ci: use Ruby 3.1 for TestFlight upload

This reverts commit a0e410155d.

.gitea/workflows/testflight.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   testflight:
-    runs-on: xcode
+    runs-on: macos-arm64
     defaults:
       run:
         shell: bash
@@ -33,10 +33,17 @@ jobs:
             brew install xcodegen
           fi
 
+      - name: Runner diagnostics
+        run: |
+          set -euo pipefail
+          whoami
+          printf 'HOME=%s\n' "$HOME"
+          security default-keychain -d user || true
+          security list-keychains -d user || true
+
       - name: Upload to TestFlight
         working-directory: ios
         env:
-          HOME: /var/lib/act_runner
           APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}

ios/AGENTS.md

@@ -21,6 +21,12 @@ Instructions for work under `/Users/buzzert/src/sybil-2/ios`.
 - To choose a screenshot path, run `just screenshot path=build/name.png`.
 - The underlying screenshot command is `xcrun simctl io booted screenshot <path>` and requires a booted simulator.
 
+## Release Workflow
+- iOS release tags use the annotated tag namespace `release/ios/vX.Y.Z`; increment from the latest existing `release/ios/v*` tag.
+- Tag message convention is `ios: X.Y.Z`, for example `git tag -a release/ios/v1.13.5 -m "ios: 1.13.5"`.
+- Push the release commit and tag together with `git push origin <branch> release/ios/vX.Y.Z`.
+- Fastlane derives the marketing version from the release tag and stamps `ios/Apps/Sybil/project.yml` during CI, so do not manually bump `MARKETING_VERSION` for normal tagged releases unless explicitly requested.
+
 ## App Structure
 - App target entry: `/Users/buzzert/src/sybil-2/ios/Apps/Sybil/Sources/SybilApp.swift`
 - Shared iOS app code lives in Swift package:

ios/Packages/Sybil/Sources/Sybil/SybilChatTranscriptView.swift

@@ -58,7 +58,8 @@ struct SybilChatTranscriptView: View {
                         .frame(height: 18 + bottomContentInset)
                         .id(bottomAnchorID)
                 }
-                .frame(maxWidth: .infinity, alignment: .leading)
+                .frame(maxWidth: SybilLayout.webContentMaxWidth, alignment: .leading)
+                .frame(maxWidth: .infinity, alignment: .center)
                 .padding(.horizontal, 14)
                 .padding(.top, 18 + topContentInset)
             }

ios/Packages/Sybil/Sources/Sybil/SybilSearchResultsView.swift

@@ -98,7 +98,8 @@ struct SybilSearchResultsView: View {
                         .foregroundStyle(SybilTheme.danger)
                 }
             }
-            .frame(maxWidth: .infinity, alignment: .leading)
+            .frame(maxWidth: SybilLayout.webContentMaxWidth, alignment: .leading)
+            .frame(maxWidth: .infinity, alignment: .center)
             .padding(.horizontal, 14)
             .padding(.top, 20 + topContentInset)
             .padding(.bottom, 20 + bottomContentInset)

ios/Packages/Sybil/Sources/Sybil/SybilTheme.swift

@@ -64,6 +64,10 @@ extension Font {
     }
 }
 
+enum SybilLayout {
+    static let webContentMaxWidth: CGFloat = 896
+}
+
 enum SybilTheme {
     static let background = Color(red: 0.02, green: 0.02, blue: 0.05)
     static let surface = Color(red: 0.05, green: 0.04, blue: 0.10)

ios/fastlane/Fastfile

@@ -6,9 +6,6 @@ APP_IDENTIFIER = "net.buzzert.sybil2"
 SCHEME = "Sybil"
 TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
-CI_KEYCHAIN_NAME = "sybil_ci_keychain"
-CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -71,23 +68,20 @@ platform :ios do
     )
   end
 
-  # CI has no login keychain, so create a dedicated throwaway one for match to
-  # import the distribution cert into. The runner's launchd job sets
-  # SessionCreate, so add_to_search_list actually makes it visible to xcodebuild.
+  # CI uses a throwaway keychain that is deleted after the lane exits.
   private_lane :prepare_ci_keychain do
-    next unless ci?
+    next nil unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
-    create_keychain(
-      name: CI_KEYCHAIN_NAME,
-      password: CI_KEYCHAIN_PASSWORD,
-      unlock: true,
-      timeout: 3600,
-      add_to_search_list: true
+    run_token = "#{Time.now.to_i}_#{Process.pid}"
+    keychain_name = "fastlane_ci_#{run_token}"
+
+    setup_ci(
+      force: true,
+      keychain_name: keychain_name,
+      timeout: 7_200
     )
 
-    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
-    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
+    keychain_name
   end
 
   private_lane :sync_signing do |options|
@@ -112,7 +106,10 @@ platform :ios do
 
   desc "Build and upload to TestFlight"
   lane :beta do
-    prepare_ci_keychain
+    ci_keychain_name = nil
+
+    begin
+      ci_keychain_name = prepare_ci_keychain
 
       api_key = app_store_api_key
 
@@ -125,6 +122,8 @@ platform :ios do
 
       sync_signing(api_key: api_key, readonly: true)
 
+      sh("security find-identity -v -p codesigning") if ci_keychain_name
+
       build_app(
         project: PROJECT_FILE,
         scheme: SCHEME,
@@ -149,5 +148,8 @@ platform :ios do
         api_key: api_key,
         skip_waiting_for_build_processing: true
       )
+    ensure
+      delete_keychain(name: ci_keychain_name) if ci_keychain_name
+    end
   end
 end