testflight.yml

name: iOS TestFlight

on:
  workflow_dispatch:
    inputs:
      configure_app:
        description: Register/update the App Store Connect app, beta group, and testers before uploading.
        required: true
        default: true
        type: boolean
      upload_build:
        description: Build and upload an iOS archive to TestFlight.
        required: true
        default: true
        type: boolean
      build_number:
        description: Optional CFBundleVersion. Defaults to the GitHub run number.
        required: false
        type: string

permissions:
  contents: read

jobs:
  ios-testflight:
    name: Register Garyx iOS and upload TestFlight build
    runs-on: macos-26
    env:
      GARYX_APP_NAME: ${{ vars.GARYX_APP_NAME || 'Garyx' }}
      GARYX_APP_SKU: ${{ vars.GARYX_APP_SKU || 'garyx-ios' }}
      IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID || 'com.garyx.mobile' }}
      IOS_WIDGET_BUNDLE_ID: ${{ vars.IOS_WIDGET_BUNDLE_ID || 'com.garyx.mobile.RecentThreadsWidget' }}
      IOS_APP_GROUP_ID: ${{ vars.IOS_APP_GROUP_ID || 'group.com.garyx.mobile' }}
      TESTFLIGHT_GROUP_NAME: ${{ vars.TESTFLIGHT_GROUP_NAME || 'Garyx Experimental' }}
      TESTFLIGHT_TESTER_EMAILS: ${{ secrets.TESTFLIGHT_TESTER_EMAILS }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
      APP_STORE_CONNECT_API_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_ISSUER_ID }}
      APP_STORE_CONNECT_API_KEY_P8: ${{ secrets.APP_STORE_CONNECT_API_KEY_P8 }}
      IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}
      IOS_DISTRIBUTION_CERTIFICATE_PASSWORD: ${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Check required TestFlight secrets
        shell: bash
        run: |
          set -euo pipefail
          missing=()
          for name in \
            APPLE_TEAM_ID \
            APP_STORE_CONNECT_API_KEY_ID \
            APP_STORE_CONNECT_API_ISSUER_ID \
            APP_STORE_CONNECT_API_KEY_P8; do
            if [[ -z "${!name:-}" ]]; then
              missing+=("$name")
            fi
          done
          if [[ "${{ inputs.upload_build }}" == "true" ]]; then
            for name in \
              IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 \
              IOS_DISTRIBUTION_CERTIFICATE_PASSWORD; do
              if [[ -z "${!name:-}" ]]; then
                missing+=("$name")
              fi
            done
          fi
          if (( ${#missing[@]} > 0 )); then
            printf 'Missing required GitHub secret(s): %s\n' "${missing[*]}" >&2
            exit 1
          fi

      - name: Write App Store Connect API key
        shell: bash
        run: |
          set -euo pipefail
          key_dir="$RUNNER_TEMP/appstoreconnect"
          mkdir -p "$key_dir" "$HOME/.appstoreconnect/private_keys"
          key_path="$key_dir/AuthKey_${APP_STORE_CONNECT_API_KEY_ID}.p8"
          printf '%s' "$APP_STORE_CONNECT_API_KEY_P8" > "$key_path"
          python3 - "$key_path" <<'PY'
          import pathlib
          import sys

          path = pathlib.Path(sys.argv[1])
          text = path.read_text()
          if "\\n" in text and "-----BEGIN" in text and "\n" not in text.strip().split("-----BEGIN", 1)[1]:
              text = text.replace("\\n", "\n")
          path.write_text(text)
          PY
          chmod 600 "$key_path"
          cp "$key_path" "$HOME/.appstoreconnect/private_keys/"
          echo "APP_STORE_CONNECT_API_KEY_PATH=$key_path" >> "$GITHUB_ENV"

      - name: Register App Store Connect app and TestFlight testers
        if: inputs.configure_app
        shell: bash
        run: node scripts/appstore-connect/setup-testflight.mjs

      - name: Resolve build number
        if: inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          build_number="${{ inputs.build_number }}"
          if [[ -z "$build_number" ]]; then
            build_number="${GITHUB_RUN_NUMBER}"
          fi
          echo "GARYX_IOS_BUILD_NUMBER=$build_number" >> "$GITHUB_ENV"

      - name: Install iOS signing assets
        if: inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          signing_dir="$RUNNER_TEMP/ios-signing"
          mkdir -p "$signing_dir"
          certificate_path="$signing_dir/distribution.p12"
          keychain_path="$signing_dir/app-signing.keychain-db"
          keychain_password="$(openssl rand -base64 24)"

          SIGNING_CERTIFICATE_P12_PATH="$certificate_path" \
          python3 - <<'PY'
          import base64
          import os
          from pathlib import Path

          Path(os.environ["SIGNING_CERTIFICATE_P12_PATH"]).write_bytes(
              base64.b64decode(os.environ["IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64"])
          )
          PY
          chmod 600 "$certificate_path"

          security create-keychain -p "$keychain_password" "$keychain_path"
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$keychain_password" "$keychain_path"
          security import "$certificate_path" \
            -P "$IOS_DISTRIBUTION_CERTIFICATE_PASSWORD" \
            -A \
            -t cert \
            -f pkcs12 \
            -k "$keychain_path"
          security list-keychains -d user -s "$keychain_path"
          security default-keychain -d user -s "$keychain_path"
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$keychain_password" \
            "$keychain_path"

          certificate_pem="$signing_dir/distribution.pem"
          security find-certificate -p "$keychain_path" > "$certificate_pem"
          certificate_serial="$(
            openssl x509 -in "$certificate_pem" -noout -serial |
            cut -d= -f2 |
            tr -d '[:space:]'
          )"
          if [[ -z "$certificate_serial" ]]; then
            echo "Could not read the imported distribution certificate serial." >&2
            exit 1
          fi
          echo "::add-mask::$certificate_serial"

          echo "SIGNING_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
          echo "IOS_DISTRIBUTION_CERTIFICATE_SERIAL=$certificate_serial" >> "$GITHUB_ENV"

      - name: Create and install App Store provisioning profiles
        if: inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          profile_dir="$HOME/Library/MobileDevice/Provisioning Profiles"
          mkdir -p "$profile_dir"
          IOS_PROFILE_INSTALL_DIR="$profile_dir" \
            node scripts/appstore-connect/prepare-ios-profiles.mjs

      - name: Validate App Store provisioning profiles
        if: inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          validate_profile() {
            local label="$1"
            local profile_path="$2"
            local bundle_id="$3"
            local plist_path="$RUNNER_TEMP/${label}-profile.plist"

            security cms -D -i "$profile_path" > "$plist_path"
            local app_identifier
            app_identifier="$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:application-identifier' "$plist_path")"
            if [[ "$app_identifier" != *".$bundle_id" ]]; then
              echo "$label profile has app identifier '$app_identifier', expected bundle '$bundle_id'." >&2
              exit 1
            fi

            local app_group
            app_group="$(/usr/libexec/PlistBuddy -c 'Print :Entitlements:com.apple.security.application-groups:0' "$plist_path" 2>/dev/null || true)"
            if [[ "$app_group" != "$IOS_APP_GROUP_ID" ]]; then
              echo "$label profile does not include expected App Group '$IOS_APP_GROUP_ID'." >&2
              exit 1
            fi
          }

          validate_profile "app" "$IOS_APP_PROVISIONING_PROFILE_PATH" "$IOS_BUNDLE_ID"
          validate_profile "widget" "$IOS_WIDGET_PROVISIONING_PROFILE_PATH" "$IOS_WIDGET_BUNDLE_ID"

      - name: Archive Garyx iOS app
        if: inputs.upload_build
        shell: bash
        working-directory: mobile/garyx-mobile
        run: |
          set -euo pipefail
          xcodebuild \
            -project GaryxMobile.xcodeproj \
            -scheme GaryxMobile \
            -configuration Release \
            -destination 'generic/platform=iOS' \
            -archivePath "$RUNNER_TEMP/GaryxMobile.xcarchive" \
            archive \
            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
            CURRENT_PROJECT_VERSION="$GARYX_IOS_BUILD_NUMBER" \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="Apple Distribution" \
            IOS_APP_PROVISIONING_PROFILE_SPECIFIER="$IOS_APP_PROVISIONING_PROFILE_SPECIFIER" \
            IOS_WIDGET_PROVISIONING_PROFILE_SPECIFIER="$IOS_WIDGET_PROVISIONING_PROFILE_SPECIFIER" \
            OTHER_CODE_SIGN_FLAGS="--keychain $SIGNING_KEYCHAIN_PATH"

      - name: Verify archived app icon
        if: inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          apps_dir="$RUNNER_TEMP/GaryxMobile.xcarchive/Products/Applications"
          app_count="$(find "$apps_dir" -maxdepth 1 -type d -name '*.app' -print | wc -l | tr -d '[:space:]')"
          if [[ "$app_count" != "1" ]]; then
            echo "Expected exactly one archived app bundle in $apps_dir; found $app_count." >&2
            find "$apps_dir" -maxdepth 1 -type d -name '*.app' -print >&2
            exit 1
          fi
          app_path="$(find "$apps_dir" -maxdepth 1 -type d -name '*.app' -print -quit)"
          echo "Verifying archived app bundle: $(basename "$app_path")"
          if [[ ! -f "$app_path/AppIcon60x60@2x.png" ]]; then
            echo "Archived app is missing the iPhone app icon." >&2
            exit 1
          fi
          if [[ ! -f "$app_path/AppIcon76x76@2x~ipad.png" ]]; then
            echo "Archived app is missing the iPad app icon." >&2
            exit 1
          fi
          if [[ ! -f "$app_path/Assets.car" ]]; then
            echo "Archived app is missing compiled asset catalog." >&2
            exit 1
          fi
          icon_name="$(/usr/libexec/PlistBuddy -c 'Print CFBundleIconName' "$app_path/Info.plist" 2>/dev/null || true)"
          legacy_icon="$(/usr/libexec/PlistBuddy -c 'Print CFBundleIcons:CFBundlePrimaryIcon:CFBundleIconFiles:0' "$app_path/Info.plist" 2>/dev/null || true)"
          if [[ "$icon_name" != "AppIcon" && -z "$legacy_icon" ]]; then
            echo "Archived Info.plist does not declare an app icon." >&2
            exit 1
          fi

      - name: Export IPA
        if: inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          export_options="$RUNNER_TEMP/ExportOptions.plist"
          cat > "$export_options" <<PLIST
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>method</key>
            <string>app-store-connect</string>
            <key>destination</key>
            <string>export</string>
            <key>signingStyle</key>
            <string>manual</string>
            <key>signingCertificate</key>
            <string>Apple Distribution</string>
            <key>teamID</key>
            <string>${APPLE_TEAM_ID}</string>
            <key>provisioningProfiles</key>
            <dict>
              <key>${IOS_BUNDLE_ID}</key>
              <string>${IOS_APP_PROVISIONING_PROFILE_SPECIFIER}</string>
              <key>${IOS_WIDGET_BUNDLE_ID}</key>
              <string>${IOS_WIDGET_PROVISIONING_PROFILE_SPECIFIER}</string>
            </dict>
            <key>stripSwiftSymbols</key>
            <true/>
            <key>uploadSymbols</key>
            <true/>
          </dict>
          </plist>
          PLIST
          xcodebuild \
            -exportArchive \
            -archivePath "$RUNNER_TEMP/GaryxMobile.xcarchive" \
            -exportPath "$RUNNER_TEMP/GaryxMobileExport" \
            -exportOptionsPlist "$export_options"

      - name: Upload IPA to TestFlight
        if: inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          ipa_path="$(find "$RUNNER_TEMP/GaryxMobileExport" -maxdepth 1 -name '*.ipa' -print -quit)"
          if [[ -z "$ipa_path" ]]; then
            echo "No IPA exported." >&2
            exit 1
          fi
          xcrun altool \
            --upload-app \
            --type ios \
            --file "$ipa_path" \
            --apiKey "$APP_STORE_CONNECT_API_KEY_ID" \
            --apiIssuer "$APP_STORE_CONNECT_API_ISSUER_ID"

      - name: Make build available to internal testers
        if: inputs.upload_build
        shell: bash
        run: node scripts/appstore-connect/publish-internal-testflight.mjs

      - name: Clean up signing keychain
        if: always() && inputs.upload_build
        shell: bash
        run: |
          set -euo pipefail
          if [[ -n "${SIGNING_KEYCHAIN_PATH:-}" ]]; then
            security delete-keychain "$SIGNING_KEYCHAIN_PATH" || true
          fi