Add kids CI pipeline and scope builds with change_in()

Mirrors the bccm Prep/Build/Deploy + production-promotion pipelines
for the kids flavor, and gates every block (bccm + kids) with
change_in() so a PR that only touches one app's tree no longer
rebuilds the other. lib/, pubspec.yaml, submodules/, Makefile, and
.semaphore/ are deliberately shared triggers — kids consumes lib/
directly via `brunstadtv_app: path: ../`.

Also parameterizes scripts/refresh-ios-signing-secrets.sh with a
bccm|kids flavor argument so it can refresh either Semaphore
signing-cert secret.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: KillerX

.semaphore/promote-kids-android-prod.yml

@@ -0,0 +1,23 @@
+version: v1.0
+name: Promote kids Android to Production
+agent:
+  machine:
+    type: f1-standard-4
+    os_image: ubuntu2404
+blocks:
+  - name: Promote AAB beta to production
+    task:
+      jobs:
+        - name: Promote on Play Store
+          commands:
+            - checkout
+            - sem-version ruby 3.2
+            - cp /home/semaphore/google-play-service-account.json kids/android/fastlane/google-play-service-account.json
+            - artifact pull workflow kids_build_number
+            - export BUILD_NUMBER=$(cat kids_build_number)
+            - test -n "$BUILD_NUMBER" && test "$BUILD_NUMBER" -gt 0
+            - cd kids/android
+            - bundle install
+            - bundle exec fastlane promote_to_production
+      secrets:
+        - name: android-play-store-api-linux

.semaphore/promote-kids-ios-prod.yml

@@ -0,0 +1,27 @@
+version: v1.0
+name: Promote kids iOS to App Store
+agent:
+  machine:
+    type: a2-standard-4
+    os_image: macos-xcode26
+blocks:
+  - name: Submit TestFlight build to App Store
+    task:
+      jobs:
+        - name: Promote on App Store Connect
+          commands:
+            - checkout
+            - sem-version ruby 3.2
+            - export APP_STORE_CONNECT_KEY_ID="$BCCMEDIA_APP_STORE_CONNECT_KEY_ID"
+            - export APP_STORE_CONNECT_ISSUER_ID="$BCCMEDIA_APP_STORE_CONNECT_ISSUER_ID"
+            - export APP_STORE_CONNECT_KEY_CONTENT_BASE64="$BCCMEDIA_APP_STORE_CONNECT_KEY_CONTENT_BASE64"
+            - artifact pull workflow kids_ios_build_number
+            - export BUILD_NUMBER=$(cat kids_ios_build_number)
+            - test -n "$BUILD_NUMBER" && test "$BUILD_NUMBER" -gt 0
+            - export APP_VERSION=$(grep '^version:' kids/pubspec.yaml | awk '{print $2}' | cut -d+ -f1)
+            - test -n "$APP_VERSION"
+            - cd kids/ios
+            - bundle install
+            - bundle exec fastlane promote_to_app_store
+      secrets:
+        - name: bccmedia-testflight-api

.semaphore/semaphore.yml

@@ -8,9 +8,16 @@ global_job_config:
   env_vars:
     - name: FLUTTER_VERSION
       value: 3.32.0
+# Each block is gated with change_in() so a PR that only touches kids/ skips
+# the bccm builds and vice versa. lib/, pubspec.yaml, submodules/, Makefile,
+# and .semaphore/ are shared infra — a change there triggers BOTH apps. kids
+# also depends on lib/ directly because kids/pubspec.yaml uses
+# `brunstadtv_app: path: ../`.
 blocks:
   - name: Prep bccm version
     dependencies: []
+    run:
+      when: "branch = 'master' AND change_in(['/lib/', '/android/', '/ios/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
     task:
       jobs:
         - name: Compute bccm versionCode
@@ -27,11 +34,11 @@ blocks:
             - artifact push workflow /tmp/bccm_build_number -d bccm_build_number
       secrets:
         - name: android-play-store-api-linux
-    run:
-      when: branch = 'master'
   - name: Build bccm Android
     dependencies:
       - Prep bccm version
+    run:
+      when: "change_in(['/lib/', '/android/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
     task:
       prologue:
         commands:
@@ -88,7 +95,7 @@ blocks:
     dependencies:
       - Build bccm Android
     run:
-      when: branch = 'master'
+      when: "branch = 'master' AND change_in(['/lib/', '/android/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
     task:
       jobs:
         - name: Upload to Play (internal + beta)
@@ -108,6 +115,8 @@ blocks:
         - name: android-play-store-api-linux
   - name: Prep bccm iOS version
     dependencies: []
+    run:
+      when: "change_in(['/lib/', '/ios/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
     task:
       jobs:
         - name: Compute bccm iOS build number
@@ -126,6 +135,8 @@ blocks:
   - name: Build bccm iOS
     dependencies:
       - Prep bccm iOS version
+    run:
+      when: "change_in(['/lib/', '/ios/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
     task:
       agent:
         machine:
@@ -215,7 +226,7 @@ blocks:
     dependencies:
       - Build bccm iOS
     run:
-      when: branch = 'master'
+      when: "branch = 'master' AND change_in(['/lib/', '/ios/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
     task:
       agent:
         machine:
@@ -234,8 +245,238 @@ blocks:
             - bundle exec fastlane testflight
       secrets:
         - name: bccmedia-testflight-api
+  - name: Prep kids version
+    dependencies: []
+    run:
+      when: "branch = 'master' AND change_in(['/kids/', '/lib/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
+    task:
+      jobs:
+        - name: Compute kids versionCode
+          commands:
+            - checkout
+            - sem-version ruby 3.2
+            - cp /home/semaphore/google-play-service-account.json kids/android/fastlane/google-play-service-account.json
+            - cd kids/android
+            - bundle install
+            - bundle exec fastlane next_version_code
+            - export BUILD_NUMBER=$(cat fastlane/.next_version_code)
+            - test -n "$BUILD_NUMBER" && test "$BUILD_NUMBER" -gt 0
+            - echo "$BUILD_NUMBER" > /tmp/kids_build_number
+            - artifact push workflow /tmp/kids_build_number -d kids_build_number
+      secrets:
+        - name: android-play-store-api-linux
+  - name: Build kids Android
+    dependencies:
+      - Prep kids version
+    run:
+      when: "change_in(['/kids/', '/lib/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
+    task:
+      prologue:
+        commands:
+          - checkout
+          - git submodule update --init --recursive
+          - echo "$BCCMEDIA_ENV_DART_BASE64" | base64 -d > lib/env/.env.dart
+          - sem-version java 17
+          - cache restore flutter-sdk-linux-$FLUTTER_VERSION
+          - |
+            if [ ! -d "$HOME/flutter" ]; then
+              wget -q https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz -O /tmp/flutter.tar.xz
+              tar xf /tmp/flutter.tar.xz -C $HOME
+            fi
+          - cache store flutter-sdk-linux-$FLUTTER_VERSION $HOME/flutter
+          - 'export PATH="$HOME/flutter/bin:$PATH"'
+          - flutter --version
+          - export ANDROID_HOME="$HOME/android-sdk"
+          - cache restore android-sdk
+          - |
+            if [ ! -d "$ANDROID_HOME/platforms/android-36" ]; then
+              mkdir -p "$ANDROID_HOME/cmdline-tools"
+              curl -sSL -o /tmp/cmdline-tools.zip https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
+              unzip -q /tmp/cmdline-tools.zip -d "$ANDROID_HOME/cmdline-tools"
+              mv "$ANDROID_HOME/cmdline-tools/cmdline-tools" "$ANDROID_HOME/cmdline-tools/latest"
+              yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null
+              "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platform-tools" "platforms;android-36" "build-tools;36.0.0"
+            fi
+          - cache store android-sdk $ANDROID_HOME
+          - 'export PATH="$ANDROID_HOME/platform-tools:$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"'
+      jobs:
+        - name: Build AAB
+          commands:
+            - artifact pull workflow kids_build_number
+            - export BUILD_NUMBER=$(cat kids_build_number)
+            - echo "Building with versionCode=$BUILD_NUMBER"
+            - keystore_path="$(pwd)/kids/android/app/upload-keystore.jks"
+            - echo "$KEYSTORE_FILE" | base64 -d > "$keystore_path"
+            - |
+              cat > kids/android/key.properties << EOF
+              storePassword=$KEYSTORE_PASSWORD
+              keyPassword=$KEY_PASSWORD
+              keyAlias=$KEY_ALIAS
+              storeFile=$keystore_path
+              EOF
+            - 'cache restore pub-linux-kids-$SEMAPHORE_GIT_BRANCH-$(checksum kids/pubspec.yaml),pub-linux-kids-$(checksum kids/pubspec.yaml),pub-linux-kids'
+            - make pubgetall
+            - cache store pub-linux-kids-$SEMAPHORE_GIT_BRANCH-$(checksum kids/pubspec.yaml) $HOME/.pub-cache
+            - cd kids
+            - flutter build appbundle --release -t lib/main.dart --build-number=$BUILD_NUMBER
+            - artifact push workflow build/app/outputs/bundle/release/app-release.aab -d kids.aab
+      secrets:
+        - name: kids-android-keystore
+        - name: bccmedia-env-dart
+  - name: Deploy kids Android
+    dependencies:
+      - Build kids Android
+    run:
+      when: "branch = 'master' AND change_in(['/kids/', '/lib/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
+    task:
+      jobs:
+        - name: Upload to Play (internal + beta)
+          commands:
+            - checkout
+            - sem-version ruby 3.2
+            - cp /home/semaphore/google-play-service-account.json kids/android/fastlane/google-play-service-account.json
+            - mkdir -p kids/build/app/outputs/bundle/release
+            - artifact pull workflow kids.aab
+            - mv kids.aab kids/build/app/outputs/bundle/release/app-release.aab
+            - artifact pull workflow kids_build_number
+            - export BUILD_NUMBER=$(cat kids_build_number)
+            - cd kids/android
+            - bundle install
+            - bundle exec fastlane upload
+      secrets:
+        - name: android-play-store-api-linux
+  - name: Prep kids iOS version
+    dependencies: []
+    run:
+      when: "change_in(['/kids/', '/lib/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
+    task:
+      jobs:
+        - name: Compute kids iOS build number
+          commands:
+            - checkout
+            - sem-version ruby 3.2
+            # The shared App Store Connect API key is exposed by the secret under
+            # BCCMEDIA_-prefixed env vars. Kids fastlane reads the unprefixed names,
+            # so re-export them here (and in the build/deploy/promote jobs).
+            - export APP_STORE_CONNECT_KEY_ID="$BCCMEDIA_APP_STORE_CONNECT_KEY_ID"
+            - export APP_STORE_CONNECT_ISSUER_ID="$BCCMEDIA_APP_STORE_CONNECT_ISSUER_ID"
+            - export APP_STORE_CONNECT_KEY_CONTENT_BASE64="$BCCMEDIA_APP_STORE_CONNECT_KEY_CONTENT_BASE64"
+            - cd kids/ios
+            - bundle install
+            - bundle exec fastlane next_build_number
+            - export BUILD_NUMBER=$(cat fastlane/.next_build_number)
+            - test -n "$BUILD_NUMBER" && test "$BUILD_NUMBER" -gt 0
+            - echo "$BUILD_NUMBER" > /tmp/kids_ios_build_number
+            - artifact push workflow /tmp/kids_ios_build_number -d kids_ios_build_number
+      secrets:
+        - name: bccmedia-testflight-api
+  - name: Build kids iOS
+    dependencies:
+      - Prep kids iOS version
+    run:
+      when: "change_in(['/kids/', '/lib/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
+    task:
+      agent:
+        machine:
+          type: a2-standard-4
+          os_image: macos-xcode26
+      prologue:
+        commands:
+          - checkout
+          - git submodule update --init --recursive
+          - echo "$BCCMEDIA_ENV_DART_BASE64" | base64 -d > lib/env/.env.dart
+          - cache restore flutter-sdk-macos-$FLUTTER_VERSION
+          - |
+            if [ ! -d "$HOME/flutter" ]; then
+              curl -sSL -o /tmp/flutter.tar.xz https://storage.googleapis.com/flutter_infra_release/releases/stable/macos/flutter_macos_${FLUTTER_VERSION}-stable.tar.xz
+              tar xf /tmp/flutter.tar.xz -C $HOME
+            fi
+          - cache store flutter-sdk-macos-$FLUTTER_VERSION $HOME/flutter
+          - 'export PATH="$HOME/flutter/bin:$PATH"'
+          - flutter --version
+      jobs:
+        - name: Build IPA
+          commands:
+            - artifact pull workflow kids_ios_build_number
+            - export BUILD_NUMBER=$(cat kids_ios_build_number)
+            - echo "Building with iOS build number=$BUILD_NUMBER"
+            - echo "$CERTIFICATE_P12_BASE64" | base64 -d > /tmp/certificate.p12
+            - security create-keychain -p "" build.keychain
+            - security import /tmp/certificate.p12 -k ~/Library/Keychains/build.keychain-db -P "$CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+            - curl -fsSL https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer -o /tmp/AppleWWDRCAG3.cer
+            - security import /tmp/AppleWWDRCAG3.cer -k ~/Library/Keychains/build.keychain-db -T /usr/bin/codesign || true
+            - security list-keychains -s ~/Library/Keychains/build.keychain-db
+            - security default-keychain -s ~/Library/Keychains/build.keychain-db
+            - security unlock-keychain -p "" ~/Library/Keychains/build.keychain-db
+            - security set-keychain-settings ~/Library/Keychains/build.keychain-db
+            - 'security set-key-partition-list -S apple-tool:,apple: -s -k "" ~/Library/Keychains/build.keychain-db'
+            - 'export CODE_SIGN_IDENTITY=$(security find-identity -v -p codesigning | grep -o ''"[^"]*"'' | head -1 | tr -d ''"'')'
+            - 'echo "Signing identity: $CODE_SIGN_IDENTITY"'
+            - |
+              if [ -z "$CODE_SIGN_IDENTITY" ]; then
+                echo "ERROR: no valid code-signing identity in build.keychain."
+                security find-identity -p codesigning ~/Library/Keychains/build.keychain-db || true
+                exit 1
+              fi
+            - mkdir -p "$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles" "$HOME/Library/MobileDevice/Provisioning Profiles"
+            - echo "$PROVISIONING_PROFILE_BASE64" | base64 -d > "$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles/profile.mobileprovision"
+            - cp "$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles/profile.mobileprovision" "$HOME/Library/MobileDevice/Provisioning Profiles/profile.mobileprovision"
+            - export PROVISIONING_PROFILE_UUID=$(security cms -D -i "$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles/profile.mobileprovision" | grep -A 1 "UUID" | grep -o '<string>.*</string>' | sed 's/<string>\(.*\)<\/string>/\1/')
+            - 'echo "Provisioning profile UUID: $PROVISIONING_PROFILE_UUID"'
+            - echo "CODE_SIGN_STYLE = Manual" >> kids/ios/Flutter/Release.xcconfig
+            - echo "PROVISIONING_PROFILE = $PROVISIONING_PROFILE_UUID" >> kids/ios/Flutter/Release.xcconfig
+            - echo "CODE_SIGN_IDENTITY = $CODE_SIGN_IDENTITY" >> kids/ios/Flutter/Release.xcconfig
+            - 'cache restore pub-macos-kids-$SEMAPHORE_GIT_BRANCH-$(checksum kids/pubspec.yaml),pub-macos-kids-$(checksum kids/pubspec.yaml),pub-macos-kids'
+            - make pubgetall
+            - cache store pub-macos-kids-$SEMAPHORE_GIT_BRANCH-$(checksum kids/pubspec.yaml) $HOME/.pub-cache
+            - 'cache restore cocoapods-kids-$SEMAPHORE_GIT_BRANCH-$(checksum kids/ios/Podfile.lock),cocoapods-kids-$(checksum kids/ios/Podfile.lock),cocoapods-kids'
+            - 'export DART_VM_OPTIONS="--old_gen_heap_size=6144"'
+            - cd kids
+            - flutter build ipa --release -t lib/main.dart --build-number=$BUILD_NUMBER --export-options-plist=ios/ExportOptions.plist
+            - cd ..
+            - cache store cocoapods-kids-$SEMAPHORE_GIT_BRANCH-$(checksum kids/ios/Podfile.lock) kids/ios/Pods
+            - |
+              shopt -s nullglob
+              ipas=(kids/build/ios/ipa/*.ipa)
+              echo "Built IPA(s): ${ipas[*]:-<none>}"
+              if [ ${#ipas[@]} -eq 0 ]; then echo "ERROR: no .ipa produced by flutter build ipa"; exit 1; fi
+              [ "${ipas[0]}" = kids/build/ios/ipa/kids.ipa ] || mv "${ipas[0]}" kids/build/ios/ipa/kids.ipa
+            - artifact push workflow kids/build/ios/ipa/kids.ipa -d kids.ipa
+      secrets:
+        - name: kids-ios-signing-certs
+        - name: bccmedia-env-dart
+  - name: Deploy kids iOS
+    dependencies:
+      - Build kids iOS
+    run:
+      when: "branch = 'master' AND change_in(['/kids/', '/lib/', '/pubspec.yaml', '/pubspec.lock', '/submodules/', '/Makefile', '/.semaphore/'], {default_branch: 'master', pipeline_file: 'ignore'})"
+    task:
+      agent:
+        machine:
+          type: a2-standard-4
+          os_image: macos-xcode26
+      jobs:
+        - name: Upload to TestFlight (internal + Beta)
+          commands:
+            - checkout
+            - sem-version ruby 3.2
+            - export APP_STORE_CONNECT_KEY_ID="$BCCMEDIA_APP_STORE_CONNECT_KEY_ID"
+            - export APP_STORE_CONNECT_ISSUER_ID="$BCCMEDIA_APP_STORE_CONNECT_ISSUER_ID"
+            - export APP_STORE_CONNECT_KEY_CONTENT_BASE64="$BCCMEDIA_APP_STORE_CONNECT_KEY_CONTENT_BASE64"
+            - mkdir -p kids/build/ios/ipa
+            - artifact pull workflow kids.ipa
+            - mv kids.ipa kids/build/ios/ipa/kids.ipa
+            - cd kids/ios
+            - bundle install
+            - bundle exec fastlane testflight
+      secrets:
+        - name: bccmedia-testflight-api
 promotions:
   - name: Promote Android to Production
     pipeline_file: promote-android-prod.yml
   - name: Promote iOS to App Store
     pipeline_file: promote-ios-prod.yml
+  - name: Promote kids Android to Production
+    pipeline_file: promote-kids-android-prod.yml
+  - name: Promote kids iOS to App Store
+    pipeline_file: promote-kids-ios-prod.yml