xcode-cloud-staging.yml

name: Xcode Cloud staging trigger

# Disabled on push. Tier 2 replaced what this was for: a dev-signed build from
# the working tree lands on the phone in about a minute, without a commit, and
# the staging Xcode Cloud build had been failing in ci_post_clone for weeks
# without anybody needing it. The production trigger is the one that matters.
#
# The machinery stays, and stays tested, so it can be run by hand if the
# question is ever specifically "does a staging archive still build".
on:
  workflow_dispatch:

concurrency:
  group: xcode-cloud-staging-trigger
  cancel-in-progress: false

jobs:
  start-xcode-cloud:
    name: Build in Xcode Cloud and distribute to TestFlight
    runs-on: blacksmith-6vcpu-macos-latest
    timeout-minutes: 90
    permissions:
      contents: read
    steps:
      - name: Check out repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Verify release automation
        run: |
          node --test .github/scripts/app-store-connect.test.mjs
          node --test .github/scripts/xcode-cloud-artifacts.test.mjs
          node --test .github/scripts/xcode-cloud-diagnostics.test.mjs
          node --test .github/scripts/upload-ios-export.test.mjs
          node --test .github/scripts/xcode-cloud-workflows.test.mjs
          bash apps/ios/ci_scripts/ci_post_clone_test.sh
          apps/ios/ci_scripts/verify_built_configuration_test.sh

      - name: Start staging build
        id: start
        env:
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          XCODE_CLOUD_WORKFLOW_ID: 304D20E5-2087-4E0D-8A6E-5E6025DEED36
          XCODE_CLOUD_BRANCH_REF_ID: 12bf4a16-c48a-4b1b-b524-ff04e6bd4278
        run: node .github/scripts/start-xcode-cloud.mjs

      - name: Wait for Xcode Cloud export
        id: xcode_cloud
        env:
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          XCODE_CLOUD_BUILD_RUN_ID: ${{ steps.start.outputs.build_run_id }}
          XCODE_CLOUD_DIAGNOSTICS_DIR: ${{ runner.temp }}/xcode-cloud-diagnostics
        run: node .github/scripts/wait-for-xcode-cloud.mjs

      - name: Preserve failed Xcode Cloud diagnostics
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: xcode-cloud-staging-diagnostics-${{ steps.start.outputs.build_number }}
          path: ${{ runner.temp }}/xcode-cloud-diagnostics
          if-no-files-found: ignore
          retention-days: 1

      - name: Download Xcode Cloud App Store export
        if: steps.xcode_cloud.outputs.artifact_url != ''
        env:
          ARTIFACT_URL: ${{ steps.xcode_cloud.outputs.artifact_url }}
        run: |
          mkdir -p "$RUNNER_TEMP/xcode-cloud-app-store"
          curl --fail --location \
            --connect-timeout 30 \
            --max-time 1800 \
            --retry 3 \
            --retry-all-errors \
            --retry-delay 2 \
            "$ARTIFACT_URL" --output "$RUNNER_TEMP/xcode-cloud-app-store.zip"
          unzip -q "$RUNNER_TEMP/xcode-cloud-app-store.zip" -d "$RUNNER_TEMP/xcode-cloud-app-store"

      - name: Verify signed staging IPA
        if: steps.xcode_cloud.outputs.artifact_url != ''
        run: .github/scripts/verify-ios-export.sh staging "$RUNNER_TEMP/xcode-cloud-app-store"

      - name: Preserve signed staging IPA for physical acceptance
        if: steps.xcode_cloud.outputs.artifact_url != ''
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: albatross-staging-${{ steps.start.outputs.build_number }}
          path: ${{ runner.temp }}/xcode-cloud-app-store/**/*.ipa
          if-no-files-found: error
          retention-days: 1

      - name: Upload export to App Store Connect
        if: steps.xcode_cloud.outputs.needs_upload == 'true'
        env:
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          BUILD_NUMBER: ${{ steps.start.outputs.build_number }}
        run: |
          ipa_path=$(find "$RUNNER_TEMP/xcode-cloud-app-store" -type f -name '*.ipa' -print -quit)
          if [ -z "$ipa_path" ]; then
            echo "The Xcode Cloud App Store export did not contain an IPA." >&2
            exit 1
          fi

          IPA_PATH="$ipa_path" node .github/scripts/upload-ios-export.mjs

      - name: Confirm TestFlight processing and internal group assignment
        env:
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
          APP_STORE_APP_ID: 6792830834
          TESTFLIGHT_GROUP_ID: 4606fec2-432b-4875-93dc-8f4a3982f6e0
          BUILD_NUMBER: ${{ steps.start.outputs.build_number }}
        run: node .github/scripts/wait-for-testflight.mjs