Files

T

Jeppe B 88eda43560 Automate signed iOS App Store releases (#192 )

## What changed

- adds production iOS identity, localized storefront metadata, native
privacy declarations, App Store-safe artwork, and account-deletion UX
- mirrors the live Danish Google Play title, short description, and long
description in the App Store metadata source
- generates Android launcher/store icons from the opaque iOS marketing
master so both platforms use the same white background
- adds guarded GitHub Actions workflows for storefront readiness,
credential health, signed TestFlight uploads, and App Store candidate
preparation
- adds pinned Fastlane configuration with a committed dependency lock,
release manifest tooling, and an operational App Store runbook
- preserves the upstream iOS safe-area implementation while retaining
opaque App Store icon assets

## Why

The repository previously supported development-signed device bundles
but had no production App Store identity, reproducible storefront source
of truth, or protected signed-release pipeline. Apple also requires
in-app account deletion for apps that support account creation. The
Android icon master was transparent, which rendered as black on dark
store/device surfaces.

## Impact

Automation remains fail-closed behind
`APP_STORE_AUTOMATION_ENABLED=false`. No build can upload to TestFlight
or change App Store metadata until the switch is deliberately enabled
after merge and the remaining release gates are satisfied.

## Validation

- focused App Store, iOS icon, and cross-platform icon-background tests
pass
- every generated Android store/launcher icon is opaque with pure-white
corners; iOS marketing artwork is checked the same way
- Android icon drift check passes for all 19 generated files
- production Vite build and the broader focused release checks completed
successfully
- storefront metadata is valid; only the two expected screenshot-set
warnings remain
- App Store Readiness is green at head `4445fecc`
- Apple Distribution certificate and App Store profile were
independently verified for `HP3FJ4GVL7.io.truckwash.app`
- live App Store Connect API authentication succeeded for app
`6792777794`
- App Store record, free Denmark-only availability, and automatic
`Internal QA` TestFlight group are configured
- EU trader status, Content Rights, 4+ age rating, and the published App
Privacy label are completed in App Store Connect
- iPhone and iPad accessibility declarations are configured honestly as
pre-release drafts

## Remaining external gates

- reviewed iPhone and iPad screenshot sets are still required
- an App Review login must be supplied without creating or exposing
customer credentials
- the first signed TestFlight candidate must run after merge and
deliberate automation enablement

2026-07-20 17:59:43 +02:00

2.0 KiB

Raw Blame History

Mobile Store Delivery

Android and iOS delivery are intentionally independent. An iOS release or tag must never publish an Android production artifact.

Android

Android Store Artifacts remains in .github/workflows/mobile-artifacts.yml. It builds the Capacitor Android package io.truckwash.twa and supports:

Automatic delivery after successful current-master Automated Tests.
Manual dispatch with version, version code, upload toggle, track, and status.
Existing mobile-v* tags for the Android workflow.

The Android job continues using GitHub environment mobile-store-production. Its required secrets are:

ANDROID_KEYSTORE_BASE64
ANDROID_KEYSTORE_PASSWORD
ANDROID_KEY_ALIAS
ANDROID_KEY_PASSWORD
GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64

Its variables are ANDROID_PACKAGE_NAME, ANDROID_AAB_PATH, PLAY_STORE_TRACK, PLAY_STORE_RELEASE_STATUS, and optional PLAY_STORE_USER_FRACTION. See the Google Play Console runbook for production track policy.

iOS

iOS uses three separate workflows:

iOS Internal TestFlight: exact verified master release to signed internal TestFlight build.
iOS App Store Candidate: protected ios-vX.Y.Z tag to exact-build storefront candidate, without rebuilding or submission.
iOS Credential Health: weekly identity, access, and expiry preflight.

The GitHub environments and variables are documented in docs/app-store-release.md. The repository-level APP_STORE_AUTOMATION_ENABLED variable gates all access to them and must remain false until the signed credential canary is approved.

Local source/storefront checks:

npm run mobile:permissions:check
npm run mobile:ios:storefront:check

Strict candidate asset check:

npm run mobile:ios:storefront:check-strict

Version identity is deliberately different between platforms:

Android package: io.truckwash.twa
iOS App Store bundle: io.truckwash.app

The iOS release build verifies the final signed IPA rather than relying on the Capacitor appId, which remains the Android package identifier.

2.0 KiB Raw Blame History

Mobile Store Delivery

Android

iOS

2.0 KiB

Raw Blame History