ci: fix setup-just auth and split ios release into separate workflow

.gitea/workflows/ci-scraper.yaml

@@ -33,6 +33,8 @@ jobs:
 
       - name: Install just
         uses: extractions/setup-just@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: go vet
         run: just lint
@@ -51,6 +53,8 @@ jobs:
 
       - name: Install just
         uses: extractions/setup-just@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run tests
         run: just test
@@ -70,6 +74,8 @@ jobs:
 
       - name: Install just
         uses: extractions/setup-just@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build binary
         run: |

.gitea/workflows/ci-ui.yaml

@@ -34,6 +34,8 @@ jobs:
 
       - name: Install just
         uses: extractions/setup-just@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies
         run: just ui-install

.gitea/workflows/ios-release.yaml

@@ -0,0 +1,96 @@
+name: iOS Release
+
+on:
+  push:
+    tags:
+      - "ios-v*"
+
+jobs:
+  # ── archive & release to TestFlight ──────────────────────────────────────
+  # Triggered only on ios-v* tags (e.g. ios-v1.0.0).
+  # Required secrets:
+  #   APPLE_CERTIFICATE_BASE64          - Distribution certificate (.p12) base64-encoded
+  #   APPLE_CERTIFICATE_PASSWORD        - Password for the .p12 file
+  #   APPLE_PROVISIONING_PROFILE_BASE64 - App Store distribution profile base64-encoded
+  #   KEYCHAIN_PASSWORD                 - Temporary keychain password (any random string)
+  #   ASC_KEY_ID                        - App Store Connect API key ID
+  #   ASC_ISSUER_ID                     - App Store Connect issuer ID
+  #   ASC_PRIVATE_KEY                   - Contents of the .p8 private key file
+  #   APPLE_TEAM_ID                     - 10-character Apple Developer team ID (GHZXC6FVMU)
+  release:
+    name: Release to TestFlight
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install just
+        run: npm install -g rust-just
+
+      - name: Set build number from run number
+        run: just ios-set-build-number ${{ gitea.run_number }}
+
+      - name: Import signing certificate
+        env:
+          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
+          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12
+          security import $RUNNER_TEMP/cert.p12 \
+            -P "$CERTIFICATE_PASSWORD" \
+            -A -t cert -f pkcs12 \
+            -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
+      - name: Import provisioning profile
+        env:
+          PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
+        run: |
+          PP_PATH=$RUNNER_TEMP/profile.mobileprovision
+          echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
+
+      - name: Write App Store Connect API key
+        env:
+          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+        run: |
+          mkdir -p ~/private_keys
+          echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8
+
+      - name: Inject team ID into ExportOptions.plist
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          /usr/libexec/PlistBuddy -c \
+            "Set :teamID $APPLE_TEAM_ID" \
+            ios/LibNovel/ExportOptions.plist
+
+      - name: Archive
+        run: just ios-archive
+
+      - name: Export IPA
+        run: just ios-export
+
+      - name: Upload to TestFlight
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: just ios-upload
+
+      - name: Upload IPA artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: LibNovel-${{ gitea.ref_name }}.ipa
+          path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa
+          retention-days: 30
+
+      - name: Cleanup keychain
+        if: always()
+        run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db

.gitea/workflows/ios.yaml

@@ -7,15 +7,14 @@ on:
       - "ios/**"
       - "justfile"
       - ".gitea/workflows/ios.yaml"
-  push_tag:
+      - ".gitea/workflows/ios-release.yaml"
-    tags:
-      - "ios-v*"
   pull_request:
     branches: ["v2", "main"]
     paths:
       - "ios/**"
       - "justfile"
       - ".gitea/workflows/ios.yaml"
+      - ".gitea/workflows/ios-release.yaml"
 
 concurrency:
   group: ${{ gitea.workflow }}-${{ gitea.ref }}
@@ -26,7 +25,6 @@ jobs:
   build:
     name: Build
     runs-on: macos-latest
-    if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }}
 
     steps:
       - uses: actions/checkout@v4
@@ -42,7 +40,6 @@ jobs:
     name: Test
     runs-on: macos-latest
     needs: build
-    if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }}
 
     steps:
       - uses: actions/checkout@v4
@@ -60,93 +57,3 @@ jobs:
           name: test-results
           path: ios/LibNovel/test-results.xml
           retention-days: 7
-
-  # ── archive & release to TestFlight ──────────────────────────────────────
-  # Triggered only on ios-v* tags (e.g. ios-v1.0.0).
-  # Required secrets:
-  #   APPLE_CERTIFICATE_BASE64          - Distribution certificate (.p12) base64-encoded
-  #   APPLE_CERTIFICATE_PASSWORD        - Password for the .p12 file
-  #   APPLE_PROVISIONING_PROFILE_BASE64 - App Store distribution profile base64-encoded
-  #   KEYCHAIN_PASSWORD                 - Temporary keychain password (any random string)
-  #   ASC_KEY_ID                        - App Store Connect API key ID
-  #   ASC_ISSUER_ID                     - App Store Connect issuer ID
-  #   ASC_PRIVATE_KEY                   - Contents of the .p8 private key file
-  #   APPLE_TEAM_ID                     - 10-character Apple Developer team ID (GHZXC6FVMU)
-  release:
-    name: Release to TestFlight
-    runs-on: macos-latest
-    if: ${{ startsWith(gitea.ref, 'refs/tags/ios-v') }}
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install just
-        run: npm install -g rust-just
-
-      - name: Set build number from run number
-        run: just ios-set-build-number ${{ gitea.run_number }}
-
-      - name: Import signing certificate
-        env:
-          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
-          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-        run: |
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12
-          security import $RUNNER_TEMP/cert.p12 \
-            -P "$CERTIFICATE_PASSWORD" \
-            -A -t cert -f pkcs12 \
-            -k $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
-
-      - name: Import provisioning profile
-        env:
-          PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
-        run: |
-          PP_PATH=$RUNNER_TEMP/profile.mobileprovision
-          echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
-          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
-          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
-
-      - name: Write App Store Connect API key
-        env:
-          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-        run: |
-          mkdir -p ~/private_keys
-          echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8
-
-      - name: Inject team ID into ExportOptions.plist
-        env:
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: |
-          /usr/libexec/PlistBuddy -c \
-            "Set :teamID $APPLE_TEAM_ID" \
-            ios/LibNovel/ExportOptions.plist
-
-      - name: Archive
-        run: just ios-archive
-
-      - name: Export IPA
-        run: just ios-export
-
-      - name: Upload to TestFlight
-        env:
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: just ios-upload
-
-      - name: Upload IPA artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: LibNovel-${{ gitea.ref_name }}.ipa
-          path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa
-          retention-days: 30
-
-      - name: Cleanup keychain
-        if: always()
-        run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db