Consume release tooling from convos-releases

Lanes, ruby env, and CI job bodies move to xmtplabs/convos-releases.
This repo keeps stub Fastfile + Appfile/Matchfile/Pluginfile, thin
caller workflows, and the xcode devshell consuming the flake input.

Author: insipx

.github/workflows/firebase-pr.yml

@@ -1,31 +1,10 @@
-# Firebase PR Build
+# Firebase PR Build — thin caller. The job lives in convos-releases:
+# https://github.com/xmtplabs/convos-releases/blob/main/.github/workflows/ios-firebase-pr.yml
 #
-# Builds the Convos (PR Preview) scheme ad-hoc on every PR and uploads
-# the IPA to Firebase App Distribution so testers can install the change
-# directly from the Firebase tester app, with a separate bundle id
-# (org.convos.ios-preview.pr) so it doesn't collide with TestFlight Dev.
-#
-# Required repository secrets:
-#   CONVOS_CERTIFICATES_TOKEN     - GitHub PAT with read access to
-#                                   xmtplabs/convos-certificates
-#   MATCH_PASSWORD                - Passphrase for the match repo encryption
-#   FIREBASE_SERVICE_ACCOUNT_JSON - Full JSON contents of a service account
-#                                   with the App Distribution Admin role
-#   CACHIX_AUTH_TOKEN             - Auth token for the xmtp Cachix cache
-#                                   (required if the cache is private)
-#
-# Optional repository secret:
-#   SENTRY_DSN_DEV                - Sentry DSN baked into dev/PR builds;
-#                                   Sentry is disabled when unset
-#
-# Required repository variables:
-#   FIREBASE_APP_ID_PR            - Firebase iOS app id (1:NNN:ios:HEX) for
-#                                   org.convos.ios-preview.pr
-#
-# Optional repository variable:
-#   FIREBASE_TESTER_GROUPS        - Comma-separated tester group aliases.
-#                                   Defaults to "xmtp-internal".
-
+# Required repository secrets (passed via `secrets: inherit`):
+#   CONVOS_CERTIFICATES_TOKEN, MATCH_PASSWORD, FIREBASE_SERVICE_ACCOUNT_JSON,
+#   CACHIX_AUTH_TOKEN; optional POSTHOG_API_KEY_DEV, SENTRY_DSN_DEV.
+# Required repository variable: FIREBASE_APP_ID_PR.
 name: Firebase PR Build
 
 on:
@@ -42,114 +21,23 @@ concurrency:
 
 jobs:
   firebase_pr:
-    name: Build & upload to Firebase App Distribution
     # On `labeled`, only run when the `adhoc-build` label is the one being
     # added — otherwise unrelated labels (bug, wip, etc.) would also fire.
     if: github.event.action != 'labeled' || github.event.label.name == 'adhoc-build'
-    runs-on: warp-macos-latest-arm64-12x
-    timeout-minutes: 25
+    # Callers must grant what the reusable workflow's job declares — a called
+    # workflow can't elevate beyond the caller's grant.
     permissions:
       id-token: write
       contents: read
-    env:
+    uses: xmtplabs/convos-releases/.github/workflows/ios-firebase-pr.yml@main
+    with:
+      runner: warp-macos-latest-arm64-12x
       # Bump both together when Xcode upgrades; the hash is from
       # `nix store add /Applications/Xcode_NN.N.app`.
-      XCODE_APP_PATH: /Applications/Xcode_26.3.app
-      XCODE_NIX_PATH: /nix/store/x9hdz5mfp44i9b05sswp271jdv68r8vx-Xcode.app
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Checkout convos-certificates (match repo)
-        uses: actions/checkout@v6
-        with:
-          repository: xmtplabs/convos-certificates
-          token: ${{ secrets.CONVOS_CERTIFICATES_TOKEN }}
-          path: convos-certificates
-          persist-credentials: false
-
-      - name: Install Nix
-        uses: nixbuild/nix-quick-install-action@v33
-        with:
-          nix_conf: |
-            experimental-features = nix-command flakes
-
-      - name: Pin Xcode into /nix/store
-        uses: xmtplabs/xmtp-cache-apple@v1
-        with:
-          xcode-path: ${{ env.XCODE_APP_PATH }}
-          xcode-nix-path: ${{ env.XCODE_NIX_PATH }}
-
-      # Action installs cachix + substituter; push happens manually after
-      # the build so we can exclude Xcode's closure (EULA + 11 GiB).
-      - name: Set up xmtp Cachix cache
-        uses: cachix/cachix-action@v15
-        with:
-          name: xmtp
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          skipPush: true
-
-      - name: Snapshot pre-build store paths
-        run: nix path-info --all | sort > /tmp/store-paths-before
-
-      - name: Enter dev shell
-        uses: nicknovitski/nix-develop@v1
-        with:
-          arguments: "--accept-flake-config --impure"
-
-      - name: Verify Xcode
-        run: xcodebuild -version
-
-      # PR builds reuse Dev backend (config.pr.json), so empty env is fine.
-      - name: Generate Secrets.swift
-        env:
-          BUILD_CONFIGURATION: Dev
-          POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY_DEV }}
-          SENTRY_DSN_DEV: ${{ secrets.SENTRY_DSN_DEV }}
-        run: ./Scripts/generate-secrets-secure.sh
-
-      - name: Run fastlane firebase_pr
-        env:
-          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
-          # CI uses local match checkout; local dev uses SSH (Matchfile default).
-          MATCH_GIT_URL: ${{ github.workspace }}/convos-certificates
-          FIREBASE_APP_ID_PR: ${{ vars.FIREBASE_APP_ID_PR }}
-          # JSON piped through env, never on disk.
-          FIREBASE_SERVICE_ACCOUNT_JSON_CONTENT: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_JSON }}
-          FIREBASE_TESTER_GROUPS: ${{ vars.FIREBASE_TESTER_GROUPS || 'xmtp-internal' }}
-          GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
-          GITHUB_PR_TITLE: ${{ github.event.pull_request.title }}
-        run: fastlane firebase_pr
-
-      - name: Upload IPA artifact
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: Convos-PR-${{ github.event.pull_request.number || github.run_id }}.ipa
-          path: build/Convos-PR.ipa
-          if-no-files-found: warn
-          retention-days: 14
-
-      # Push paths produced this job, minus Xcode and anything whose
-      # closure references it. Skipped on failure to avoid caching
-      # half-built derivations that would poison subsequent runs.
-      - name: Push new paths to xmtp Cachix
-        if: success()
-        run: |
-          set -e
-          new_paths=$(comm -13 \
-            /tmp/store-paths-before \
-            <(nix path-info --all | sort))
-          if [ -z "$new_paths" ]; then
-            echo "No new paths to push."
-            exit 0
-          fi
-          # Single DB query for the tainted set (Xcode + every path whose
-          # closure includes it), then set-difference against new paths.
-          tainted=$(nix-store --query --referrers-closure "$XCODE_NIX_PATH" | sort -u)
-          to_push=$(comm -23 <(echo "$new_paths" | sort -u) <(echo "$tainted"))
-          if [ -z "$to_push" ]; then
-            echo "Nothing to push after filtering."
-            exit 0
-          fi
-          echo "Pushing $(echo "$to_push" | wc -l | tr -d ' ') paths to xmtp cache"
-          echo "$to_push" | xargs cachix push xmtp
+      xcode-app-path: /Applications/Xcode_26.3.app
+      xcode-nix-path: /nix/store/x9hdz5mfp44i9b05sswp271jdv68r8vx-Xcode.app
+      firebase-app-id: ${{ vars.FIREBASE_APP_ID_PR }}
+      tester-groups: ${{ vars.FIREBASE_TESTER_GROUPS || 'xmtp-internal' }}
+      pr-number: ${{ github.event.pull_request.number || '' }}
+      pr-title: ${{ github.event.pull_request.title || '' }}
+    secrets: inherit

.github/workflows/testflight-prod.yml

@@ -1,33 +1,11 @@
-# Prod TestFlight Release
+# Prod TestFlight Release — thin caller. The job lives in convos-releases:
+# https://github.com/xmtplabs/convos-releases/blob/main/.github/workflows/ios-testflight-prod.yml
 #
-# Builds the Convos (Prod) scheme for the App Store on every push to `dev`
-# and uploads the IPA to the prod app's internal TestFlight tester groups.
-# These builds are signed with the prod bundle ID (org.convos.ios) and talk
-# to the prod backend (config.prod.json) - testers are exercising prod.
-#
-# PR ad-hoc builds (firebase-pr.yml) are unaffected: they keep the dev bundle
-# ID, the dev network, and Firebase App Distribution.
-#
-# Concurrency: only the latest commit's build completes. If a new commit
-# lands while a previous build is running, the in-flight build is cancelled.
-#
-# Required repository secrets:
-#   CONVOS_CERTIFICATES_TOKEN          - GitHub PAT with read access to
-#                                        xmtplabs/convos-certificates
-#   MATCH_PASSWORD                     - Passphrase for the match repo
-#                                        encryption
-#   APP_STORE_CONNECT_API_KEY_ID       - Key ID for the ASC API key
-#   APP_STORE_CONNECT_ISSUER_ID        - Issuer ID for the ASC API key
-#   APP_STORE_CONNECT_API_PRIVATE_KEY  - Raw .p8 contents of the ASC API key
-#   CACHIX_AUTH_TOKEN                  - Auth token for the xmtp Cachix cache
-#
-# Optional repository secrets (Sentry crash reporting; prod builds ship
-# without Sentry when these are unset):
-#   SENTRY_DSN_PROD                    - DSN baked into prod builds
-#   SENTRY_AUTH_TOKEN                  - Token for dSYM upload (symbolication)
-#   SENTRY_ORG                         - Sentry org slug for dSYM upload
-#   SENTRY_PROJECT                     - Sentry project slug for dSYM upload
-
+# Required repository secrets (passed via `secrets: inherit`):
+#   CONVOS_CERTIFICATES_TOKEN, MATCH_PASSWORD, APP_STORE_CONNECT_API_KEY_ID,
+#   APP_STORE_CONNECT_ISSUER_ID, APP_STORE_CONNECT_API_PRIVATE_KEY,
+#   CACHIX_AUTH_TOKEN; optional POSTHOG_API_KEY_PROD, SENTRY_DSN_PROD,
+#   SENTRY_AUTH_TOKEN, SENTRY_ORG, SENTRY_PROJECT.
 name: Prod TestFlight Release
 
 on:
@@ -43,134 +21,14 @@ concurrency:
 
 jobs:
   testflight_prod:
-    name: Build & upload to TestFlight (Prod)
-    runs-on: warp-macos-latest-arm64-12x
-    timeout-minutes: 45
+    # Callers must grant what the reusable workflow's job declares — a called
+    # workflow can't elevate beyond the caller's grant.
     permissions:
       id-token: write
       contents: read
-    env:
-      # Bump both together when Xcode upgrades; the hash is from
-      # `nix store add /Applications/Xcode_NN.N.app`.
-      XCODE_APP_PATH: /Applications/Xcode_26.3.app
-      XCODE_NIX_PATH: /nix/store/x9hdz5mfp44i9b05sswp271jdv68r8vx-Xcode.app
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          # latest_testflight_build_number doesn't need history, but
-          # git rev-list --count HEAD does; the deeper of the two wins.
-          fetch-depth: 0
-
-      - name: Checkout convos-certificates (match repo)
-        uses: actions/checkout@v6
-        with:
-          repository: xmtplabs/convos-certificates
-          token: ${{ secrets.CONVOS_CERTIFICATES_TOKEN }}
-          path: convos-certificates
-          persist-credentials: false
-
-      - name: Install Nix
-        uses: nixbuild/nix-quick-install-action@v33
-        with:
-          nix_conf: |
-            experimental-features = nix-command flakes
-
-      - name: Pin Xcode into /nix/store
-        uses: xmtplabs/xmtp-cache-apple@v1
-        with:
-          xcode-path: ${{ env.XCODE_APP_PATH }}
-          xcode-nix-path: ${{ env.XCODE_NIX_PATH }}
-
-      # Action installs cachix + substituter; push happens manually after
-      # the build so we can exclude Xcode's closure (EULA + 11 GiB).
-      - name: Set up xmtp Cachix cache
-        uses: cachix/cachix-action@v15
-        with:
-          name: xmtp
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-          skipPush: true
-
-      - name: Snapshot pre-build store paths
-        run: nix path-info --all | sort > /tmp/store-paths-before
-
-      - name: Enter dev shell
-        uses: nicknovitski/nix-develop@v1
-        with:
-          arguments: "--accept-flake-config --impure"
-
-      - name: Verify Xcode
-        run: xcodebuild -version
-
-      - name: Generate Secrets.swift
-        env:
-          BUILD_CONFIGURATION: Prod
-          POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY_PROD }}
-          SENTRY_DSN_PROD: ${{ secrets.SENTRY_DSN_PROD }}
-        run: ./Scripts/generate-secrets-secure.sh
-
-      - name: Run fastlane testflight_prod
-        env:
-          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
-          # CI uses the local match checkout; local dev uses SSH (Matchfile default).
-          MATCH_GIT_URL: ${{ github.workspace }}/convos-certificates
-          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
-          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
-          # Passed directly to fastlane's app_store_connect_api_key via key_content;
-          # stays in memory, never written to disk, redacted from logs.
-          APP_STORE_CONNECT_API_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_API_PRIVATE_KEY }}
-          GITHUB_SHA: ${{ github.sha }}
-          GITHUB_REF_NAME: ${{ github.ref_name }}
-        run: fastlane testflight_prod
-
-      # Sentry symbolicates prod crash reports server-side using the dSYMs
-      # from the archive (gym zips them next to the IPA). Skips cleanly when
-      # the Sentry secrets are not configured.
-      - name: Upload dSYMs to Sentry
-        env:
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
-          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
-        run: |
-          if [ -z "$SENTRY_AUTH_TOKEN" ]; then
-            echo "SENTRY_AUTH_TOKEN not set - skipping dSYM upload."
-            exit 0
-          fi
-          shopt -s nullglob
-          dsym_zips=(build/*.dSYM.zip)
-          if [ ${#dsym_zips[@]} -eq 0 ]; then
-            echo "No dSYM zips found in build/ - nothing to upload."
-            exit 0
-          fi
-          sentry-cli debug-files upload "${dsym_zips[@]}"
-
-      - name: Upload IPA artifact
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: Convos-Prod-TestFlight-${{ github.run_id }}
-          path: build/Convos-Prod-TestFlight.ipa
-          if-no-files-found: warn
-          retention-days: 14
-
-      # Push paths produced this job, minus Xcode and anything whose
-      # closure references it. Skipped on failure to avoid caching
-      # half-built derivations that would poison subsequent runs.
-      - name: Push new paths to xmtp Cachix
-        if: success()
-        run: |
-          set -e
-          new_paths=$(comm -13 \
-            /tmp/store-paths-before \
-            <(nix path-info --all | sort))
-          if [ -z "$new_paths" ]; then
-            echo "No new paths to push."
-            exit 0
-          fi
-          tainted=$(nix-store --query --referrers-closure "$XCODE_NIX_PATH" | sort -u)
-          to_push=$(comm -23 <(echo "$new_paths" | sort -u) <(echo "$tainted"))
-          if [ -z "$to_push" ]; then
-            echo "Nothing to push after filtering."
-            exit 0
-          fi
-          echo "Pushing $(echo "$to_push" | wc -l | tr -d ' ') paths to xmtp cache"
-          echo "$to_push" | xargs cachix push xmtp
+    uses: xmtplabs/convos-releases/.github/workflows/ios-testflight-prod.yml@main
+    with:
+      runner: warp-macos-latest-arm64-12x
+      xcode-app-path: /Applications/Xcode_26.3.app
+      xcode-nix-path: /nix/store/x9hdz5mfp44i9b05sswp271jdv68r8vx-Xcode.app
+    secrets: inherit