ci: fix setup-just auth and split ios release into separate workflow

.gitea/workflows/ios.yaml

@@ -7,15 +7,14 @@ on:
       - "ios/**"
       - "justfile"
       - ".gitea/workflows/ios.yaml"
-  push_tag:
-    tags:
-      - "ios-v*"
+      - ".gitea/workflows/ios-release.yaml"
   pull_request:
     branches: ["v2", "main"]
     paths:
       - "ios/**"
       - "justfile"
       - ".gitea/workflows/ios.yaml"
+      - ".gitea/workflows/ios-release.yaml"
 
 concurrency:
   group: ${{ gitea.workflow }}-${{ gitea.ref }}
@@ -26,7 +25,6 @@ jobs:
   build:
     name: Build
     runs-on: macos-latest
-    if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }}
 
     steps:
       - uses: actions/checkout@v4
@@ -42,7 +40,6 @@ jobs:
     name: Test
     runs-on: macos-latest
     needs: build
-    if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }}
 
     steps:
       - uses: actions/checkout@v4
@@ -60,93 +57,3 @@ jobs:
           name: test-results
           path: ios/LibNovel/test-results.xml
           retention-days: 7
-
-  # ── archive & release to TestFlight ──────────────────────────────────────
-  # Triggered only on ios-v* tags (e.g. ios-v1.0.0).
-  # Required secrets:
-  #   APPLE_CERTIFICATE_BASE64          - Distribution certificate (.p12) base64-encoded
-  #   APPLE_CERTIFICATE_PASSWORD        - Password for the .p12 file
-  #   APPLE_PROVISIONING_PROFILE_BASE64 - App Store distribution profile base64-encoded
-  #   KEYCHAIN_PASSWORD                 - Temporary keychain password (any random string)
-  #   ASC_KEY_ID                        - App Store Connect API key ID
-  #   ASC_ISSUER_ID                     - App Store Connect issuer ID
-  #   ASC_PRIVATE_KEY                   - Contents of the .p8 private key file
-  #   APPLE_TEAM_ID                     - 10-character Apple Developer team ID (GHZXC6FVMU)
-  release:
-    name: Release to TestFlight
-    runs-on: macos-latest
-    if: ${{ startsWith(gitea.ref, 'refs/tags/ios-v') }}
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install just
-        run: npm install -g rust-just
-
-      - name: Set build number from run number
-        run: just ios-set-build-number ${{ gitea.run_number }}
-
-      - name: Import signing certificate
-        env:
-          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
-          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-        run: |
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12
-          security import $RUNNER_TEMP/cert.p12 \
-            -P "$CERTIFICATE_PASSWORD" \
-            -A -t cert -f pkcs12 \
-            -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-
-      - name: Import provisioning profile
-        env:
-          PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
-        run: |
-          PP_PATH=$RUNNER_TEMP/profile.mobileprovision
-          echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
-          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
-          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
-
-      - name: Write App Store Connect API key
-        env:
-          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-        run: |
-          mkdir -p ~/private_keys
-          echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8
-
-      - name: Inject team ID into ExportOptions.plist
-        env:
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: |
-          /usr/libexec/PlistBuddy -c \
-            "Set :teamID $APPLE_TEAM_ID" \
-            ios/LibNovel/ExportOptions.plist
-
-      - name: Archive
-        run: just ios-archive
-
-      - name: Export IPA
-        run: just ios-export
-
-      - name: Upload to TestFlight
-        env:
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: just ios-upload
-
-      - name: Upload IPA artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: LibNovel-${{ gitea.ref_name }}.ipa
-          path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa
-          retention-days: 30
-
-      - name: Cleanup keychain
-        if: always()
-        run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db