Add check to ensure pod install doesn't change Podfile.lock (#19)

bin/hash_file

@@ -1,8 +1,21 @@
-#!/bin/bash -eu
+#!/bin/bash -e
 
 if [ -z "$1" ]; then
 	echo "You must pass a filename to hash"
 	exit 1
 fi
 
-sha256sum "$1" | cut -f1 -d " "
+# Calling `set -u` here instead of the shebang otherwise the `-z "$1"` above
+# would fail without printing the error message if `$1` was unbound.
+set -u
+
+# `shasum` is available on only macOS
+if command -v shasum &> /dev/null; then
+  sha_command='shasum -a 256'
+else
+  sha_command='sha256sum'
+fi
+
+# Both `shasum` and `sha256sum` will print the hash and the file name (`$1`).
+# We only care about the hash, so we use `cut` to extract it.
+$sha_command "$1" | cut -f1 -d " "

bin/install_cocoapods

@@ -13,13 +13,37 @@ LOCAL_CACHE_KEY="$BUILDKITE_PIPELINE_SLUG-local-pod-cache-$PODFILE_HASH"
 restore_cache "$LOCAL_CACHE_KEY"
 
 # If the `pod check` plugin is installed, use it to determine whether or not to install Pods at all
-# If it's not installed (or if it fails), we'll try to install Pods. 
+# If it's not installed (or if it fails), we'll try to install Pods.
 # If that fails, it may be due to an out-of-date repo. We can use `--repo-update` to try to resolve this automatically.
 if bundle exec pod plugins installed | grep -q check; then
 	bundle exec pod check || bundle exec pod install || bundle exec pod install --repo-update --verbose
 else
 	bundle exec pod install || bundle exec pod install --repo-update --verbose
 fi
 
+# Check that `Podfile.lock` was unchanged by `pod install`. If it was, it means
+# the lockfile might have been inadvertently changed.
+
+# `shasum` is available only on macOS
+if command -v shasum &> /dev/null; then
+  sha_command='shasum -a 256'
+else
+  sha_command='sha256sum'
+fi
+
+function lockfile_error () {
+  message="\`Podfile.lock\` was changed by \`bundle exec pod install\`. Please run \`bundle exec pod install\` locally with a clean cache and commit the result."
+  echo "$message"
+  buildkite-agent annotate "$message" --style 'error' --context 'ctx-error'
+}
+trap lockfile_error ERR
+
+echo "Checking that Podfile.lock was not modified by 'pod install'"
+# Notice the two spaces as per shasum/sha256sum output
+echo "${PODFILE_HASH}  Podfile.lock" | $sha_command --check --status
+
+# Remove trap for the lockfile error now that we've done the check.
+trap - ERR
+
 # If this is the first time we've seen this particular hash of `Podfile.lock`, create a cache entry for future use
 save_cache Pods "$LOCAL_CACHE_KEY"