From 5d9b41bcf259eab4e664268e306d056941557063 Mon Sep 17 00:00:00 2001 From: Admin Date: Sun, 8 Mar 2026 22:21:43 +0500 Subject: [PATCH] ci: fix setup-just auth and split ios release into separate workflow --- .gitea/workflows/ci-scraper.yaml | 6 ++ .gitea/workflows/ci-ui.yaml | 2 + .gitea/workflows/ios-release.yaml | 96 ++++++++++++++++++++++++++++++ .gitea/workflows/ios.yaml | 97 +------------------------------ 4 files changed, 106 insertions(+), 95 deletions(-) create mode 100644 .gitea/workflows/ios-release.yaml diff --git a/.gitea/workflows/ci-scraper.yaml b/.gitea/workflows/ci-scraper.yaml index 768b778..5bb0b97 100644 --- a/.gitea/workflows/ci-scraper.yaml +++ b/.gitea/workflows/ci-scraper.yaml @@ -33,6 +33,8 @@ jobs: - name: Install just uses: extractions/setup-just@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: go vet run: just lint @@ -51,6 +53,8 @@ jobs: - name: Install just uses: extractions/setup-just@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Run tests run: just test @@ -70,6 +74,8 @@ jobs: - name: Install just uses: extractions/setup-just@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Build binary run: | diff --git a/.gitea/workflows/ci-ui.yaml b/.gitea/workflows/ci-ui.yaml index d58b643..8f82ae6 100644 --- a/.gitea/workflows/ci-ui.yaml +++ b/.gitea/workflows/ci-ui.yaml @@ -34,6 +34,8 @@ jobs: - name: Install just uses: extractions/setup-just@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Install dependencies run: just ui-install diff --git a/.gitea/workflows/ios-release.yaml b/.gitea/workflows/ios-release.yaml new file mode 100644 index 0000000..208ad5b --- /dev/null +++ b/.gitea/workflows/ios-release.yaml @@ -0,0 +1,96 @@ +name: iOS Release + +on: + push: + tags: + - "ios-v*" + +jobs: + # ── archive & release to TestFlight ────────────────────────────────────── + # Triggered only on ios-v* tags (e.g. ios-v1.0.0). + # Required secrets: + # APPLE_CERTIFICATE_BASE64 - Distribution certificate (.p12) base64-encoded + # APPLE_CERTIFICATE_PASSWORD - Password for the .p12 file + # APPLE_PROVISIONING_PROFILE_BASE64 - App Store distribution profile base64-encoded + # KEYCHAIN_PASSWORD - Temporary keychain password (any random string) + # ASC_KEY_ID - App Store Connect API key ID + # ASC_ISSUER_ID - App Store Connect issuer ID + # ASC_PRIVATE_KEY - Contents of the .p8 private key file + # APPLE_TEAM_ID - 10-character Apple Developer team ID (GHZXC6FVMU) + release: + name: Release to TestFlight + runs-on: macos-latest + + steps: + - uses: actions/checkout@v4 + + - name: Install just + run: npm install -g rust-just + + - name: Set build number from run number + run: just ios-set-build-number ${{ gitea.run_number }} + + - name: Import signing certificate + env: + CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }} + CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} + KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} + run: | + KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db + security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH + security set-keychain-settings -lut 21600 $KEYCHAIN_PATH + security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH + echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12 + security import $RUNNER_TEMP/cert.p12 \ + -P "$CERTIFICATE_PASSWORD" \ + -A -t cert -f pkcs12 \ + -k $KEYCHAIN_PATH + security list-keychain -d user -s $KEYCHAIN_PATH + + - name: Import provisioning profile + env: + PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }} + run: | + PP_PATH=$RUNNER_TEMP/profile.mobileprovision + echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH + mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles + cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/ + + - name: Write App Store Connect API key + env: + ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }} + ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }} + run: | + mkdir -p ~/private_keys + echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8 + + - name: Inject team ID into ExportOptions.plist + env: + APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} + run: | + /usr/libexec/PlistBuddy -c \ + "Set :teamID $APPLE_TEAM_ID" \ + ios/LibNovel/ExportOptions.plist + + - name: Archive + run: just ios-archive + + - name: Export IPA + run: just ios-export + + - name: Upload to TestFlight + env: + ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }} + ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }} + run: just ios-upload + + - name: Upload IPA artifact + uses: actions/upload-artifact@v4 + with: + name: LibNovel-${{ gitea.ref_name }}.ipa + path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa + retention-days: 30 + + - name: Cleanup keychain + if: always() + run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db diff --git a/.gitea/workflows/ios.yaml b/.gitea/workflows/ios.yaml index 8a68a12..551bb1b 100644 --- a/.gitea/workflows/ios.yaml +++ b/.gitea/workflows/ios.yaml @@ -7,15 +7,14 @@ on: - "ios/**" - "justfile" - ".gitea/workflows/ios.yaml" - push_tag: - tags: - - "ios-v*" + - ".gitea/workflows/ios-release.yaml" pull_request: branches: ["v2", "main"] paths: - "ios/**" - "justfile" - ".gitea/workflows/ios.yaml" + - ".gitea/workflows/ios-release.yaml" concurrency: group: ${{ gitea.workflow }}-${{ gitea.ref }} @@ -26,7 +25,6 @@ jobs: build: name: Build runs-on: macos-latest - if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }} steps: - uses: actions/checkout@v4 @@ -42,7 +40,6 @@ jobs: name: Test runs-on: macos-latest needs: build - if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }} steps: - uses: actions/checkout@v4 @@ -60,93 +57,3 @@ jobs: name: test-results path: ios/LibNovel/test-results.xml retention-days: 7 - - # ── archive & release to TestFlight ────────────────────────────────────── - # Triggered only on ios-v* tags (e.g. ios-v1.0.0). - # Required secrets: - # APPLE_CERTIFICATE_BASE64 - Distribution certificate (.p12) base64-encoded - # APPLE_CERTIFICATE_PASSWORD - Password for the .p12 file - # APPLE_PROVISIONING_PROFILE_BASE64 - App Store distribution profile base64-encoded - # KEYCHAIN_PASSWORD - Temporary keychain password (any random string) - # ASC_KEY_ID - App Store Connect API key ID - # ASC_ISSUER_ID - App Store Connect issuer ID - # ASC_PRIVATE_KEY - Contents of the .p8 private key file - # APPLE_TEAM_ID - 10-character Apple Developer team ID (GHZXC6FVMU) - release: - name: Release to TestFlight - runs-on: macos-latest - if: ${{ startsWith(gitea.ref, 'refs/tags/ios-v') }} - - steps: - - uses: actions/checkout@v4 - - - name: Install just - run: npm install -g rust-just - - - name: Set build number from run number - run: just ios-set-build-number ${{ gitea.run_number }} - - - name: Import signing certificate - env: - CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }} - CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }} - KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} - run: | - KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db - security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH - security set-keychain-settings -lut 21600 $KEYCHAIN_PATH - security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH - echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12 - security import $RUNNER_TEMP/cert.p12 \ - -P "$CERTIFICATE_PASSWORD" \ - -A -t cert -f pkcs12 \ - -k $KEYCHAIN_PATH - security list-keychain -d user -s $KEYCHAIN_PATH - - - name: Import provisioning profile - env: - PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }} - run: | - PP_PATH=$RUNNER_TEMP/profile.mobileprovision - echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH - mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles - cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/ - - - name: Write App Store Connect API key - env: - ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }} - ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }} - run: | - mkdir -p ~/private_keys - echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8 - - - name: Inject team ID into ExportOptions.plist - env: - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} - run: | - /usr/libexec/PlistBuddy -c \ - "Set :teamID $APPLE_TEAM_ID" \ - ios/LibNovel/ExportOptions.plist - - - name: Archive - run: just ios-archive - - - name: Export IPA - run: just ios-export - - - name: Upload to TestFlight - env: - ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }} - ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }} - run: just ios-upload - - - name: Upload IPA artifact - uses: actions/upload-artifact@v4 - with: - name: LibNovel-${{ gitea.ref_name }}.ipa - path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa - retention-days: 30 - - - name: Cleanup keychain - if: always() - run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db