mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-07-20 18:08:55 +00:00
03aee68fba
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v5...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
245 lines
10 KiB
YAML
245 lines
10 KiB
YAML
name: iOS App Store Release on Release
|
|
on:
|
|
push:
|
|
tags:
|
|
- v*
|
|
workflow_dispatch:
|
|
inputs: {}
|
|
|
|
jobs:
|
|
ios-app-store-release:
|
|
runs-on: macos-26
|
|
env:
|
|
UNSPLASH_KEY: ${{ secrets.UNSPLASH_KEY }}
|
|
UNSPLASH_CLIENT_ID: ${{ secrets.UNSPLASH_CLIENT_ID }}
|
|
|
|
steps:
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version: 22
|
|
- name: Check out Git repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Select Xcode 26.2
|
|
run: sudo xcode-select -s /Applications/Xcode_26.2.app
|
|
|
|
- name: Verify Xcode and SDK version
|
|
run: |
|
|
echo "=== Xcode Version ==="
|
|
xcodebuild -version
|
|
echo ""
|
|
echo "=== SDK Information ==="
|
|
xcrun --show-sdk-version
|
|
xcodebuild -showsdks | grep -E "(iOS|iphoneos)"
|
|
|
|
# work around for npm installs from git+https://github.com/johannesjo/J2M.git
|
|
- name: Reconfigure git to use HTTP authentication
|
|
run: >
|
|
git config --global url."https://github.com/".insteadOf
|
|
ssh://git@github.com/
|
|
|
|
- name: Install Apple WWDR intermediate certificate
|
|
run: |
|
|
curl -fsSL https://www.apple.com/certificateauthority/AppleWWDRCAG4.cer -o /tmp/AppleWWDRCAG4.cer
|
|
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/AppleWWDRCAG4.cer
|
|
|
|
- name: Configure signing keychain
|
|
env:
|
|
# Reuse mac_certs - "Apple Distribution" certificate works for both macOS and iOS
|
|
MAC_CERTS: ${{ secrets.mac_certs }}
|
|
MAC_CERTS_PASSWORD: ${{ secrets.mac_certs_password }}
|
|
run: |
|
|
CERT_PATH="$RUNNER_TEMP/dist-cert.p12"
|
|
KEYCHAIN_NAME="build.keychain"
|
|
KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db"
|
|
echo "$MAC_CERTS" | base64 --decode > "$CERT_PATH"
|
|
echo "=== DIAGNOSTIC: Decoded .p12 SHA256 ==="
|
|
shasum -a 256 "$CERT_PATH"
|
|
echo "========================================"
|
|
security create-keychain -p "" "$KEYCHAIN_NAME"
|
|
security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
|
|
security unlock-keychain -p "" "$KEYCHAIN_PATH"
|
|
curl -fsSL https://www.apple.com/certificateauthority/AppleWWDRCAG4.cer -o "$RUNNER_TEMP/AppleWWDRCAG4.cer"
|
|
security import "$RUNNER_TEMP/AppleWWDRCAG4.cer" -k "$KEYCHAIN_PATH" -T /usr/bin/codesign
|
|
security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$MAC_CERTS_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
|
|
security list-keychains -s "$KEYCHAIN_PATH" "$HOME/Library/Keychains/login.keychain-db"
|
|
security default-keychain -s "$KEYCHAIN_PATH"
|
|
security set-key-partition-list -S apple-tool:,apple: -k "" "$KEYCHAIN_PATH"
|
|
security find-identity -v -p codesigning "$KEYCHAIN_PATH"
|
|
|
|
- name: List available signing identities
|
|
run: security find-identity -v -p codesigning
|
|
|
|
- name: Install provisioning profile
|
|
env:
|
|
IOS_PROVISION_PROFILE: ${{ secrets.IOS_PROVISION_PROFILE }}
|
|
run: |
|
|
PROFILE_PATH="$RUNNER_TEMP/ios-provisioning.mobileprovision"
|
|
echo "$IOS_PROVISION_PROFILE" | base64 --decode > "$PROFILE_PATH"
|
|
# Get the UUID from the provisioning profile
|
|
PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print UUID" /dev/stdin <<< $(security cms -D -i "$PROFILE_PATH"))
|
|
echo "Profile UUID: $PROFILE_UUID"
|
|
# Create the provisioning profiles directory if it doesn't exist
|
|
mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
|
|
# Copy the profile with its UUID as the filename
|
|
cp "$PROFILE_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/${PROFILE_UUID}.mobileprovision"
|
|
echo "PROVISIONING_PROFILE_UUID=$PROFILE_UUID" >> "$GITHUB_ENV"
|
|
|
|
- name: Verify provisioning profile
|
|
run: |
|
|
security cms -D -i "$HOME/Library/MobileDevice/Provisioning Profiles/${PROVISIONING_PROFILE_UUID}.mobileprovision" > /tmp/profile.plist
|
|
echo "=== PROVISIONING PROFILE INFO ==="
|
|
echo "Name: $(/usr/libexec/PlistBuddy -c "Print Name" /tmp/profile.plist)"
|
|
echo "Team: $(/usr/libexec/PlistBuddy -c "Print TeamIdentifier:0" /tmp/profile.plist)"
|
|
PROFILE_APP_ID=$(/usr/libexec/PlistBuddy -c "Print Entitlements:application-identifier" /tmp/profile.plist | sed 's/^[A-Z0-9]*\.//')
|
|
echo "App ID: $PROFILE_APP_ID"
|
|
echo "=================================="
|
|
# Verify bundle ID matches
|
|
EXPECTED_BUNDLE_ID="com.super-productivity.app"
|
|
if [ "$PROFILE_APP_ID" != "$EXPECTED_BUNDLE_ID" ]; then
|
|
echo "ERROR: Provisioning profile app ID ($PROFILE_APP_ID) does not match expected bundle ID ($EXPECTED_BUNDLE_ID)"
|
|
echo "Please create a new provisioning profile with the correct bundle ID"
|
|
exit 1
|
|
fi
|
|
echo "Bundle ID verification passed!"
|
|
|
|
- name: Get npm cache directory
|
|
id: npm-cache-dir
|
|
run: |
|
|
echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
|
|
|
|
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
|
|
id: npm-cache
|
|
with:
|
|
path: ${{ steps.npm-cache-dir.outputs.dir }}
|
|
key: ${{ runner.os }}-node22-${{ hashFiles('**/package-lock.json') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node22-
|
|
|
|
- name: Install npm Packages
|
|
run: npm i
|
|
|
|
- name: Generate environment
|
|
run: npm run env
|
|
|
|
- name: Set iOS version from package.json
|
|
run: |
|
|
FULL_VERSION=$(node -p "require('./package.json').version")
|
|
# Strip pre-release suffix (e.g., "17.0.0-RC.3" -> "17.0.0")
|
|
# App Store requires X.Y.Z format; build number differentiates uploads
|
|
VERSION=$(echo "$FULL_VERSION" | sed 's/-.*//')
|
|
BUILD_NUMBER=$(date +%Y%m%d%H%M)
|
|
echo "Setting iOS version to $VERSION (build $BUILD_NUMBER) [from $FULL_VERSION]"
|
|
|
|
cd ios/App
|
|
if ! xcrun agvtool new-marketing-version "$VERSION"; then
|
|
echo "Error: Failed to set marketing version to $VERSION"
|
|
exit 1
|
|
fi
|
|
if ! xcrun agvtool new-version -all "$BUILD_NUMBER"; then
|
|
echo "Error: Failed to set build number to $BUILD_NUMBER"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Build Angular frontend
|
|
run: npm run buildFrontend:prodWeb
|
|
|
|
- name: Sync Capacitor iOS
|
|
run: npm run sync:ios
|
|
|
|
- name: Install CocoaPods
|
|
run: |
|
|
cd ios/App
|
|
pod install
|
|
|
|
- name: Archive iOS app
|
|
run: |
|
|
cd ios/App
|
|
# Archive without code signing - signing is handled during export
|
|
# This avoids conflicts with CocoaPods frameworks
|
|
xcodebuild archive \
|
|
-workspace App.xcworkspace \
|
|
-scheme App \
|
|
-configuration Release \
|
|
-archivePath "$RUNNER_TEMP/App.xcarchive" \
|
|
-destination 'generic/platform=iOS' \
|
|
CODE_SIGNING_REQUIRED=NO \
|
|
CODE_SIGNING_ALLOWED=NO
|
|
|
|
- name: Create ExportOptions.plist
|
|
run: |
|
|
cat > "$RUNNER_TEMP/ExportOptions.plist" << EOF
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>method</key>
|
|
<string>app-store-connect</string>
|
|
<key>teamID</key>
|
|
<string>${{ secrets.APPLE_TEAM_ID }}</string>
|
|
<key>uploadSymbols</key>
|
|
<true/>
|
|
<key>signingStyle</key>
|
|
<string>manual</string>
|
|
<key>provisioningProfiles</key>
|
|
<dict>
|
|
<key>com.super-productivity.app</key>
|
|
<string>${{ env.PROVISIONING_PROFILE_UUID }}</string>
|
|
</dict>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
|
|
- name: Export IPA
|
|
run: |
|
|
xcodebuild -exportArchive \
|
|
-archivePath "$RUNNER_TEMP/App.xcarchive" \
|
|
-exportPath "$RUNNER_TEMP/ipa-output" \
|
|
-exportOptionsPlist "$RUNNER_TEMP/ExportOptions.plist"
|
|
|
|
- name: List exported files
|
|
run: ls -la "$RUNNER_TEMP/ipa-output"
|
|
|
|
- name: Upload IPA artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: sup-ios-release
|
|
path: ${{ runner.temp }}/ipa-output/*.ipa
|
|
|
|
- name: Set up Ruby and fastlane
|
|
# Pinned by SHA per repo policy. ruby-version is required: with no
|
|
# .ruby-version file in the repo the action errors out rather than
|
|
# using system Ruby. bundler-cache runs `bundle install` and caches the
|
|
# ~210-gem fastlane tree so it isn't reinstalled each run.
|
|
uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af # v1.313.0
|
|
with:
|
|
ruby-version: '3.3'
|
|
bundler-cache: true
|
|
|
|
- name: Prepare App Store release notes
|
|
run: node tools/prepare-appstore-release-notes.js
|
|
|
|
# Upload the IPA to App Store Connect and (for final release tags) submit
|
|
# it for review with automatic release on approval. Pre-release tags (any
|
|
# tag containing "-", e.g. -rc.0/-beta.1) and manual runs only upload the
|
|
# build (TestFlight). The "-" check is case-insensitive by construction,
|
|
# unlike contains(...,'RC'); the repo's RC tags are mostly lowercase.
|
|
- name: Upload to App Store Connect and submit for review
|
|
env:
|
|
ASC_KEY_ID: ${{ secrets.mac_api_key_id }}
|
|
ASC_ISSUER_ID: ${{ secrets.mac_api_key_issuer_id }}
|
|
ASC_KEY_CONTENT: ${{ secrets.mac_api_key }}
|
|
SUBMIT_FOR_REVIEW: ${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
|
|
run: |
|
|
set -euo pipefail
|
|
shopt -s nullglob
|
|
ipas=("$RUNNER_TEMP"/ipa-output/*.ipa)
|
|
if [ ${#ipas[@]} -ne 1 ]; then
|
|
echo "Expected exactly 1 .ipa, found ${#ipas[@]}: ${ipas[*]:-none}"
|
|
exit 1
|
|
fi
|
|
export IPA_PATH="${ipas[0]}"
|
|
echo "Submitting $IPA_PATH (submit_for_review=$SUBMIT_FOR_REVIEW)"
|
|
bundle exec fastlane ios release
|