diff --git a/.gitignore b/.gitignore index 53e0970..78581db 100644 --- a/.gitignore +++ b/.gitignore @@ -32,6 +32,7 @@ android/app/google-services.json android/app/release/*.jks android/keystore.properties android/local.properties +android/play-service-account.json ios/App/App/GoogleService-Info.plist ios/*.p8 diff --git a/AUTOMATED_RELEASE.md b/AUTOMATED_RELEASE.md new file mode 100644 index 0000000..7ed5329 --- /dev/null +++ b/AUTOMATED_RELEASE.md @@ -0,0 +1,85 @@ +# Automated Release Pipeline + +Builds and (optionally) uploads signed Android and iOS release artifacts from the CLI — no Android Studio or Xcode GUI needed for routine releases. + +## Quick start + +```sh +./scripts/pull-secrets.sh # pulls all signing secrets from Vaultwarden +./scripts/release.sh # bump patch version, build + sign both platforms +./scripts/release.sh --upload # also upload: Android → Play internal track, iOS → TestFlight +``` + +Common flags on `release.sh`: + +| Flag | Effect | +|---|---| +| `--android` / `--ios` | Build only one platform | +| `--bump minor\|major` | Bump type (default: `patch`) | +| `--skip-bump` | Build with the current version, don't bump | +| `--upload` | Upload after building | +| `--track TRACK` | Play Store track for `--upload` (default: `internal`) | + +Outputs: +- Android: `android/app/build/outputs/bundle/release/app-release.aab` +- iOS: `build/ios/Donetick.ipa` + +## One-time machine setup + +1. `bundle install` — installs fastlane (Ruby gems, local to the repo via `vendor/bundle`) +2. `./scripts/pull-secrets.sh` — pulls all secrets below from Vaultwarden +3. `android/local.properties` needs `sdk.dir=` — not pulled from vault, machine-specific. Android Studio creates this automatically; if building headless-only, create it manually. +4. Export `ASC_ISSUER_ID` (App Store Connect API key issuer ID) — either in your shell profile, or add it to the `Donetick Env Production` vault note so `pull-secrets.sh` delivers it into `.env.production` (which `release.sh` auto-sources). +5. A working Apple Distribution certificate + the `Donetick App Store(fastline)` provisioning profile must be installed in your keychain / `~/Library/MobileDevice/Provisioning Profiles/` (see "iOS signing model" below) — **not** currently pulled from vault, machine-specific one-time setup. + +## Secrets pulled by `scripts/pull-secrets.sh` + +All secrets live in Vaultwarden (`https://www.bitwarden.com`) as Secure Notes, named exactly as below: + +| Vault item name | Written to | Encoding | +|---|---|---| +| Donetick Google Services Android | `android/app/google-services.json` | raw | +| Donetick Android Keystore | `android/app/release/donetick.jks` | base64 | +| Donetick Keystore Password | (used inline for `android/keystore.properties`) | raw | +| Donetick Google Play Service Account | `android/play-service-account.json` | raw | +| Donetick Google Services iOS | `ios/App/App/GoogleService-Info.plist` | raw | +| Donetick App Store Connect Key | `ios/AuthKey_84F695CDQ3.p8` | base64 | +| Donetick Env Production | `.env.production` | raw | + +None of these files are committed to git — all covered by `.gitignore`. + +## iOS signing model (important — don't relitigate this) + +The App target uses **manual signing for Release**, not Automatic. This was a deliberate choice, not the default: + +- The project has **two** Apple Distribution-type certificates on the Apple Developer account: an Xcode Cloud–managed one (private key never leaves Apple, can't be used for local CLI signing) and a plain one created via Xcode → Settings → Accounts → Manage Certificates (private key is in the local keychain, usable). Automatic signing kept binding to the wrong (Managed) one. +- Fix: `ios/App/App.xcodeproj/project.pbxproj` → App target → Release config has `CODE_SIGN_STYLE = Manual`, `CODE_SIGN_IDENTITY = "Apple Distribution"`, `PROVISIONING_PROFILE_SPECIFIER = "Donetick App Store(fastline)"`. Debug config is untouched (still Automatic, for local dev builds in Xcode). +- `fastlane/Fastfile`'s `ios release` lane passes explicit `export_options: { signingStyle: "manual", provisioningProfiles: {...} }` to `build_app` — do **not** switch this back to `-allowProvisioningUpdates`/automatic without a good reason, it re-triggers the ambiguous cert selection. + +**If you ever add/change an entitlement** (new Capability in Signing & Capabilities, e.g. a new permission), the existing provisioning profile becomes stale and exports will fail with an error like `"App.app" requires a provisioning profile with the X feature`. Fix: +1. developer.apple.com → Identifiers → `com.donetick.app` → confirm the new capability is checked +2. developer.apple.com → Profiles → find `Donetick App Store(fastline)` → regenerate it → download +3. Install it locally: get its UUID (`security cms -D -i .mobileprovision | plutil -extract UUID xml1 -o - -`) and copy to `~/Library/MobileDevice/Provisioning Profiles/.mobileprovision` + +**If the Distribution certificate ever expires/is revoked**, redo the one-time Xcode step: Settings → Accounts → Manage Certificates → `+` → Apple Distribution, then regenerate the profile as above. + +## Android signing model + +Standard keystore signing via `android/keystore.properties`, read by `android/app/build.gradle`. One historical gotcha already fixed: `storeFile` must be `release/donetick.jks` (relative to the `android/app` module dir), **not** `app/release/donetick.jks` — that extra `app/` silently resolved to a double-nested wrong path and broke CLI builds (Android Studio may have masked this before). + +## Play Store upload gotchas + +- The service account (`fastline-471@donetick-5f910.iam.gserviceaccount.com`) needs the **Google Play Android Developer API enabled** in its GCP project (`donetick-5f910`), **and** explicit per-app release permission granted in Play Console → Users and permissions (not just account-level access) — **and you have to actually click Save**, the UI will silently not persist it otherwise. +- Google Play Console permission changes can take time to propagate on Google's backend even after saving (historically documented as up to ~24h, though in practice it was near-instant once actually saved). +- The Play Developer API requires the app to have had **at least one manual release** uploaded through the Play Console website before API uploads work at all — not an issue for Donetick (already satisfied) but relevant if this is ever set up for a brand-new app. + +## Fastlane lanes reference + +```sh +bundle exec fastlane android release # build signed .aab +bundle exec fastlane android apk # build signed .apk (sideloading/testing) +bundle exec fastlane android upload [track:X] # upload .aab to Play Store (default track: internal) + +bundle exec fastlane ios release # build signed .ipa +bundle exec fastlane ios upload # upload .ipa to TestFlight +``` diff --git a/fastlane/Fastfile b/fastlane/Fastfile index 40781d0..75d79ab 100644 --- a/fastlane/Fastfile +++ b/fastlane/Fastfile @@ -5,6 +5,7 @@ default_platform(:ios) IOS_KEY_PATH = File.expand_path("../ios/AuthKey_84F695CDQ3.p8") IOS_OUTPUT_DIR = File.expand_path("../build/ios") ANDROID_PROJECT_DIR = File.expand_path("../android") +PLAY_JSON_KEY_PATH = File.expand_path("../android/play-service-account.json") platform :ios do desc "Build a signed, App Store-ready .ipa" @@ -31,6 +32,32 @@ platform :ios do UI.success("Signed .ipa at #{IOS_OUTPUT_DIR}/Donetick.ipa") end + + desc "Upload the built .ipa to TestFlight" + lane :upload do + UI.user_error!("Missing #{IOS_KEY_PATH} — run scripts/pull-secrets.sh first") unless File.exist?(IOS_KEY_PATH) + UI.user_error!("ASC_ISSUER_ID is not set (App Store Connect API key issuer id)") if ENV["ASC_ISSUER_ID"].to_s.empty? + + ipa_path = File.join(IOS_OUTPUT_DIR, "Donetick.ipa") + UI.user_error!("Missing #{ipa_path} — run `fastlane ios release` first") unless File.exist?(ipa_path) + + api_key = app_store_connect_api_key( + key_id: ENV["ASC_KEY_ID"] || "84F695CDQ3", + issuer_id: ENV["ASC_ISSUER_ID"], + key_filepath: IOS_KEY_PATH, + duration: 1200, + in_house: false, + ) + + upload_to_testflight( + api_key: api_key, + ipa: ipa_path, + skip_waiting_for_build_processing: true, + skip_submission: true, + ) + + UI.success("Uploaded to TestFlight") + end end platform :android do @@ -63,4 +90,24 @@ platform :android do apk_path = lane_context[SharedValues::GRADLE_APK_OUTPUT_PATH] UI.success("Signed .apk at #{apk_path}") end + + desc "Upload the built .aab to the Play Store (internal testing track by default)" + lane :upload do |options| + UI.user_error!("Missing #{PLAY_JSON_KEY_PATH} — run scripts/pull-secrets.sh first") unless File.exist?(PLAY_JSON_KEY_PATH) + + aab_path = File.join(ANDROID_PROJECT_DIR, "app/build/outputs/bundle/release/app-release.aab") + UI.user_error!("Missing #{aab_path} — run `fastlane android release` first") unless File.exist?(aab_path) + + upload_to_play_store( + json_key: PLAY_JSON_KEY_PATH, + package_name: "com.donetick.app", + aab: aab_path, + track: options[:track] || "internal", + skip_upload_metadata: true, + skip_upload_images: true, + skip_upload_screenshots: true, + ) + + UI.success("Uploaded to Play Store (#{options[:track] || 'internal'} track)") + end end diff --git a/fastlane/README.md b/fastlane/README.md index 6920af8..e93f221 100644 --- a/fastlane/README.md +++ b/fastlane/README.md @@ -23,6 +23,14 @@ For _fastlane_ installation instructions, see [Installing _fastlane_](https://do Build a signed, App Store-ready .ipa +### ios upload + +```sh +[bundle exec] fastlane ios upload +``` + +Upload the built .ipa to TestFlight + ---- @@ -44,6 +52,14 @@ Build a signed release .aab Build a signed release .apk (for sideloading/testing) +### android upload + +```sh +[bundle exec] fastlane android upload +``` + +Upload the built .aab to the Play Store (internal testing track by default) + ---- This README.md is auto-generated and will be re-generated every time [_fastlane_](https://fastlane.tools) is run. diff --git a/scripts/release.sh b/scripts/release.sh index fd53679..21a6a2a 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -7,22 +7,26 @@ cd "$REPO_ROOT" PLATFORM="both" BUMP="patch" SKIP_BUMP=false +UPLOAD=false +ANDROID_TRACK="internal" usage() { cat <&2; usage; exit 1 ;; esac @@ -65,11 +71,21 @@ fi if [ "$PLATFORM" = "android" ] || [ "$PLATFORM" = "both" ]; then echo "→ Building signed Android release (.aab)" $RUN android release + + if [ "$UPLOAD" = true ]; then + echo "→ Uploading Android release to Play Store ($ANDROID_TRACK track)" + $RUN android upload track:"$ANDROID_TRACK" + fi fi if [ "$PLATFORM" = "ios" ] || [ "$PLATFORM" = "both" ]; then echo "→ Building signed iOS release (.ipa)" $RUN ios release + + if [ "$UPLOAD" = true ]; then + echo "→ Uploading iOS release to TestFlight" + $RUN ios upload + fi fi echo "✓ Release build complete"