profiles and signing: EAS-style build profiles, one secret set per distribution, automatic provisioning

cmd/builder/root.go

@@ -250,6 +250,44 @@ func detectIOSPath() (string, string) {
 	return "", ""
 }
 
+// bundleIDRe matches PRODUCT_BUNDLE_IDENTIFIER assignments in a project.pbxproj.
+var bundleIDRe = regexp.MustCompile(`PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";\s]+)"?\s*;`)
+
+// detectBundleID reads the app's bundle identifier from the Xcode project
+// under iosPath, skipping test targets and $(…) values. Anything still
+// ambiguous yields "" so init leaves the field for `signing setup` to resolve.
+func detectBundleID(iosPath string) string {
+	if iosPath == "" {
+		iosPath = "."
+	}
+	projects, _ := filepath.Glob(filepath.Join(iosPath, "*.xcodeproj", "project.pbxproj"))
+	var found []string
+	for _, path := range projects {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		found = append(found, bundleIDsFromPbxproj(string(data))...)
+	}
+	if len(found) == 1 {
+		return found[0]
+	}
+	return ""
+}
+
+// bundleIDsFromPbxproj returns the distinct app bundle identifiers in pbxproj text.
+func bundleIDsFromPbxproj(text string) []string {
+	var ids []string
+	for _, m := range bundleIDRe.FindAllStringSubmatch(text, -1) {
+		id := m[1]
+		if strings.Contains(id, "$") || strings.HasSuffix(id, "Tests") || slices.Contains(ids, id) {
+			continue
+		}
+		ids = append(ids, id)
+	}
+	return ids
+}
+
 func detectGitHubRepo(remoteName string) (owner, repo string, err error) {
 	// Try to get GitHub remote URL from git
 	cmd := exec.Command("git", "remote", "get-url", remoteName)
@@ -432,6 +470,10 @@ func runInit(cmd *cobra.Command, args []string) error {
 	cfg.Project, cfg.Platform = projectName, "ios"
 	cfg.GitHub = config.GitHubConfig{Owner: githubOwner, Repo: repoName}
 	cfg.IOS.Path, cfg.IOS.Scheme = iosPath, scheme
+	if cfg.IOS.BundleID == "" {
+		cfg.IOS.BundleID = detectBundleID(iosPath)
+	}
+	syncExtensions(cfg, os.Stdout)
 	if flutterVersion != "" {
 		cfg.Flutter.Version = flutterVersion
 	}
@@ -506,7 +548,7 @@ func runInit(cmd *cobra.Command, args []string) error {
 
 	if buildErr == nil {
 		fmt.Println()
-		return runBuild(context.Background(), cfg, build.BuildOptions{
+		return runBuild(context.Background(), cfg, &build.BuildOptions{
 			OutputDir: "dist",
 			Timeout:   build.DefaultTimeout,
 			Remote:    remoteName,
@@ -587,6 +629,7 @@ func init() {
 	iosBuildCmd.Flags().Bool("unsigned", false, "Build unsigned IPA (skip code signing even if configured)")
 	iosBuildCmd.Flags().StringP("remote", "r", "origin", "Git remote to push the working-tree snapshot to")
 	iosBuildCmd.Flags().String("provider", "", "Override CI provider (default github or builder.json provider)")
+	iosBuildCmd.Flags().String("profile", "", "Build profile from builder.json (default: defaultProfile, else the top-level ios settings)")
 	iosCmd.AddCommand(iosBuildCmd)
 
 	// iOS share command flags
@@ -596,6 +639,20 @@ func init() {
 	iosCmd.AddCommand(iosShareCmd)
 }
 
+// effectiveProvider is the --provider flag, else the selected profile's
+// provider, else builder.json's. The coordinator resolves the same chain; this
+// exists so the GitHub client and signal handling agree with it.
+func effectiveProvider(cfg *config.Config, profile, flag string) (string, error) {
+	if flag != "" {
+		return flag, nil
+	}
+	s, err := cfg.ResolveProfile(profile)
+	if err != nil {
+		return "", err
+	}
+	return s.Provider, nil
+}
+
 func runIOSBuild(cmd *cobra.Command, args []string) error {
 	cfg, err := loadConfig()
 	if err != nil {
@@ -610,13 +667,18 @@ func runIOSBuild(cmd *cobra.Command, args []string) error {
 	timeout, _ := cmd.Flags().GetDuration("timeout")
 	unsigned, _ := cmd.Flags().GetBool("unsigned")
 	remote, _ := cmd.Flags().GetString("remote")
-	provider, _ := cmd.Flags().GetString("provider")
+	providerFlag, _ := cmd.Flags().GetString("provider")
+	profile, _ := cmd.Flags().GetString("profile")
 
 	ctx := cmd.Context()
 	if ctx == nil {
 		ctx = context.Background()
 	}
 
+	provider, err := effectiveProvider(cfg, profile, providerFlag)
+	if err != nil {
+		return err
+	}
 	name, err := cfg.ProviderName(provider)
 	if err != nil {
 		return err
@@ -626,8 +688,9 @@ func runIOSBuild(cmd *cobra.Command, args []string) error {
 		ctx, stop = signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
 		defer stop()
 	}
-	return runBuild(ctx, cfg, build.BuildOptions{
+	return runBuild(ctx, cfg, &build.BuildOptions{
 		Provider:  provider,
+		Profile:   profile,
 		OutputDir: outputDir,
 		Timeout:   timeout,
 		Unsigned:  unsigned,
@@ -646,6 +709,8 @@ func runIOSShare(cmd *cobra.Command, args []string) error {
 
 	duration, _ := cmd.Flags().GetDuration("duration")
 	remote, _ := cmd.Flags().GetString("remote")
+	// A simulator build takes no profile, so the provider is the flag, else
+	// builder.json's.
 	provider, _ := cmd.Flags().GetString("provider")
 
 	ctx := cmd.Context()
@@ -688,11 +753,18 @@ func runIOSShare(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-func runBuild(ctx context.Context, cfg *config.Config, opts build.BuildOptions) error {
+func runBuild(ctx context.Context, cfg *config.Config, opts *build.BuildOptions) error {
 	ghClient, err := clientForProvider(cfg, opts.Provider)
 	if err != nil {
 		return err
 	}
+	// A GitHub build with a distribution needs its signing set in the
+	// repository; ensureSigningSecrets leaves Codemagic and Bitrise alone.
+	if ghClient != nil && !opts.Unsigned {
+		if err := ensureSigningSecrets(ctx, cfg, ghClient, getASCClient, opts.Profile, opts.Provider, os.Stdout); err != nil {
+			return err
+		}
+	}
 
 	coordinator := build.NewCoordinator(cfg, ghClient)
 

cmd/builder/root_test.go

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+const flutterPbxproj = `
+		97C147061CF9000F007C117D /* Debug */ = {
+			buildSettings = {
+				PRODUCT_BUNDLE_IDENTIFIER = com.example.myApp;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+			};
+		};
+		97C147071CF9000F007C117D /* Release */ = {
+			buildSettings = {
+				PRODUCT_BUNDLE_IDENTIFIER = com.example.myApp;
+			};
+		};
+		331C8088294A63A400263BE5 /* Debug */ = {
+			buildSettings = {
+				PRODUCT_BUNDLE_IDENTIFIER = com.example.myApp.RunnerTests;
+			};
+		};
+`
+
+func TestBundleIDsFromPbxproj(t *testing.T) {
+	if got := bundleIDsFromPbxproj(flutterPbxproj); len(got) != 1 || got[0] != "com.example.myApp" {
+		t.Errorf("bundleIDsFromPbxproj = %v, want [com.example.myApp]", got)
+	}
+	quoted := `PRODUCT_BUNDLE_IDENTIFIER = "com.example.my-app"; PRODUCT_BUNDLE_IDENTIFIER = "$(BUNDLE_ID_PREFIX).app";`
+	if got := bundleIDsFromPbxproj(quoted); len(got) != 1 || got[0] != "com.example.my-app" {
+		t.Errorf("bundleIDsFromPbxproj(quoted) = %v", got)
+	}
+	two := `PRODUCT_BUNDLE_IDENTIFIER = com.example.free; PRODUCT_BUNDLE_IDENTIFIER = com.example.pro;`
+	if got := bundleIDsFromPbxproj(two); len(got) != 2 {
+		t.Errorf("bundleIDsFromPbxproj(two apps) = %v", got)
+	}
+}
+
+func TestDetectBundleID(t *testing.T) {
+	dir := t.TempDir()
+	proj := filepath.Join(dir, "ios", "Runner.xcodeproj")
+	if err := os.MkdirAll(proj, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(proj, "project.pbxproj"), []byte(flutterPbxproj), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if got := detectBundleID(filepath.Join(dir, "ios")); got != "com.example.myApp" {
+		t.Errorf("detectBundleID = %q", got)
+	}
+	if got := detectBundleID(filepath.Join(dir, "missing")); got != "" {
+		t.Errorf("detectBundleID(missing) = %q, want empty", got)
+	}
+	// Two app targets: ambiguous, leave it to signing setup.
+	two := filepath.Join(dir, "two", "App.xcodeproj")
+	if err := os.MkdirAll(two, 0755); err != nil {
+		t.Fatal(err)
+	}
+	_ = os.WriteFile(filepath.Join(two, "project.pbxproj"), []byte(`PRODUCT_BUNDLE_IDENTIFIER = com.example.free; PRODUCT_BUNDLE_IDENTIFIER = com.example.pro;`), 0644)
+	if got := detectBundleID(filepath.Join(dir, "two")); got != "" {
+		t.Errorf("detectBundleID(two apps) = %q, want empty", got)
+	}
+}