.gitea/workflows/ci-scraper.yaml

@@ -14,6 +14,10 @@ on:
       - "justfile"
       - ".gitea/workflows/ci-scraper.yaml"
 
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   # ── lint & vet ───────────────────────────────────────────────────────────────
   lint:

.gitea/workflows/ci-ui.yaml

@@ -14,6 +14,10 @@ on:
       - "justfile"
       - ".gitea/workflows/ci-ui.yaml"
 
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   # ── type-check & build ───────────────────────────────────────────────────────
   build:

.gitea/workflows/deploy.yaml

@@ -19,14 +19,18 @@ on:
 #              Header: x-api-key: <token>
 #   Response on success: HTTP 200, body: [{"result":{"data":{"json":{...}}}}]
 
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   # ── production deploy (main/master only) ─────────────────────────────────────
   deploy-production:
     name: Deploy Production
     runs-on: ubuntu-latest
     if: >
-      github.event_name == 'push' &&
+      gitea.event_name == 'push' &&
-      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
+      (gitea.ref == 'refs/heads/main' || gitea.ref == 'refs/heads/master')
     steps:
       - name: Redeploy production stack
         run: |
@@ -46,15 +50,15 @@ jobs:
     name: Deploy Preview
     runs-on: ubuntu-latest
     if: >
-      github.event_name == 'push' &&
+      gitea.event_name == 'push' &&
-      github.ref != 'refs/heads/main' &&
+      gitea.ref != 'refs/heads/main' &&
-      github.ref != 'refs/heads/master'
+      gitea.ref != 'refs/heads/master'
     steps:
       - name: Sanitize branch name
         id: branch
         run: |
           # Lowercase, replace non-alphanumeric with dashes, strip trailing dashes, max 20 chars
-          SUFFIX=$(echo "${{ github.ref_name }}" \
+          SUFFIX=$(echo "${{ gitea.ref_name }}" \
             | tr '[:upper:]' '[:lower:]' \
             | sed 's/[^a-z0-9]/-/g' \
             | cut -c1-20 \
@@ -81,12 +85,12 @@ jobs:
   cleanup-preview:
     name: Cleanup Preview
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    if: gitea.event_name == 'pull_request' && gitea.event.action == 'closed'
     steps:
       - name: Sanitize branch name
         id: branch
         run: |
-          SUFFIX=$(echo "${{ github.head_ref }}" \
+          SUFFIX=$(echo "${{ gitea.head_ref }}" \
             | tr '[:upper:]' '[:lower:]' \
             | sed 's/[^a-z0-9]/-/g' \
             | cut -c1-20 \

.gitea/workflows/ios.yaml

@@ -7,6 +7,9 @@ on:
       - "ios/**"
       - "justfile"
       - ".gitea/workflows/ios.yaml"
+  push_tag:
+    tags:
+      - "ios-v*"
   pull_request:
     branches: ["v2", "main"]
     paths:
@@ -14,38 +17,38 @@ on:
       - "justfile"
       - ".gitea/workflows/ios.yaml"
 
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
-  # ── build ─────────────────────────────────────────────────────────────────
+  # ── build (simulator) ─────────────────────────────────────────────────────
   build:
     name: Build
     runs-on: macos-latest
+    if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }}
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install just
-        run: brew install just
+        run: npm install -g rust-just
-
-      - name: Install xcodegen
-        run: brew install xcodegen
 
       - name: Build (simulator)
         run: just ios-build
 
-  # ── test ──────────────────────────────────────────────────────────────────
+  # ── unit tests ────────────────────────────────────────────────────────────
   test:
     name: Test
     runs-on: macos-latest
     needs: build
+    if: ${{ !startsWith(gitea.ref, 'refs/tags/ios-v') }}
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Install just
-        run: brew install just
+        run: npm install -g rust-just
-
-      - name: Install xcodegen
-        run: brew install xcodegen
 
       - name: Run unit tests
         run: just ios-test
@@ -58,52 +61,92 @@ jobs:
           path: ios/LibNovel/test-results.xml
           retention-days: 7
 
-  # ── archive (release IPA) ─────────────────────────────────────────────────
+  # ── archive & release to TestFlight ──────────────────────────────────────
-  # Runs only on pushes to v2/main (not PRs).
+  # Triggered only on ios-v* tags (e.g. ios-v1.0.0).
-  # Requires secrets: APPLE_CERTIFICATE_BASE64, APPLE_CERTIFICATE_PASSWORD,
+  # Required secrets:
-  #                   APPLE_PROVISIONING_PROFILE_BASE64, KEYCHAIN_PASSWORD
+  #   APPLE_CERTIFICATE_BASE64          - Distribution certificate (.p12) base64-encoded
-  # Also requires ios/LibNovel/ExportOptions.plist to exist.
+  #   APPLE_CERTIFICATE_PASSWORD        - Password for the .p12 file
-  #
+  #   APPLE_PROVISIONING_PROFILE_BASE64 - App Store distribution profile base64-encoded
-  # archive:
+  #   KEYCHAIN_PASSWORD                 - Temporary keychain password (any random string)
-  #   name: Archive
+  #   ASC_KEY_ID                        - App Store Connect API key ID
-  #   runs-on: macos-latest
+  #   ASC_ISSUER_ID                     - App Store Connect issuer ID
-  #   needs: [build, test]
+  #   ASC_PRIVATE_KEY                   - Contents of the .p8 private key file
-  #   if: gitea.event_name == 'push'
+  #   APPLE_TEAM_ID                     - 10-character Apple Developer team ID (GHZXC6FVMU)
-  #
+  release:
-  #   steps:
+    name: Release to TestFlight
-  #     - uses: actions/checkout@v4
+    runs-on: macos-latest
-  #
+    if: ${{ startsWith(gitea.ref, 'refs/tags/ios-v') }}
-  #     - name: Install just
+
-  #       run: brew install just
+    steps:
-  #
+      - uses: actions/checkout@v4
-  #     - name: Install xcodegen
+
-  #       run: brew install xcodegen
+      - name: Install just
-  #
+        run: npm install -g rust-just
-  #     - name: Import signing certificate
+
-  #       env:
+      - name: Set build number from run number
-  #         CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
+        run: just ios-set-build-number ${{ gitea.run_number }}
-  #         CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+
-  #         KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+      - name: Import signing certificate
-  #       run: |
+        env:
-  #         KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          CERTIFICATE_BASE64: ${{ secrets.APPLE_CERTIFICATE_BASE64 }}
-  #         security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-  #         security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-  #         security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+        run: |
-  #         echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-  #         security import $RUNNER_TEMP/cert.p12 \
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-  #           -P "$CERTIFICATE_PASSWORD" \
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-  #           -A -t cert -f pkcs12 \
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-  #           -k $KEYCHAIN_PATH
+          echo "$CERTIFICATE_BASE64" | base64 --decode > $RUNNER_TEMP/cert.p12
-  #         security list-keychain -d user -s $KEYCHAIN_PATH
+          security import $RUNNER_TEMP/cert.p12 \
-  #
+            -P "$CERTIFICATE_PASSWORD" \
-  #     - name: Import provisioning profile
+            -A -t cert -f pkcs12 \
-  #       env:
+            -k $KEYCHAIN_PATH
-  #         PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
+          security list-keychain -d user -s $KEYCHAIN_PATH
-  #       run: |
+
-  #         PP_PATH=$RUNNER_TEMP/profile.mobileprovision
+      - name: Import provisioning profile
-  #         echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
+        env:
-  #         mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
-  #         cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
+        run: |
-  #
+          PP_PATH=$RUNNER_TEMP/profile.mobileprovision
-  #     - name: Archive & export IPA
+          echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
-  #       run: just ios-archive && just ios-export
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
+
+      - name: Write App Store Connect API key
+        env:
+          ASC_PRIVATE_KEY: ${{ secrets.ASC_PRIVATE_KEY }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+        run: |
+          mkdir -p ~/private_keys
+          echo "$ASC_PRIVATE_KEY" > ~/private_keys/AuthKey_$ASC_KEY_ID.p8
+
+      - name: Inject team ID into ExportOptions.plist
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          /usr/libexec/PlistBuddy -c \
+            "Set :teamID $APPLE_TEAM_ID" \
+            ios/LibNovel/ExportOptions.plist
+
+      - name: Archive
+        run: just ios-archive
+
+      - name: Export IPA
+        run: just ios-export
+
+      - name: Upload to TestFlight
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: just ios-upload
+
+      - name: Upload IPA artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: LibNovel-${{ gitea.ref_name }}.ipa
+          path: ${{ env.RUNNER_TEMP }}/ipa/LibNovel.ipa
+          retention-days: 30
+
+      - name: Cleanup keychain
+        if: always()
+        run: security delete-keychain $RUNNER_TEMP/app-signing.keychain-db

.gitea/workflows/release-ui.yaml

@@ -5,6 +5,10 @@ on:
     tags:
       - "v*"
 
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 defaults:
   run:
     working-directory: ui

ios/LibNovel/ExportOptions.plist

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>method</key>
+	<string>app-store-connect</string>
+	<key>teamID</key>
+	<string>$(DEVELOPMENT_TEAM)</string>
+	<key>uploadBitcode</key>
+	<false/>
+	<key>uploadSymbols</key>
+	<true/>
+	<key>signingStyle</key>
+	<string>manual</string>
+	<key>provisioningProfiles</key>
+	<dict>
+		<key>cc.kalekber.libnovel</key>
+		<string>LibNovel Distribution</string>
+	</dict>
+</dict>
+</plist>

justfile

@@ -147,6 +147,23 @@ ios-export:
         -exportPath {{runner_temp}}/ipa \
         -exportOptionsPlist ExportOptions.plist
 
+# Set the build number (CFBundleVersion) in project.yml before archiving.
+# Usage: just ios-set-build-number 42
+ios-set-build-number number:
+    cd {{ios_dir}} && sed -i '' \
+        's/CURRENT_PROJECT_VERSION: .*/CURRENT_PROJECT_VERSION: {{number}}/' \
+        project.yml
+
+# Upload the exported IPA to TestFlight via App Store Connect API.
+# Requires env vars: ASC_KEY_ID, ASC_ISSUER_ID, ASC_PRIVATE_KEY_PATH
+# The private key (.p8 file) must be present at ASC_PRIVATE_KEY_PATH.
+ios-upload:
+    xcrun altool --upload-app \
+        --type ios \
+        --file {{runner_temp}}/ipa/LibNovel.ipa \
+        --apiKey "$ASC_KEY_ID" \
+        --apiIssuer "$ASC_ISSUER_ID"
+
 # ─── Docker Compose ───────────────────────────────────────────────────────────
 
 # Start all services (browserless, kokoro, scraper, minio, pocketbase)