app.yml

name: App

on:
  push:
    branches:
      - main
    paths:
      - "app/**"
      - ".github/workflows/app.yml"
      - "Tuist/**"
      - ".xcode-version"
      - ".swiftpm/**"
      - "Package.swift"
      - "Package.resolved"
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - "app/**"
      - ".github/workflows/app.yml"
      - "Tuist/**"
      - ".xcode-version"
      - ".swiftpm/**"
      - "Package.swift"
      - "Package.resolved"
  workflow_dispatch:

permissions:
  contents: read

env:
  MISE_VERSION: "2026.5.15"
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  MISE_GITHUB_TOKEN: ${{ secrets.TUIST_APP_GITHUB_TOKEN || github.token }}
  TUIST_ENABLE_CACHING: ${{ github.event.pull_request.head.repo.fork != true }}
  MISE_GITHUB_ATTESTATIONS: 0

concurrency:
  group: app-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  check-team-membership:
    name: Check Team Membership
    runs-on: ubuntu-latest
    timeout-minutes: 5
    if: github.event_name == 'pull_request'
    outputs:
      is-team-member: ${{ steps.check.outputs.is-member }}
    steps:
      - name: Check if author is team member
        id: check
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.TUIST_APP_GITHUB_TOKEN || github.token }}
          script: |
            // If TUIST_GITHUB_TOKEN is not available (e.g., from a fork), treat as non-member
            const token = '${{ secrets.TUIST_APP_GITHUB_TOKEN }}';
            if (!token || token === '') {
              console.log(`Running from fork - treating ${context.payload.pull_request.user.login} as non-member`);
              core.setOutput('is-member', 'false');
              return;
            }

            try {
              const { data: membership } = await github.rest.teams.getMembershipForUserInOrg({
                org: 'tuist',
                team_slug: 'engineering',
                username: context.payload.pull_request.user.login
              });
              console.log(`User ${context.payload.pull_request.user.login} is a member of @tuist/engineering`);
              core.setOutput('is-member', 'true');
            } catch (error) {
              if (error.status === 404) {
                console.log(`User ${context.payload.pull_request.user.login} is NOT a member of @tuist/engineering`);
              } else {
                // Don't let a transient GitHub API error (e.g. 403 rate-limit) fail the
                // whole workflow. Fail safe: treat the author as a non-member so the
                // privileged device-build/share steps skip rather than the PR going red.
                console.log(`Could not resolve team membership (${error.status} ${error.message}); treating as non-member`);
              }
              core.setOutput('is-member', 'false');
            }
  app-build:
    name: Build
    runs-on: tuist-macos
    timeout-minutes: 30
    needs: [check-team-membership]
    permissions:
      contents: read
      id-token: write
    if: |
      always() &&
      !cancelled() &&
      !contains(needs.*.result, 'failure') &&
      (github.event.pull_request.draft == false || github.event_name != 'pull_request')
    steps:
      - uses: actions/checkout@v4
      - name: Skip Xcode Macro Fingerprint Validation
        run: defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES
      - name: Skip Xcode Package Validation
        run: defaults write com.apple.dt.Xcode IDESkipPackagePluginFingerprintValidation -bool YES
      - name: Restore cache
        id: cache-restore
        uses: actions/cache/restore@v4
        with:
          path: .build
          key: ${{ runner.os }}-app-${{ hashFiles('Package.resolved', 'Package.swift') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        run: tuist install --force-resolved-versions
      - name: Update CFBundleVersion
        run: |
          sed -i '' -e "s/CFBundleVersion.*/CFBundleVersion\": \"${{ github.run_number }}\",/g" "app/Project.swift"
      - name: Generate TuistApp
        run: mise x -- tuist generate TuistApp
      - name: Build TuistApp
        run: mise x -- tuist xcodebuild build -scheme TuistApp -destination "generic/platform=iOS Simulator" -workspace Tuist.xcworkspace
      - name: Share TuistApp
        if: |
          github.event_name == 'push' ||
          github.event_name == 'workflow_dispatch' ||
          (github.event_name == 'pull_request' && needs.check-team-membership.outputs.is-team-member == 'true')
        run: mise x -- tuist share TuistApp
      - name: Save cache
        id: cache-save
        uses: actions/cache/save@v4
        with:
          path: .build
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}

  app-test:
    name: Test
    runs-on: tuist-macos
    timeout-minutes: 30
    needs: [check-team-membership]
    permissions:
      contents: read
      id-token: write
    if: |
      always() &&
      !cancelled() &&
      !contains(needs.*.result, 'failure') &&
      (github.event.pull_request.draft == false || github.event_name != 'pull_request')
    steps:
      - uses: actions/checkout@v4
      - name: Skip Xcode Macro Fingerprint Validation
        run: defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES
      - name: Skip Xcode Package Validation
        run: defaults write com.apple.dt.Xcode IDESkipPackagePluginFingerprintValidation -bool YES
      - name: Restore cache
        id: cache-restore
        uses: actions/cache/restore@v4
        with:
          path: .build
          key: ${{ runner.os }}-app-${{ hashFiles('Package.resolved', 'Package.swift') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        run: tuist install --force-resolved-versions
      - name: Test TuistApp
        run: tuist test TuistApp -- -retry-tests-on-failure -test-iterations 4 CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO
      - name: Save cache
        id: cache-save
        uses: actions/cache/save@v4
        with:
          path: .build
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}

  app-device-build:
    name: Device Build
    runs-on: tuist-macos
    timeout-minutes: 30
    needs: [check-team-membership]
    permissions:
      contents: read
      id-token: write
    if: |
      always() &&
      !cancelled() &&
      !contains(needs.*.result, 'failure') &&
      (github.event.pull_request.draft == false || github.event_name != 'pull_request')
    env:
      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - name: Skip Xcode Macro Fingerprint Validation
        run: defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES
      - name: Skip Xcode Package Validation
        run: defaults write com.apple.dt.Xcode IDESkipPackagePluginFingerprintValidation -bool YES
      - name: Restore cache
        id: cache-restore
        uses: actions/cache/restore@v4
        with:
          path: .build
          key: ${{ runner.os }}-app-${{ hashFiles('Package.resolved', 'Package.swift') }}
      - uses: jdx/mise-action@v4.0.1
        with:
          version: ${{ env.MISE_VERSION }}
          github_token: ${{ env.MISE_GITHUB_TOKEN }}
      - name: Authenticate with Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist auth login
      - name: Setup Tuist
        if: github.event.pull_request.head.repo.fork != true
        run: tuist setup
      - name: Install Tuist dependencies
        run: tuist install --force-resolved-versions
      - name: Update CFBundleVersion
        run: |
          sed -i '' -e "s/CFBundleVersion.*/CFBundleVersion\": \"${{ github.run_number }}\",/g" "app/Project.swift"
      - name: Generate TuistApp
        run: mise x -- tuist generate TuistApp
      - name: Bundle iOS app
        if: |
          github.event_name == 'push' ||
          github.event_name == 'workflow_dispatch' ||
          (github.event_name == 'pull_request' && needs.check-team-membership.outputs.is-team-member == 'true')
        run: mise run app:bundle-ios
      - name: Inspect TuistApp
        if: |
          github.event_name == 'push' ||
          github.event_name == 'workflow_dispatch' ||
          (github.event_name == 'pull_request' && needs.check-team-membership.outputs.is-team-member == 'true')
        run: mise x -- tuist inspect bundle build/Tuist.ipa
      - name: Share TuistApp
        if: |
          github.event_name == 'push' ||
          github.event_name == 'workflow_dispatch' ||
          (github.event_name == 'pull_request' && needs.check-team-membership.outputs.is-team-member == 'true')
        run: mise x -- tuist share build/Tuist.ipa
      - name: Save cache
        id: cache-save
        uses: actions/cache/save@v4
        with:
          path: .build
          key: ${{ steps.cache-restore.outputs.cache-primary-key }}