Read archived binary plist with plutil

.env.example

@@ -3,3 +3,4 @@ ASC_ISSUER_ID=
 ASC_KEY=
 MATCH_PASSWORD=
 MATCH_GIT_BASIC_AUTHORIZATION=
+HOME_ASSISTANT_ACCESS_TOKEN=

.gitea/workflows/testflight.yml

@@ -28,6 +28,7 @@ jobs:
           ASC_KEY: ${{ secrets.ASC_KEY }}
           MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
           MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
+          HOME_ASSISTANT_ACCESS_TOKEN: ${{ secrets.HOME_ASSISTANT_ACCESS_TOKEN }}
           CI: "true"
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_HIDE_CHANGELOG: "1"

README.md

@@ -46,7 +46,10 @@ TestFlight releases
 
 Gitea Actions publishes tags named `release/vX.X.X` to TestFlight. The semantic
 version from the tag and the Gitea `GITHUB_RUN_NUMBER` are written into the
-app's Info.plist before it is archived. For example:
+app's Info.plist before it is archived. The workflow also copies the
+`HOME_ASSISTANT_ACCESS_TOKEN` Gitea secret into the app's
+`HomeAssistantAccessToken` Info.plist entry and verifies the archived app
+contains it. For example:
 
 ```sh
 git tag -a release/v2.0.0 -m 'Release 2.0.0'
@@ -61,3 +64,4 @@ repository Actions secrets:
 - `ASC_KEY`
 - `MATCH_PASSWORD`
 - `MATCH_GIT_BASIC_AUTHORIZATION`
+- `HOME_ASSISTANT_ACCESS_TOKEN`

XIONControlPanel/SupportingFiles/Info.plist

@@ -22,6 +22,8 @@
 	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>HomeAssistantAccessToken</key>
 	<string>$(HOME_ASSISTANT_ACCESS_TOKEN)</string>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
 	<key>LSRequiresIPhoneOS</key>
 	<true/>
 	<key>NSAppTransportSecurity</key>

fastlane/Fastfile

@@ -1,3 +1,18 @@
+require "open3"
+
+def read_plist_value(path, key)
+  value, _error, status = Open3.capture3(
+    "/usr/bin/plutil",
+    "-extract",
+    key,
+    "raw",
+    path
+  )
+  UI.user_error!("Unable to read #{key} from the archived app") unless status.success?
+
+  value.strip
+end
+
 default_platform(:ios)
 
 platform :ios do
@@ -14,11 +29,17 @@ platform :ios do
     build_number = ENV.fetch("GITHUB_RUN_NUMBER")
     UI.user_error!("GITHUB_RUN_NUMBER must be a positive integer") unless build_number.match?(/\A[1-9]\d*\z/)
 
+    home_assistant_access_token = ENV["HOME_ASSISTANT_ACCESS_TOKEN"]&.strip
+    if home_assistant_access_token.to_s.empty?
+      UI.user_error!("HOME_ASSISTANT_ACCESS_TOKEN must be configured for release builds")
+    end
+
     update_info_plist(
       plist_path: "XIONControlPanel/SupportingFiles/Info.plist",
       block: proc do |plist|
         plist["CFBundleShortVersionString"] = version
         plist["CFBundleVersion"] = build_number
+        plist["HomeAssistantAccessToken"] = home_assistant_access_token
       end
     )
 
@@ -31,6 +52,21 @@ platform :ios do
 
     build_app(scheme: "XIONControlPanel")
 
+    archived_plist = File.join(
+      lane_context[SharedValues::XCODEBUILD_ARCHIVE],
+      "Products",
+      "Applications",
+      "XION.app",
+      "Info.plist"
+    )
+    archived_access_token = read_plist_value(
+      archived_plist,
+      "HomeAssistantAccessToken"
+    )
+    unless archived_access_token == home_assistant_access_token
+      UI.user_error!("The archived app does not contain the configured Home Assistant access token")
+    end
+
     upload_to_testflight(
       api_key: api_key,
       skip_waiting_for_build_processing: true,