From 4cb775de472bbcb9aa776d1fa4f23577a4b3d728 Mon Sep 17 00:00:00 2001
From: James Magahern <james@magahern.com>
Date: Mon, 27 Jul 2026 19:28:24 -0700
Subject: [PATCH] Bake Home Assistant token into release builds

---
 .env.example                    |  1 +
 .gitea/workflows/testflight.yml |  1 +
 README.md                       |  6 +++++-
 fastlane/Fastfile               | 21 +++++++++++++++++++++
 4 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 5ca8e90..9016857 100644
--- a/.env.example
+++ b/.env.example
@@ -3,3 +3,4 @@ ASC_ISSUER_ID=
 ASC_KEY=
 MATCH_PASSWORD=
 MATCH_GIT_BASIC_AUTHORIZATION=
+HOME_ASSISTANT_ACCESS_TOKEN=
diff --git a/.gitea/workflows/testflight.yml b/.gitea/workflows/testflight.yml
index 0849589..8ec3630 100644
--- a/.gitea/workflows/testflight.yml
+++ b/.gitea/workflows/testflight.yml
@@ -28,6 +28,7 @@ jobs:
           ASC_KEY: ${{ secrets.ASC_KEY }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
           MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
+          HOME_ASSISTANT_ACCESS_TOKEN: ${{ secrets.HOME_ASSISTANT_ACCESS_TOKEN }}
           CI: "true"
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_HIDE_CHANGELOG: "1"
diff --git a/README.md b/README.md
index 80c12c6..c8a138b 100644
--- a/README.md
+++ b/README.md
@@ -46,7 +46,10 @@ TestFlight releases
 
 Gitea Actions publishes tags named `release/vX.X.X` to TestFlight. The semantic
 version from the tag and the Gitea `GITHUB_RUN_NUMBER` are written into the
-app's Info.plist before it is archived. For example:
+app's Info.plist before it is archived. The workflow also copies the
+`HOME_ASSISTANT_ACCESS_TOKEN` Gitea secret into the app's
+`HomeAssistantAccessToken` Info.plist entry and verifies the archived app
+contains it. For example:
 
 ```sh
 git tag -a release/v2.0.0 -m 'Release 2.0.0'
@@ -61,3 +64,4 @@ repository Actions secrets:
 - `ASC_KEY`
 - `MATCH_PASSWORD`
 - `MATCH_GIT_BASIC_AUTHORIZATION`
+- `HOME_ASSISTANT_ACCESS_TOKEN`
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 23abb6a..c8ec043 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -14,11 +14,17 @@ platform :ios do
     build_number = ENV.fetch("GITHUB_RUN_NUMBER")
     UI.user_error!("GITHUB_RUN_NUMBER must be a positive integer") unless build_number.match?(/\A[1-9]\d*\z/)
 
+    home_assistant_access_token = ENV["HOME_ASSISTANT_ACCESS_TOKEN"]&.strip
+    if home_assistant_access_token.to_s.empty?
+      UI.user_error!("HOME_ASSISTANT_ACCESS_TOKEN must be configured for release builds")
+    end
+
     update_info_plist(
       plist_path: "XIONControlPanel/SupportingFiles/Info.plist",
       block: proc do |plist|
         plist["CFBundleShortVersionString"] = version
         plist["CFBundleVersion"] = build_number
+        plist["HomeAssistantAccessToken"] = home_assistant_access_token
       end
     )
 
@@ -31,6 +37,21 @@ platform :ios do
 
     build_app(scheme: "XIONControlPanel")
 
+    archived_plist = File.join(
+      lane_context[SharedValues::XCODEBUILD_ARCHIVE],
+      "Products",
+      "Applications",
+      "XION.app",
+      "Info.plist"
+    )
+    archived_access_token = get_info_plist_value(
+      path: archived_plist,
+      key: "HomeAssistantAccessToken"
+    ).to_s
+    unless archived_access_token == home_assistant_access_token
+      UI.user_error!("The archived app does not contain the configured Home Assistant access token")
+    end
+
     upload_to_testflight(
       api_key: api_key,
       skip_waiting_for_build_processing: true,