ci: fix setup-just auth and split ios release into separate workflow

.gitea/workflows/ios-release.yaml

@@ -0,0 +1,96 @@
+name: iOS Release
+
+on:
+  push:
+    tags:
+      - "ios-v*"
+
+jobs:
+  # ── archive & release to TestFlight ──────────────────────────────────────
+  # Triggered only on ios-v* tags (e.g. ios-v1.0.0).
+  # Required secrets:
+  #   APPLE_CERTIFICATE_BASE64          - Distribution certificate (.p12) base64-encoded
+  #   APPLE_CERTIFICATE_PASSWORD        - Password for the .p12 file
+  #   APPLE_PROVISIONING_PROFILE_BASE64 - App Store distribution profile base64-encoded
+  #   KEYCHAIN_PASSWORD                 - Temporary keychain password (any random string)
+  #   ASC_KEY_ID                        - App Store Connect API key ID
+  #   ASC_ISSUER_ID                     - App Store Connect issuer ID
+  #   ASC_PRIVATE_KEY                   - Contents of the .p8 private key file
+  #   APPLE_TEAM_ID                     - 10-character Apple Developer team ID (GHZXC6FVMU)
+  release:
+    name: Release to TestFlight
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install just
+        run: npm install -g rust-just
+
+      - name: Set build number from run number
+        run: just ios-set-build-number ${{ gitea.run_number }}
+
+      - name: Import signing certificate
+        env:
+          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
+          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12
+          security import $RUNNER_TEMP/cert.p12 \
+            -P "$CERTIFICATE_PASSWORD" \
+            -A -t cert -f pkcs12 \
+            -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
+      - name: Import provisioning profile
+        env:
+          PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
+        run: |
+          PP_PATH=$RUNNER_TEMP/profile.mobileprovision
+          echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
+
+      - name: Write App Store Connect API key
+        env:
+          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+        run: |
+          mkdir -p ~/private_keys
+          echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8
+
+      - name: Inject team ID into ExportOptions.plist
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          /usr/libexec/PlistBuddy -c \
+            "Set :teamID $APPLE_TEAM_ID" \
+            ios/LibNovel/ExportOptions.plist
+
+      - name: Archive
+        run: just ios-archive
+
+      - name: Export IPA
+        run: just ios-export
+
+      - name: Upload to TestFlight
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: just ios-upload
+
+      - name: Upload IPA artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: LibNovel-${{ gitea.ref_name }}.ipa
+          path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa
+          retention-days: 30
+
+      - name: Cleanup keychain
+        if: always()
+        run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db