build-ios.yml

name: Build iOS

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string
      build_type:
        required: true
        type: string
      installer_base_name:
        required: true
        type: string

jobs:
  build-ios:
    permissions:
      contents: "read"
      id-token: "write"
    env:
      BUILD_TYPE: ${{ inputs.build_type }}
      VERSION: ${{ inputs.version }}
    runs-on: macos-26
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Download pubspec.yaml
        uses: actions/download-artifact@v4
        with:
          name: pubspec

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Install Flutter
        uses: subosito/flutter-action@v2.22.0
        with:
          channel: stable
          flutter-version-file: .github/flutter-version.yaml
          cache: true

      - name: Cache Flutter dependencies
        uses: actions/cache@v4
        timeout-minutes: 5
        continue-on-error: true
        with:
          path: |
            ~/.pub-cache
          key: ${{ runner.os }}-flutter-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-flutter-    

      - name: Cache iOS CocoaPods
        uses: actions/cache@v4
        timeout-minutes: 10
        continue-on-error: true
        with:
          path: |
            ios/Pods
          key: ${{ runner.os }}-ios-pods-${{ hashFiles('ios/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-ios-pods-      

      - name: Decode APP_ENV
        uses: timheuer/base64-to-file@v1.2
        with:
          fileName: "app.env"
          fileDir: ${{ github.workspace }}
          encodedString: ${{ secrets.APP_ENV }}

      - name: Install the Apple certificate and provisioning profile IOS
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.IOS_CERTIFICATE_P12_BASE64 }}
          P12_PASSWORD: ${{ secrets.IOS_CERTIFICATE_P12_PASS }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_PROVISION_PROFILE_BASE64 }}
          BUILD_TUNNEL_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_TUNNEL_PROVISION_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          EXPORT_OPTIONS: ${{ secrets.EXPORT_OPTION_PLIST }}
        run: |
          set -x
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
          TPP_PATH=$RUNNER_TEMP/build_tpp.mobileprovision
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          EXPORT_OPTIONS_PATH=$GITHUB_WORKSPACE/ExportOptions.plist
          # import certificate from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          PROVISIONING_PROFILES_DIR=~/Library/MobileDevice/Provisioning\ Profiles
          mkdir -p "$PROVISIONING_PROFILES_DIR"

          # apply main provisioning profile
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH
          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

          # apply tunnel provisioning profile
          echo -n "$BUILD_TUNNEL_PROVISION_PROFILE_BASE64" | base64 --decode -o $TPP_PATH
          cp $TPP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

          # Create ExportOptions.plist
          echo "$EXPORT_OPTIONS" | base64 --decode > "$EXPORT_OPTIONS_PATH"

      - name: Set gomobile cache dir
        shell: bash
        run: |
          echo "GOMOBILECACHE=$HOME/.cache/gomobile" >> "$GITHUB_ENV"
          mkdir -p "$HOME/.cache/gomobile"

      - name: Cache gomobile
        uses: actions/cache@v4
        timeout-minutes: 10
        continue-on-error: true
        with:
          path: ~/.cache/gomobile
          key: ${{ runner.os }}-gomobile-${{ hashFiles('**/go.mod', '**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-gomobile-

      - name: Install dependencies
        run: make install-gomobile
        env:
          GOMOBILECACHE: ${{ env.GOMOBILECACHE }}

      - name: Build iOS release
        run: make ios-release
        env:
          BUILD_TYPE: ${{ inputs.build_type }}
          VERSION: ${{ inputs.version }}
          INSTALLER_NAME: ${{ inputs.installer_base_name }}
          GOMOBILECACHE: ${{ env.GOMOBILECACHE }}

      - name: Upload application
        uses: actions/upload-artifact@v4
        with:
          name: lantern-installer-ipa
          path: ${{ inputs.installer_base_name }}${{ inputs.build_type != 'production' && format('-{0}', inputs.build_type) || '' }}.ipa
          retention-days: 2