fix: switch to automatic signing for archive, manual for export

.gitea/workflows/ios-release.yaml

@@ -28,11 +28,28 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install just
-        run: command -v just || brew install just
+      - name: Set up Ruby with rbenv
+        run: |
+          # Install rbenv and ruby-build if not already installed
+          brew install rbenv ruby-build || true
+          
+          # Install Ruby 3.2.2
+          rbenv install 3.2.2 --skip-existing
+          rbenv global 3.2.2
+          
+          # Add rbenv to PATH for subsequent steps
+          echo "$(rbenv root)/shims" >> $GITHUB_PATH
+          
+          # Verify Ruby version
+          eval "$(rbenv init -)"
+          ruby --version
 
-      - name: Set build number from run number
-        run: just ios-set-build-number ${{ gitea.run_number }}
+      - name: Install dependencies
+        working-directory: ios/LibNovel
+        run: |
+          eval "$(rbenv init -)"
+          gem install bundler
+          bundle install
 
       - name: Import signing certificate
         env:
@@ -45,20 +62,12 @@ jobs:
           security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
           echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12
-          echo "DEBUG: p12 file size: $(wc -c < $RUNNER_TEMP/cert.p12) bytes"
-          echo "DEBUG: p12 first bytes (hex): $(xxd $RUNNER_TEMP/cert.p12 | head -2)"
-          echo "DEBUG: import result:"
           security import $RUNNER_TEMP/cert.p12 \
             -P "$CERTIFICATE_PASSWORD" \
             -A -t cert -f pkcs12 \
-            -k $KEYCHAIN_PATH && echo "import OK" || echo "import FAILED exit $?"
+            -k $KEYCHAIN_PATH
           security list-keychain -d user -s $KEYCHAIN_PATH $(security list-keychains -d user | tr -d '"' | xargs)
-          echo "DEBUG: keychain list:"
-          security list-keychains -d user
-          echo "DEBUG: all certs in keychain (not just codesigning):"
-          security find-certificate -a $KEYCHAIN_PATH 2>&1 | grep "labl\|subj" || echo "none"
-          echo "DEBUG: signing identities found:"
-          security find-identity -v -p codesigning
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
 
       - name: Import provisioning profile
         env:
@@ -67,60 +76,27 @@ jobs:
           PP_PATH=$RUNNER_TEMP/profile.mobileprovision
           echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
           UUID=$(security cms -D -i "$PP_PATH" | plutil -extract UUID raw -)
+          PROFILE_NAME=$(security cms -D -i "$PP_PATH" | plutil -extract Name raw -)
           mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
           cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/$UUID.mobileprovision
+          echo "Installed profile: $PROFILE_NAME (UUID: $UUID)"
+          echo "PROFILE_NAME=$PROFILE_NAME" >> $GITHUB_ENV
 
-      - name: Write App Store Connect API key
-        env:
-          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-        run: |
-          mkdir -p ~/private_keys
-          echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8
-
-      - name: Inject team ID into ExportOptions.plist
-        env:
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: |
-          /usr/libexec/PlistBuddy -c \
-            "Set :teamID $APPLE_TEAM_ID" \
-            ios/LibNovel/ExportOptions.plist
-
-      - name: Archive
+      - name: Build and upload to TestFlight
         env:
           USER: runner
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          LC_ALL: en_US.UTF-8
+          LANG: en_US.UTF-8
+          APPLE_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          APPLE_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          APPLE_KEY_CONTENT: ${{ secrets.ASC_PRIVATE_KEY }}
+          BUILD_NUMBER: ${{ gitea.run_number }}
+        working-directory: ios/LibNovel
         run: |
-          PROFILE_UUID=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract UUID raw -)
-          PROFILE_NAME=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract Name raw -)
-          PROFILE_BUNDLE=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract Entitlements.application-identifier raw - 2>/dev/null || echo "n/a")
-          PROFILE_TEAM=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract TeamIdentifier.0 raw -)
-          PROFILE_EXPIRY=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract ExpirationDate raw -)
-          echo "DEBUG: PROFILE_UUID=$PROFILE_UUID"
-          echo "DEBUG: PROFILE_NAME=$PROFILE_NAME"
-          echo "DEBUG: PROFILE_BUNDLE=$PROFILE_BUNDLE"
-          echo "DEBUG: PROFILE_TEAM=$PROFILE_TEAM"
-          echo "DEBUG: PROFILE_EXPIRY=$PROFILE_EXPIRY"
-          echo "DEBUG: APPLE_TEAM_ID=$APPLE_TEAM_ID"
-          echo "DEBUG: profiles dir listing:"
-          ls ~/Library/MobileDevice/Provisioning\ Profiles/
-          just ios-archive "$APPLE_TEAM_ID" "$PROFILE_UUID"
-
-      - name: Export IPA
-        run: just ios-export
-
-      - name: Upload to TestFlight
-        env:
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: just ios-upload
-
-      - name: Upload IPA artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: LibNovel-${{ gitea.ref_name }}.ipa
-          path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa
-          retention-days: 30
+          eval "$(rbenv init -)"
+          echo "Using provisioning profile: $PROFILE_NAME"
+          export PROVISIONING_PROFILE_NAME="$PROFILE_NAME"
+          bundle exec fastlane beta
 
       - name: Cleanup keychain
         if: always()

ios/LibNovel/.gitignore

@@ -0,0 +1,10 @@
+# Fastlane
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots/**/*.png
+fastlane/test_output
+fastlane/README.md
+
+# Bundler
+.bundle
+vendor/bundle

ios/LibNovel/Gemfile

@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "fastlane"

ios/LibNovel/fastlane/Fastfile

@@ -0,0 +1,43 @@
+default_platform(:ios)
+
+platform :ios do
+  desc "Build and upload to TestFlight"
+  lane :beta do
+    # Generate Xcode project from project.yml (one level up from fastlane/)
+    sh("cd .. && xcodegen generate --spec project.yml --project .")
+
+    # Set build number from CI run number (passed as env var)
+    increment_build_number(
+      build_number: ENV["BUILD_NUMBER"] || "1",
+      xcodeproj: "LibNovel.xcodeproj"
+    )
+
+    # Use automatic signing - Xcode will find the right profile
+    update_code_signing_settings(
+      use_automatic_signing: true,
+      path: "LibNovel.xcodeproj",
+      team_id: "GHZXC6FVMU",
+      targets: ["LibNovel"]
+    )
+
+    # Build the app
+    build_app(
+      scheme: "LibNovel",
+      export_method: "app-store",
+      clean: true,
+      configuration: "Release",
+      export_options: {
+        method: "app-store",
+        teamID: "GHZXC6FVMU",
+        provisioningProfiles: {
+          "com.kalekber.LibNovel" => ENV["PROVISIONING_PROFILE_NAME"] || "LibNovel Distribution"
+        }
+      }
+    )
+
+    # Upload to TestFlight
+    upload_to_testflight(
+      skip_waiting_for_build_processing: true
+    )
+  end
+end

ios/LibNovel/project.yml

@@ -52,7 +52,6 @@ targets:
       configs:
         Release:
           CODE_SIGN_STYLE: Manual
-          CODE_SIGN_IDENTITY: "Apple Distribution"
           DEVELOPMENT_TEAM: GHZXC6FVMU
 
   LibNovelTests:

ios/LibNovel/test-build.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+# Test script for local iOS build iteration
+# Run from ios/LibNovel directory
+
+echo "=== Generating Xcode project ==="
+xcodegen generate --spec project.yml --project .
+
+echo ""
+echo "=== Listing available provisioning profiles ==="
+ls -la ~/Library/MobileDevice/Provisioning\ Profiles/ || echo "No profiles found"
+
+echo ""
+echo "=== Listing available signing identities ==="
+security find-identity -v -p codesigning
+
+echo ""
+echo "=== Attempting archive build ==="
+xcodebuild archive \
+  -project LibNovel.xcodeproj \
+  -scheme LibNovel \
+  -configuration Release \
+  -destination 'generic/platform=iOS' \
+  -archivePath ./build/LibNovel.xcarchive \
+  -allowProvisioningUpdates \
+  CODE_SIGN_STYLE=Manual \
+  CODE_SIGN_IDENTITY="Apple Distribution" \
+  DEVELOPMENT_TEAM="GHZXC6FVMU"
+
+echo ""
+echo "=== Build succeeded! ==="

justfile

@@ -139,11 +139,9 @@ ios-archive team_id profile_uuid: ios-gen ios-resolve
         -destination 'generic/platform=iOS' \
         -clonedSourcePackagesDirPath {{ios_spm}} \
         -archivePath {{runner_temp}}/LibNovel.xcarchive \
-        -allowProvisioningUpdates \
-        CODE_SIGN_STYLE=Manual \
         CODE_SIGN_IDENTITY="Apple Distribution" \
-        DEVELOPMENT_TEAM="{{team_id}}" \
-        PROVISIONING_PROFILE="{{profile_uuid}}"
+        "PROVISIONING_PROFILE[sdk=iphoneos*]={{profile_uuid}}" \
+        DEVELOPMENT_TEAM="{{team_id}}"
 
 # Export an IPA from the archive produced by ios-archive.
 # Requires ios/LibNovel/ExportOptions.plist.