Jeppe B
468d436d3e
Adds exact-SHA cPanel release proof v2, atomic rollback restoration, and protected recovery gating.
438 lines
23 KiB
YAML
438 lines
23 KiB
YAML
name: iOS Internal TestFlight
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: [Frontend Release]
|
|
types: [completed]
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
inputs:
|
|
source_sha:
|
|
description: Full master commit SHA with a verified Frontend Release proof
|
|
required: true
|
|
type: string
|
|
confirmation:
|
|
description: Type UPLOAD IOS INTERNAL BUILD
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
|
|
concurrency:
|
|
group: ios-internal-testflight
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
prepare:
|
|
name: Resolve verified release
|
|
if: >-
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'workflow_run' &&
|
|
github.event.workflow_run.head_branch == 'master' &&
|
|
github.event.workflow_run.head_repository.full_name == github.repository)
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
outputs:
|
|
source_sha: ${{ steps.resolve.outputs.source_sha }}
|
|
enabled: ${{ steps.resolve.outputs.enabled }}
|
|
current: ${{ steps.resolve.outputs.current }}
|
|
steps:
|
|
- name: Checkout repository history
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Resolve immutable source and rollout gate
|
|
id: resolve
|
|
shell: bash
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
WORKFLOW_SOURCE_SHA: ${{ github.event.workflow_run.head_sha || '' }}
|
|
INPUT_SOURCE_SHA: ${{ inputs.source_sha || '' }}
|
|
CONFIRMATION: ${{ inputs.confirmation || '' }}
|
|
AUTOMATION_ENABLED: ${{ vars.APP_STORE_AUTOMATION_ENABLED || 'false' }}
|
|
run: |
|
|
set -euo pipefail
|
|
source_sha="$WORKFLOW_SOURCE_SHA"
|
|
if [[ "$EVENT_NAME" == workflow_dispatch ]]; then
|
|
[[ "$GITHUB_REF" == refs/heads/master ]] || { echo "Dispatch this workflow from master." >&2; exit 1; }
|
|
[[ "$CONFIRMATION" == "UPLOAD IOS INTERNAL BUILD" ]] || { echo "Invalid confirmation." >&2; exit 1; }
|
|
source_sha="${INPUT_SOURCE_SHA,,}"
|
|
fi
|
|
[[ "$source_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "A full lowercase source SHA is required." >&2; exit 1; }
|
|
git show-ref --verify --quiet refs/remotes/origin/master || { echo "origin/master was not included in the full checkout." >&2; exit 1; }
|
|
git cat-file -e "${source_sha}^{commit}"
|
|
git merge-base --is-ancestor "$source_sha" origin/master || { echo "Source is not reachable from master." >&2; exit 1; }
|
|
current=false
|
|
[[ "$(git rev-parse origin/master)" == "$source_sha" ]] && current=true
|
|
enabled=false
|
|
[[ "$AUTOMATION_ENABLED" == true ]] && enabled=true
|
|
echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
|
|
echo "current=$current" >> "$GITHUB_OUTPUT"
|
|
echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
|
|
if [[ "$enabled" != true ]]; then
|
|
echo "### iOS automation is safely disabled" >> "$GITHUB_STEP_SUMMARY"
|
|
echo 'Set repository variable `APP_STORE_AUTOMATION_ENABLED=true` only after the signing/API credential canary passes.' >> "$GITHUB_STEP_SUMMARY"
|
|
elif [[ "$current" != true ]]; then
|
|
echo "### Stale release skipped" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "The verified SHA is no longer current master." >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
|
|
- name: Require green WebKit mobile tests before App Store upload
|
|
if: steps.resolve.outputs.enabled == 'true' && steps.resolve.outputs.current == 'true'
|
|
run: node scripts/mobile/verify-store-test-gate.mjs --platform apple
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
STORE_SOURCE_SHA: ${{ steps.resolve.outputs.source_sha }}
|
|
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
|
|
|
|
deliver:
|
|
name: Sign, upload, process, and distribute
|
|
needs: prepare
|
|
if: needs.prepare.outputs.enabled == 'true' && needs.prepare.outputs.current == 'true'
|
|
runs-on: macos-15
|
|
timeout-minutes: 120
|
|
environment: app-store-signing
|
|
env:
|
|
DEVELOPER_DIR: /Applications/Xcode_26.3.app/Contents/Developer
|
|
IOS_SOURCE_SHA: ${{ needs.prepare.outputs.source_sha }}
|
|
IOS_PROJECT_PATH: ${{ vars.IOS_PROJECT || 'ios/App/App.xcodeproj' }}
|
|
IOS_SCHEME: ${{ vars.IOS_SCHEME || 'App' }}
|
|
IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'io.truckwash.app' }}
|
|
APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
|
|
APP_STORE_CONNECT_API_KEY_ID: ${{ vars.APP_STORE_CONNECT_API_KEY_ID }}
|
|
APP_STORE_CONNECT_ISSUER_ID: ${{ vars.APP_STORE_CONNECT_ISSUER_ID || '' }}
|
|
APP_STORE_CONNECT_APP_ID: ${{ vars.APP_STORE_CONNECT_APP_ID }}
|
|
TESTFLIGHT_INTERNAL_GROUP_ID: ${{ vars.TESTFLIGHT_INTERNAL_GROUP_ID }}
|
|
APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY_BASE64 }}
|
|
steps:
|
|
- name: Checkout verified source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ env.IOS_SOURCE_SHA }}
|
|
fetch-depth: 1
|
|
persist-credentials: false
|
|
|
|
- name: Download and verify frontend release proof
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TRIGGERING_RELEASE_RUN_ID: ${{ github.event.workflow_run.id || '' }}
|
|
run: |
|
|
set -euo pipefail
|
|
artifact_name="frontend-release-proof-$IOS_SOURCE_SHA"
|
|
response="$RUNNER_TEMP/proof-artifacts.json"
|
|
curl --fail --silent --show-error --location \
|
|
-H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
|
|
"$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts?name=$artifact_name&per_page=100" > "$response"
|
|
artifact_id="$(jq -r --arg run "$TRIGGERING_RELEASE_RUN_ID" '
|
|
[.artifacts[] | select(.expired == false) | select(($run == "") or ((.workflow_run.id|tostring) == $run))] |
|
|
sort_by(.created_at) | last | .id // empty' "$response")"
|
|
[[ "$artifact_id" =~ ^[0-9]+$ ]] || { echo "No verified Frontend Release proof found for $IOS_SOURCE_SHA." >&2; exit 1; }
|
|
mkdir -p output/frontend-release-proof
|
|
curl --fail --silent --show-error --location \
|
|
-H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
|
|
"$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/actions/artifacts/$artifact_id/zip" -o "$RUNNER_TEMP/proof.zip"
|
|
unzip -q "$RUNNER_TEMP/proof.zip" -d output/frontend-release-proof
|
|
PROOF_PATH=output/frontend-release-proof/frontend-release-proof.json node <<'NODE'
|
|
const fs = require("node:fs");
|
|
const proof = JSON.parse(fs.readFileSync(process.env.PROOF_PATH, "utf8"));
|
|
const checks = {
|
|
schema: proof.schemaVersion === 2,
|
|
repository: proof.repository === process.env.GITHUB_REPOSITORY,
|
|
source: proof.sourceSha === process.env.IOS_SOURCE_SHA,
|
|
exactSource: proof.sha === process.env.IOS_SOURCE_SHA,
|
|
releaseIdentity: typeof proof.releaseId === "string" && proof.releaseId.length > 0,
|
|
archive: /^[a-f0-9]{64}$/.test(proof.archiveSha256 || ""),
|
|
activeTarget: typeof proof.activeTarget === "string" && proof.activeTarget.length > 0,
|
|
verification: proof.verificationState === "verified",
|
|
publicGate: proof.livePublicGate === "passed",
|
|
credentialedGate: ["passed", "not-configured"].includes(proof.liveCredentialedGate),
|
|
managerGate: proof.releaseManagerGate === "passed",
|
|
serverVersion: proof.serverVersionUpdated === true,
|
|
serverVersionReadBack: proof.serverVersionReadBack === "passed",
|
|
};
|
|
const failures = Object.entries(checks).filter(([, passed]) => !passed).map(([label]) => label);
|
|
if (failures.length) throw new Error(`Invalid frontend release proof: ${failures.join(", ")}`);
|
|
NODE
|
|
|
|
- name: Verify Xcode 26 and iOS 26 SDK
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
[[ -x "$DEVELOPER_DIR/usr/bin/xcodebuild" ]] || { echo "Xcode 26.3 is not installed at $DEVELOPER_DIR." >&2; exit 1; }
|
|
xcode_version="$(xcodebuild -version | sed -n '1p')"
|
|
sdk_version="$(xcrun --sdk iphoneos --show-sdk-version)"
|
|
[[ "$xcode_version" =~ ^Xcode\ 26\. ]] || { echo "Xcode 26.x required; found $xcode_version." >&2; exit 1; }
|
|
[[ "$sdk_version" =~ ^26\. ]] || { echo "iPhoneOS 26 SDK required; found $sdk_version." >&2; exit 1; }
|
|
echo "XCODE_VERSION=$xcode_version" >> "$GITHUB_ENV"
|
|
echo "IOS_SDK_VERSION=$sdk_version" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Setup Ruby and pinned Fastlane
|
|
uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
|
|
with:
|
|
ruby-version: "3.3"
|
|
bundler-cache: true
|
|
|
|
- name: Install web dependencies
|
|
run: npm ci --legacy-peer-deps
|
|
|
|
- name: Validate storefront and resolve version
|
|
id: version
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
node scripts/mobile/validate-app-store.mjs
|
|
version="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).marketingVersion")"
|
|
bundle="$(node -p "JSON.parse(require('fs').readFileSync('ios/release.json')).bundleId")"
|
|
[[ "$bundle" == "$IOS_BUNDLE_ID" ]]
|
|
echo "IOS_MARKETING_VERSION=$version" >> "$GITHUB_ENV"
|
|
echo "MOBILE_VERSION_NAME=$version" >> "$GITHUB_ENV"
|
|
|
|
- name: Resolve build number from App Store Connect
|
|
id: app-store
|
|
run: node scripts/mobile/app-store-connect.mjs next-build-number
|
|
|
|
- name: Export resolved build number
|
|
env:
|
|
BUILD_NUMBER: ${{ steps.app-store.outputs.build_number }}
|
|
run: |
|
|
[[ "$BUILD_NUMBER" =~ ^[1-9][0-9]*$ ]]
|
|
echo "IOS_BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
|
|
echo "MOBILE_VERSION_CODE=$BUILD_NUMBER" >> "$GITHUB_ENV"
|
|
|
|
- name: Validate complete Apple environment
|
|
env:
|
|
IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
|
|
IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
|
|
IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
|
|
UPLOAD_IOS_TO_APP_STORE: "true"
|
|
run: node scripts/mobile/check-store-upload-env.mjs --ios
|
|
|
|
- name: Build and sync production iOS shell
|
|
run: |
|
|
npm run build
|
|
npx cap sync ios
|
|
npm run mobile:permissions:check
|
|
xcodebuild -resolvePackageDependencies -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME"
|
|
|
|
- name: Validate native release settings
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
settings="$RUNNER_TEMP/ios-release-build-settings.txt"
|
|
xcodebuild -showBuildSettings -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release CODE_SIGNING_ALLOWED=NO > "$settings"
|
|
grep -Eq "^[[:space:]]*PRODUCT_BUNDLE_IDENTIFIER = ${IOS_BUNDLE_ID//./\.}$" "$settings"
|
|
grep -Eq '^[[:space:]]*APP_DISPLAY_NAME = Truck Wash$' "$settings"
|
|
grep -Eq '^[[:space:]]*IPHONEOS_DEPLOYMENT_TARGET = 15\.0$' "$settings"
|
|
if grep -q 'isa = PBXShellScriptBuildPhase;' "$IOS_PROJECT_PATH/project.pbxproj"; then
|
|
echo "Unexpected Xcode shell-script build phase detected." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Install and validate Apple distribution signing assets
|
|
shell: bash
|
|
env:
|
|
IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
|
|
IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}
|
|
IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
|
|
run: |
|
|
set -euo pipefail
|
|
certificate_path="$RUNNER_TEMP/apple-distribution.p12"
|
|
profile_path="$RUNNER_TEMP/app-store.mobileprovision"
|
|
profile_plist="$RUNNER_TEMP/app-store-profile.plist"
|
|
keychain_path="$RUNNER_TEMP/app-store-signing.keychain-db"
|
|
keychain_password="$(openssl rand -base64 48 | tr -d '\n')"
|
|
echo "::add-mask::$keychain_password"
|
|
echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
|
|
node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64.replace(/\\s/g,''),'base64'))" "$certificate_path"
|
|
node -e "const fs=require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_APP_STORE_PROFILE_BASE64.replace(/\\s/g,''),'base64'))" "$profile_path"
|
|
chmod 600 "$certificate_path" "$profile_path"
|
|
security cms -D -i "$profile_path" > "$profile_plist"
|
|
security create-keychain -p "$keychain_password" "$keychain_path"
|
|
security set-keychain-settings -lut 21600 "$keychain_path"
|
|
security unlock-keychain -p "$keychain_password" "$keychain_path"
|
|
security import "$certificate_path" -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
|
|
security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k "$keychain_password" "$keychain_path"
|
|
identity_sha="$(security find-identity -v -p codesigning "$keychain_path" | awk '/Apple Distribution/ {print $2; exit}')"
|
|
[[ "$identity_sha" =~ ^[0-9A-Fa-f]{40}$ ]] || { echo "P12 lacks an Apple Distribution identity." >&2; exit 1; }
|
|
IOS_SIGNING_IDENTITY_SHA="$identity_sha" PROFILE_PLIST="$profile_plist" python3 <<'PY'
|
|
import datetime, hashlib, os, plistlib, re, sys
|
|
with open(os.environ["PROFILE_PLIST"], "rb") as handle: profile = plistlib.load(handle)
|
|
entitlements = profile.get("Entitlements", {})
|
|
expiration = profile.get("ExpirationDate")
|
|
if expiration and expiration.tzinfo is None: expiration = expiration.replace(tzinfo=datetime.timezone.utc)
|
|
team = os.environ["APPLE_TEAM_ID"]
|
|
bundle = os.environ["IOS_BUNDLE_ID"]
|
|
hashes = {hashlib.sha1(value).hexdigest().upper() for value in profile.get("DeveloperCertificates", [])}
|
|
checks = {
|
|
"team": team in profile.get("TeamIdentifier", []),
|
|
"application identifier": entitlements.get("application-identifier") == f"{team}.{bundle}",
|
|
"team entitlement": entitlements.get("com.apple.developer.team-identifier") == team,
|
|
"distribution entitlement": entitlements.get("get-task-allow") is False,
|
|
"App Store profile has no devices": not profile.get("ProvisionedDevices"),
|
|
"non-enterprise profile": profile.get("ProvisionsAllDevices") is not True,
|
|
"expiration": expiration is not None and expiration > datetime.datetime.now(datetime.timezone.utc),
|
|
"certificate belongs to profile": os.environ["IOS_SIGNING_IDENTITY_SHA"].upper() in hashes,
|
|
"safe profile name": isinstance(profile.get("Name"), str) and not re.search(r"[\r\n]", profile["Name"]),
|
|
}
|
|
failed = [name for name, passed in checks.items() if not passed]
|
|
if failed:
|
|
print("Distribution signing validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
|
|
sys.exit(1)
|
|
PY
|
|
profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$profile_plist")"
|
|
profile_name="$(/usr/libexec/PlistBuddy -c 'Print :Name' "$profile_plist")"
|
|
profile_install="$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
|
|
mkdir -p "$(dirname "$profile_install")"
|
|
echo "IOS_PROFILE_INSTALL_PATH=$profile_install" >> "$GITHUB_ENV"
|
|
cp "$profile_path" "$profile_install"
|
|
echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
|
|
echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
|
|
|
|
- name: Archive and export App Store IPA
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
archive="$RUNNER_TEMP/TruckWash.xcarchive"
|
|
export_dir="$RUNNER_TEMP/ios-export"
|
|
export_options="$RUNNER_TEMP/ExportOptions.plist"
|
|
xcodebuild -project "$IOS_PROJECT_PATH" -scheme "$IOS_SCHEME" -configuration Release \
|
|
-destination 'generic/platform=iOS' -archivePath "$archive" archive \
|
|
DEVELOPMENT_TEAM="$APPLE_TEAM_ID" CODE_SIGN_STYLE=Manual CODE_SIGN_IDENTITY='Apple Distribution' \
|
|
PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" MARKETING_VERSION="$IOS_MARKETING_VERSION" \
|
|
CURRENT_PROJECT_VERSION="$IOS_BUILD_NUMBER" DEBUG_INFORMATION_FORMAT='dwarf-with-dsym'
|
|
EXPORT_OPTIONS="$export_options" python3 <<'PY'
|
|
import os, plistlib
|
|
options = {"method":"app-store-connect","signingStyle":"manual","teamID":os.environ["APPLE_TEAM_ID"],"provisioningProfiles":{os.environ["IOS_BUNDLE_ID"]:os.environ["IOS_PROFILE_NAME"]},"stripSwiftSymbols":True,"manageAppVersionAndBuildNumber":False}
|
|
with open(os.environ["EXPORT_OPTIONS"], "wb") as handle: plistlib.dump(options, handle)
|
|
PY
|
|
xcodebuild -exportArchive -archivePath "$archive" -exportPath "$export_dir" -exportOptionsPlist "$export_options"
|
|
shopt -s nullglob
|
|
ipa_files=("$export_dir"/*.ipa)
|
|
[[ ${#ipa_files[@]} -eq 1 ]] || { echo "Expected one IPA; found ${#ipa_files[@]}." >&2; exit 1; }
|
|
echo "IOS_ARCHIVE_PATH=$archive" >> "$GITHUB_ENV"
|
|
echo "IOS_IPA_PATH=${ipa_files[0]}" >> "$GITHUB_ENV"
|
|
|
|
- name: Inspect signed IPA
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
inspect="$RUNNER_TEMP/ios-inspect"
|
|
unzip -q "$IOS_IPA_PATH" -d "$inspect"
|
|
shopt -s nullglob
|
|
apps=("$inspect"/Payload/*.app)
|
|
[[ ${#apps[@]} -eq 1 ]] || { echo "Expected one Payload app." >&2; exit 1; }
|
|
app="${apps[0]}"
|
|
codesign --verify --deep --strict "$app"
|
|
codesign -d --entitlements :- "$app" > "$RUNNER_TEMP/entitlements.plist"
|
|
security cms -D -i "$app/embedded.mobileprovision" > "$RUNNER_TEMP/embedded-profile.plist"
|
|
[[ -f "$app/PrivacyInfo.xcprivacy" ]]
|
|
[[ -f "$app/da.lproj/InfoPlist.strings" ]]
|
|
[[ -f "$app/en.lproj/InfoPlist.strings" ]]
|
|
APP_PATH="$app" python3 <<'PY'
|
|
import os, plistlib, sys
|
|
app = os.environ["APP_PATH"]
|
|
with open(f"{app}/Info.plist", "rb") as handle: info = plistlib.load(handle)
|
|
with open(os.path.join(os.environ["RUNNER_TEMP"], "entitlements.plist"), "rb") as handle: ent = plistlib.load(handle)
|
|
with open(os.path.join(os.environ["RUNNER_TEMP"], "embedded-profile.plist"), "rb") as handle: profile = plistlib.load(handle)
|
|
checks = {
|
|
"bundle": info.get("CFBundleIdentifier") == os.environ["IOS_BUNDLE_ID"],
|
|
"version": info.get("CFBundleShortVersionString") == os.environ["IOS_MARKETING_VERSION"],
|
|
"build": info.get("CFBundleVersion") == os.environ["IOS_BUILD_NUMBER"],
|
|
"minimum iOS": info.get("MinimumOSVersion") == "15.0",
|
|
"profile": profile.get("UUID") == os.environ["IOS_PROFILE_UUID"],
|
|
"non-debug signature": ent.get("get-task-allow") is not True,
|
|
"signature application id": ent.get("application-identifier") == f'{os.environ["APPLE_TEAM_ID"]}.{os.environ["IOS_BUNDLE_ID"]}',
|
|
}
|
|
failed = [name for name, passed in checks.items() if not passed]
|
|
if failed:
|
|
print("IPA validation failed:", *[f"- {name}" for name in failed], sep="\n", file=sys.stderr)
|
|
sys.exit(1)
|
|
PY
|
|
|
|
- name: Recheck live master before upload
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
live_master_sha="$(curl --fail --silent --show-error --location \
|
|
-H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
|
|
"$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/git/ref/heads/master" | jq -r '.object.sha')"
|
|
[[ "$live_master_sha" == "$IOS_SOURCE_SHA" ]] || {
|
|
echo "master advanced while the signed build was queued; refusing upload." >&2
|
|
exit 1
|
|
}
|
|
- name: Upload and wait for App Store processing
|
|
env:
|
|
TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
|
|
run: bundle exec fastlane ios upload_internal
|
|
|
|
- name: Assign exact processed build to Internal QA
|
|
id: distribute
|
|
env:
|
|
TESTFLIGHT_WHAT_TO_TEST: Automatisk intern build fra verificeret master ${{ env.IOS_SOURCE_SHA }}.
|
|
run: node scripts/mobile/app-store-connect.mjs wait-and-distribute
|
|
|
|
- name: Assemble signed release evidence
|
|
shell: bash
|
|
env:
|
|
APP_STORE_BUILD_ID: ${{ steps.distribute.outputs.app_store_build_id }}
|
|
run: |
|
|
set -euo pipefail
|
|
artifact="output/ios-release"
|
|
mkdir -p "$artifact"
|
|
cp "$IOS_IPA_PATH" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.ipa"
|
|
shopt -s nullglob
|
|
dsyms=("$IOS_ARCHIVE_PATH"/dSYMs/*.dSYM)
|
|
[[ ${#dsyms[@]} -gt 0 ]] || { echo "Release archive contains no dSYM bundles." >&2; exit 1; }
|
|
ditto -c -k --sequesterRsrc --keepParent "$IOS_ARCHIVE_PATH/dSYMs" "$artifact/TruckWash-$IOS_MARKETING_VERSION-$IOS_BUILD_NUMBER.dSYM.zip"
|
|
node scripts/mobile/create-ios-release-manifest.mjs
|
|
(cd "$artifact" && shasum -a 256 -- * > SHA256SUMS)
|
|
|
|
- name: Upload signed IPA
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: truck-wash-ios-${{ env.IOS_SOURCE_SHA }}
|
|
path: output/ios-release/*.ipa
|
|
if-no-files-found: error
|
|
retention-days: 30
|
|
|
|
- name: Upload release manifest, dSYM, and checksums
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: ios-release-manifest-${{ env.IOS_SOURCE_SHA }}
|
|
path: |
|
|
output/ios-release/ios-release-manifest.json
|
|
output/ios-release/*.dSYM.zip
|
|
output/ios-release/SHA256SUMS
|
|
if-no-files-found: error
|
|
retention-days: 90
|
|
|
|
- name: Clean up Apple signing material
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then security delete-keychain "$IOS_KEYCHAIN_PATH" || true; fi
|
|
if [[ -n "${IOS_PROFILE_INSTALL_PATH:-}" ]]; then rm -f "$IOS_PROFILE_INSTALL_PATH"; fi
|
|
rm -f "$RUNNER_TEMP/apple-distribution.p12" "$RUNNER_TEMP/app-store.mobileprovision" "$RUNNER_TEMP/app-store-profile.plist"
|
|
|
|
disabled:
|
|
name: Automation disabled
|
|
needs: prepare
|
|
if: needs.prepare.outputs.enabled != 'true'
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- run: echo "App Store automation is disabled; no signing environment or secrets were accessed."
|