boc/ios-github-actions.yml

name: iOS → App Store (GitHub Actions)

on:
  push:
    branches: [main]
    paths: ['ios/**', '.github/workflows/ios-deploy.yml']
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      lane:
        description: 'beta (TestFlight) eller release (App Store)'
        required: true
        default: 'beta'
        type: choice
        options: [beta, release]

jobs:
  build-ios:
    name: Build & Deploy iOS
    runs-on: macos-14        # GitHub-hosted Apple Silicon — ingen egen Mac behövs

    env:
      BUNDLE_ID:                         ${{ secrets.BUNDLE_ID }}
      APPLE_TEAM_ID:                     ${{ secrets.APPLE_TEAM_ID }}
      ASC_API_KEY_ID:                    ${{ secrets.ASC_API_KEY_ID }}
      ASC_ISSUER_ID:                     ${{ secrets.ASC_ISSUER_ID }}
      ASC_API_KEY:                       ${{ secrets.ASC_API_KEY }}
      MATCH_GIT_URL:                     ${{ secrets.MATCH_GIT_URL }}
      MATCH_PASSWORD:                    ${{ secrets.MATCH_PASSWORD }}
      FASTLANE_SKIP_UPDATE_CHECK:        "1"
      FASTLANE_HIDE_CHANGELOG:           "1"

    steps:
      - uses: actions/checkout@v4

      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
          working-directory: ios

      - name: Select Xcode
        run: |
          sudo xcode-select --switch /Applications/Xcode_16.2.app/Contents/Developer
          xcodebuild -version

      - name: Write ASC API Key
        run: |
          mkdir -p /tmp/asc
          echo "$ASC_API_KEY" | base64 --decode > /tmp/asc/AuthKey_${ASC_API_KEY_ID}.p8
          cat > /tmp/asc/api_key.json <<EOF
          {
            "key_id": "${ASC_API_KEY_ID}",
            "issuer_id": "${ASC_ISSUER_ID}",
            "key": "$(echo "$ASC_API_KEY" | base64 --decode | awk '{printf "%s\\n", $0}')",
            "duration": 1200,
            "in_house": false
          }
          EOF

      - name: Fastlane Match (sync certs)
        working-directory: ios
        run: bundle exec fastlane match appstore --readonly true

      - name: Set build number
        working-directory: ios
        run: |
          BUILD="${{ github.run_number }}"
          agvtool new-version -all "$BUILD" || \
          /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD" */Info.plist

      - name: Build
        working-directory: ios
        run: |
          xcodebuild \
            -workspace *.xcworkspace \
            -scheme AAMOS \
            -configuration Release \
            -destination "generic/platform=iOS" \
            -archivePath /tmp/AAMOS.xcarchive \
            archive \
            CODE_SIGN_STYLE=Manual \
            PROVISIONING_PROFILE_SPECIFIER="match AppStore ${BUNDLE_ID}" \
            DEVELOPMENT_TEAM="${APPLE_TEAM_ID}" | xcpretty --color

      - name: Export IPA
        run: |
          cat > /tmp/ExportOptions.plist <<EOF
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0"><dict>
            <key>method</key><string>app-store</string>
            <key>teamID</key><string>${APPLE_TEAM_ID}</string>
            <key>signingStyle</key><string>manual</string>
            <key>provisioningProfiles</key><dict>
              <key>${BUNDLE_ID}</key><string>match AppStore ${BUNDLE_ID}</string>
            </dict>
          </dict></plist>
          EOF
          xcodebuild -exportArchive \
            -archivePath /tmp/AAMOS.xcarchive \
            -exportPath /tmp/AAMOS-ipa \
            -exportOptionsPlist /tmp/ExportOptions.plist

      - name: Upload to TestFlight / App Store
        run: |
          LANE="${{ github.event.inputs.lane || (github.event_name == 'release' && 'release' || 'beta') }}"
          if [ "$LANE" = "release" ]; then
            echo "→ Submitting to App Store"
            cd ios && bundle exec fastlane release
          else
            echo "→ Uploading to TestFlight"
            xcrun altool --upload-app --type ios \
              --file /tmp/AAMOS-ipa/*.ipa \
              --apiKey "${ASC_API_KEY_ID}" \
              --apiIssuer "${ASC_ISSUER_ID}" \
              --output-format json
          fi

      - name: Notify Telegram
        if: always()
        env:
          TG_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          TG_CHAT: ${{ secrets.TELEGRAM_CHAT_ID }}
        run: |
          STATUS="${{ job.status == 'success' && '✅' || '❌' }}"
          MSG="${STATUS} iOS build %23${{ github.run_number }} — ${{ job.status }}%0ABranch: ${{ github.ref_name }}%0ACommit: ${{ github.event.head_commit.message }}"
          curl -s "https://api.telegram.org/bot${TG_TOKEN}/sendMessage" \
            -d "chat_id=${TG_CHAT}&text=${MSG}" > /dev/null

      - name: Cleanup
        if: always()
        run: rm -rf /tmp/asc /tmp/AAMOS.xcarchive /tmp/AAMOS-ipa