ios-testflight-release.yml

name: ios-release

on:
  workflow_dispatch:
    inputs:
      destination:
        description: Where to publish the build and App Store assets
        required: true
        default: testflight
        type: choice
        options:
          - testflight
          - app-store-assets
          - app-store
      submit_for_review:
        description: Submit the App Store version for review after upload
        required: true
        default: false
        type: boolean
      screenshot_style:
        description: Screenshot presentation to upload
        required: true
        default: framed
        type: choice
        options:
          - raw
          - framed

concurrency:
  group: ios-release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  release:
    runs-on: [self-hosted, macOS]
    timeout-minutes: 60
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version-file: ".nvmrc"

      - name: Install pnpm
        uses: pnpm/action-setup@ac6db6d3c1f721f886538a378a2d73e85697340a # v6.0.8

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate App Store metadata and public links
        if: inputs.destination != 'testflight'
        working-directory: standalone/webapp
        run: pnpm appstore:metadata:validate

      - name: Install Ruby gems (fastlane + cocoapods)
        working-directory: standalone/webapp
        run: |
          eval "$(/opt/homebrew/bin/rbenv init - --no-rehash bash)"
          bundle install
          # Persist rbenv shims on PATH so bundle, pod, and fastlane are
          # resolvable in every subsequent step without re-init.
          echo "$(rbenv root)/shims" >> "$GITHUB_PATH"

      - name: Build library + web assets
        run: pnpm run build:lib && pnpm --filter @tumaet/webapp run build

      - name: Add iOS platform (if missing)
        working-directory: standalone/webapp
        run: |
          if [ ! -d "ios" ]; then
            pnpm capacitor:add:ios
          fi

      - name: Capacitor sync (iOS)
        working-directory: standalone/webapp
        # Bake the live-update signing public key into the app so the updater
        # strictly rejects any bundle it can't verify. Unset (e.g. forks) → the
        # feature is simply disabled, not insecure.
        env:
          CAPGO_PUBLIC_KEY: ${{ vars.CAPGO_PUBLIC_KEY }}
          # Fail the build if the signing key is missing rather than shipping
          # OTA with signature enforcement silently disabled.
          CAPGO_REQUIRE_SIGNING: "true"
        run: pnpm exec cap sync ios

      - name: Resolve marketing version and build number
        if: inputs.destination != 'app-store-assets'
        run: |
          MARKETING_VERSION=$(node -p "require('./standalone/webapp/package.json').version")
          echo "MARKETING_VERSION=$MARKETING_VERSION" >> "$GITHUB_ENV"
          echo "BUILD_NUMBER=$(date +'%Y%m%d%H%M')" >> "$GITHUB_ENV"

      - name: Prepare licensed Apple product bezels
        if: inputs.destination != 'testflight' && inputs.screenshot_style == 'framed'
        working-directory: standalone/webapp
        run: pnpm run appstore:screenshots:prepare-frames

      - name: Capture iPhone and iPad App Store screenshots
        if: inputs.destination != 'testflight'
        working-directory: standalone/webapp
        env:
          APP_STORE_SCREENSHOT_STYLE: ${{ inputs.screenshot_style }}
        run: bundle exec fastlane screenshots

      - name: Upload App Store screenshot review
        if: inputs.destination != 'testflight'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ios-app-store-screenshot-review
          path: |
            standalone/webapp/fastlane/screenshots/
            standalone/webapp/fastlane/screenshots-framed/
            standalone/webapp/fastlane/screenshots-review.html
          if-no-files-found: error
          retention-days: 14

      - name: Build iOS app (Fastlane)
        if: inputs.destination != 'app-store-assets'
        working-directory: standalone/webapp
        env:
          BUILD_NUMBER: ${{ env.BUILD_NUMBER }}
          MARKETING_VERSION: ${{ env.MARKETING_VERSION }}
          MATCH_GITLAB_AUTH: ${{ secrets.IOS_MATCH_GITLAB_AUTH }}
          MATCH_PASSWORD: ${{ secrets.IOS_MATCH_PASSWORD }}
          MATCH_GIT_URL: ${{ vars.IOS_MATCH_GIT_URL }}
          API_KEY_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_KEY_ID }}
          API_KEY_ISSUER_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          API_KEY_PASSWORD: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_PASSWORD }}
          # The lane rebuilds and re-syncs the web bundle before archiving, so the
          # signing key must be present here too — otherwise the archived binary
          # would accept unsigned live updates.
          CAPGO_PUBLIC_KEY: ${{ vars.CAPGO_PUBLIC_KEY }}
          CAPGO_REQUIRE_SIGNING: "true"
        run: bundle exec fastlane build

      - name: Upload to TestFlight (Fastlane)
        if: inputs.destination == 'testflight'
        working-directory: standalone/webapp
        env:
          API_KEY_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_KEY_ID }}
          API_KEY_ISSUER_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          API_KEY_PASSWORD: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_PASSWORD }}
        run: bundle exec fastlane release

      - name: Upload App Store metadata and screenshots (Fastlane)
        if: inputs.destination == 'app-store-assets'
        working-directory: standalone/webapp
        env:
          APP_STORE_SCREENSHOT_STYLE: ${{ inputs.screenshot_style }}
          API_KEY_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_KEY_ID }}
          API_KEY_ISSUER_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          API_KEY_PASSWORD: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_PASSWORD }}
          # Optional: App Review contact. Unset secrets are skipped, leaving the
          # existing App Store Connect values untouched.
          APP_REVIEW_FIRST_NAME: ${{ secrets.IOS_APP_REVIEW_FIRST_NAME }}
          APP_REVIEW_LAST_NAME: ${{ secrets.IOS_APP_REVIEW_LAST_NAME }}
          APP_REVIEW_EMAIL: ${{ secrets.IOS_APP_REVIEW_EMAIL }}
          APP_REVIEW_PHONE: ${{ secrets.IOS_APP_REVIEW_PHONE }}
        run: bundle exec fastlane store_assets

      - name: Upload App Store build, metadata, and screenshots (Fastlane)
        if: inputs.destination == 'app-store'
        working-directory: standalone/webapp
        env:
          APP_STORE_SCREENSHOT_STYLE: ${{ inputs.screenshot_style }}
          API_KEY_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_KEY_ID }}
          API_KEY_ISSUER_ID: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          API_KEY_PASSWORD: ${{ secrets.IOS_APP_STORE_CONNECT_API_KEY_PASSWORD }}
          SUBMIT_FOR_REVIEW: ${{ inputs.submit_for_review }}
          # Optional: App Review contact. Unset secrets are skipped, leaving the
          # existing App Store Connect values untouched.
          APP_REVIEW_FIRST_NAME: ${{ secrets.IOS_APP_REVIEW_FIRST_NAME }}
          APP_REVIEW_LAST_NAME: ${{ secrets.IOS_APP_REVIEW_LAST_NAME }}
          APP_REVIEW_EMAIL: ${{ secrets.IOS_APP_REVIEW_EMAIL }}
          APP_REVIEW_PHONE: ${{ secrets.IOS_APP_REVIEW_PHONE }}
        run: bundle exec fastlane release_app_store

      - name: Upload IPA artifact
        if: always() && inputs.destination != 'app-store-assets'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ios-ipa
          path: standalone/webapp/build/*.ipa
          retention-days: 7