86 lines
6.3 KiB
Markdown
86 lines
6.3 KiB
Markdown
# Automated Release Pipeline
|
||
|
||
Builds and (optionally) uploads signed Android and iOS release artifacts from the CLI — no Android Studio or Xcode GUI needed for routine releases.
|
||
|
||
## Quick start
|
||
|
||
```sh
|
||
./scripts/pull-secrets.sh # pulls all signing secrets from Vaultwarden
|
||
./scripts/release.sh # bump patch version, build + sign both platforms
|
||
./scripts/release.sh --upload # also upload: Android → Play internal track, iOS → TestFlight
|
||
```
|
||
|
||
Common flags on `release.sh`:
|
||
|
||
| Flag | Effect |
|
||
|---|---|
|
||
| `--android` / `--ios` | Build only one platform |
|
||
| `--bump minor\|major` | Bump type (default: `patch`) |
|
||
| `--skip-bump` | Build with the current version, don't bump |
|
||
| `--upload` | Upload after building |
|
||
| `--track TRACK` | Play Store track for `--upload` (default: `internal`) |
|
||
|
||
Outputs:
|
||
- Android: `android/app/build/outputs/bundle/release/app-release.aab`
|
||
- iOS: `build/ios/Donetick.ipa`
|
||
|
||
## One-time machine setup
|
||
|
||
1. `bundle install` — installs fastlane (Ruby gems, local to the repo via `vendor/bundle`)
|
||
2. `./scripts/pull-secrets.sh` — pulls all secrets below from Vaultwarden
|
||
3. `android/local.properties` needs `sdk.dir=<path to Android SDK>` — not pulled from vault, machine-specific. Android Studio creates this automatically; if building headless-only, create it manually.
|
||
4. Export `ASC_ISSUER_ID` (App Store Connect API key issuer ID) — either in your shell profile, or add it to the `Donetick Env Production` vault note so `pull-secrets.sh` delivers it into `.env.production` (which `release.sh` auto-sources).
|
||
5. A working Apple Distribution certificate + the `Donetick App Store(fastline)` provisioning profile must be installed in your keychain / `~/Library/MobileDevice/Provisioning Profiles/` (see "iOS signing model" below) — **not** currently pulled from vault, machine-specific one-time setup.
|
||
|
||
## Secrets pulled by `scripts/pull-secrets.sh`
|
||
|
||
All secrets live in Vaultwarden (`https://www.bitwarden.com`) as Secure Notes, named exactly as below:
|
||
|
||
| Vault item name | Written to | Encoding |
|
||
|---|---|---|
|
||
| Donetick Google Services Android | `android/app/google-services.json` | raw |
|
||
| Donetick Android Keystore | `android/app/release/donetick.jks` | base64 |
|
||
| Donetick Keystore Password | (used inline for `android/keystore.properties`) | raw |
|
||
| Donetick Google Play Service Account | `android/play-service-account.json` | raw |
|
||
| Donetick Google Services iOS | `ios/App/App/GoogleService-Info.plist` | raw |
|
||
| Donetick App Store Connect Key | `ios/AuthKey_84F695CDQ3.p8` | base64 |
|
||
| Donetick Env Production | `.env.production` | raw |
|
||
|
||
None of these files are committed to git — all covered by `.gitignore`.
|
||
|
||
## iOS signing model (important — don't relitigate this)
|
||
|
||
The App target uses **manual signing for Release**, not Automatic. This was a deliberate choice, not the default:
|
||
|
||
- The project has **two** Apple Distribution-type certificates on the Apple Developer account: an Xcode Cloud–managed one (private key never leaves Apple, can't be used for local CLI signing) and a plain one created via Xcode → Settings → Accounts → Manage Certificates (private key is in the local keychain, usable). Automatic signing kept binding to the wrong (Managed) one.
|
||
- Fix: `ios/App/App.xcodeproj/project.pbxproj` → App target → Release config has `CODE_SIGN_STYLE = Manual`, `CODE_SIGN_IDENTITY = "Apple Distribution"`, `PROVISIONING_PROFILE_SPECIFIER = "Donetick App Store(fastline)"`. Debug config is untouched (still Automatic, for local dev builds in Xcode).
|
||
- `fastlane/Fastfile`'s `ios release` lane passes explicit `export_options: { signingStyle: "manual", provisioningProfiles: {...} }` to `build_app` — do **not** switch this back to `-allowProvisioningUpdates`/automatic without a good reason, it re-triggers the ambiguous cert selection.
|
||
|
||
**If you ever add/change an entitlement** (new Capability in Signing & Capabilities, e.g. a new permission), the existing provisioning profile becomes stale and exports will fail with an error like `"App.app" requires a provisioning profile with the X feature`. Fix:
|
||
1. developer.apple.com → Identifiers → `com.donetick.app` → confirm the new capability is checked
|
||
2. developer.apple.com → Profiles → find `Donetick App Store(fastline)` → regenerate it → download
|
||
3. Install it locally: get its UUID (`security cms -D -i <file>.mobileprovision | plutil -extract UUID xml1 -o - -`) and copy to `~/Library/MobileDevice/Provisioning Profiles/<uuid>.mobileprovision`
|
||
|
||
**If the Distribution certificate ever expires/is revoked**, redo the one-time Xcode step: Settings → Accounts → Manage Certificates → `+` → Apple Distribution, then regenerate the profile as above.
|
||
|
||
## Android signing model
|
||
|
||
Standard keystore signing via `android/keystore.properties`, read by `android/app/build.gradle`. One historical gotcha already fixed: `storeFile` must be `release/donetick.jks` (relative to the `android/app` module dir), **not** `app/release/donetick.jks` — that extra `app/` silently resolved to a double-nested wrong path and broke CLI builds (Android Studio may have masked this before).
|
||
|
||
## Play Store upload gotchas
|
||
|
||
- The service account (`fastline-471@donetick-5f910.iam.gserviceaccount.com`) needs the **Google Play Android Developer API enabled** in its GCP project (`donetick-5f910`), **and** explicit per-app release permission granted in Play Console → Users and permissions (not just account-level access) — **and you have to actually click Save**, the UI will silently not persist it otherwise.
|
||
- Google Play Console permission changes can take time to propagate on Google's backend even after saving (historically documented as up to ~24h, though in practice it was near-instant once actually saved).
|
||
- The Play Developer API requires the app to have had **at least one manual release** uploaded through the Play Console website before API uploads work at all — not an issue for Donetick (already satisfied) but relevant if this is ever set up for a brand-new app.
|
||
|
||
## Fastlane lanes reference
|
||
|
||
```sh
|
||
bundle exec fastlane android release # build signed .aab
|
||
bundle exec fastlane android apk # build signed .apk (sideloading/testing)
|
||
bundle exec fastlane android upload [track:X] # upload .aab to Play Store (default track: internal)
|
||
|
||
bundle exec fastlane ios release # build signed .ipa
|
||
bundle exec fastlane ios upload # upload .ipa to TestFlight
|
||
```
|