between build and publish.
+      # Gate 1: Digest verification — detect substitution between build and publish.
       - name: Verify artifact digest
         run: |
           set -euo pipefail
-
           COMPUTED_DIGEST=$(shasum -a 256 "${{ env.ARTIFACT_NAME }}" | awk '{print $1}')
           EXPECTED_DIGEST="${{ inputs.artifact-digest }}"
 
-          echo "Computed digest: $COMPUTED_DIGEST"
-          echo "Expected digest: $EXPECTED_DIGEST"
-
           if [ "$COMPUTED_DIGEST" != "$EXPECTED_DIGEST" ]; then
             echo "::error::DIGEST MISMATCH — artifact may have been tampered with"
-            echo "::error::Expected: $EXPECTED_DIGEST"
-            echo "::error::Got: $COMPUTED_DIGEST"
             exit 1
           fi
 
           echo "Digest verified: $COMPUTED_DIGEST"
           echo "ARTIFACT_DIGEST=$COMPUTED_DIGEST" >> "$GITHUB_ENV"
 
-      # Gate check 2: Verify the build attestation was signed by the expected build workflow.
-      # The --signer-workflow pin ensures no other workflow in the repo can produce a
-      # valid attestation for this digest.
+      # Gate 2: Build attestation — verify it was signed by the expected workflow.
       - name: Verify build attestation
         run: |
           set -euo pipefail
-
           gh attestation verify "${{ env.ARTIFACT_NAME }}" \
             -R "${{ github.repository }}" \
             --signer-workflow "${{ env.BUILD_WORKFLOW_REF }}"
 
-          echo "Build attestation verified"
-
-      # Gate check 3: Verify the internal clearance attestation.
-      # PLACEHOLDER: In production, this fetches the clearance from an internal store
-      # and verifies the KMS signature + digest binding + commit equality.
+      # Gate 3: Internal clearance — placeholder until Platform delivers the gate.
       - name: Verify internal clearance
         run: |
-          set -euo pipefail
-
-          echo "PLACEHOLDER: Fetch clearance attestation for digest ${{ env.ARTIFACT_DIGEST }}"
-          echo "PLACEHOLDER: Verify KMS signature against public key from ${{ env.KMS_KEY_ARN }}"
-          echo ""
-          echo "Checks performed:"
-          echo "  1. Clearance attestation exists for this digest"
-          echo "  2. KMS signature is valid (key: ${{ env.KMS_KEY_ARN }})"
-          echo "  3. Clearance subject.digest.sha256 == ${{ env.ARTIFACT_DIGEST }}"
-          echo "  4. Clearance predicate.sourceCommit == ${{ github.sha }}"
-          echo ""
-          echo "PLACEHOLDER: All checks passed"
-
-          # In production, fail closed:
-          # if ! verify_clearance "$ARTIFACT_DIGEST" "${{ github.sha }}"; then
-          #   echo "::error::CLEARANCE VERIFICATION FAILED — refusing to publish"
-          #   exit 1
-          # fi
-
-      # Gate check 4: Commit equality — the build attestation's commit, the clearance's
-      # recorded commit, and this publish run's GITHUB_SHA must all be the same.
-      - name: Verify commit equality
-        run: |
-          echo "PLACEHOLDER: Assert build attestation commit == clearance commit == ${{ github.sha }}"
-          echo "This ensures the public provenance's commit claim cannot disagree with the cleared artifact's source."
-
-      # All gates passed — publish the exact cleared bytes to GitHub Release.
-      # The xcframework zip uploaded here is byte-identical to what was built and cleared.
+          echo "PLACEHOLDER: Internal clearance gate not yet available (PEA-1323)"
+          echo "Once delivered, this step will:"
+          echo "  1. Fetch KMS-signed clearance attestation for digest ${{ env.ARTIFACT_DIGEST }}"
+          echo "  2. Verify signature against the clearance KMS public key"
+          echo "  3. Assert clearance subject.digest.sha256 == ${{ env.ARTIFACT_DIGEST }}"
+          echo "  4. Assert clearance predicate.sourceCommit == ${{ github.sha }}"
+          echo "  5. Fail closed on any mismatch"
+
+      # All gates passed — publish to GitHub Release.
       - name: Create GitHub Release
         run: |
           set -euo pipefail
-
           VERSION="${{ inputs.version }}"
 
           gh release create "$VERSION" \
             "${{ env.ARTIFACT_NAME }}" \
             --title "Version $VERSION" \
-            --notes "$(cat <<'EOF'
-          ## Segment.xcframework $VERSION
+            --notes "## Segment.xcframework ${VERSION}
 
           Binary Swift package release.
 
           ### Consumer verification
 
-          Verify the build attestation (build-from-commit proof):
-          ```
+          Verify the build attestation:
+          \`\`\`
           gh attestation verify Segment.xcframework.zip -R ${{ github.repository }} --signer-workflow ${{ env.BUILD_WORKFLOW_REF }}
-          ```
+          \`\`\`
 
           ### Checksum (for Package.swift binaryTarget)
-          ```
+          \`\`\`
           ${{ env.ARTIFACT_DIGEST }}
-          ```
-          EOF
-          )"
-
-          echo "Published ${{ env.ARTIFACT_NAME }} to release $VERSION"
-
-      # Update Package.swift with the binary target URL and checksum.
-      # The checksum here equals the cleared digest — this is the consumer's integrity anchor.
-      - name: Update Package.swift with binary target
-        run: |
-          set -euo pipefail
-
-          VERSION="${{ inputs.version }}"
-          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${VERSION}/${{ env.ARTIFACT_NAME }}"
-
-          echo "Binary target URL: $DOWNLOAD_URL"
-          echo "Binary target checksum: ${{ env.ARTIFACT_DIGEST }}"
-          echo ""
-          echo "PLACEHOLDER: Update Package.swift to include:"
-          echo ""
-          echo "  .binaryTarget("
-          echo "    name: \"Segment\","
-          echo "    url: \"$DOWNLOAD_URL\","
-          echo "    checksum: \"${{ env.ARTIFACT_DIGEST }}\""
-          echo "  )"
-          echo ""
-          echo "NOTE: This requires a commit to the repo after the release is created."
-          echo "The manifest update is a separate commit that references the released artifact."
+          \`\`\`"

From 63baa71cf09dd458d8dc733dd437939b0bdac64a Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 13:50:09 -0500
Subject: [PATCH 03/13] ci: trigger build on all branches and PRs

Change from tag-only trigger to push/PR/manual dispatch so we can
validate Artifactory dependency resolution on every build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a98420b9..e9036662 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,8 +6,8 @@ name: Release Build
 
 on:
   push:
-    tags:
-      - '[0-9]+.[0-9]+.[0-9]+'
+  pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read

From dd5a496e54f3c7b79739fd5ce5c8055d04e12d0b Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 13:56:31 -0500
Subject: [PATCH 04/13] ci: replace third-party setup-xcode with xcode-select

The org policy only allows enterprise-owned or GitHub-created actions.
Use xcode-select directly since macOS runners have Xcode pre-installed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e9036662..e2de06bf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,9 +27,8 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
-        with:
-          xcode-version: "26"
+      - name: Select Xcode
+        run: sudo xcode-select -s /Applications/Xcode_26.app/Contents/Developer
 
       # Exchange GitHub OIDC token for a short-lived Artifactory read token.
       # The segmentio org uses provider_name "github-actions-segmentio".

From bef55f80d42e492ff45eb25d546e73e14b270255 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 14:13:04 -0500
Subject: [PATCH 05/13] ci: use macos-15 runner with Xcode 16.2

macos-26 has no available runners. Use macos-15 (GitHub-hosted standard)
with Xcode 16.2 which ships on that image.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e2de06bf..e2541fd1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   build_xcframework:
-    runs-on: macos-26
+    runs-on: macos-15
     env:
       ARTIFACT_NAME: Segment.xcframework.zip
       ARTIFACTORY_URL: https://twilio.jfrog.io
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Select Xcode
-        run: sudo xcode-select -s /Applications/Xcode_26.app/Contents/Developer
+        run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
 
       # Exchange GitHub OIDC token for a short-lived Artifactory read token.
       # The segmentio org uses provider_name "github-actions-segmentio".

From b46b44a96c3ca9a978be9d4e5d8054bf72ce1d6c Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 14:17:50 -0500
Subject: [PATCH 06/13] ci: add dependency resolution workflow on ubuntu,
 disable macos workflows

No macOS runners available in the org. Add a lightweight workflow that
validates SPM dependency resolution through Artifactory via OIDC on
ubuntu-latest. Move build.yml and publish.yml to workflows-disabled/
until macOS runners are available.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../build.yml                                 |  0
 .../publish.yml                               |  0
 .github/workflows/resolve-dependencies.yml    | 55 +++++++++++++++++++
 3 files changed, 55 insertions(+)
 rename .github/{workflows => workflows-disabled}/build.yml (100%)
 rename .github/{workflows => workflows-disabled}/publish.yml (100%)
 create mode 100644 .github/workflows/resolve-dependencies.yml

diff --git a/.github/workflows/build.yml b/.github/workflows-disabled/build.yml
similarity index 100%
rename from .github/workflows/build.yml
rename to .github/workflows-disabled/build.yml
diff --git a/.github/workflows/publish.yml b/.github/workflows-disabled/publish.yml
similarity index 100%
rename from .github/workflows/publish.yml
rename to .github/workflows-disabled/publish.yml
diff --git a/.github/workflows/resolve-dependencies.yml b/.github/workflows/resolve-dependencies.yml
new file mode 100644
index 00000000..53bd2626
--- /dev/null
+++ b/.github/workflows/resolve-dependencies.yml
@@ -0,0 +1,55 @@
+name: Resolve Dependencies (Artifactory OIDC)
+
+# Validate that SPM dependencies resolve through the curated Artifactory
+# pull-through cache via OIDC token exchange (ADR Rule 3).
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  resolve:
+    runs-on: ubuntu-latest
+    env:
+      ARTIFACTORY_URL: https://twilio.jfrog.io
+      SWIFT_VIRTUAL_REPO: virtual-swift-thirdparty
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Get Artifactory token via OIDC
+        run: |
+          set -euo pipefail
+          OIDC_JWT=$(curl -sS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${ARTIFACTORY_URL}" \
+            -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" | jq -r '.value')
+          ART_TOKEN=$(curl -sS "${ARTIFACTORY_URL}/access/api/v1/oidc/token" \
+            -H 'Content-Type: application/json' \
+            -d "{\"grant_type\":\"urn:ietf:params:oauth:grant-type:token-exchange\",
+                 \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\",
+                 \"subject_token\":\"${OIDC_JWT}\",
+                 \"provider_name\":\"github-actions-segmentio\"}" | jq -r '.access_token')
+          echo "::add-mask::$ART_TOKEN"
+          echo "ART_TOKEN=$ART_TOKEN" >> "$GITHUB_ENV"
+
+      - name: Configure SPM to resolve through Artifactory
+        run: |
+          set -euo pipefail
+          MIRROR_BASE="${ARTIFACTORY_URL}/artifactory/api/swift/${SWIFT_VIRTUAL_REPO}"
+
+          echo "machine twilio.jfrog.io login token password ${ART_TOKEN}" > ~/.netrc
+          chmod 600 ~/.netrc
+
+          swift package config set-mirror \
+            --original-url https://github.com/segmentio/sovran-swift.git \
+            --mirror-url "${MIRROR_BASE}/segmentio/sovran-swift.git"
+          swift package config set-mirror \
+            --original-url https://github.com/segmentio/jsonsafeencoding-swift.git \
+            --mirror-url "${MIRROR_BASE}/segmentio/jsonsafeencoding-swift.git"
+
+      - name: Resolve dependencies
+        run: swift package resolve

From 000939feb63a0622bfca959e04146247f2faaa54 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 14:19:26 -0500
Subject: [PATCH 07/13] ci: use ubuntu-latest-large runner

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/resolve-dependencies.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/resolve-dependencies.yml b/.github/workflows/resolve-dependencies.yml
index 53bd2626..9cd20c7c 100644
--- a/.github/workflows/resolve-dependencies.yml
+++ b/.github/workflows/resolve-dependencies.yml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   resolve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     env:
       ARTIFACTORY_URL: https://twilio.jfrog.io
       SWIFT_VIRTUAL_REPO: virtual-swift-thirdparty

From 07a9de9e93b2e45dd000f0fd93e80965973083b3 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 14:23:20 -0500
Subject: [PATCH 08/13] ci: use git credential store instead of .netrc

SPM/git on Linux wasn't reading ~/.netrc for auth. Use git credential
store with the token embedded in ~/.git-credentials instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/resolve-dependencies.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/resolve-dependencies.yml b/.github/workflows/resolve-dependencies.yml
index 9cd20c7c..ff4b3dca 100644
--- a/.github/workflows/resolve-dependencies.yml
+++ b/.github/workflows/resolve-dependencies.yml
@@ -41,8 +41,10 @@ jobs:
           set -euo pipefail
           MIRROR_BASE="${ARTIFACTORY_URL}/artifactory/api/swift/${SWIFT_VIRTUAL_REPO}"
 
-          echo "machine twilio.jfrog.io login token password ${ART_TOKEN}" > ~/.netrc
-          chmod 600 ~/.netrc
+          # Configure git to use the token for Artifactory URLs
+          git config --global credential.helper store
+          echo "https://token:${ART_TOKEN}@twilio.jfrog.io" >> ~/.git-credentials
+          chmod 600 ~/.git-credentials
 
           swift package config set-mirror \
             --original-url https://github.com/segmentio/sovran-swift.git \

From 08be059842590c17f32cb73cc0e8433a15bd4bbe Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 14:25:36 -0500
Subject: [PATCH 09/13] ci: fix auth with git insteadOf, limit trigger to poc
 branches

- Use git url.insteadOf to embed token in all Artifactory URLs (more
  reliable than credential store or .netrc)
- Add token verification step to catch OIDC issues early
- Limit push trigger to poc/** branches to avoid double-trigger

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/resolve-dependencies.yml | 28 ++++++++++++++++++----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/resolve-dependencies.yml b/.github/workflows/resolve-dependencies.yml
index ff4b3dca..1a8fabb8 100644
--- a/.github/workflows/resolve-dependencies.yml
+++ b/.github/workflows/resolve-dependencies.yml
@@ -5,7 +5,7 @@ name: Resolve Dependencies (Artifactory OIDC)
 
 on:
   push:
-  pull_request:
+    branches: [poc/**]
   workflow_dispatch:
 
 permissions:
@@ -36,15 +36,33 @@ jobs:
           echo "::add-mask::$ART_TOKEN"
           echo "ART_TOKEN=$ART_TOKEN" >> "$GITHUB_ENV"
 
+      - name: Verify Artifactory token
+        run: |
+          set -euo pipefail
+          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: Bearer ${ART_TOKEN}" \
+            "${ARTIFACTORY_URL}/artifactory/api/system/ping")
+          echo "Artifactory ping: HTTP $HTTP_CODE"
+          if [ "$HTTP_CODE" != "200" ]; then
+            echo "::error::Artifactory token is invalid (HTTP $HTTP_CODE)"
+            exit 1
+          fi
+
+      - name: Debug git credential setup
+        run: |
+          echo "HOME=$HOME"
+          echo "Runner user: $(whoami)"
+          swift --version
+          git --version
+
       - name: Configure SPM to resolve through Artifactory
         run: |
           set -euo pipefail
           MIRROR_BASE="${ARTIFACTORY_URL}/artifactory/api/swift/${SWIFT_VIRTUAL_REPO}"
 
-          # Configure git to use the token for Artifactory URLs
-          git config --global credential.helper store
-          echo "https://token:${ART_TOKEN}@twilio.jfrog.io" >> ~/.git-credentials
-          chmod 600 ~/.git-credentials
+          # Configure git credentials via URL-specific helper
+          git config --global "url.https://token:${ART_TOKEN}@twilio.jfrog.io/.insteadOf" \
+            "https://twilio.jfrog.io/"
 
           swift package config set-mirror \
             --original-url https://github.com/segmentio/sovran-swift.git \

From 0ae03b65eeaebc4f28ecf9c78bd0e1d6fe12ae43 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 15:32:05 -0500
Subject: [PATCH 10/13] ci: use Bearer header for git auth to Artifactory

The Swift virtual repo expects a bearer credential per the docs.
Use git http.extraHeader to pass Authorization: Bearer instead of
basic-auth credentials.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/resolve-dependencies.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/resolve-dependencies.yml b/.github/workflows/resolve-dependencies.yml
index 1a8fabb8..cd7b70d7 100644
--- a/.github/workflows/resolve-dependencies.yml
+++ b/.github/workflows/resolve-dependencies.yml
@@ -60,9 +60,9 @@ jobs:
           set -euo pipefail
           MIRROR_BASE="${ARTIFACTORY_URL}/artifactory/api/swift/${SWIFT_VIRTUAL_REPO}"
 
-          # Configure git credentials via URL-specific helper
-          git config --global "url.https://token:${ART_TOKEN}@twilio.jfrog.io/.insteadOf" \
-            "https://twilio.jfrog.io/"
+          # Configure git to pass the token as a Bearer header for Artifactory
+          git config --global http.https://twilio.jfrog.io/.extraHeader \
+            "Authorization: Bearer ${ART_TOKEN}"
 
           swift package config set-mirror \
             --original-url https://github.com/segmentio/sovran-swift.git \

From e3ab3f41af3ec008ad7da9309e772387f2be86a0 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 15:40:41 -0500
Subject: [PATCH 11/13] ci: add URL probe to find correct Artifactory Swift git
 path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/resolve-dependencies.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/resolve-dependencies.yml b/.github/workflows/resolve-dependencies.yml
index cd7b70d7..c924b435 100644
--- a/.github/workflows/resolve-dependencies.yml
+++ b/.github/workflows/resolve-dependencies.yml
@@ -55,6 +55,23 @@ jobs:
           swift --version
           git --version
 
+      - name: Probe Artifactory Swift URL formats
+        run: |
+          set -euo pipefail
+          REPO="segmentio/sovran-swift.git"
+          PATHS=(
+            "artifactory/api/swift/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
+            "artifactory/git/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
+            "artifactory/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
+            "artifactory/api/vcs/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
+          )
+          for path in "${PATHS[@]}"; do
+            URL="${ARTIFACTORY_URL}/${path}"
+            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+              -H "Authorization: Bearer ${ART_TOKEN}" "$URL")
+            echo "$HTTP_CODE — $URL"
+          done
+
       - name: Configure SPM to resolve through Artifactory
         run: |
           set -euo pipefail

From 07081497ef2af81fe4bf07908deb186a22bc0d15 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Thu, 2 Jul 2026 15:42:38 -0500
Subject: [PATCH 12/13] ci: probe more git URL variations (focus on git/ path
 that returned 500)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/resolve-dependencies.yml | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/resolve-dependencies.yml b/.github/workflows/resolve-dependencies.yml
index c924b435..0a34a65c 100644
--- a/.github/workflows/resolve-dependencies.yml
+++ b/.github/workflows/resolve-dependencies.yml
@@ -58,18 +58,24 @@ jobs:
       - name: Probe Artifactory Swift URL formats
         run: |
           set -euo pipefail
-          REPO="segmentio/sovran-swift.git"
           PATHS=(
-            "artifactory/api/swift/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
-            "artifactory/git/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
-            "artifactory/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
-            "artifactory/api/vcs/${SWIFT_VIRTUAL_REPO}/${REPO}/info/refs?service=git-upload-pack"
+            "artifactory/git/virtual-swift-thirdparty/segmentio/sovran-swift.git/info/refs?service=git-upload-pack"
+            "artifactory/git/virtual-swift-thirdparty/segmentio/sovran-swift/info/refs?service=git-upload-pack"
+            "artifactory/git/virtual-swift-thirdparty/sovran-swift.git/info/refs?service=git-upload-pack"
+            "artifactory/git/remote-swift-github/segmentio/sovran-swift.git/info/refs?service=git-upload-pack"
+            "artifactory/git/remote-swift-github/segmentio/sovran-swift/info/refs?service=git-upload-pack"
+            "artifactory/remote-swift-github/segmentio/sovran-swift.git/info/refs?service=git-upload-pack"
           )
           for path in "${PATHS[@]}"; do
             URL="${ARTIFACTORY_URL}/${path}"
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+            RESPONSE=$(curl -s -w "\n%{http_code}" \
               -H "Authorization: Bearer ${ART_TOKEN}" "$URL")
-            echo "$HTTP_CODE — $URL"
+            HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+            BODY=$(echo "$RESPONSE" | sed '$d' | head -5)
+            echo "$HTTP_CODE — $path"
+            if [ "$HTTP_CODE" != "404" ]; then
+              echo "  Body: $BODY"
+            fi
           done
 
       - name: Configure SPM to resolve through Artifactory

From f3de6a72848984e44637facd1683e9ca28493f76 Mon Sep 17 00:00:00 2001
From: Wenxi Zeng <wzeng@twilio.com>
Date: Mon, 6 Jul 2026 10:53:34 -0500
Subject: [PATCH 13/13] feedback

---
 docs/artifactory-swift-feedback.md | 114 +++++++++++++++++++++++++++++
 1 file changed, 114 insertions(+)
 create mode 100644 docs/artifactory-swift-feedback.md

diff --git a/docs/artifactory-swift-feedback.md b/docs/artifactory-swift-feedback.md
new file mode 100644
index 00000000..08026638
--- /dev/null
+++ b/docs/artifactory-swift-feedback.md
@@ -0,0 +1,114 @@
+# Feedback: SPM Dependency Resolution via Artifactory
+
+**From:** Segment SDK team (analytics-swift)
+**To:** Secure Supply Chain / Platform team
+**Date:** 2026-07-02
+**Repo:** `segmentio/analytics-swift`
+**Branch:** `poc/binary-xcframework-release-pipeline`
+
+## What works
+
+| Step | Status | Evidence |
+| --- | --- | --- |
+| OIDC token exchange (`github-actions-segmentio` provider) | Working | Token mints successfully, `segmentio/analytics-swift` is in the OIDC trust |
+| Token validation (Artifactory REST API ping) | Working | `GET /artifactory/api/system/ping` returns HTTP 200 with the OIDC-issued token |
+
+## What doesn't work
+
+SPM cannot clone dependencies through Artifactory. Git clone fails regardless
+of URL format or auth mechanism.
+
+### Auth mechanisms tried
+
+| Approach | Result |
+| --- | --- |
+| `~/.netrc` (`machine twilio.jfrog.io login token password $TOKEN`) | `could not read Username` — git on Linux didn't read it |
+| `git credential.helper store` with `~/.git-credentials` (`https://token:$TOKEN@twilio.jfrog.io`) | `Authentication failed` |
+| `git config url.insteadOf` (embed token in URL rewrite) | `repository not found` (404) |
+| `git config http.extraHeader "Authorization: Bearer $TOKEN"` | `repository not found` (404) |
+
+The Bearer header approach is what the internal docs recommend for Swift. Once
+auth was resolved, the underlying issue became clear: **the URL path returns 404
+or 500 regardless of auth**.
+
+### URL paths probed
+
+All probed with a valid Bearer token (confirmed via ping).
+
+| URL path | HTTP | Response |
+| --- | --- | --- |
+| `artifactory/api/swift/virtual-swift-thirdparty/segmentio/sovran-swift.git/info/refs` | 404 | Not found |
+| `artifactory/git/virtual-swift-thirdparty/segmentio/sovran-swift.git/info/refs` | 500 | `"Expected Repository attribute"` |
+| `artifactory/git/virtual-swift-thirdparty/segmentio/sovran-swift/info/refs` | 500 | `"Expected Repository attribute"` |
+| `artifactory/git/virtual-swift-thirdparty/sovran-swift.git/info/refs` | 500 | `"Expected Repository attribute"` |
+| `artifactory/git/remote-swift-github/segmentio/sovran-swift.git/info/refs` | 500 | `"Expected Repository attribute"` |
+| `artifactory/git/remote-swift-github/segmentio/sovran-swift/info/refs` | 500 | `"Expected Repository attribute"` |
+| `artifactory/remote-swift-github/segmentio/sovran-swift.git/info/refs` | 404 | Not found |
+| `artifactory/virtual-swift-thirdparty/segmentio/sovran-swift.git/info/refs` | 404 | Not found |
+| `artifactory/api/vcs/virtual-swift-thirdparty/segmentio/sovran-swift.git/info/refs` | 404 | Not found |
+
+## Root cause (our assessment)
+
+The `"Expected Repository attribute"` error on all `/git/` paths suggests the
+Artifactory instance does not have a **Git LFS / Git repository type** enabled.
+The Swift virtual repo (`virtual-swift-thirdparty`) is configured as a `swift`
+package type, which likely supports the Swift Package Registry protocol
+(SE-0292) but **not raw git clone over HTTPS** — which is what SPM uses to
+resolve dependencies.
+
+SPM resolves packages by git-cloning the repository URL declared in
+`Package.swift`. The `swift package config set-mirror` command redirects those
+clones to a different URL, but the target must still be a git-cloneable
+endpoint.
+
+## Proposed solutions
+
+We need one of the following to resolve Swift dependencies through Artifactory
+in CI:
+
+1. **Provide a git-cloneable URL path** for the `virtual-swift-thirdparty`
+   repo. If there is a URL format that supports `git clone` over HTTPS with
+   a Bearer token, we need documentation on it.
+
+2. **Or, enable a git-type repository** in Artifactory that proxies
+   `https://github.com` and supports the git smart HTTP protocol
+   (`/info/refs?service=git-upload-pack`). The current Swift-type repo does
+   not support raw git clone.
+
+3. **Or, provide documentation on Swift Package Registry (SE-0292) mode** if
+   that's how the Swift virtual repo is meant to be consumed. SPM 5.7+ supports
+   registry-based resolution (`swift package-registry set`), but this is a
+   different mechanism than git mirrors and we have no example of it working
+   against this Artifactory instance.
+
+## Questions
+
+1. **Does `virtual-swift-thirdparty` support git clone?** If so, what is the
+   correct URL format? The docs say to "configure SPM to resolve through
+   `https://twilio.jfrog.io/artifactory/api/swift/virtual-swift-thirdparty/`"
+   but don't specify the git clone path.
+
+2. **If it only supports the Swift Package Registry protocol (SE-0292):** is
+   there documentation on how to configure SPM to use registry mode instead of
+   git mode? SPM 5.7+ has `swift package-registry set`, but this is a different
+   resolution mechanism than git-based mirrors.
+
+3. **Is a separate git-type repository needed?** Would the solution be to
+   create a `remote-git-github` repository (Artifactory Git LFS type) that
+   proxies `https://github.com` and can serve git clone requests?
+
+## Environment
+
+- Runner: `ubuntu-latest-large` (GitHub-hosted)
+- Swift: version available on the runner image
+- Git: version available on the runner image
+- Artifactory: `twilio.jfrog.io` (cloud instance)
+
+## How to reproduce
+
+See workflow at:
+`segmentio/analytics-swift/.github/workflows/resolve-dependencies.yml`
+(branch `poc/binary-xcframework-release-pipeline`)
+
+Trigger manually via Actions > "Resolve Dependencies (Artifactory OIDC)" >
+Run workflow.