testflight.yml

name: Upload to Testflight

on:
  workflow_call:
    inputs:
      owntube_source:
        required: false
        type: string
        description: "The repository with OwnTube-tv/web-client code. Defaults to the source repository."
      use_parent_repo_customizations:
        required: false
        type: boolean
        description: "Should a parent repo be used for customizations? (Required for branded builds)"
      target:
        required: true
        type: string
        description: Upload iOS (iphoneos) or tvOS (appletvos) app
      runner-label:
        type: string
        default: "macos-latest"
      customizations_env_content:
        required: false
        type: string
      build_info:
        required: true
        type: string
      code_sign_identity:
        required: true
        type: string
    secrets:
      BUILD_CERTIFICATE_BASE64:
        required: true
        description: A base64-encoded representation of the code signing certificate
      PROVISIONING_PROFILE_BASE64:
        required: true
        description: A base64-encoded representation of the provisioning profile containing the certificate
      P12_PASSWORD:
        required: true
        description: Password to the certificate
      PROVISIONING_PROFILE_SPECIFIER:
        required: true
        description: Provisioning profile specifier, e.g. MyOwnTube Apple Profile
      APPLE_DEVELOPMENT_TEAM:
        required: true
        description: Unique Apple team ID
      APPLE_API_PRIVATE_KEY:
        required: true
        description: A base64-encoded representation of the Apple Api key p8 file from App Store Connect
      APPLE_API_KEY:
        required: true
        description: Identifier for the Apple API key
      APPLE_API_KEY_ISSUER:
        required: true
        description: Apple API key issuer ID

jobs:
  testflight:
    runs-on: ${{ inputs.runner-label }}
    environment: owntube
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          repository: ${{ inputs.owntube_source || github.repository }}

      - name: Checkout parent repo with customizations
        uses: actions/checkout@v4
        if: ${{ inputs.use_parent_repo_customizations }}
        with:
          path: customizations

      - name: Setup Node 20
        uses: actions/setup-node@v4
        with:
          node-version: 20.x

      - name: Install Dependencies
        run: cd OwnTube.tv/ && npm install

      - name: Create .env File
        id: create_env
        if: ${{ inputs.customizations_env_content != '' }}
        run: |
          echo "BUNDLE_ID=$(echo "${{ inputs.customizations_env_content }}" | grep '^EXPO_PUBLIC_IOS_BUNDLE_IDENTIFIER=' | cut -d'=' -f2)" >> $GITHUB_OUTPUT
          echo "APP_NAME=$(echo "${{ inputs.customizations_env_content }}" | grep '^EXPO_PUBLIC_APP_NAME=' | cut -d'=' -f2 | sed "s/['\"]//g")" >> $GITHUB_OUTPUT
          echo "${{ inputs.customizations_env_content }}" > ./OwnTube.tv/.env

      - name: Expo Prebuild assets
        run: |
          if [ "${{ inputs.target }}" == "appletvos" ]; then
            export EXPO_TV=1
          fi
          export LC_CTYPE=UTF-8
          cd OwnTube.tv/ && npx expo prebuild --clean --platform ios

      - name: Inject Build Info
        run: |
          cat > ./OwnTube.tv/build-info.json << 'EOF'
          ${{ inputs.build_info }}
          EOF

      - name: Install the Apple certificate and provisioning profile
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.PROVISIONING_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: "CI_PASSWORD"
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificate and provisioning profile from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          # apply provisioning profile
          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: 16.4

      - name: Build and archive app for upload to Testflight by @${{ github.actor }}
        env:
          APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_DEVELOPMENT_TEAM }}
          PROVISIONING_PROFILE_SPECIFIER: ${{ secrets.PROVISIONING_PROFILE_SPECIFIER }}
        run: |
          if [ "${{ inputs.target }}" == "appletvos" ]; then
            export EXPO_TV=1
          fi
          cd OwnTube.tv/ios/
          WORKSPACE_FILE=$(find . -maxdepth 1 -name "*.xcworkspace")
          SCHEME=$(xcodebuild -list | sed -n '/Schemes:/,$p' | tail -n +2 | head -n 1 | xargs)

          if [[ -n "$WORKSPACE_FILE" && -n "$SCHEME" ]]; then
            echo "Running xcodebuild with workspace $WORKSPACE_FILE and scheme $SCHEME"
            xcodebuild \
            -workspace "$WORKSPACE_FILE" \
            -sdk ${{ inputs.target }} \
            -scheme "$SCHEME" \
            -configuration Release \
            -quiet \
            -archivePath ./build/OwnTube.xcarchive \
            archive \
            DEVELOPMENT_TEAM="$APPLE_DEVELOPMENT_TEAM" \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="${{ inputs.code_sign_identity }}" \
            PROVISIONING_PROFILE_SPECIFIER="$PROVISIONING_PROFILE_SPECIFIER" \
            CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO \
            OTHER_CODE_SIGN_FLAGS="--keychain $RUNNER_TEMP/app-signing.keychain-db"
          else
            echo "Error: No .xcworkspace or scheme file found."
            exit 1
          fi

      - name: Export archive
        env:
          APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_DEVELOPMENT_TEAM }}
          PROVISIONING_PROFILE_SPECIFIER: ${{ secrets.PROVISIONING_PROFILE_SPECIFIER }}
        run: |
          cd OwnTube.tv/ios
          echo "<?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
          <key>method</key>
          <string>app-store-connect</string>
          <key>uploadSymbols</key>
          <true/>
          <key>uploadBitcode</key>
          <false/>
          <key>teamID</key>
          <string>"$APPLE_DEVELOPMENT_TEAM"</string>
          <key>destination</key>
          <string>export</string>
          <key>provisioningProfiles</key>
          <dict>
          <key>${{ steps.create_env.outputs.BUNDLE_ID || 'com.owntubetv.owntube' }}</key>
          <string>"$PROVISIONING_PROFILE_SPECIFIER"</string>
          </dict>
          </dict>
          </plist>
          " > ./ExportOptions.plist &&
          xcodebuild \
          -exportArchive \
          -archivePath ./build/OwnTube.xcarchive \
          -exportPath ./build/OwnTube \
          -exportOptionsPlist ExportOptions.plist

      - name: Install private API key P8
        env:
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
        run: |
          mkdir -p ~/private_keys
          echo -n "$APPLE_API_PRIVATE_KEY" | base64 --decode --output ~/private_keys/AuthKey_$APPLE_API_KEY.p8

      - name: Upload app
        env:
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ISSUER: ${{ secrets.APPLE_API_KEY_ISSUER }}
        run: |
          IPA_NAME="${{ steps.create_env.outputs.APP_NAME }}"
          IPA_NAME="${IPA_NAME// /}"
          cd OwnTube.tv/ios
          xcrun altool --upload-app \
          --type ${{ inputs.target }} \
          --file build/OwnTube/$IPA_NAME.ipa \
          --apiKey "$APPLE_API_KEY" \
          --apiIssuer "$APPLE_API_KEY_ISSUER"

      - name: Clean up keychain and provisioning profile
        if: ${{ always() }}
        run: |
          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
          rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision
          rm -rf ~/private_keys
          security list-keychains -s ~/Library/Keychains/login.keychain-db
          security lock-keychain ~/Library/Keychains/login.keychain-db