profiles, signing and release: EAS-style profiles, signing sets, automatic provisioning, extensions, ios release

cmd/builder/release.go

@@ -0,0 +1,171 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/MobAI-App/ios-builder/internal/build"
+	"github.com/MobAI-App/ios-builder/internal/config"
+	"github.com/MobAI-App/ios-builder/internal/release"
+	"github.com/spf13/cobra"
+)
+
+var iosReleaseCmd = &cobra.Command{
+	Use:   "release",
+	Short: "Build, upload to App Store Connect and submit in one command",
+	Long: `Builds the working tree with the next build number, uploads the IPA to App
+Store Connect, waits for processing and hands the build on:
+
+  --testflight   (default) adds it to the named TestFlight groups (--group,
+                 repeatable) with --notes as "What to Test"
+  --app-store    attaches it to the App Store version (--version, or the one
+                 in the project) and submits it for review (--release
+                 manual|after-approval)
+
+The build number is one above the highest CFBundleVersion App Store Connect
+holds for the app, so every release uploads; --build-number overrides it and
+--version sets the marketing version. The app is identified by --bundle-id,
+ios.bundleId in builder.json, or the newest IPA in the output directory.
+
+Needs an App Store Connect API key (builder auth apple) and a builder.json
+profile with "distribution": "store" (--profile, or defaultProfile, or the
+only App Store profile there is), built in Release; builder signing setup
+--distribution store writes the "store" profile.
+Missing STORE signing secrets on GitHub are provisioned first, as ios build
+--profile does.`,
+	Args: cobra.NoArgs,
+	RunE: runIOSRelease,
+}
+
+func init() {
+	f := iosReleaseCmd.Flags()
+	f.Bool("testflight", false, "Distribute to TestFlight (default)")
+	f.Bool("app-store", false, "Submit an App Store version for review")
+	f.StringArray("group", nil, "TestFlight group name to add the build to (repeatable)")
+	f.String("notes", "", "What to Test notes for the build")
+	f.String("release", "", "App Store release: manual or after-approval")
+	f.String("version", "", "Marketing version to build and submit (default: the project's)")
+	f.String("build-number", "", "CFBundleVersion to build (default: one above the highest in App Store Connect)")
+	f.String("bundle-id", "", "App bundle ID (default: ios.bundleId in builder.json, then the newest IPA in the output directory)")
+	f.Bool("no-encryption", false, "Declare the app uses no non-exempt encryption (export compliance)")
+	f.StringP("output", "o", "dist", "Output directory for the IPA")
+	f.StringP("remote", "r", "origin", "Git remote to push the working-tree snapshot to")
+	f.String("provider", "", "Override CI provider (default github or builder.json provider)")
+	f.String("profile", "", "App Store build profile from builder.json, distribution store (default: defaultProfile)")
+	f.Duration("timeout", 30*time.Minute, "Time limit for the build, and again for App Store Connect processing")
+	f.Bool("json", false, "Print the result as JSON (progress goes to stderr)")
+	iosCmd.AddCommand(iosReleaseCmd)
+}
+
+func runIOSRelease(cmd *cobra.Command, _ []string) error {
+	testflight, _ := cmd.Flags().GetBool("testflight")
+	appStore, _ := cmd.Flags().GetBool("app-store")
+	if testflight && appStore {
+		return fmt.Errorf("pass only one of --testflight or --app-store")
+	}
+	releaseFlag, _ := cmd.Flags().GetString("release")
+	releaseType, err := parseReleaseType(releaseFlag)
+	if err != nil {
+		return err
+	}
+	cfg, err := loadConfig()
+	if err != nil {
+		return err
+	}
+	if err := cfg.Validate(); err != nil {
+		return fmt.Errorf("invalid configuration: %w", err)
+	}
+	bo, err := buildOptionsFromFlags(cmd, cfg)
+	if err != nil {
+		return err
+	}
+	opts := &release.Options{Build: bo, AppStore: appStore, ReleaseType: releaseType}
+	opts.BundleID, _ = cmd.Flags().GetString("bundle-id")
+	opts.BuildNumber, _ = cmd.Flags().GetString("build-number")
+	opts.Version, _ = cmd.Flags().GetString("version")
+	opts.Groups, _ = cmd.Flags().GetStringArray("group")
+	opts.Notes, _ = cmd.Flags().GetString("notes")
+	opts.NoEncryption, _ = cmd.Flags().GetBool("no-encryption")
+	return runRelease(cmd, cfg, opts)
+}
+
+// releaseError keeps a build deadline out of finish, which reads every
+// DeadlineExceeded as the App Store Connect wait and claims processing continues.
+func releaseError(res *release.Result, err error, timeout time.Duration) error {
+	if errors.Is(err, context.DeadlineExceeded) && (res == nil || res.IPAPath == "") {
+		return fmt.Errorf("the build did not finish within %s; raise --timeout (%v)", timeout, err)
+	}
+	return err
+}
+
+// buildOptionsFromFlags reads the flags `ios build` and `ios release` share;
+// Provider is resolved as the coordinator will, so the GitHub client agrees.
+func buildOptionsFromFlags(cmd *cobra.Command, cfg *config.Config) (build.BuildOptions, error) {
+	var opts build.BuildOptions
+	opts.OutputDir, _ = cmd.Flags().GetString("output")
+	opts.Timeout, _ = cmd.Flags().GetDuration("timeout")
+	opts.Remote, _ = cmd.Flags().GetString("remote")
+	opts.Profile, _ = cmd.Flags().GetString("profile")
+	providerFlag, _ := cmd.Flags().GetString("provider")
+	provider, err := effectiveProvider(cfg, opts.Profile, providerFlag)
+	if err != nil {
+		return opts, err
+	}
+	opts.Provider = provider
+	return opts, nil
+}
+
+// runRelease is the flow behind `ios release` and `ios build --submit`: API
+// key, App Store profile and (on GitHub) the STORE signing set are settled
+// before anything is pushed.
+func runRelease(cmd *cobra.Command, cfg *config.Config, opts *release.Options) error {
+	client, err := getASCClient()
+	if err != nil {
+		return err
+	}
+	out := newOutput(cmd)
+	opts.Log = out.log
+	// Preflight may pick the only store profile; the build, the provider and
+	// the signing set below must all follow that choice.
+	opts.Build.Profile, err = release.Preflight(cfg, opts.Build.Profile, out.log)
+	if err != nil {
+		return err
+	}
+	providerFlag, _ := cmd.Flags().GetString("provider")
+	opts.Build.Provider, err = effectiveProvider(cfg, opts.Build.Profile, providerFlag)
+	if err != nil {
+		return err
+	}
+	ghClient, err := clientForProvider(cfg, opts.Build.Provider)
+	if err != nil {
+		return err
+	}
+	ctx, cancel := commandContext(cmd, false)
+	defer cancel()
+
+	if ghClient != nil {
+		if err := ensureSigningSecrets(ctx, cfg, ghClient, getASCClient, opts.Build.Profile, opts.Build.Provider, out.log); err != nil {
+			return err
+		}
+	}
+	coordinator := build.NewCoordinatorWithOutput(cfg, ghClient, out.log)
+	res, err := release.Run(ctx, cfg, coordinator, client, opts)
+	err = releaseError(res, err, opts.Build.Timeout)
+	return finish(out, cmd, res, err, func() {
+		fmt.Println()
+		fmt.Printf("IPA:          %s\n", res.IPAPath)
+		fmt.Printf("Build number: %s (version %s)\n", res.BuildNumber, res.Version)
+		fmt.Printf("ASC build:    %s\n", res.ASCBuildID)
+		if len(res.Groups) > 0 {
+			names := make([]string, 0, len(res.Groups))
+			for _, g := range res.Groups {
+				names = append(names, g.Name)
+			}
+			fmt.Printf("Groups:       %s\n", strings.Join(names, ", "))
+		}
+		fmt.Printf("Link:         %s\n", res.Link)
+	})
+}

cmd/builder/release_test.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/MobAI-App/ios-builder/internal/release"
+)
+
+func TestReleaseErrorTellsBuildTimeoutFromASCWait(t *testing.T) {
+	deadline := fmt.Errorf("build failed: %w", context.DeadlineExceeded)
+	err := releaseError(&release.Result{BuildNumber: "3"}, deadline, 5*time.Minute)
+	if errors.Is(err, context.DeadlineExceeded) || !strings.Contains(err.Error(), "did not finish within 5m0s") {
+		t.Errorf("build deadline = %v", err)
+	}
+	// After the IPA exists the deadline is the App Store Connect wait; finish explains that one.
+	if err := releaseError(&release.Result{IPAPath: "dist/app.ipa"}, deadline, time.Minute); !errors.Is(err, context.DeadlineExceeded) {
+		t.Errorf("ASC deadline = %v", err)
+	}
+	other := errors.New("runner exploded")
+	if err := releaseError(nil, other, time.Minute); err != other {
+		t.Errorf("other error = %v", err)
+	}
+}

cmd/builder/root.go

@@ -20,6 +20,7 @@ import (
 	"github.com/MobAI-App/ios-builder/internal/build"
 	"github.com/MobAI-App/ios-builder/internal/config"
 	"github.com/MobAI-App/ios-builder/internal/github"
+	"github.com/MobAI-App/ios-builder/internal/release"
 	"github.com/MobAI-App/ios-builder/internal/update"
 	"github.com/MobAI-App/ios-builder/internal/workflow"
 	"github.com/manifoldco/promptui"
@@ -250,6 +251,44 @@ func detectIOSPath() (string, string) {
 	return "", ""
 }
 
+// bundleIDRe matches PRODUCT_BUNDLE_IDENTIFIER assignments in a project.pbxproj.
+var bundleIDRe = regexp.MustCompile(`PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?\s*;`)
+
+// detectBundleID reads the app's bundle identifier from the Xcode project
+// under iosPath, skipping test targets and $(…) values. Anything still
+// ambiguous yields "" so init leaves the field for `signing setup` to resolve.
+func detectBundleID(iosPath string) string {
+	if iosPath == "" {
+		iosPath = "."
+	}
+	projects, _ := filepath.Glob(filepath.Join(iosPath, "*.xcodeproj", "project.pbxproj"))
+	var found []string
+	for _, path := range projects {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		found = append(found, bundleIDsFromPbxproj(string(data))...)
+	}
+	if len(found) == 1 {
+		return found[0]
+	}
+	return ""
+}
+
+// bundleIDsFromPbxproj returns the distinct app bundle identifiers in pbxproj text.
+func bundleIDsFromPbxproj(text string) []string {
+	var ids []string
+	for _, m := range bundleIDRe.FindAllStringSubmatch(text, -1) {
+		id := m[1]
+		if strings.Contains(id, "$") || strings.HasSuffix(id, "Tests") || slices.Contains(ids, id) {
+			continue
+		}
+		ids = append(ids, id)
+	}
+	return ids
+}
+
 func detectGitHubRepo(remoteName string) (owner, repo string, err error) {
 	// Try to get GitHub remote URL from git
 	cmd := exec.Command("git", "remote", "get-url", remoteName)
@@ -432,6 +471,10 @@ func runInit(cmd *cobra.Command, args []string) error {
 	cfg.Project, cfg.Platform = projectName, "ios"
 	cfg.GitHub = config.GitHubConfig{Owner: githubOwner, Repo: repoName}
 	cfg.IOS.Path, cfg.IOS.Scheme = iosPath, scheme
+	if cfg.IOS.BundleID == "" {
+		cfg.IOS.BundleID = detectBundleID(iosPath)
+	}
+	syncExtensions(cfg, os.Stdout)
 	if flutterVersion != "" {
 		cfg.Flutter.Version = flutterVersion
 	}
@@ -506,7 +549,7 @@ func runInit(cmd *cobra.Command, args []string) error {
 
 	if buildErr == nil {
 		fmt.Println()
-		return runBuild(context.Background(), cfg, build.BuildOptions{
+		return runBuild(context.Background(), cfg, &build.BuildOptions{
 			OutputDir: "dist",
 			Timeout:   build.DefaultTimeout,
 			Remote:    remoteName,
@@ -587,6 +630,8 @@ func init() {
 	iosBuildCmd.Flags().Bool("unsigned", false, "Build unsigned IPA (skip code signing even if configured)")
 	iosBuildCmd.Flags().StringP("remote", "r", "origin", "Git remote to push the working-tree snapshot to")
 	iosBuildCmd.Flags().String("provider", "", "Override CI provider (default github or builder.json provider)")
+	iosBuildCmd.Flags().String("profile", "", "Build profile from builder.json (default: defaultProfile, else the top-level ios settings)")
+	iosBuildCmd.Flags().Bool("submit", false, "Also upload to App Store Connect and process for TestFlight (short for: ios release)")
 	iosCmd.AddCommand(iosBuildCmd)
 
 	// iOS share command flags
@@ -596,6 +641,20 @@ func init() {
 	iosCmd.AddCommand(iosShareCmd)
 }
 
+// effectiveProvider is the --provider flag, else the selected profile's
+// provider, else builder.json's. The coordinator resolves the same chain; this
+// exists so the GitHub client and signal handling agree with it.
+func effectiveProvider(cfg *config.Config, profile, flag string) (string, error) {
+	if flag != "" {
+		return flag, nil
+	}
+	s, err := cfg.ResolveProfile(profile)
+	if err != nil {
+		return "", err
+	}
+	return s.Provider, nil
+}
+
 func runIOSBuild(cmd *cobra.Command, args []string) error {
 	cfg, err := loadConfig()
 	if err != nil {
@@ -606,18 +665,25 @@ func runIOSBuild(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid configuration: %w", err)
 	}
 
-	outputDir, _ := cmd.Flags().GetString("output")
-	timeout, _ := cmd.Flags().GetDuration("timeout")
-	unsigned, _ := cmd.Flags().GetBool("unsigned")
-	remote, _ := cmd.Flags().GetString("remote")
-	provider, _ := cmd.Flags().GetString("provider")
+	opts, err := buildOptionsFromFlags(cmd, cfg)
+	if err != nil {
+		return err
+	}
+	opts.Unsigned, _ = cmd.Flags().GetBool("unsigned")
+	submit, _ := cmd.Flags().GetBool("submit")
+	if submit {
+		if opts.Unsigned {
+			return fmt.Errorf("--submit uploads to App Store Connect, which needs a signed build; drop --unsigned")
+		}
+		return runRelease(cmd, cfg, &release.Options{Build: opts})
+	}
 
 	ctx := cmd.Context()
 	if ctx == nil {
 		ctx = context.Background()
 	}
 
-	name, err := cfg.ProviderName(provider)
+	name, err := cfg.ProviderName(opts.Provider)
 	if err != nil {
 		return err
 	}
@@ -626,13 +692,7 @@ func runIOSBuild(cmd *cobra.Command, args []string) error {
 		ctx, stop = signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
 		defer stop()
 	}
-	return runBuild(ctx, cfg, build.BuildOptions{
-		Provider:  provider,
-		OutputDir: outputDir,
-		Timeout:   timeout,
-		Unsigned:  unsigned,
-		Remote:    remote,
-	})
+	return runBuild(ctx, cfg, &opts)
 }
 
 func runIOSShare(cmd *cobra.Command, args []string) error {
@@ -646,6 +706,8 @@ func runIOSShare(cmd *cobra.Command, args []string) error {
 
 	duration, _ := cmd.Flags().GetDuration("duration")
 	remote, _ := cmd.Flags().GetString("remote")
+	// A simulator build takes no profile, so the provider is the flag, else
+	// builder.json's.
 	provider, _ := cmd.Flags().GetString("provider")
 
 	ctx := cmd.Context()
@@ -688,11 +750,18 @@ func runIOSShare(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-func runBuild(ctx context.Context, cfg *config.Config, opts build.BuildOptions) error {
+func runBuild(ctx context.Context, cfg *config.Config, opts *build.BuildOptions) error {
 	ghClient, err := clientForProvider(cfg, opts.Provider)
 	if err != nil {
 		return err
 	}
+	// A GitHub build with a distribution needs its signing set in the
+	// repository; ensureSigningSecrets leaves Codemagic and Bitrise alone.
+	if ghClient != nil && !opts.Unsigned {
+		if err := ensureSigningSecrets(ctx, cfg, ghClient, getASCClient, opts.Profile, opts.Provider, os.Stdout); err != nil {
+			return err
+		}
+	}
 
 	coordinator := build.NewCoordinator(cfg, ghClient)