Set up Gitea TestFlight deployment

.env.example

@@ -0,0 +1,12 @@
+FASTLANE_SKIP_UPDATE_CHECK=1
+FASTLANE_HIDE_CHANGELOG=1
+
+# App Store Connect API key (the key content must be base64 encoded).
+APP_STORE_CONNECT_KEY_ID=
+APP_STORE_CONNECT_ISSUER_ID=
+APP_STORE_CONNECT_KEY_CONTENT=
+
+# Shared fastlane match repository.
+MATCH_GIT_URL=
+MATCH_PASSWORD=
+MATCH_GIT_BASIC_AUTHORIZATION=

.gitea/workflows/testflight.yml

@@ -0,0 +1,43 @@
+name: TestFlight
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "release/ios/v*"
+      - "v[0-9]*"
+      - "[0-9]*"
+
+jobs:
+  testflight:
+    runs-on: macos-arm64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.1.7"
+          bundler-cache: true
+
+      - name: Upload to TestFlight
+        env:
+          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+          APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
+          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+          MATCH_GIT_URL: ${{ secrets.MATCH_GIT_URL }}
+          MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
+          QUEUECUBE_VERSION_TAG: ${{ github.ref_name }}
+          FASTLANE_SKIP_UPDATE_CHECK: "1"
+          FASTLANE_HIDE_CHANGELOG: "1"
+          FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
+        # act_runner does not propagate setup-ruby's PATH changes into later
+        # steps, so put the selected Ruby back on PATH before running Bundler.
+        run: |
+          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
+          bundle exec fastlane ios beta

.gitignore

@@ -1,4 +1,5 @@
 /.env
+/.bundle/
 ios/build/
 fastlane/report.xml
 fastlane/Preview.html

Gemfile

@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "fastlane"

Gemfile.lock

@@ -0,0 +1,231 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    CFPropertyList (3.0.8)
+    abbrev (0.1.2)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    artifactory (3.0.17)
+    atomos (0.1.3)
+    aws-eventstream (1.3.2)
+    aws-partitions (1.1109.0)
+    aws-sdk-core (3.224.1)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.101.0)
+      aws-sdk-core (~> 3, >= 3.216.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.188.0)
+      aws-sdk-core (~> 3, >= 3.224.1)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.11.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    babosa (1.0.4)
+    base64 (0.2.0)
+    claide (1.1.0)
+    colored (1.2)
+    colored2 (3.1.2)
+    commander (4.6.0)
+      highline (~> 2.0.0)
+    csv (3.3.5)
+    declarative (0.0.20)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
+    dotenv (2.8.1)
+    emoji_regex (3.2.3)
+    excon (0.109.0)
+    faraday (1.10.6)
+      faraday-em_http (~> 1.0)
+      faraday-em_synchrony (~> 1.0)
+      faraday-excon (~> 1.1)
+      faraday-httpclient (~> 1.0)
+      faraday-multipart (~> 1.0)
+      faraday-net_http (~> 1.0)
+      faraday-net_http_persistent (~> 1.0)
+      faraday-patron (~> 1.0)
+      faraday-rack (~> 1.0)
+      faraday-retry (~> 1.0)
+      ruby2_keywords (>= 0.0.4)
+    faraday-cookie_jar (0.0.8)
+      faraday (>= 0.8.0)
+      http-cookie (>= 1.0.0)
+    faraday-em_http (1.0.0)
+    faraday-em_synchrony (1.0.1)
+    faraday-excon (1.1.0)
+    faraday-httpclient (1.0.1)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
+    faraday-net_http (1.0.2)
+    faraday-net_http_persistent (1.2.0)
+    faraday-patron (1.0.0)
+    faraday-rack (1.0.0)
+    faraday-retry (1.0.4)
+    faraday_middleware (1.2.1)
+      faraday (~> 1.0)
+    fastimage (2.4.1)
+    fastlane (2.230.0)
+      CFPropertyList (>= 2.3, < 4.0.0)
+      abbrev (~> 0.1.2)
+      addressable (>= 2.8, < 3.0.0)
+      artifactory (~> 3.0)
+      aws-sdk-s3 (~> 1.0)
+      babosa (>= 1.0.3, < 2.0.0)
+      base64 (~> 0.2.0)
+      bundler (>= 1.12.0, < 3.0.0)
+      colored (~> 1.2)
+      commander (~> 4.6)
+      csv (~> 3.3)
+      dotenv (>= 2.1.1, < 3.0.0)
+      emoji_regex (>= 0.1, < 4.0)
+      excon (>= 0.71.0, < 1.0.0)
+      faraday (~> 1.0)
+      faraday-cookie_jar (~> 0.0.6)
+      faraday_middleware (~> 1.0)
+      fastimage (>= 2.1.0, < 3.0.0)
+      fastlane-sirp (>= 1.0.0)
+      gh_inspector (>= 1.1.2, < 2.0.0)
+      google-apis-androidpublisher_v3 (~> 0.3)
+      google-apis-playcustomapp_v1 (~> 0.1)
+      google-cloud-env (>= 1.6.0, < 2.0.0)
+      google-cloud-storage (~> 1.31)
+      highline (~> 2.0)
+      http-cookie (~> 1.0.5)
+      json (< 3.0.0)
+      jwt (>= 2.1.0, < 3)
+      logger (>= 1.6, < 2.0)
+      mini_magick (>= 4.9.4, < 5.0.0)
+      multipart-post (>= 2.0.0, < 3.0.0)
+      mutex_m (~> 0.3.0)
+      naturally (~> 2.2)
+      nkf (~> 0.2.0)
+      optparse (>= 0.1.1, < 1.0.0)
+      plist (>= 3.1.0, < 4.0.0)
+      rubyzip (>= 2.0.0, < 3.0.0)
+      security (= 0.1.5)
+      simctl (~> 1.6.3)
+      terminal-notifier (>= 2.0.0, < 3.0.0)
+      terminal-table (~> 3)
+      tty-screen (>= 0.6.3, < 1.0.0)
+      tty-spinner (>= 0.8.0, < 1.0.0)
+      word_wrap (~> 1.0.0)
+      xcodeproj (>= 1.13.0, < 2.0.0)
+      xcpretty (~> 0.4.1)
+      xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+    fastlane-sirp (1.1.0)
+    gh_inspector (1.1.3)
+    google-apis-androidpublisher_v3 (0.54.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-core (0.11.3)
+      addressable (~> 2.5, >= 2.5.1)
+      googleauth (>= 0.16.2, < 2.a)
+      httpclient (>= 2.8.1, < 3.a)
+      mini_mime (~> 1.0)
+      representable (~> 3.0)
+      retriable (>= 2.0, < 4.a)
+      rexml
+    google-apis-iamcredentials_v1 (0.17.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-playcustomapp_v1 (0.13.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-storage_v1 (0.29.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-cloud-core (1.6.1)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (1.6.0)
+      faraday (>= 0.17.3, < 3.0)
+    google-cloud-errors (1.3.1)
+    google-cloud-storage (1.45.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-iamcredentials_v1 (~> 0.1)
+      google-apis-storage_v1 (~> 0.29.0)
+      google-cloud-core (~> 1.6)
+      googleauth (>= 0.16.2, < 2.a)
+      mini_mime (~> 1.0)
+    googleauth (1.8.1)
+      faraday (>= 0.17.3, < 3.a)
+      jwt (>= 1.4, < 3.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    highline (2.0.3)
+    http-cookie (1.0.8)
+      domain_name (~> 0.5)
+    httpclient (2.9.0)
+      mutex_m
+    jmespath (1.6.2)
+    json (2.7.6)
+    jwt (2.10.3)
+      base64
+    logger (1.7.0)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    multi_json (1.15.0)
+    multipart-post (2.4.1)
+    mutex_m (0.3.0)
+    nanaimo (0.4.0)
+    naturally (2.3.0)
+    nkf (0.2.0)
+    optparse (0.8.1)
+    os (1.1.4)
+    plist (3.7.2)
+    public_suffix (5.1.1)
+    rake (13.4.2)
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    retriable (3.8.0)
+    rexml (3.4.4)
+    rouge (3.28.0)
+    ruby2_keywords (0.0.5)
+    rubyzip (2.4.1)
+    security (0.1.5)
+    signet (0.18.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 3.0)
+      multi_json (~> 1.10)
+    simctl (1.6.10)
+      CFPropertyList
+      naturally
+    terminal-notifier (2.0.0)
+    terminal-table (3.0.2)
+      unicode-display_width (>= 1.1.1, < 3)
+    trailblazer-option (0.1.2)
+    tty-cursor (0.7.1)
+    tty-screen (0.8.2)
+    tty-spinner (0.9.3)
+      tty-cursor (~> 0.7)
+    uber (0.1.0)
+    unf (0.2.0)
+    unicode-display_width (2.6.0)
+    word_wrap (1.0.0)
+    xcodeproj (1.27.0)
+      CFPropertyList (>= 2.3.3, < 4.0)
+      atomos (~> 0.1.3)
+      claide (>= 1.0.2, < 2.0)
+      colored2 (~> 3.1)
+      nanaimo (~> 0.4.0)
+      rexml (>= 3.3.6, < 4.0)
+    xcpretty (0.4.1)
+      rouge (~> 3.28.0)
+    xcpretty-travis-formatter (1.0.1)
+      xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  fastlane
+
+BUNDLED WITH
+   2.5.23

README.md

@@ -4,6 +4,27 @@ QueueCube is a web frontend for [mpv](https://github.com/mpv-player/mpv).
 
 It allows you to remotely manage mpv's playqueue as well as the ability to search YouTube via a locally running [Invidious](https://github.com/iv-org/invidious) instance. 
 
+## iOS TestFlight releases
+
+Gitea Actions builds and uploads the iOS app when a version tag is pushed. The
+workflow accepts the repository's existing numeric tags (for example `3.2`),
+`v3.2`, and `release/ios/v3.2`; it can also be started manually.
+
+Configure these Gitea Actions secrets before the first run:
+
+- `APP_STORE_CONNECT_KEY_ID`
+- `APP_STORE_CONNECT_ISSUER_ID`
+- `APP_STORE_CONNECT_KEY_CONTENT`
+- `MATCH_GIT_URL`
+- `MATCH_PASSWORD`
+- `MATCH_GIT_BASIC_AUTHORIZATION`
+
+For local Fastlane use, copy `.env.example` to `.env` and fill in the same
+values. Run `bundle exec fastlane ios setup_signing` only when the match signing
+assets need to be created or updated. `bundle exec fastlane ios build` creates
+a signed IPA without uploading it, while `bundle exec fastlane ios beta`
+performs the release.
+
 ![queuecube user interface](screenshots/queuecube.png)
 
 ## Running 

fastlane/Fastfile

@@ -7,6 +7,10 @@ default_platform(:ios)
 
 BUNDLE_IDENTIFIER = "net.buzzert.QueueCube"
 DEVELOPMENT_TEAM = "DQQH5H6GBD"
+PROVISIONING_PROFILE_NAME = "QueueCube AppStore CI"
+CI_KEYCHAIN_NAME = "queuecube_ci_keychain"
+CI_KEYCHAIN_PASSWORD = "queuecube-ci-keychain-password"
+CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
 APP_ROOT = File.expand_path("..", File.expand_path(__dir__))
 IOS_PROJECT_DIR = File.join(APP_ROOT, "ios")
 XCODE_PROJECT = File.join(IOS_PROJECT_DIR, "QueueCube.xcodeproj")
@@ -33,18 +37,57 @@ def git_output(*args)
   stdout.strip
 end
 
-def app_version
+def present?(value)
-  tag = git_output("describe", "--tags", "--abbrev=0")
+  !value.to_s.strip.empty?
-  version = tag.sub(/\Av/, "")
+end
-  unless version.match?(/\A\d+(?:\.\d+){0,2}\z/)
+
-    UI.user_error!("Latest git tag #{tag.inspect} is not a valid App Store version. Use a tag like 1.5.2 or v1.5.2.")
+def ci?
+  present?(ENV["CI"])
+end
+
+def version_from_tag(tag)
+  patterns = [
+    %r{\Arelease/ios/v(\d+(?:\.\d+){0,2})\z},
+    %r{\Av?(\d+(?:\.\d+){0,2})\z}
+  ]
+
+  patterns.each do |pattern|
+    match = tag.to_s.match(pattern)
+    return match[1] if match
   end
 
-  version
+  nil
+end
+
+def app_version
+  candidates = [
+    ENV["QUEUECUBE_VERSION_TAG"],
+    ENV["GITHUB_REF_NAME"],
+    ENV["GITHUB_REF"].to_s.sub(%r{\Arefs/tags/}, "")
+  ]
+
+  candidates.each do |tag|
+    version = version_from_tag(tag)
+    return version if version
+  end
+
+  latest_tag = git_output("describe", "--tags", "--abbrev=0")
+  version = version_from_tag(latest_tag)
+  return version if version
+
+  candidates << latest_tag
+  UI.user_error!("Release tag must look like 3.2, v3.2, or release/ios/v3.2; got #{candidates.compact.inspect}")
 end
 
 def build_number
-  git_output("rev-list", "--count", "HEAD")
+  value = ENV["QUEUECUBE_BUILD_NUMBER"]
+  value = Time.now.utc.strftime("%Y%m%d%H%M%S") unless present?(value)
+
+  unless value.to_s.match?(/\A\d+\z/)
+    UI.user_error!("Build number must be numeric; got #{value.inspect}")
+  end
+
+  value.to_s
 end
 
 def upload_export_options
@@ -56,9 +99,16 @@ def upload_export_options
       <key>method</key>
       <string>app-store-connect</string>
       <key>signingStyle</key>
-      <string>automatic</string>
+      <string>manual</string>
       <key>teamID</key>
       <string>#{DEVELOPMENT_TEAM}</string>
+      <key>signingCertificate</key>
+      <string>Apple Distribution</string>
+      <key>provisioningProfiles</key>
+      <dict>
+        <key>#{BUNDLE_IDENTIFIER}</key>
+        <string>#{PROVISIONING_PROFILE_NAME}</string>
+      </dict>
       <key>manageAppVersionAndBuildNumber</key>
       <false/>
       <key>stripSwiftSymbols</key>
@@ -71,12 +121,70 @@ def upload_export_options
 end
 
 platform :ios do
-  desc "Build QueueCube for iOS and upload the archive to TestFlight"
+  private_lane :app_store_api_key do
-  lane :beta do
+    app_store_connect_api_key(
+      key_id: ENV.fetch("APP_STORE_CONNECT_KEY_ID"),
+      issuer_id: ENV.fetch("APP_STORE_CONNECT_ISSUER_ID"),
+      key_content: ENV.fetch("APP_STORE_CONNECT_KEY_CONTENT"),
+      is_key_content_base64: true
+    )
+  end
+
+  # CI signs headlessly, so match imports the distribution identity into a
+  # fresh keychain. Put it first because this shared runner may have locked
+  # keychains from other projects containing the same identity.
+  private_lane :prepare_ci_keychain do
+    next unless ci?
+
+    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
+    create_keychain(
+      name: CI_KEYCHAIN_NAME,
+      password: CI_KEYCHAIN_PASSWORD,
+      unlock: true,
+      timeout: 3600,
+      add_to_search_list: false
+    )
+
+    others = sh("security list-keychains -d user", log: false)
+      .scan(/"([^"]+)"/)
+      .flatten
+      .reject { |path| path.include?(CI_KEYCHAIN_NAME) }
+    sh("security list-keychains -d user -s #{([CI_KEYCHAIN_DB_PATH] + others).shelljoin}")
+
+    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
+    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
+  end
+
+  private_lane :sync_signing do |options|
+    match(
+      type: "appstore",
+      readonly: options.fetch(:readonly),
+      app_identifier: BUNDLE_IDENTIFIER,
+      team_id: DEVELOPMENT_TEAM,
+      profile_name: PROVISIONING_PROFILE_NAME,
+      git_url: ENV.fetch("MATCH_GIT_URL"),
+      git_branch: ENV.fetch("MATCH_GIT_BRANCH", "master"),
+      git_full_name: "QueueCube Release Bot",
+      git_user_email: "james.magahern@me.com",
+      api_key: options.fetch(:api_key)
+    )
+  end
+
+  desc "Create or update match signing assets"
+  lane :setup_signing do
+    sync_signing(api_key: app_store_api_key, readonly: false)
+  end
+
+  private_lane :build_release do
+    prepare_ci_keychain
+
+    api_key = app_store_api_key
     version = app_version
     build = build_number
     UI.message("Using QueueCube version #{version} (build #{build}) from git")
 
+    sync_signing(api_key: api_key, readonly: true)
+
     FileUtils.rm_rf(archive_path)
     FileUtils.rm_rf(export_path)
 
@@ -94,7 +202,10 @@ platform :ios do
         "DEVELOPMENT_TEAM=#{DEVELOPMENT_TEAM}",
         "PRODUCT_BUNDLE_IDENTIFIER=#{BUNDLE_IDENTIFIER}",
         "MARKETING_VERSION=#{version}",
-        "CURRENT_PROJECT_VERSION=#{build}"
+        "CURRENT_PROJECT_VERSION=#{build}",
+        "CODE_SIGN_STYLE=Manual",
+        "CODE_SIGN_IDENTITY=Apple Distribution",
+        "PROVISIONING_PROFILE_SPECIFIER=#{PROVISIONING_PROFILE_NAME}"
       ))
     end
 
@@ -117,13 +228,27 @@ platform :ios do
     ipa_path = Dir[File.join(export_path, "*.ipa")].first
     UI.user_error!("No IPA found in #{export_path}") unless ipa_path
 
+    { api_key: api_key, ipa_path: ipa_path }
+  ensure
+    export_options&.unlink
+    delete_keychain(name: CI_KEYCHAIN_NAME) if ci? && File.file?(CI_KEYCHAIN_DB_PATH)
+  end
+
+  desc "Build an App Store-signed QueueCube IPA without uploading it"
+  lane :build do
+    build_release
+  end
+
+  desc "Build QueueCube for iOS and upload the archive to TestFlight"
+  lane :beta do
+    release = build_release
+
     upload_to_testflight(
+      api_key: release.fetch(:api_key),
       app_identifier: BUNDLE_IDENTIFIER,
-      ipa: ipa_path,
+      ipa: release.fetch(:ipa_path),
       skip_waiting_for_build_processing: true,
       uses_non_exempt_encryption: false
     )
-  ensure
-    export_options&.unlink
   end
 end

fastlane/README.md

@@ -15,6 +15,22 @@ For _fastlane_ installation instructions, see [Installing _fastlane_](https://do
 
 ## iOS
 
+### ios setup_signing
+
+```sh
+[bundle exec] fastlane ios setup_signing
+```
+
+Create or update match signing assets
+
+### ios build
+
+```sh
+[bundle exec] fastlane ios build
+```
+
+Build an App Store-signed QueueCube IPA without uploading it
+
 ### ios beta
 
 ```sh