ci(ios): sign the release with fastlane so TestFlight uploads from a device-less runner

.github/workflows/native-release.yml

@@ -34,7 +34,10 @@ concurrency:
 
 jobs:
   android:
-    if: github.repository == 'liketrek/TREK'
+    # Gated on a repository variable so the release can ship iOS alone while the
+    # Google Play account and its signing secrets are not yet in place. Set the
+    # repository variable NATIVE_RELEASE_ANDROID to 1 to turn the Android half on.
+    if: github.repository == 'liketrek/TREK' && vars.NATIVE_RELEASE_ANDROID == '1'
     runs-on: ubuntu-24.04
     timeout-minutes: 40
     environment: store
@@ -148,43 +151,23 @@ jobs:
           ASC_KEY_P8_B64: ${{ secrets.ASC_KEY_P8_B64 }}
         run: printf '%s' "$ASC_KEY_P8_B64" | base64 -d > "$RUNNER_TEMP/AuthKey.p8"
 
-      - name: Archive
-        working-directory: client/ios/App
+      # Signs for distribution and uploads to TestFlight. Automatic signing cannot
+      # run on a device-less CI runner (it signs for development and then needs a
+      # development profile, which needs a registered device), so client/fastlane/Fastfile
+      # signs manually: it creates or reuses the distribution certificate and the App
+      # Store profile through the API key, so neither has to be stored as a secret.
+      - name: Build and upload to TestFlight
+        working-directory: client
         env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: >-
-          xcodebuild archive
-          -project App.xcodeproj
-          -scheme App
-          -configuration Release
-          -destination 'generic/platform=iOS'
-          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
-          MARKETING_VERSION=${{ steps.version.outputs.version }}
-          CURRENT_PROJECT_VERSION=${{ steps.version.outputs.build }}
-          DEVELOPMENT_TEAM="$APPLE_TEAM_ID"
-          -allowProvisioningUpdates
-          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
-          -authenticationKeyID "$ASC_KEY_ID"
-          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
-
-      # ExportOptions.plist says destination=upload, so this step sends the build
-      # to App Store Connect, where it shows up in TestFlight after processing.
-      - name: Export and upload to App Store Connect
-        working-directory: client/ios/App
-        env:
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
-        run: >-
-          xcodebuild -exportArchive
-          -archivePath "$RUNNER_TEMP/TREK.xcarchive"
-          -exportOptionsPlist ../ExportOptions.plist
-          -exportPath "$RUNNER_TEMP/export"
-          -allowProvisioningUpdates
-          -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8"
-          -authenticationKeyID "$ASC_KEY_ID"
-          -authenticationKeyIssuerID "$ASC_ISSUER_ID"
+          MARKETING_VERSION: ${{ steps.version.outputs.version }}
+          CURRENT_PROJECT_VERSION: ${{ steps.version.outputs.build }}
+          FASTLANE_SKIP_UPDATE_CHECK: '1'
+          FASTLANE_HIDE_CHANGELOG: '1'
+        run: fastlane ios beta
 
       - name: Remove the API key
         if: always()

client/fastlane/Fastfile

@@ -0,0 +1,78 @@
+# iOS release signing and TestFlight upload, driven by .github/workflows/native-release.yml.
+#
+# Automatic signing cannot work on a CI runner with no registered devices: it signs
+# the archive for development and then needs a development provisioning profile, which
+# requires a device. So this signs manually for distribution instead. The distribution
+# certificate and the App Store provisioning profile are created (or reused) through the
+# App Store Connect API key, which means no certificate or profile has to be stored as a
+# secret: the key the workflow already holds is enough.
+#
+# The lane expects these in the environment (the workflow sets them):
+#   ASC_KEY_ID, ASC_ISSUER_ID, ASC_KEY_PATH  — the App Store Connect API key
+#   APPLE_TEAM_ID                            — the developer team
+#   MARKETING_VERSION, CURRENT_PROJECT_VERSION — the version and build number
+#   RUNNER_TEMP                              — a writable scratch directory
+
+default_platform(:ios)
+
+APP_IDENTIFIER = "com.liketrek.trek"
+PROJECT = "ios/App/App.xcodeproj"
+
+platform :ios do
+  desc "Build the signed Release app and upload it to TestFlight (internal testing)."
+  lane :beta do
+    key = app_store_connect_api_key(
+      key_id: ENV.fetch("ASC_KEY_ID"),
+      issuer_id: ENV.fetch("ASC_ISSUER_ID"),
+      key_filepath: ENV.fetch("ASC_KEY_PATH"),
+      in_house: false,
+    )
+
+    # A throwaway keychain, so the certificate's private key lives only for this run.
+    setup_ci
+
+    # Distribution certificate into the keychain, and an App Store profile that trusts it.
+    get_certificates(api_key: key, development: false)
+    get_provisioning_profile(
+      api_key: key,
+      app_identifier: APP_IDENTIFIER,
+      development: false,
+    )
+
+    # Pin the project to that profile for this build; automatic signing stays the default
+    # a developer sees when they open the project in Xcode.
+    update_code_signing_settings(
+      path: PROJECT,
+      use_automatic_signing: false,
+      team_id: ENV.fetch("APPLE_TEAM_ID"),
+      code_sign_identity: "Apple Distribution",
+      bundle_identifier: APP_IDENTIFIER,
+      profile_name: lane_context[SharedValues::SIGH_NAME],
+      targets: ["App"],
+    )
+
+    build_app(
+      project: PROJECT,
+      scheme: "App",
+      configuration: "Release",
+      export_method: "app-store",
+      output_directory: File.join(ENV.fetch("RUNNER_TEMP"), "export"),
+      xcargs: [
+        "MARKETING_VERSION=#{ENV.fetch('MARKETING_VERSION')}",
+        "CURRENT_PROJECT_VERSION=#{ENV.fetch('CURRENT_PROJECT_VERSION')}",
+      ].join(" "),
+      export_options: {
+        signingStyle: "manual",
+        provisioningProfiles: { APP_IDENTIFIER => lane_context[SharedValues::SIGH_NAME] },
+      },
+    )
+
+    # Upload to App Store Connect; it shows up in TestFlight after Apple finishes processing.
+    # Internal testing needs no App Review, so nothing here submits the app for review.
+    upload_to_testflight(
+      api_key: key,
+      skip_waiting_for_build_processing: true,
+      skip_submission: true,
+    )
+  end
+end