testflight.yml.disabled

name: TestFlight Beta

# Three trigger modes, in order of preference:
#
#   1. release: published
#      The canonical curated path. Cut a GitHub Release with a SemVer tag
#      (vX.Y.Z), expert-crafted release notes in the body, and optionally
#      mark it as a pre-release. The workflow:
#        - Uses the tag as MARKETING_VERSION (strips the leading "v")
#        - Uses the release body as TestFlight What-To-Test
#        - Builds, uploads, attaches notes, and pings external testers
#      Use this for everything that should ship with intentional notes.
#
#   2. push: main
#      The fast path for direct merges. Auto-pushes to TestFlight using
#      git-log-derived notes, then auto-cuts a prerelease GitHub Release
#      tagged "testflight-X.Y.Z-build.N" so every ship has a permanent,
#      browsable artifact. The prerelease flag signals this isn't an App
#      Store release; users can later cut a curated vX.Y.Z release.
#
#   3. workflow_dispatch
#      Manual override path with explicit version + notes inputs.
on:
  release:
    types: [published]
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      marketing_version:
        description: "Optional MARKETING_VERSION override, for example 1.1"
        required: false
        type: string
      build_number:
        description: "Optional CURRENT_PROJECT_VERSION override. Leave blank for an auto-generated build number."
        required: false
        type: string
      summary:
        description: "Short release summary for the generated changelog."
        required: false
        type: string
      what_to_test:
        description: "Extra TestFlight What to Test notes."
        required: false
        type: string

concurrency:
  group: testflight-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write  # required so the release-cut step can push tags + create GitHub Releases

jobs:
  testflight:
    name: Build, Upload, And Annotate TestFlight
    runs-on: macos-26
    timeout-minutes: 90

    env:
      ASC_BUNDLE_ID: com.offscript.app
      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
      ASC_KEY_TYPE: team
      DEVELOPMENT_TEAM: 363TRR79UG
      TEST_DESTINATION: platform=iOS Simulator,OS=latest,name=iPhone 17 Pro

    steps:
      - name: Check out repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Select active Xcode
        run: |
          set -euo pipefail
          for candidate in \
            /Applications/Xcode_26.4.1.app/Contents/Developer \
            /Applications/Xcode_26.4.app/Contents/Developer \
            /Applications/Xcode_26.4.0.app/Contents/Developer \
            /Applications/Xcode_26.3.app/Contents/Developer \
            /Applications/Xcode.app/Contents/Developer
          do
            if [[ -d "$candidate" ]]; then
              sudo xcode-select -s "$candidate"
              break
            fi
          done
          echo "DEVELOPER_DIR=$(xcode-select -p)" >> "$GITHUB_ENV"
          echo "ASC_KEY_PATH=$RUNNER_TEMP/AuthKey.p8" >> "$GITHUB_ENV"
          xcodebuild -version
          xcodebuild -showsdks

      - name: Install App Store Connect script dependencies
        run: |
          set -euo pipefail
          python3 -m venv "$RUNNER_TEMP/asc-venv"
          "$RUNNER_TEMP/asc-venv/bin/python" -m pip install --upgrade pip
          "$RUNNER_TEMP/asc-venv/bin/python" -m pip install PyJWT cryptography requests
          echo "$RUNNER_TEMP/asc-venv/bin" >> "$GITHUB_PATH"

      - name: Validate required TestFlight secrets
        run: |
          set -euo pipefail
          test -n "${ASC_KEY_ID}" || { echo "Missing secret ASC_KEY_ID"; exit 1; }
          test -n "${ASC_ISSUER_ID}" || { echo "Missing secret ASC_ISSUER_ID. CI xcodebuild upload requires a team API key issuer ID."; exit 1; }
          test -n "${ASC_KEY_P8_BASE64:-}" || { echo "Missing secret ASC_KEY_P8_BASE64"; exit 1; }
        env:
          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}

      - name: Materialize App Store Connect API key
        run: |
          set -euo pipefail
          umask 077
          printf '%s' "$ASC_KEY_P8_BASE64" | base64 --decode > "$ASC_KEY_PATH"
          test -s "$ASC_KEY_PATH"
        env:
          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}

      - name: Materialize Sentry DSN into Secrets.xcconfig
        # SENTRY_DSN is intentionally optional. If the secret isn't set, we
        # still write a stub xcconfig so the project's base configuration
        # reference resolves and CrashReporter.configure() simply skips
        # Sentry init (per the malformed-DSN guard inside CrashReporter).
        run: |
          set -euo pipefail
          umask 077
          mkdir -p Config
          if [ -n "${SENTRY_DSN:-}" ]; then
            printf 'SENTRY_DSN = %s\n' "$SENTRY_DSN" > Config/Secrets.xcconfig
            echo "Sentry DSN materialized into Config/Secrets.xcconfig"
          else
            printf 'SENTRY_DSN =\n' > Config/Secrets.xcconfig
            echo "::warning::SENTRY_DSN secret is not set; Sentry will be disabled in this build"
          fi
        env:
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}

      - name: Compute release metadata
        id: metadata
        env:
          # Release-trigger fields. Empty when triggered by push or
          # workflow_dispatch — handled gracefully below.
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          RELEASE_BODY: ${{ github.event.release.body }}
        run: |
          set -euo pipefail
          INPUT_VERSION="${{ github.event.inputs.marketing_version || '' }}"
          INPUT_BUILD="${{ github.event.inputs.build_number || '' }}"

          # Precedence: explicit workflow_dispatch input > release tag > xcodeproj.
          # Release tags are normalized "vX.Y.Z" → "X.Y.Z" so MARKETING_VERSION
          # stays SemVer-clean for ASC.
          if [[ -n "$INPUT_VERSION" ]]; then
            MARKETING_VERSION="$INPUT_VERSION"
          elif [[ -n "${RELEASE_TAG:-}" ]]; then
            MARKETING_VERSION="${RELEASE_TAG#v}"
          else
            MARKETING_VERSION="$(xcodebuild -project OffScript.xcodeproj -scheme OffScript -configuration Release -showBuildSettings | awk -F '= ' '/MARKETING_VERSION = / { print $2; exit }')"
          fi

          # Stash the release body for the notes step. We base64 it so any
          # newlines / shell-meta survive the env round-trip cleanly.
          if [[ -n "${RELEASE_BODY:-}" ]]; then
            printf '%s' "$RELEASE_BODY" | base64 > /tmp/release_body.b64
            echo "release_body_b64_path=/tmp/release_body.b64" >> "$GITHUB_OUTPUT"
          fi

          if [[ -n "$INPUT_BUILD" ]]; then
            BUILD_NUMBER="$INPUT_BUILD"
          else
            BUILD_NUMBER="$(date -u +%Y%m%d)${GITHUB_RUN_NUMBER}${GITHUB_RUN_ATTEMPT}"
          fi

          if [[ "${{ github.event_name }}" == "push" ]]; then
            REVISION_RANGE="${{ github.event.before }}..${{ github.sha }}"
          else
            REVISION_RANGE="$(git describe --tags --abbrev=0 2>/dev/null || echo HEAD~20)..${{ github.sha }}"
          fi

          {
            echo "marketing_version=$MARKETING_VERSION"
            echo "build_number=$BUILD_NUMBER"
            echo "revision_range=$REVISION_RANGE"
          } >> "$GITHUB_OUTPUT"

          echo "MARKETING_VERSION=$MARKETING_VERSION" >> "$GITHUB_ENV"
          echo "BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
          echo "REVISION_RANGE=$REVISION_RANGE" >> "$GITHUB_ENV"

      - name: Resolve simulator destination
        run: |
          set -euo pipefail
          python3 - <<'PY' >> "$GITHUB_ENV"
          import json
          import subprocess

          preferred = [
              "iPhone 17 Pro",
              "iPhone 16 Pro",
              "iPhone 15 Pro",
              "iPhone 17",
              "iPhone 16",
              "iPhone 15",
          ]
          data = json.loads(subprocess.check_output(["xcrun", "simctl", "list", "devices", "available", "-j"]))
          names = []
          for runtime, devices in data.get("devices", {}).items():
              if "iOS" not in runtime:
                  continue
              for device in devices:
                  name = device.get("name", "")
                  if device.get("isAvailable") and name.startswith("iPhone") and name not in names:
                      names.append(name)

          for name in preferred:
              if name in names:
                  print(f"TEST_DESTINATION=platform=iOS Simulator,OS=latest,name={name}")
                  break
          else:
              if not names:
                  raise SystemExit("No available iPhone simulator found")
              print(f"TEST_DESTINATION=platform=iOS Simulator,OS=latest,name={names[0]}")
          PY

      - name: Generate changelog and What to Test notes
        env:
          # When triggered by a published GitHub Release, prefer the release
          # body verbatim — it's the human-curated source of truth.
          RELEASE_BODY: ${{ github.event.release.body }}
          RELEASE_NAME: ${{ github.event.release.name }}
        run: |
          set -euo pipefail
          # Resolve summary + what-to-test in this precedence order:
          #   1. workflow_dispatch explicit input
          #   2. release body (when triggered by release: published)
          #   3. empty (let generate_testflight_notes.py fall back to git log)
          SUMMARY="${{ github.event.inputs.summary || '' }}"
          WHAT_TO_TEST="${{ github.event.inputs.what_to_test || '' }}"
          if [[ -z "$SUMMARY" && -n "${RELEASE_NAME:-}" ]]; then
            SUMMARY="$RELEASE_NAME"
          fi
          if [[ -z "$WHAT_TO_TEST" && -n "${RELEASE_BODY:-}" ]]; then
            # Use the release body verbatim — release authors are expected to
            # write expert TestFlight-shaped notes there.
            WHAT_TO_TEST="$RELEASE_BODY"
          fi

          scripts/generate_testflight_notes.py \
            --range "$REVISION_RANGE" \
            --version "$MARKETING_VERSION" \
            --build "$BUILD_NUMBER" \
            --summary "$SUMMARY" \
            --what-to-test "$WHAT_TO_TEST" \
            --output-dir build/TestFlight/notes

          {
            echo "## TestFlight Beta ${MARKETING_VERSION} (${BUILD_NUMBER})"
            echo
            cat build/TestFlight/notes/WHAT_TO_TEST.md
            echo
            echo "## Changelog"
            sed -n '1,80p' build/TestFlight/notes/CHANGELOG.md
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Validate TestFlight export policy
        run: scripts/upload_testflight.sh --validate-only

      - name: Run unit tests
        run: |
          set -euo pipefail
          xcodebuild test \
            -project OffScript.xcodeproj \
            -scheme OffScript \
            -destination "$TEST_DESTINATION" \
            -only-testing:OffScriptTests \
            -resultBundlePath build/TestFlight/TestResults.xcresult

      - name: Upload to TestFlight
        run: scripts/upload_testflight.sh

      - name: Wait for processing and publish TestFlight notes
        run: |
          set -euo pipefail
          scripts/app_store_connect.py wait-build \
            --build "$BUILD_NUMBER" \
            --require-valid \
            --timeout 2400 \
            --poll 30 \
            --id-file build/TestFlight/notes/build-id.txt

          scripts/app_store_connect.py set-beta-notes \
            --build-id "$(cat build/TestFlight/notes/build-id.txt)" \
            --notes-file build/TestFlight/notes/testflight-notes.txt \
            --locale en-US

          scripts/app_store_connect.py sync-latest --apply
          scripts/app_store_connect.py status --limit 5 > build/TestFlight/notes/app-store-connect-status.txt

      - name: Upload release artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: testflight-${{ steps.metadata.outputs.marketing_version }}-${{ steps.metadata.outputs.build_number }}
          path: |
            build/TestFlight/notes
            build/TestFlight/TestResults.xcresult
          if-no-files-found: warn

      # Cut a GitHub Release for push-triggered runs so every TestFlight ship
      # leaves a permanent, browsable artifact on the Releases page.
      #
      # We only cut here for push events because release-triggered runs were
      # already initiated by an existing release (cutting again would loop).
      # Push-triggered releases are tagged with the build number to make them
      # globally unique even when the marketing version hasn't changed
      # between commits — the user can still curate the marketing release
      # later by editing the release on the Releases page.
      - name: Cut GitHub Release (push-triggered TestFlight ships only)
        if: github.event_name == 'push' && success()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TAG="testflight-${MARKETING_VERSION}-build.${BUILD_NUMBER}"
          NOTES_FILE="build/TestFlight/notes/CHANGELOG.md"
          WHAT_FILE="build/TestFlight/notes/WHAT_TO_TEST.md"

          BODY_FILE="$(mktemp)"
          {
            echo "## TestFlight Beta · ${MARKETING_VERSION} (${BUILD_NUMBER})"
            echo
            if [ -f "$WHAT_FILE" ]; then
              echo "### What to Test"
              cat "$WHAT_FILE"
              echo
            fi
            if [ -f "$NOTES_FILE" ]; then
              echo "### Changelog"
              cat "$NOTES_FILE"
            fi
          } > "$BODY_FILE"

          # --prerelease because TestFlight builds aren't App Store releases.
          # When the user is ready to ship to the App Store, they cut a fresh
          # vX.Y.Z release manually with curated notes — that release-trigger
          # path takes over.
          gh release create "$TAG" \
            --title "TestFlight ${MARKETING_VERSION} (${BUILD_NUMBER})" \
            --notes-file "$BODY_FILE" \
            --prerelease \
            --target "${GITHUB_SHA}" \
            build/TestFlight/notes/testflight-notes.txt \
            build/TestFlight/notes/CHANGELOG.md \
            build/TestFlight/notes/WHAT_TO_TEST.md
          echo "::notice::Cut GitHub Release $TAG"