ios-testflight.yml

name: iOS TestFlight Release

on:
  workflow_dispatch:
    inputs:
      beta_group_names:
        description: "Comma-separated TestFlight beta groups"
        required: false
        default: "Internal Testers,External Testers"
        type: string
      wait_for_processing:
        description: "Wait for ASC processing before finishing"
        required: false
        default: true
        type: boolean

permissions:
  contents: write

jobs:
  prepare-release-assets:
    runs-on: macos-26
    timeout-minutes: 90
    env:
      HOMEBREW_NO_AUTO_UPDATE: "1"
      SCCACHE_BUCKET: rust-cache
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_R2_ENDPOINT }}
      SCCACHE_REGION: auto
      SCCACHE_S3_USE_SSL: "true"
      SCCACHE_S3_KEY_PREFIX: ci/ios-release
      SCCACHE_LOG: info
      AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Select Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: '26.3'

      - name: Install build dependencies
        run: brew install xcodegen meson ninja

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@v0.0.9

      - name: Prime sccache
        run: |
          export SCCACHE_ERROR_LOG="$RUNNER_TEMP/sccache-ios.log"
          rm -f "$SCCACHE_ERROR_LOG"
          sccache --stop-server || true
          sccache --start-server
          sccache --show-stats || true

      - name: Prepare iOS release assets
        env:
          CARGO_INCREMENTAL: "0"
          CARGO_BUILD_JOBS: "1"
          IOS_RUST_PROFILE: mobile-release
          RUSTC_WRAPPER: sccache
        run: |
          set -euo pipefail
          export SCCACHE_ERROR_LOG="$RUNNER_TEMP/sccache-ios.log"
          trap 'status=$?; echo "==> sccache stats"; sccache --show-stats || true; if [ -f "$SCCACHE_ERROR_LOG" ]; then echo "==> sccache error log"; tail -200 "$SCCACHE_ERROR_LOG" || true; fi; exit $status' EXIT
          sccache --zero-stats || true
          ./apps/ios/scripts/build-rust.sh --preserve-current --device-only
          make ios-frameworks xcgen
          echo "==> sccache stats after iOS release prep"
          sccache --show-stats || true

      - name: Package iOS release prep artifact
        run: |
          mkdir -p .ci-prep/ios
          tar -czf .ci-prep/ios/ios-release-prep.tgz -C . \
            apps/ios/Frameworks/ios_system \
            apps/ios/GeneratedRust \
            apps/ios/Sources/Litter/Bridge/UniFFICodexClient.generated.swift

      - name: Upload iOS release prep artifact
        uses: actions/upload-artifact@v4
        with:
          name: ios-release-prep
          path: .ci-prep/ios
          if-no-files-found: error

  upload-testflight:
    needs: prepare-release-assets
    runs-on: macos-26
    timeout-minutes: 150
    environment: release
    env:
      HOMEBREW_NO_AUTO_UPDATE: "1"
      SCCACHE_BUCKET: rust-cache
      SCCACHE_ENDPOINT: ${{ secrets.SCCACHE_R2_ENDPOINT }}
      SCCACHE_REGION: auto
      SCCACHE_S3_USE_SSL: "true"
      SCCACHE_S3_KEY_PREFIX: ci/ios-release
      SCCACHE_LOG: info
      AWS_ACCESS_KEY_ID: ${{ secrets.SCCACHE_R2_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.SCCACHE_R2_SECRET_ACCESS_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Select Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: '26.3'

      - name: Validate required secrets
        env:
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_PRIVATE_KEY_P8_B64: ${{ secrets.ASC_PRIVATE_KEY_P8_B64 }}
          IOS_APP_STORE_APP_ID: ${{ secrets.IOS_APP_STORE_APP_ID }}
          IOS_TEAM_ID: ${{ secrets.IOS_TEAM_ID }}
          IOS_DIST_CERT_P12_B64: ${{ secrets.IOS_DIST_CERT_P12_B64 }}
          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
          IOS_APP_STORE_PROFILE_B64: ${{ secrets.IOS_APP_STORE_PROFILE_B64 }}
        run: |
          set -euo pipefail
          required=(
            ASC_KEY_ID
            ASC_ISSUER_ID
            ASC_PRIVATE_KEY_P8_B64
            IOS_APP_STORE_APP_ID
            IOS_TEAM_ID
            IOS_DIST_CERT_P12_B64
            IOS_DIST_CERT_PASSWORD
            IOS_APP_STORE_PROFILE_B64
          )
          for name in "${required[@]}"; do
            if [[ -z "${!name:-}" ]]; then
              echo "Missing required secret: $name" >&2
              exit 1
            fi
          done

      - name: Install build dependencies
        run: |
          set -euo pipefail
          brew install xcodegen jq
          HOMEBREW_NO_AUTO_UPDATE=0 brew install asc
          xcodebuild -version
          asc --version

      - name: Download iOS release prep artifact
        uses: actions/download-artifact@v4
        with:
          name: ios-release-prep
          path: .ci-prep/ios

      - name: Restore iOS release prep
        run: |
          IOS_PREP_ROOT=.ci-prep/ios
          if [ -d "$IOS_PREP_ROOT/ios" ]; then
            IOS_PREP_ROOT="$IOS_PREP_ROOT/ios"
          fi

          tar -xzf "$IOS_PREP_ROOT/ios-release-prep.tgz" -C .

      - name: Decode App Store Connect API key
        env:
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_PRIVATE_KEY_P8_B64: ${{ secrets.ASC_PRIVATE_KEY_P8_B64 }}
        run: |
          set -euo pipefail
          ASC_KEY_PATH="$RUNNER_TEMP/AuthKey_${ASC_KEY_ID}.p8"
          echo "$ASC_PRIVATE_KEY_P8_B64" | base64 --decode > "$ASC_KEY_PATH"
          chmod 600 "$ASC_KEY_PATH"
          echo "ASC_PRIVATE_KEY_PATH=$ASC_KEY_PATH" >> "$GITHUB_ENV"

      - name: Install signing certificate and provisioning profiles
        env:
          IOS_DIST_CERT_P12_B64: ${{ secrets.IOS_DIST_CERT_P12_B64 }}
          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
          IOS_APP_STORE_PROFILE_B64: ${{ secrets.IOS_APP_STORE_PROFILE_B64 }}
          IOS_LIVE_ACTIVITY_APP_STORE_PROFILE_B64: ${{ secrets.IOS_LIVE_ACTIVITY_APP_STORE_PROFILE_B64 }}
        run: |
          set -euo pipefail

          CERT_PATH="$RUNNER_TEMP/dist-cert.p12"
          APP_PROFILE_PATH="$RUNNER_TEMP/app-store.mobileprovision"
          LIVE_ACTIVITY_PROFILE_PATH="$RUNNER_TEMP/live-activity-app-store.mobileprovision"
          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -base64 24)"

          echo "$IOS_DIST_CERT_P12_B64" | base64 --decode > "$CERT_PATH"
          echo "$IOS_APP_STORE_PROFILE_B64" | base64 --decode > "$APP_PROFILE_PATH"
          echo "$IOS_LIVE_ACTIVITY_APP_STORE_PROFILE_B64" | base64 --decode > "$LIVE_ACTIVITY_PROFILE_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH"
          security default-keychain -d user -s "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$IOS_DIST_CERT_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"

          install_profile() {
            local profile_path="$1"
            local env_name="$2"
            local profile_uuid profile_name

            profile_uuid="$(security cms -D -i "$profile_path" | plutil -extract UUID raw -)"
            profile_name="$(security cms -D -i "$profile_path" | plutil -extract Name raw -)"
            cp "$profile_path" "$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
            echo "$env_name=$profile_name" >> "$GITHUB_ENV"
          }

          install_profile "$APP_PROFILE_PATH" "APP_PROVISIONING_PROFILE_SPECIFIER"
          install_profile "$LIVE_ACTIVITY_PROFILE_PATH" "LIVE_ACTIVITY_PROVISIONING_PROFILE_SPECIFIER"

      - name: Resolve release inputs
        run: |
          set -euo pipefail

          SCHEME="Litter"
          APP_BUNDLE_ID="com.sigkitten.litter"

          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            BETA_GROUP_NAMES="${{ inputs.beta_group_names }}"
            if [[ "${{ inputs.wait_for_processing }}" == "true" ]]; then
              WAIT_FOR_PROCESSING="1"
            else
              WAIT_FOR_PROCESSING="0"
            fi
          else
            BETA_GROUP_NAMES="Internal Testers,External Testers"
            WAIT_FOR_PROCESSING="0"
          fi

          echo "SCHEME=$SCHEME" >> "$GITHUB_ENV"
          echo "APP_BUNDLE_ID=$APP_BUNDLE_ID" >> "$GITHUB_ENV"
          echo "BETA_GROUP_NAMES=$BETA_GROUP_NAMES" >> "$GITHUB_ENV"
          echo "WAIT_FOR_PROCESSING=$WAIT_FOR_PROCESSING" >> "$GITHUB_ENV"

      - name: Build TestFlight IPA
        env:
          SCHEME: ${{ env.SCHEME }}
          APP_BUNDLE_ID: ${{ env.APP_BUNDLE_ID }}
          LIVE_ACTIVITY_BUNDLE_ID: com.sigkitten.litter.liveactivity
          APP_STORE_APP_ID: ${{ secrets.IOS_APP_STORE_APP_ID }}
          TEAM_ID: ${{ secrets.IOS_TEAM_ID }}
          APP_PROVISIONING_PROFILE_SPECIFIER: ${{ env.APP_PROVISIONING_PROFILE_SPECIFIER }}
          LIVE_ACTIVITY_PROVISIONING_PROFILE_SPECIFIER: ${{ env.LIVE_ACTIVITY_PROVISIONING_PROFILE_SPECIFIER }}
          EXPORT_SIGNING_STYLE: manual
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_PRIVATE_KEY_PATH: ${{ env.ASC_PRIVATE_KEY_PATH }}
          BETA_GROUP_NAMES: ${{ env.BETA_GROUP_NAMES }}
          WAIT_FOR_PROCESSING: ${{ env.WAIT_FOR_PROCESSING }}
          TESTFLIGHT_SKIP_UPLOAD: "1"
        run: |
          set -euo pipefail
          ./apps/ios/scripts/testflight-upload.sh

      - name: Upload to TestFlight
        env:
          SCHEME: ${{ env.SCHEME }}
          APP_BUNDLE_ID: ${{ env.APP_BUNDLE_ID }}
          LIVE_ACTIVITY_BUNDLE_ID: com.sigkitten.litter.liveactivity
          APP_STORE_APP_ID: ${{ secrets.IOS_APP_STORE_APP_ID }}
          TEAM_ID: ${{ secrets.IOS_TEAM_ID }}
          APP_PROVISIONING_PROFILE_SPECIFIER: ${{ env.APP_PROVISIONING_PROFILE_SPECIFIER }}
          LIVE_ACTIVITY_PROVISIONING_PROFILE_SPECIFIER: ${{ env.LIVE_ACTIVITY_PROVISIONING_PROFILE_SPECIFIER }}
          EXPORT_SIGNING_STYLE: manual
          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
          ASC_PRIVATE_KEY_PATH: ${{ env.ASC_PRIVATE_KEY_PATH }}
          BETA_GROUP_NAMES: ${{ env.BETA_GROUP_NAMES }}
          WAIT_FOR_PROCESSING: ${{ env.WAIT_FOR_PROCESSING }}
          TESTFLIGHT_SKIP_BUILD: "1"
        run: |
          set -euo pipefail
          ./apps/ios/scripts/testflight-upload.sh

      - name: Commit TestFlight version bump
        run: |
          set -euo pipefail
          if git diff --quiet -- apps/ios/project.yml docs/releases/testflight-whats-new.md; then
            echo "No TestFlight version bump to commit."
            exit 0
          fi

          version="$(awk -F'"' '/MARKETING_VERSION:/ {print $2; exit}' apps/ios/project.yml)"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add apps/ios/project.yml docs/releases/testflight-whats-new.md
          git commit -m "ios: start TestFlight ${version} [skip mobile-release]"
          git push origin "HEAD:${GITHUB_REF_NAME}"