ios-testflight.yml

name: Build iOS release candidate

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Marketing version, for example 0.1.0"
        required: true
        type: string
      build_number:
        description: "Unique increasing build number, never reuse after upload"
        required: true
        type: string
      distribution_method:
        description: "Create an App Store Connect or registered-device Ad Hoc package"
        default: app-store-connect
        type: choice
        options:
          - app-store-connect
          - ad-hoc
      upload_testflight:
        description: "Upload to App Store Connect (does not submit review or invite testers)"
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: ios-release
  cancel-in-progress: false

jobs:
  release:
    runs-on: macos-15
    timeout-minutes: 60
    # Configure required reviewers and allowed branches BEFORE adding secrets.
    environment: ios-release
    env:
      IOS_VERSION: ${{ inputs.version }}
      IOS_BUILD_NUMBER: ${{ inputs.build_number }}
      IOS_EXPORT_METHOD: ${{ inputs.distribution_method }}
      IOS_TAURI_EXPORT_METHOD: ${{ inputs.distribution_method == 'ad-hoc' && 'release-testing' || 'app-store-connect' }}
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Check credentials and reviewed source before installing dependencies
        env:
          HAS_CERTIFICATE: ${{ secrets.IOS_CERTIFICATE != '' }}
          HAS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD != '' }}
          HAS_APP_STORE_PROFILE: ${{ secrets.IOS_MOBILE_PROVISION != '' }}
          HAS_AD_HOC_PROFILE: ${{ secrets.IOS_ADHOC_MOBILE_PROVISION != '' }}
          HAS_TEAM: ${{ secrets.APPLE_TEAM_ID != '' }}
          HAS_API_KEY: ${{ secrets.ASC_PRIVATE_KEY != '' }}
          HAS_API_KEY_ID: ${{ secrets.ASC_KEY_ID != '' }}
          HAS_ISSUER: ${{ secrets.ASC_ISSUER_ID != '' }}
          UPLOAD: ${{ inputs.upload_testflight }}
          APPROVED_SHA: ${{ vars.IOS_RELEASE_APPROVED_SHA }}
        run: |
          set -euo pipefail
          for name in HAS_CERTIFICATE HAS_CERTIFICATE_PASSWORD HAS_TEAM; do
            if [[ "${!name}" != true ]]; then
              echo "::error::Missing iOS signing configuration: $name (see docs/releases/ios-launch-readiness.md)"
              exit 1
            fi
          done
          case "$IOS_EXPORT_METHOD" in
            app-store-connect)
              [[ "$HAS_APP_STORE_PROFILE" == true ]] || { echo '::error::Missing App Store Connect provisioning profile'; exit 1; }
              ;;
            ad-hoc)
              [[ "$HAS_AD_HOC_PROFILE" == true ]] || { echo '::error::Missing Ad Hoc provisioning profile'; exit 1; }
              [[ "$UPLOAD" != true ]] || { echo '::error::Ad Hoc packages cannot be uploaded to TestFlight'; exit 1; }
              ;;
            *)
              echo "::error::Unsupported distribution method: $IOS_EXPORT_METHOD"
              exit 1
              ;;
          esac
          if [[ "$UPLOAD" == true ]]; then
            for name in HAS_API_KEY HAS_API_KEY_ID HAS_ISSUER; do
              [[ "${!name}" == true ]] || { echo "::error::Missing upload configuration: $name"; exit 1; }
            done
            [[ "$APPROVED_SHA" == "$GITHUB_SHA" ]] || { echo '::error::Complete the release checklist and approve this exact commit before uploading'; exit 1; }
          fi

      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "22"
          cache: pnpm

      - name: Validate release input and installed toolchain
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail
          xcode_path="$(python3 - <<'PY'
          import glob
          import re

          candidates = []
          for path in glob.glob("/Applications/Xcode_26*.app"):
              match = re.search(r"Xcode_(26(?:\.\d+)*)", path)
              if match:
                  version = tuple(int(part) for part in match.group(1).split("."))
                  candidates.append((version, path))
          if not candidates:
              raise SystemExit("Xcode 26 is not installed on this runner")
          print(max(candidates)[1])
          PY
          )"
          export DEVELOPER_DIR="$xcode_path/Contents/Developer"
          sudo xcode-select --switch "$DEVELOPER_DIR"
          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
          [[ "$(xcode-select -p)" == "$DEVELOPER_DIR" ]] || { echo '::error::System Xcode selection does not match Xcode 26'; exit 1; }
          [[ "$(xcrun --find xcodebuild)" == "$DEVELOPER_DIR/usr/bin/xcodebuild" ]] || { echo '::error::xcrun is not resolving tools from Xcode 26'; exit 1; }
          ios_sdk_version="$(xcrun --sdk iphoneos --show-sdk-version)"
          ios_sdk_major="${ios_sdk_version%%.*}"
          [[ "$ios_sdk_major" =~ ^[0-9]+$ && "$ios_sdk_major" -ge 26 ]] || { echo "::error::Selected iPhoneOS SDK $ios_sdk_version is older than 26"; exit 1; }
          node scripts/ios-release/readiness.mjs config > "$RUNNER_TEMP/ios-release-config.json"
          xcodebuild -version
          major=$(xcodebuild -version | awk '/Xcode/{split($2,v,".");print v[1]}')
          [[ "$major" -ge 26 ]] || { echo '::error::Select a runner with Xcode 26 or newer'; exit 1; }
          node --test scripts/ios-release/readiness.test.mjs

      - name: Install dependencies
        run: |
          pnpm install --frozen-lockfile
          rustup target add aarch64-apple-ios
          command -v xcodegen >/dev/null || brew install xcodegen

      - name: Run mobile regression checks
        env:
          NODE_OPTIONS: --max-old-space-size=6144
        run: |
          pnpm exec tsc --noEmit
          pnpm test src/modules/MobileRemote
          # The native crate embeds frontendDist with its default custom-protocol feature.
          # Plain cargo does not run Tauri's beforeBuildCommand.
          pnpm build:mobile-native
          cargo check --locked --manifest-path apps/remote-ios/src-tauri/Cargo.toml --target aarch64-apple-ios

      - name: Install isolated iOS signing materials
        env:
          IOS_CERTIFICATE: ${{ secrets.IOS_CERTIFICATE }}
          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
          IOS_MOBILE_PROVISION: ${{ inputs.distribution_method == 'ad-hoc' && secrets.IOS_ADHOC_MOBILE_PROVISION || secrets.IOS_MOBILE_PROVISION }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set +x
          set -euo pipefail
          umask 077

          certificate_path="$RUNNER_TEMP/ios-distribution.p12"
          profile_path="$RUNNER_TEMP/ios-distribution.mobileprovision"
          profile_plist="$RUNNER_TEMP/ios-distribution.plist"
          keychain_path="$RUNNER_TEMP/ios-signing.keychain-db"
          keychain_password="$(uuidgen)$(uuidgen)"
          echo "::add-mask::$keychain_password"
          {
            echo "IOS_KEYCHAIN_PATH=$keychain_path"
            echo "IOS_KEYCHAIN_PASSWORD=$keychain_password"
          } >> "$GITHUB_ENV"

          CERTIFICATE_PATH="$certificate_path" PROFILE_PATH="$profile_path" python3 - <<'PY'
          import base64
          import os
          from pathlib import Path

          for source, target in (
              ("IOS_CERTIFICATE", "CERTIFICATE_PATH"),
              ("IOS_MOBILE_PROVISION", "PROFILE_PATH"),
          ):
              try:
                  encoded = "".join(os.environ[source].split())
                  decoded = base64.b64decode(encoded, validate=True)
              except Exception as error:
                  raise SystemExit(f"Invalid base64 signing material: {source}") from error
              if not decoded:
                  raise SystemExit(f"Empty decoded signing material: {source}")
              Path(os.environ[target]).write_bytes(decoded)
          PY

          security create-keychain -p "$keychain_password" "$keychain_path"
          security set-keychain-settings -lut 3600 "$keychain_path"
          security unlock-keychain -p "$keychain_password" "$keychain_path"
          security import "$certificate_path" \
            -k "$keychain_path" \
            -P "$IOS_CERTIFICATE_PASSWORD" \
            -f pkcs12 \
            -t cert \
            -T /usr/bin/codesign \
            -T /usr/bin/security >/dev/null
          security set-key-partition-list \
            -S apple-tool:,apple:,codesign: \
            -s \
            -k "$keychain_password" \
            "$keychain_path" >/dev/null
          security list-keychains -d user -s "$keychain_path"
          IOS_KEYCHAIN_PATH="$keychain_path" IOS_SIGNING_IDENTITY_FILE="$RUNNER_TEMP/ios-signing-identity" python3 - <<'PY'
          import os
          import re
          import subprocess
          from pathlib import Path

          output = subprocess.check_output(
              ["security", "find-identity", "-v", "-p", "codesigning", os.environ["IOS_KEYCHAIN_PATH"]],
              text=True,
          )
          identities = re.findall(
              r'^\s*\d+\)\s+[A-Fa-f0-9]+\s+"((?:Apple|iPhone) Distribution: [^"]+)"\s*$',
              output,
              re.MULTILINE,
          )
          if len(identities) != 1:
              raise SystemExit("Expected exactly one Apple Distribution signing identity")
          Path(os.environ["IOS_SIGNING_IDENTITY_FILE"]).write_text(identities[0], encoding="utf-8")
          PY

          security cms -D -i "$profile_path" > "$profile_plist"
          PROFILE_PLIST="$profile_plist" PROFILE_UUID_FILE="$RUNNER_TEMP/ios-profile-uuid" python3 - <<'PY'
          import os
          import plistlib
          import re
          from datetime import datetime, timezone
          from pathlib import Path

          with open(os.environ["PROFILE_PLIST"], "rb") as source:
              profile = plistlib.load(source)
          team = os.environ["APPLE_TEAM_ID"]
          bundle_id = "org2ai.org2.remote"
          entitlements = profile.get("Entitlements", {})
          app_id = entitlements.get("application-identifier", "")
          prefix, separator, profile_bundle_id = app_id.partition(".")

          if team not in profile.get("TeamIdentifier", []):
              raise SystemExit("Provisioning profile Team ID mismatch")
          if not separator or prefix not in profile.get("ApplicationIdentifierPrefix", []):
              raise SystemExit("Provisioning profile application prefix mismatch")
          if profile_bundle_id != bundle_id:
              raise SystemExit("Provisioning profile bundle ID mismatch")
          if entitlements.get("get-task-allow") is not False:
              raise SystemExit("Provisioning profile allows debugging")
          method = os.environ["IOS_EXPORT_METHOD"]
          if profile.get("ProvisionsAllDevices") is True:
              raise SystemExit("Enterprise provisioning profiles are not supported")
          if method == "app-store-connect":
              if profile.get("ProvisionedDevices") is not None:
                  raise SystemExit("Expected an App Store Connect provisioning profile")
              if entitlements.get("beta-reports-active") is not True:
                  raise SystemExit("Provisioning profile is not for App Store distribution")
          elif method == "ad-hoc":
              devices = profile.get("ProvisionedDevices")
              if not isinstance(devices, list) or not devices:
                  raise SystemExit("Ad Hoc provisioning profile has no registered devices")
              if entitlements.get("beta-reports-active") is True:
                  raise SystemExit("Expected an Ad Hoc provisioning profile")
          else:
              raise SystemExit(f"Unsupported distribution method: {method}")
          expiration = profile.get("ExpirationDate")
          if not isinstance(expiration, datetime):
              raise SystemExit("Provisioning profile expiration is missing")
          if expiration.replace(tzinfo=expiration.tzinfo or timezone.utc) <= datetime.now(timezone.utc):
              raise SystemExit("Provisioning profile has expired")

          uuid = profile.get("UUID", "")
          if not re.fullmatch(r"[A-Fa-f0-9-]{36}", uuid):
              raise SystemExit("Provisioning profile UUID is invalid")
          Path(os.environ["PROFILE_UUID_FILE"]).write_text(uuid, encoding="utf-8")
          PY

          profile_uuid="$(cat "$RUNNER_TEMP/ios-profile-uuid")"
          profiles_dir="$HOME/Library/MobileDevice/Provisioning Profiles"
          xcode_profiles_dir="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
          installed_profile="$profiles_dir/$profile_uuid.mobileprovision"
          installed_xcode_profile="$xcode_profiles_dir/$profile_uuid.mobileprovision"
          mkdir -p "$profiles_dir" "$xcode_profiles_dir"
          cp "$profile_path" "$installed_profile"
          cp "$profile_path" "$installed_xcode_profile"

          xcode_project="$GITHUB_WORKSPACE/apps/remote-ios/src-tauri/gen/apple/org2-remote.xcodeproj/project.pbxproj"
          export_options="$GITHUB_WORKSPACE/apps/remote-ios/src-tauri/gen/apple/ExportOptions.plist"
          signing_xcconfig="$RUNNER_TEMP/ios-signing.xcconfig"
          cp "$xcode_project" "$RUNNER_TEMP/ios-project.pbxproj.backup"
          cp "$export_options" "$RUNNER_TEMP/ios-export-options.plist.backup"
          IOS_XCODE_PROJECT_FILE="$xcode_project" \
          IOS_EXPORT_OPTIONS_FILE="$export_options" \
          IOS_SIGNING_XCCONFIG="$signing_xcconfig" \
          IOS_SIGNING_IDENTITY_FILE="$RUNNER_TEMP/ios-signing-identity" \
          IOS_PROFILE_UUID_FILE="$RUNNER_TEMP/ios-profile-uuid" \
          IOS_EXPORT_METHOD="$IOS_EXPORT_METHOD" \
          node scripts/ios-release/manual-signing.mjs
          plutil -lint "$export_options"

          {
            echo "IOS_INSTALLED_PROFILE=$installed_profile"
            echo "IOS_INSTALLED_XCODE_PROFILE=$installed_xcode_profile"
            echo "IOS_XCODE_PROJECT_FILE=$xcode_project"
            echo "IOS_EXPORT_OPTIONS_FILE=$export_options"
            echo "XCODE_XCCONFIG_FILE=$signing_xcconfig"
          } >> "$GITHUB_ENV"

      - name: Build signed release with bundled frontend
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail
          security unlock-keychain -p "$IOS_KEYCHAIN_PASSWORD" "$IOS_KEYCHAIN_PATH"
          pnpm tauri:ios:build --ci --export-method "$IOS_TAURI_EXPORT_METHOD" --config "$RUNNER_TEMP/ios-release-config.json"

      - name: Validate the exported IPA, not just source configuration
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail
          ipa='apps/remote-ios/src-tauri/gen/apple/build/arm64/ORG2 Remote.ipa'
          test -s "$ipa"
          inspection=$(mktemp -d "$RUNNER_TEMP/ios-ipa-inspection.XXXXXX")
          ditto -x -k "$ipa" "$inspection"
          node scripts/ios-release/readiness.mjs app "$inspection/Payload/ORG2 Remote.app"
          shasum -a 256 "$ipa" >> "$GITHUB_STEP_SUMMARY"
          printf 'Source: %s\nVersion: %s (%s)\nDistribution: %s\n' "$GITHUB_SHA" "$IOS_VERSION" "$IOS_BUILD_NUMBER" "$IOS_EXPORT_METHOD" >> "$GITHUB_STEP_SUMMARY"

      - name: Retain only the signed candidate
        uses: actions/upload-artifact@v4
        with:
          name: ios-${{ inputs.distribution_method }}-${{ inputs.version }}-${{ inputs.build_number }}
          path: apps/remote-ios/src-tauri/gen/apple/build/arm64/ORG2 Remote.ipa
          if-no-files-found: error
          retention-days: 7

      - name: Validate and upload to App Store Connect
        if: inputs.upload_testflight
        env:
          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
        run: |
          set +x
          set -euo pipefail
          umask 077
          [[ "$ASC_KEY_ID" =~ ^[A-Z0-9]{10}$ ]] || { echo 'Invalid API key ID format'; exit 1; }
          export API_PRIVATE_KEYS_DIR
          API_PRIVATE_KEYS_DIR=$(mktemp -d "$RUNNER_TEMP/ios-upload-key.XXXXXX")
          key_file="$API_PRIVATE_KEYS_DIR/AuthKey_$ASC_KEY_ID.p8"
          validation_log="$RUNNER_TEMP/ios-altool-validation.log"
          upload_log="$RUNNER_TEMP/ios-altool-upload.log"
          trap 'rm -f "$key_file" "$validation_log" "$upload_log"; rmdir "$API_PRIVATE_KEYS_DIR"' EXIT
          printf '%s' "$ASC_PRIVATE_KEY" > "$key_file"
          ipa='apps/remote-ios/src-tauri/gen/apple/build/arm64/ORG2 Remote.ipa'

          run_altool() {
            local phase="$1"
            local log="$2"
            shift 2
            local status
            set +e
            xcrun altool "$@" 2>&1 | tee "$log"
            status="${PIPESTATUS[0]}"
            set -e
            node scripts/ios-release/readiness.mjs altool "$phase" "$status" "$log"
          }

          run_altool validation "$validation_log" \
            --validate-app -f "$ipa" --type ios --apiKey "$ASC_KEY_ID" --apiIssuer "$ASC_ISSUER_ID"
          run_altool upload "$upload_log" \
            --upload-app -f "$ipa" --type ios --apiKey "$ASC_KEY_ID" --apiIssuer "$ASC_ISSUER_ID"
          echo 'Upload accepted. Processing, export-compliance questions, tester access and review are separate App Store Connect steps.' >> "$GITHUB_STEP_SUMMARY"

      - name: Remove iOS signing materials
        if: always()
        run: |
          set +x
          set +e
          [[ -z "${IOS_INSTALLED_PROFILE:-}" ]] || rm -f "$IOS_INSTALLED_PROFILE"
          [[ -z "${IOS_INSTALLED_XCODE_PROFILE:-}" ]] || rm -f "$IOS_INSTALLED_XCODE_PROFILE"
          [[ -z "${IOS_KEYCHAIN_PATH:-}" ]] || security delete-keychain "$IOS_KEYCHAIN_PATH"
          [[ -z "${IOS_XCODE_PROJECT_FILE:-}" || ! -f "$RUNNER_TEMP/ios-project.pbxproj.backup" ]] || cp "$RUNNER_TEMP/ios-project.pbxproj.backup" "$IOS_XCODE_PROJECT_FILE"
          [[ -z "${IOS_EXPORT_OPTIONS_FILE:-}" || ! -f "$RUNNER_TEMP/ios-export-options.plist.backup" ]] || cp "$RUNNER_TEMP/ios-export-options.plist.backup" "$IOS_EXPORT_OPTIONS_FILE"
          rm -f \
            "$RUNNER_TEMP/ios-distribution.p12" \
            "$RUNNER_TEMP/ios-distribution.mobileprovision" \
            "$RUNNER_TEMP/ios-distribution.plist" \
            "$RUNNER_TEMP/ios-profile-uuid" \
            "$RUNNER_TEMP/ios-signing-identity" \
            "$RUNNER_TEMP/ios-signing.xcconfig" \
            "$RUNNER_TEMP/ios-project.pbxproj.backup" \
            "$RUNNER_TEMP/ios-export-options.plist.backup"