From db947b18279c7eeae068378964715bf86aa64ed9 Mon Sep 17 00:00:00 2001 From: James Magahern Date: Mon, 6 Jul 2026 08:36:11 -0700 Subject: [PATCH] Set up TestFlight deployment --- .env.example | 16 +++ .gitea/workflows/testflight.yml | 64 +++++++++ .gitignore | 5 + Gemfile | 3 + Gemfile.lock | 231 ++++++++++++++++++++++++++++++++ README.md | 7 + fastlane/Fastfile | 170 +++++++++++++++++++++++ justfile | 18 +++ mise.toml | 4 + 9 files changed, 518 insertions(+) create mode 100644 .env.example create mode 100644 .gitea/workflows/testflight.yml create mode 100644 .gitignore create mode 100644 Gemfile create mode 100644 Gemfile.lock create mode 100644 fastlane/Fastfile create mode 100644 justfile create mode 100644 mise.toml diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..f4fbc81 --- /dev/null +++ b/.env.example @@ -0,0 +1,16 @@ +FASTLANE_SKIP_UPDATE_CHECK=1 +FASTLANE_HIDE_CHANGELOG=1 +FASTLANE_TEAM_ID=3SJALV9BQ7 + +APP_STORE_CONNECT_KEY_ID= +APP_STORE_CONNECT_ISSUER_ID= +APP_STORE_CONNECT_KEY_CONTENT= + +MATCH_GIT_URL= +MATCH_PASSWORD= +MATCH_GIT_BASIC_AUTHORIZATION= +MATCH_GIT_BRANCH=master + +ATTRACTOR_PROVISIONING_PROFILE_SPECIFIER=Attractor AppStore CI +ATTRACTOR_VERSION_TAG= +ATTRACTOR_BUILD_NUMBER= diff --git a/.gitea/workflows/testflight.yml b/.gitea/workflows/testflight.yml new file mode 100644 index 0000000..e12ac2d --- /dev/null +++ b/.gitea/workflows/testflight.yml @@ -0,0 +1,64 @@ +name: TestFlight + +on: + workflow_dispatch: + push: + tags: + - "release/ios/v*" + - "Attractor-*" + +jobs: + testflight: + runs-on: xcode + defaults: + run: + shell: bash + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Setup Ruby + uses: ruby/setup-ruby@v1 + with: + ruby-version: "3.1.7" + bundler-cache: true + + - name: Prepare Runner Keychain + env: + HOME: /var/lib/act_runner + run: | + set -euo pipefail + mkdir -p "${HOME}/Library/Keychains" + + login_keychain="${HOME}/Library/Keychains/login.keychain" + if [ ! -f "${login_keychain}-db" ]; then + security create-keychain -p "" "${login_keychain}" + fi + + security unlock-keychain -p "" "${login_keychain}" 2>/dev/null || \ + security unlock-keychain -p "attractor-ci-keychain-password" "${login_keychain}" 2>/dev/null || true + security default-keychain -d user -s "${login_keychain}" + security list-keychains -d user -s "${login_keychain}-db" + security delete-keychain "${HOME}/Library/Keychains/attractor_ci_keychain" >/dev/null 2>&1 || true + rm -f "${HOME}/Library/Keychains/attractor_ci_keychain" "${HOME}/Library/Keychains/attractor_ci_keychain-db" + + - name: Upload to TestFlight + env: + HOME: /var/lib/act_runner + APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }} + APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }} + APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }} + MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }} + MATCH_GIT_URL: ${{ secrets.MATCH_GIT_URL }} + MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }} + ATTRACTOR_VERSION_TAG: ${{ github.ref_name }} + FASTLANE_SKIP_UPDATE_CHECK: "1" + FASTLANE_HIDE_CHANGELOG: "1" + FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120" + run: | + export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}" + ruby --version + bundle exec fastlane ios beta diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..1bc3b46 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +.env +.bundle/ +build/ +fastlane/README.md +fastlane/report.xml diff --git a/Gemfile b/Gemfile new file mode 100644 index 0000000..7a118b4 --- /dev/null +++ b/Gemfile @@ -0,0 +1,3 @@ +source "https://rubygems.org" + +gem "fastlane" diff --git a/Gemfile.lock b/Gemfile.lock new file mode 100644 index 0000000..4130921 --- /dev/null +++ b/Gemfile.lock @@ -0,0 +1,231 @@ +GEM + remote: https://rubygems.org/ + specs: + CFPropertyList (3.0.9) + abbrev (0.1.2) + addressable (2.9.0) + public_suffix (>= 2.0.2, < 8.0) + artifactory (3.0.17) + atomos (0.1.3) + aws-eventstream (1.3.2) + aws-partitions (1.1109.0) + aws-sdk-core (3.224.1) + aws-eventstream (~> 1, >= 1.3.0) + aws-partitions (~> 1, >= 1.992.0) + aws-sigv4 (~> 1.9) + base64 + jmespath (~> 1, >= 1.6.1) + logger + aws-sdk-kms (1.101.0) + aws-sdk-core (~> 3, >= 3.216.0) + aws-sigv4 (~> 1.5) + aws-sdk-s3 (1.188.0) + aws-sdk-core (~> 3, >= 3.224.1) + aws-sdk-kms (~> 1) + aws-sigv4 (~> 1.5) + aws-sigv4 (1.11.0) + aws-eventstream (~> 1, >= 1.0.2) + babosa (1.0.4) + base64 (0.2.0) + claide (1.1.0) + colored (1.2) + colored2 (3.1.2) + commander (4.6.0) + highline (~> 2.0.0) + csv (3.3.5) + declarative (0.0.20) + digest-crc (0.7.0) + rake (>= 12.0.0, < 14.0.0) + domain_name (0.5.20190701) + unf (>= 0.0.5, < 1.0.0) + dotenv (2.8.1) + emoji_regex (3.2.3) + excon (0.109.0) + faraday (1.10.6) + faraday-em_http (~> 1.0) + faraday-em_synchrony (~> 1.0) + faraday-excon (~> 1.1) + faraday-httpclient (~> 1.0) + faraday-multipart (~> 1.0) + faraday-net_http (~> 1.0) + faraday-net_http_persistent (~> 1.0) + faraday-patron (~> 1.0) + faraday-rack (~> 1.0) + faraday-retry (~> 1.0) + ruby2_keywords (>= 0.0.4) + faraday-cookie_jar (0.0.8) + faraday (>= 0.8.0) + http-cookie (>= 1.0.0) + faraday-em_http (1.0.0) + faraday-em_synchrony (1.0.1) + faraday-excon (1.1.0) + faraday-httpclient (1.0.1) + faraday-multipart (1.2.0) + multipart-post (~> 2.0) + faraday-net_http (1.0.2) + faraday-net_http_persistent (1.2.0) + faraday-patron (1.0.0) + faraday-rack (1.0.0) + faraday-retry (1.0.4) + faraday_middleware (1.2.1) + faraday (~> 1.0) + fastimage (2.4.1) + fastlane (2.230.0) + CFPropertyList (>= 2.3, < 4.0.0) + abbrev (~> 0.1.2) + addressable (>= 2.8, < 3.0.0) + artifactory (~> 3.0) + aws-sdk-s3 (~> 1.0) + babosa (>= 1.0.3, < 2.0.0) + base64 (~> 0.2.0) + bundler (>= 1.12.0, < 3.0.0) + colored (~> 1.2) + commander (~> 4.6) + csv (~> 3.3) + dotenv (>= 2.1.1, < 3.0.0) + emoji_regex (>= 0.1, < 4.0) + excon (>= 0.71.0, < 1.0.0) + faraday (~> 1.0) + faraday-cookie_jar (~> 0.0.6) + faraday_middleware (~> 1.0) + fastimage (>= 2.1.0, < 3.0.0) + fastlane-sirp (>= 1.0.0) + gh_inspector (>= 1.1.2, < 2.0.0) + google-apis-androidpublisher_v3 (~> 0.3) + google-apis-playcustomapp_v1 (~> 0.1) + google-cloud-env (>= 1.6.0, < 2.0.0) + google-cloud-storage (~> 1.31) + highline (~> 2.0) + http-cookie (~> 1.0.5) + json (< 3.0.0) + jwt (>= 2.1.0, < 3) + logger (>= 1.6, < 2.0) + mini_magick (>= 4.9.4, < 5.0.0) + multipart-post (>= 2.0.0, < 3.0.0) + mutex_m (~> 0.3.0) + naturally (~> 2.2) + nkf (~> 0.2.0) + optparse (>= 0.1.1, < 1.0.0) + plist (>= 3.1.0, < 4.0.0) + rubyzip (>= 2.0.0, < 3.0.0) + security (= 0.1.5) + simctl (~> 1.6.3) + terminal-notifier (>= 2.0.0, < 3.0.0) + terminal-table (~> 3) + tty-screen (>= 0.6.3, < 1.0.0) + tty-spinner (>= 0.8.0, < 1.0.0) + word_wrap (~> 1.0.0) + xcodeproj (>= 1.13.0, < 2.0.0) + xcpretty (~> 0.4.1) + xcpretty-travis-formatter (>= 0.0.3, < 2.0.0) + fastlane-sirp (1.1.0) + gh_inspector (1.1.3) + google-apis-androidpublisher_v3 (0.54.0) + google-apis-core (>= 0.11.0, < 2.a) + google-apis-core (0.11.3) + addressable (~> 2.5, >= 2.5.1) + googleauth (>= 0.16.2, < 2.a) + httpclient (>= 2.8.1, < 3.a) + mini_mime (~> 1.0) + representable (~> 3.0) + retriable (>= 2.0, < 4.a) + rexml + google-apis-iamcredentials_v1 (0.17.0) + google-apis-core (>= 0.11.0, < 2.a) + google-apis-playcustomapp_v1 (0.13.0) + google-apis-core (>= 0.11.0, < 2.a) + google-apis-storage_v1 (0.29.0) + google-apis-core (>= 0.11.0, < 2.a) + google-cloud-core (1.6.1) + google-cloud-env (>= 1.0, < 3.a) + google-cloud-errors (~> 1.0) + google-cloud-env (1.6.0) + faraday (>= 0.17.3, < 3.0) + google-cloud-errors (1.3.1) + google-cloud-storage (1.45.0) + addressable (~> 2.8) + digest-crc (~> 0.4) + google-apis-iamcredentials_v1 (~> 0.1) + google-apis-storage_v1 (~> 0.29.0) + google-cloud-core (~> 1.6) + googleauth (>= 0.16.2, < 2.a) + mini_mime (~> 1.0) + googleauth (1.8.1) + faraday (>= 0.17.3, < 3.a) + jwt (>= 1.4, < 3.0) + multi_json (~> 1.11) + os (>= 0.9, < 2.0) + signet (>= 0.16, < 2.a) + highline (2.0.3) + http-cookie (1.0.8) + domain_name (~> 0.5) + httpclient (2.9.0) + mutex_m + jmespath (1.6.2) + json (2.7.6) + jwt (2.10.3) + base64 + logger (1.7.0) + mini_magick (4.13.2) + mini_mime (1.1.5) + multi_json (1.15.0) + multipart-post (2.4.1) + mutex_m (0.3.0) + nanaimo (0.4.0) + naturally (2.3.0) + nkf (0.2.0) + optparse (0.8.1) + os (1.1.4) + plist (3.7.2) + public_suffix (5.1.1) + rake (13.4.2) + representable (3.2.0) + declarative (< 0.1.0) + trailblazer-option (>= 0.1.1, < 0.2.0) + uber (< 0.2.0) + retriable (3.8.0) + rexml (3.4.4) + rouge (3.28.0) + ruby2_keywords (0.0.5) + rubyzip (2.4.1) + security (0.1.5) + signet (0.18.0) + addressable (~> 2.8) + faraday (>= 0.17.5, < 3.a) + jwt (>= 1.5, < 3.0) + multi_json (~> 1.10) + simctl (1.6.10) + CFPropertyList + naturally + terminal-notifier (2.0.0) + terminal-table (3.0.2) + unicode-display_width (>= 1.1.1, < 3) + trailblazer-option (0.1.2) + tty-cursor (0.7.1) + tty-screen (0.8.2) + tty-spinner (0.9.3) + tty-cursor (~> 0.7) + uber (0.1.0) + unf (0.2.0) + unicode-display_width (2.6.0) + word_wrap (1.0.0) + xcodeproj (1.27.0) + CFPropertyList (>= 2.3.3, < 4.0) + atomos (~> 0.1.3) + claide (>= 1.0.2, < 2.0) + colored2 (~> 3.1) + nanaimo (~> 0.4.0) + rexml (>= 3.3.6, < 4.0) + xcpretty (0.4.1) + rouge (~> 3.28.0) + xcpretty-travis-formatter (1.0.1) + xcpretty (~> 0.2, >= 0.0.7) + +PLATFORMS + ruby + +DEPENDENCIES + fastlane + +BUNDLED WITH + 2.5.23 diff --git a/README.md b/README.md index 6c649f5..cb22a30 100644 --- a/README.md +++ b/README.md @@ -26,3 +26,10 @@ Attractor operates in five "security modes": - Custom redirect rules - Catalyst and iPadOS support +## Deployment + +TestFlight deployment is handled by Fastlane and the Gitea workflow at `.gitea/workflows/testflight.yml`. + +Required Gitea secrets match the local `.env.example`: `APP_STORE_CONNECT_KEY_ID`, `APP_STORE_CONNECT_ISSUER_ID`, `APP_STORE_CONNECT_KEY_CONTENT`, `MATCH_GIT_URL`, `MATCH_PASSWORD`, and `MATCH_GIT_BASIC_AUTHORIZATION`. + +Push a tag like `release/ios/v4.2` or `Attractor-4.2` to build and upload to TestFlight. To prepare signing assets locally, run `bundle exec fastlane ios setup_signing`; to upload manually, run `bundle exec fastlane ios beta`. diff --git a/fastlane/Fastfile b/fastlane/Fastfile new file mode 100644 index 0000000..711fdd4 --- /dev/null +++ b/fastlane/Fastfile @@ -0,0 +1,170 @@ +require "shellwords" +require "xcodeproj" + +default_platform(:ios) + +APP_IDENTIFIER = "net.buzzert.attractor" +SCHEME = "Attractor" +TARGET_NAME = "App" +TEAM_ID = ENV["FASTLANE_TEAM_ID"].to_s.strip.empty? ? "3SJALV9BQ7" : ENV["FASTLANE_TEAM_ID"] +PROFILE_NAME = ENV["ATTRACTOR_PROVISIONING_PROFILE_SPECIFIER"].to_s.strip.empty? ? "Attractor AppStore CI" : ENV["ATTRACTOR_PROVISIONING_PROFILE_SPECIFIER"] +CI_KEYCHAIN_NAME = "attractor_ci_keychain" +CI_KEYCHAIN_PASSWORD = "attractor-ci-keychain-password" +CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db") +PROJECT_FILE = File.expand_path("../SBrowser.xcodeproj", __dir__) + +def present?(value) + !value.to_s.strip.empty? +end + +def ci? + present?(ENV["CI"]) +end + +def version_from_tag(tag) + patterns = [ + %r{\Arelease/ios/v(\d+(?:\.\d+){1,2})\z}, + %r{\AAttractor-(\d+(?:\.\d+){1,2})\z}, + %r{\Av(\d+(?:\.\d+){1,2})\z} + ] + + patterns.each do |pattern| + match = tag.to_s.match(pattern) + return match[1] if match + end + + nil +end + +def release_version + candidates = [ + ENV["ATTRACTOR_VERSION_TAG"], + ENV["GITHUB_REF_NAME"], + ENV["GITHUB_REF"].to_s.sub(%r{\Arefs/tags/}, "") + ] + + candidates.each do |tag| + version = version_from_tag(tag) + return version if version + end + + latest_tag = sh("git describe --tags --abbrev=0").strip + version = version_from_tag(latest_tag) + return version if version + + candidates << latest_tag + UI.user_error!("Release tag must look like release/ios/v4.1, Attractor-4.1, or v4.1; got #{candidates.compact.inspect}") +end + +# App Store Connect requires CFBundleVersion to be unique and strictly +# increasing app-wide. Attractor already has historical builds, so use a UTC +# timestamp by default instead of assuming a fresh CI run number is high enough. +def build_number + value = ENV["ATTRACTOR_BUILD_NUMBER"] + value = Time.now.utc.strftime("%Y%m%d%H%M%S") unless present?(value) + + unless value.to_s.match?(/\A\d+\z/) + UI.user_error!("Build number must be numeric; got #{value.inspect}") + end + + value.to_s +end + +def stamp_project_versions(version:, build:) + project = Xcodeproj::Project.open(PROJECT_FILE) + target = project.targets.find { |candidate| candidate.name == TARGET_NAME } + UI.user_error!("Could not find target #{TARGET_NAME.inspect} in #{PROJECT_FILE}") unless target + + target.build_configurations.each do |configuration| + configuration.build_settings["MARKETING_VERSION"] = version + configuration.build_settings["CURRENT_PROJECT_VERSION"] = build + end + + project.save +end + +platform :ios do + private_lane :app_store_api_key do + app_store_connect_api_key( + key_id: ENV.fetch("APP_STORE_CONNECT_KEY_ID"), + issuer_id: ENV.fetch("APP_STORE_CONNECT_ISSUER_ID"), + key_content: ENV.fetch("APP_STORE_CONNECT_KEY_CONTENT"), + is_key_content_base64: true + ) + end + + private_lane :prepare_ci_keychain do + next unless ci? + + delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH) + create_keychain( + name: CI_KEYCHAIN_NAME, + password: CI_KEYCHAIN_PASSWORD, + unlock: true, + timeout: 3600, + add_to_search_list: true + ) + + ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME + ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD + end + + private_lane :sync_signing do |options| + match( + type: "appstore", + readonly: options.fetch(:readonly), + app_identifier: APP_IDENTIFIER, + team_id: TEAM_ID, + profile_name: PROFILE_NAME, + git_url: ENV.fetch("MATCH_GIT_URL"), + git_branch: ENV.fetch("MATCH_GIT_BRANCH", "master"), + git_full_name: "Attractor Release Bot", + git_user_email: "james.magahern@me.com", + api_key: options.fetch(:api_key) + ) + end + + desc "Create or update match signing assets" + lane :setup_signing do + sync_signing(api_key: app_store_api_key, readonly: false) + end + + desc "Build and upload to TestFlight" + lane :beta do + prepare_ci_keychain + + api_key = app_store_api_key + version = release_version + build = build_number + + stamp_project_versions(version: version, build: build) + + sync_signing(api_key: api_key, readonly: true) + + build_app( + project: PROJECT_FILE, + scheme: SCHEME, + destination: "generic/platform=iOS", + export_method: "app-store", + codesigning_identity: "Apple Distribution", + xcargs: [ + "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}", + "CODE_SIGN_STYLE=Manual", + "CODE_SIGN_IDENTITY=Apple\\ Distribution", + "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}" + ].join(" "), + export_options: { + signingStyle: "manual", + teamID: TEAM_ID, + provisioningProfiles: { + APP_IDENTIFIER => PROFILE_NAME + } + } + ) + + upload_to_testflight( + api_key: api_key, + skip_waiting_for_build_processing: true + ) + end +end diff --git a/justfile b/justfile new file mode 100644 index 0000000..c961bab --- /dev/null +++ b/justfile @@ -0,0 +1,18 @@ +simulator := "platform=iOS Simulator,name=iPhone 17e,OS=latest" +derived_data := "build/DerivedData" + +default: + @just build + +build: + if command -v xcbeautify >/dev/null 2>&1; then \ + xcodebuild -project SBrowser.xcodeproj -scheme Attractor -destination '{{simulator}}' | xcbeautify; \ + else \ + xcodebuild -project SBrowser.xcodeproj -scheme Attractor -destination '{{simulator}}'; \ + fi + +beta: + bundle exec fastlane ios beta + +setup-signing: + bundle exec fastlane ios setup_signing diff --git a/mise.toml b/mise.toml new file mode 100644 index 0000000..a7a5db1 --- /dev/null +++ b/mise.toml @@ -0,0 +1,4 @@ +[tools] +just = "latest" +ruby = "3.1.7" +xcbeautify = "latest"