@daemux/store-automator 0.7.1 → 0.8.0

package/bin/cli.mjs

@@ -34,6 +34,8 @@ const valueFlags = {
   '--cloudflare-token=': 'cloudflareToken',
   '--cloudflare-account-id=': 'cloudflareAccountId',
   '--bundle-id=': 'bundleId',
+  '--match-deploy-key=': 'matchDeployKey',
+  '--match-git-url=': 'matchGitUrl',
 };
 
 for (const arg of args) {
@@ -42,15 +44,11 @@ for (const arg of args) {
   if ((v = flagValue(arg, '--branch=')) !== undefined) { cmBranch = v; continue; }
   if ((v = flagValue(arg, '--workflow=')) !== undefined) { cmWorkflowId = v; continue; }
 
-  let matched = false;
-  for (const [prefix, key] of Object.entries(valueFlags)) {
-    if ((v = flagValue(arg, prefix)) !== undefined) {
-      cliTokens[key] = v;
-      matched = true;
-      break;
-    }
+  const valueFlagEntry = Object.entries(valueFlags).find(([prefix]) => arg.startsWith(prefix));
+  if (valueFlagEntry) {
+    cliTokens[valueFlagEntry[1]] = arg.slice(valueFlagEntry[0].length);
+    continue;
   }
-  if (matched) continue;
 
   switch (arg) {
     case '-g':
@@ -70,6 +68,9 @@ for (const arg of args) {
     case '--github-setup':
       action = 'github-setup';
       break;
+    case '--github-actions':
+      cliTokens.githubActions = true;
+      break;
     case '--trigger':
       cmTrigger = true;
       break;
@@ -105,34 +106,57 @@ Codemagic:
   --trigger                      Trigger build after setup
   --wait                         Wait for build completion (implies --trigger)
 
+GitHub Actions CI mode:
+  --github-actions               Use GitHub Actions instead of Codemagic (skip MCP setup)
+  --match-deploy-key=PATH        Path to Match deploy key file (required with --github-actions)
+  --match-git-url=URL            Git URL for Match certificates repo (required with --github-actions)
+
 GitHub Actions (auto-configured during install if gh CLI available):
   --github-setup                 Set CM_API_TOKEN secret for GitHub Actions
   --token=TOKEN                  API token (or set CM_API_TOKEN env var)
 
 Examples:
-  npx @daemux/store-automator                          Install for project
+  npx @daemux/store-automator                          Install for project (Codemagic)
   npx @daemux/store-automator -g                       Install globally
   npx @daemux/store-automator -u                       Uninstall from project
   npx @daemux/store-automator -g -u                    Uninstall globally
   npx @daemux/store-automator --codemagic-setup        Register with Codemagic
   npx @daemux/store-automator --codemagic-setup --trigger --wait  Trigger and wait
-  npx @daemux/store-automator --github-setup           Configure GitHub Actions
+  npx @daemux/store-automator --github-setup           Configure GitHub Actions secret
+
+GitHub Actions install:
+  npx @daemux/store-automator --github-actions --bundle-id=ID --match-deploy-key=PATH --match-git-url=URL
 
-Non-interactive install (CI/CD):
-  npx @daemux/store-automator --bundle-id=com.company.app --codemagic-token=TOKEN --codemagic-team-id=ID --stitch-key=KEY
+Non-interactive install (Codemagic):
+  npx @daemux/store-automator --bundle-id=ID --codemagic-token=TOKEN --stitch-key=KEY
   npx @daemux/store-automator --cloudflare-token=TOKEN --cloudflare-account-id=ID`);
       process.exit(0);
-      break; // eslint: no-fallthrough
     case '-v':
     case '--version':
       console.log(pkg.version);
       process.exit(0);
-      break; // eslint: no-fallthrough
   }
 }
 
 if (cmWait) cmTrigger = true;
 
+if (cliTokens.githubActions) {
+  const missing = [];
+  if (!cliTokens.matchDeployKey) missing.push('--match-deploy-key');
+  if (!cliTokens.matchGitUrl) missing.push('--match-git-url');
+  if (!cliTokens.bundleId) missing.push('--bundle-id');
+  if (missing.length > 0) {
+    console.error(`Error: --github-actions requires: ${missing.join(', ')}`);
+    console.error('');
+    console.error('Example:');
+    console.error('  npx @daemux/store-automator --github-actions \\');
+    console.error('    --bundle-id=com.company.app \\');
+    console.error('    --match-deploy-key=creds/match_deploy_key \\');
+    console.error('    --match-git-url=git@github.com:org/certs.git');
+    process.exit(1);
+  }
+}
+
 notifier.notify();
 
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemux/store-automator",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "Full App Store & Google Play automation for Flutter apps with Claude Code agents",
   "type": "module",
   "bin": {

package/plugins/store-automator/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "store-automator",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "App Store & Google Play automation agents for Flutter app publishing",
   "author": {
     "name": "Daemux"

package/src/ci-config.mjs

@@ -7,6 +7,8 @@ const FIELD_PATTERNS = {
   team_id: /^(\s*team_id:\s*)"[^"]*"/m,
   bundle_id: /^(\s*bundle_id:\s*)"[^"]*"/m,
   package_name: /^(\s*package_name:\s*)"[^"]*"/m,
+  deploy_key_path: /^(\s*deploy_key_path:\s*)"[^"]*"/m,
+  git_url: /^(\s*git_url:\s*)"[^"]*"/m,
 };
 
 function writeCiField(projectDir, field, value) {
@@ -44,3 +46,22 @@ export function writeCiBundleId(projectDir, bundleId) {
 export function writeCiPackageName(projectDir, packageName) {
   return writeCiField(projectDir, 'package_name', packageName);
 }
+
+export function writeMatchConfig(projectDir, { deployKeyPath, gitUrl }) {
+  const wrote1 = writeCiField(projectDir, 'deploy_key_path', deployKeyPath);
+  const wrote2 = writeCiField(projectDir, 'git_url', gitUrl);
+  return wrote1 || wrote2;
+}
+
+export function readFlutterRoot(projectDir) {
+  const configPath = join(projectDir, CI_CONFIG_FILE);
+  if (!existsSync(configPath)) return '.';
+
+  try {
+    const content = readFileSync(configPath, 'utf8');
+    const match = content.match(/^flutter_root:\s*"([^"]*)"/m);
+    return match ? match[1] : '.';
+  } catch {
+    return '.';
+  }
+}

package/src/install-paths.mjs

@@ -0,0 +1,93 @@
+import { execSync, execFileSync } from 'node:child_process';
+import { installGitHubActionsTemplates, installMatchfile } from './templates.mjs';
+import { findAppByRepo, addApp, normalizeRepoUrl } from './codemagic-api.mjs';
+import {
+  writeCiAppId, writeCiTeamId, writeMatchConfig, readFlutterRoot,
+} from './ci-config.mjs';
+import { updateMcpAppId, updateMcpTeamId } from './mcp-setup.mjs';
+
+function setupGitHubActionsSecret(codemagicToken) {
+  if (!codemagicToken) return false;
+
+  try {
+    execFileSync('which', ['gh'], { encoding: 'utf8', stdio: 'pipe' });
+    const authStatus = execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: 'pipe' });
+    if (authStatus.includes('not logged')) return false;
+
+    execFileSync('gh', ['secret', 'set', 'CM_API_TOKEN', '--body', codemagicToken], {
+      encoding: 'utf8',
+      stdio: 'pipe',
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function setupCodemagicApp(projectDir, codemagicToken, codemagicTeamId) {
+  if (!codemagicToken) return;
+
+  let repoUrl;
+  try {
+    const raw = execSync('git remote get-url origin', {
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    if (!raw) return;
+    repoUrl = normalizeRepoUrl(raw);
+  } catch {
+    return;
+  }
+
+  try {
+    let app = await findAppByRepo(codemagicToken, repoUrl);
+    if (!app) {
+      app = await addApp(codemagicToken, repoUrl, codemagicTeamId);
+      console.log(`Codemagic app created: ${app.appName || app._id}`);
+    } else {
+      console.log(`Codemagic app found: ${app.appName || app._id}`);
+    }
+
+    const written = writeCiAppId(projectDir, app._id);
+    if (written) {
+      console.log(`Codemagic app_id written to ci.config.yaml`);
+    }
+
+    updateMcpAppId(projectDir, app._id);
+
+    if (codemagicTeamId) {
+      writeCiTeamId(projectDir, codemagicTeamId);
+      updateMcpTeamId(projectDir, codemagicTeamId);
+    }
+  } catch (err) {
+    console.log(`Codemagic auto-setup skipped: ${err.message || err}`);
+  }
+}
+
+export function installGitHubActionsPath(projectDir, packageDir, cliTokens) {
+  console.log('Configuring GitHub Actions mode...');
+  installGitHubActionsTemplates(projectDir, packageDir);
+
+  const flutterRoot = readFlutterRoot(projectDir);
+  installMatchfile(projectDir, packageDir, flutterRoot, {
+    matchGitUrl: cliTokens.matchGitUrl,
+    bundleId: cliTokens.bundleId,
+  });
+
+  const wrote = writeMatchConfig(projectDir, {
+    deployKeyPath: cliTokens.matchDeployKey,
+    gitUrl: cliTokens.matchGitUrl,
+  });
+  if (wrote) console.log('Match credentials written to ci.config.yaml');
+}
+
+export async function installCodemagicPath(projectDir, tokens) {
+  await setupCodemagicApp(projectDir, tokens.codemagicToken, tokens.codemagicTeamId);
+
+  const ghConfigured = setupGitHubActionsSecret(tokens.codemagicToken);
+  if (ghConfigured) {
+    console.log('GitHub Actions: CM_API_TOKEN secret configured.');
+  } else if (tokens.codemagicToken) {
+    console.log('GitHub Actions: secret not set (gh CLI unavailable or not authenticated).');
+  }
+}

package/src/install.mjs

@@ -1,7 +1,7 @@
 import { existsSync, rmSync, cpSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { execSync, execFileSync } from 'node:child_process';
+import { execSync } from 'node:child_process';
 import {
   MARKETPLACE_DIR, KNOWN_MP_PATH, CACHE_DIR,
   MARKETPLACE_NAME, PLUGIN_REF,
@@ -9,10 +9,10 @@ import {
 } from './utils.mjs';
 import { injectEnvVars, injectStatusLine } from './settings.mjs';
 import { promptForTokens } from './prompt.mjs';
-import { getMcpServers, writeMcpJson, updateMcpAppId, updateMcpTeamId } from './mcp-setup.mjs';
+import { getMcpServers, writeMcpJson } from './mcp-setup.mjs';
 import { installClaudeMd, installCiTemplates, installFirebaseTemplates } from './templates.mjs';
-import { findAppByRepo, addApp, normalizeRepoUrl } from './codemagic-api.mjs';
-import { writeCiAppId, writeCiTeamId, writeCiBundleId, writeCiPackageName } from './ci-config.mjs';
+import { writeCiBundleId, writeCiPackageName } from './ci-config.mjs';
+import { installGitHubActionsPath, installCodemagicPath } from './install-paths.mjs';
 
 function checkClaudeCli() {
   const result = exec('command -v claude') || exec('which claude');
@@ -94,61 +94,19 @@ function printSummary(scope, oldVersion, newVersion) {
   }
 }
 
-function setupGitHubActions(codemagicToken) {
-  if (!codemagicToken) return false;
-
-  try {
-    execFileSync('which', ['gh'], { encoding: 'utf8', stdio: 'pipe' });
-    const authStatus = execFileSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: 'pipe' });
-    if (authStatus.includes('not logged')) return false;
-
-    execFileSync('gh', ['secret', 'set', 'CM_API_TOKEN', '--body', codemagicToken], {
-      encoding: 'utf8',
-      stdio: 'pipe',
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function setupCodemagicApp(projectDir, codemagicToken, codemagicTeamId) {
-  if (!codemagicToken) return;
-
-  let repoUrl;
-  try {
-    const raw = execSync('git remote get-url origin', {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
-    if (!raw) return;
-    repoUrl = normalizeRepoUrl(raw);
-  } catch {
-    return;
-  }
-
-  try {
-    let app = await findAppByRepo(codemagicToken, repoUrl);
-    if (!app) {
-      app = await addApp(codemagicToken, repoUrl, codemagicTeamId);
-      console.log(`Codemagic app created: ${app.appName || app._id}`);
-    } else {
-      console.log(`Codemagic app found: ${app.appName || app._id}`);
-    }
-
-    const written = writeCiAppId(projectDir, app._id);
-    if (written) {
-      console.log(`Codemagic app_id written to ci.config.yaml`);
-    }
-
-    updateMcpAppId(projectDir, app._id);
-
-    if (codemagicTeamId) {
-      writeCiTeamId(projectDir, codemagicTeamId);
-      updateMcpTeamId(projectDir, codemagicTeamId);
-    }
-  } catch (err) {
-    console.log(`Codemagic auto-setup skipped: ${err.message || err}`);
+function printNextSteps(isGitHubActions) {
+  console.log('');
+  console.log('Next steps:');
+  if (isGitHubActions) {
+    console.log('  1. Fill ci.config.yaml with credentials');
+    console.log('  2. Add creds/AuthKey.p8 and creds/play-service-account.json');
+    console.log('  3. Set MATCH_PASSWORD secret in GitHub repository settings');
+    console.log('  4. Start Claude Code');
+  } else {
+    console.log('  1. Fill ci.config.yaml (codemagic.app_id is auto-configured if token was provided)');
+    console.log('  2. Add creds/AuthKey.p8 and creds/play-service-account.json');
+    console.log('  3. Start Claude Code');
+    console.log('  Note: For auto-trigger, install gh CLI and run "gh auth login"');
   }
 }
 
@@ -157,11 +115,18 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
 
   console.log('Installing/updating Daemux Store Automator...');
 
-  const tokens = await promptForTokens(cliTokens);
+  const isGitHubActions = Boolean(cliTokens.githubActions);
+
+  const tokens = isGitHubActions
+    ? { bundleId: cliTokens.bundleId ?? '' }
+    : await promptForTokens(cliTokens);
 
   const projectDir = process.cwd();
-  const servers = getMcpServers(tokens);
-  writeMcpJson(projectDir, servers);
+
+  if (!isGitHubActions) {
+    const servers = getMcpServers(tokens);
+    writeMcpJson(projectDir, servers);
+  }
 
   const oldVersion = readMarketplaceVersion();
   const packageDir = getPackageDir();
@@ -189,7 +154,11 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
     writeCiPackageName(projectDir, tokens.bundleId);
   }
 
-  await setupCodemagicApp(projectDir, tokens.codemagicToken, tokens.codemagicTeamId);
+  if (isGitHubActions) {
+    installGitHubActionsPath(projectDir, packageDir, cliTokens);
+  } else {
+    await installCodemagicPath(projectDir, tokens);
+  }
 
   const scopeLabel = scope === 'user' ? 'global' : 'project';
   console.log(`Configuring ${scopeLabel} settings...`);
@@ -197,20 +166,6 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
   injectEnvVars(settingsPath);
   injectStatusLine(settingsPath);
 
-  const ghConfigured = setupGitHubActions(tokens.codemagicToken);
-  if (ghConfigured) {
-    console.log('GitHub Actions: CM_API_TOKEN secret configured.');
-  } else if (tokens.codemagicToken) {
-    console.log('GitHub Actions: secret not set (gh CLI unavailable or not authenticated).');
-  }
-
   printSummary(scope, oldVersion, newVersion);
-  console.log('');
-  console.log('Next steps:');
-  console.log('  1. Fill ci.config.yaml (codemagic.app_id is auto-configured if token was provided)');
-  console.log('  2. Add creds/AuthKey.p8 and creds/play-service-account.json');
-  console.log('  3. Start Claude Code');
-  if (!ghConfigured) {
-    console.log('  Note: For auto-trigger, install gh CLI and run "gh auth login"');
-  }
+  printNextSteps(isGitHubActions);
 }

package/src/templates.mjs

@@ -1,4 +1,4 @@
-import { existsSync, cpSync, copyFileSync } from 'node:fs';
+import { existsSync, cpSync, copyFileSync, chmodSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { ensureDir } from './utils.mjs';
 
@@ -22,6 +22,17 @@ const FIREBASE_COPIES = [
   ['firebase/.firebaserc.template', 'backend/.firebaserc'],
 ];
 
+const GH_ACTIONS_WORKFLOWS = [
+  ['github/workflows/ios-release.yml', '.github/workflows/ios-release.yml'],
+  ['github/workflows/android-release.yml', '.github/workflows/android-release.yml'],
+];
+
+const GH_ACTIONS_SCRIPT_DIRS = [
+  'scripts/ci/common',
+  'scripts/ci/android',
+  'scripts/ci/ios',
+];
+
 function copyIfMissing(srcPath, destPath, label, isDirectory) {
   if (!existsSync(srcPath)) return;
   if (existsSync(destPath)) {
@@ -81,3 +92,62 @@ export function installFirebaseTemplates(projectDir, packageDir) {
     copyIfMissing(join(templateDir, src), join(projectDir, dest), dest, false);
   }
 }
+
+function copyOrUpdate(srcPath, destPath, label) {
+  if (!existsSync(srcPath)) return;
+  ensureDir(join(destPath, '..'));
+  if (existsSync(destPath)) {
+    console.log(`  ${label} exists, overwriting.`);
+  }
+  copyFileSync(srcPath, destPath);
+}
+
+function chmodShFiles(dirPath) {
+  if (!existsSync(dirPath)) return;
+  for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+    const fullPath = join(dirPath, entry.name);
+    if (entry.isDirectory()) {
+      chmodShFiles(fullPath);
+    } else if (entry.name.endsWith('.sh')) {
+      chmodSync(fullPath, 0o755);
+    }
+  }
+}
+
+export function installGitHubActionsTemplates(projectDir, packageDir) {
+  console.log('Installing GitHub Actions templates...');
+  const templateDir = join(packageDir, 'templates');
+
+  for (const [src, dest] of GH_ACTIONS_WORKFLOWS) {
+    copyOrUpdate(join(templateDir, src), join(projectDir, dest), dest);
+  }
+
+  for (const scriptDir of GH_ACTIONS_SCRIPT_DIRS) {
+    const scriptsSrc = join(templateDir, scriptDir);
+    const scriptsDest = join(projectDir, scriptDir);
+    if (existsSync(scriptsSrc)) {
+      ensureDir(scriptsDest);
+      cpSync(scriptsSrc, scriptsDest, { recursive: true });
+      chmodShFiles(scriptsDest);
+      console.log(`  ${scriptDir}/ copied.`);
+    }
+  }
+}
+
+export function installMatchfile(projectDir, packageDir, flutterRoot, { matchGitUrl, bundleId }) {
+  console.log('Installing Matchfile...');
+  const src = join(packageDir, 'templates', 'Matchfile.template');
+  if (!existsSync(src)) return;
+
+  const destDir = join(projectDir, flutterRoot, 'ios', 'fastlane');
+  ensureDir(destDir);
+  const dest = join(destDir, 'Matchfile');
+
+  copyOrUpdate(src, dest, 'Matchfile');
+
+  const content = readFileSync(dest, 'utf8');
+  const updated = content
+    .replace('{{MATCH_GIT_URL}}', matchGitUrl)
+    .replace('{{BUNDLE_ID}}', bundleId);
+  writeFileSync(dest, updated, 'utf8');
+}

package/templates/Matchfile.template

@@ -0,0 +1,8 @@
+git_url(ENV["MATCH_GIT_URL"] || "{{MATCH_GIT_URL}}")
+storage_mode("git")
+type("appstore")
+app_identifier(ENV["BUNDLE_ID"] || "{{BUNDLE_ID}}")
+git_branch("main")
+
+# Set to true after initial cert creation for faster CI runs
+# readonly(true)

package/templates/ci.config.yaml.template

@@ -12,6 +12,9 @@ credentials:
     service_account_json_path: creds/play-service-account.json
   android:
     keystore_password: "REPLACE_WITH_PASSWORD"
+  match:
+    deploy_key_path: ""
+    git_url: ""
 
 # === APP IDENTITY ===
 app:

package/templates/fastlane/android/Fastfile.template

@@ -24,7 +24,7 @@ end
 
 def rollout_options
   {
-    rollout: ENV.fetch("ROLLOUT_FRACTION", "").empty? ? nil : ENV["ROLLOUT_FRACTION"],
+    rollout: ENV.fetch("ROLLOUT_FRACTION", "").empty? ? nil : ENV["ROLLOUT_FRACTION"].to_f,
     in_app_update_priority: ENV.fetch("IN_APP_UPDATE_PRIORITY", "3").to_i
   }
 end
@@ -86,6 +86,6 @@ platform :android do
   lane :update_data_safety do
     script = "#{ROOT_DIR}/scripts/update_data_safety.py"
     csv = "#{ROOT_DIR}/fastlane/data_safety.csv"
-    sh("python3", script) if File.exist?(csv)
+    sh("python3", script, csv) if File.exist?(csv)
   end
 end

package/templates/github/workflows/android-release.yml

@@ -0,0 +1,72 @@
+name: Android Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      skip_build:
+        description: 'Skip build (metadata only)'
+        required: false
+        default: 'false'
+        type: boolean
+
+env:
+  FLUTTER_VERSION: '3.x'
+
+jobs:
+  android-release:
+    runs-on: macos-latest-xlarge
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Restore CI state cache
+        uses: actions/cache@v4
+        with:
+          path: .ci-state
+          key: ci-state-android-${{ github.ref_name }}
+          restore-keys: ci-state-android-
+
+      - name: Setup Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      - name: Upload metadata
+        run: scripts/ci/android/upload-metadata.sh
+
+      - name: Setup keystore
+        if: inputs.skip_build != 'true'
+        run: source scripts/ci/android/setup-keystore.sh
+
+      - name: Check Google Play readiness
+        if: inputs.skip_build != 'true'
+        run: scripts/ci/android/check-readiness.sh
+
+      - name: Manage Android version
+        if: inputs.skip_build != 'true'
+        run: source scripts/ci/android/manage-version.sh
+
+      - name: Flutter pub get
+        if: inputs.skip_build != 'true'
+        run: scripts/ci/common/flutter-setup.sh
+
+      - name: Build Android
+        if: inputs.skip_build != 'true'
+        run: scripts/ci/android/build.sh
+
+      - name: Upload binary
+        if: inputs.skip_build != 'true'
+        run: scripts/ci/android/upload-binary.sh
+
+      - name: Save CI state cache
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .ci-state
+          key: ci-state-android-${{ github.ref_name }}-${{ github.run_id }}

package/templates/github/workflows/ios-release.yml

@@ -0,0 +1,62 @@
+name: iOS Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      skip_build:
+        description: 'Skip build (metadata/screenshots only)'
+        required: false
+        default: 'false'
+        type: boolean
+
+env:
+  FLUTTER_VERSION: '3.x'
+
+jobs:
+  ios-release:
+    runs-on: macos-latest-xlarge
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Restore CI state cache
+        uses: actions/cache@v4
+        with:
+          path: .ci-state
+          key: ci-state-ios-${{ github.ref_name }}
+          restore-keys: ci-state-ios-
+
+      - name: Setup Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+
+      # Note: No separate "Load CI config" step needed here.
+      # Each script sources read-config.sh internally.
+
+      - name: Setup iOS signing (Fastlane Match)
+        env:
+          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+        run: scripts/ci/ios/setup-signing.sh
+
+      - name: Upload metadata & screenshots
+        run: scripts/ci/ios/upload-metadata.sh
+
+      - name: Sync IAP
+        run: scripts/ci/ios/sync-iap.sh
+
+      # Build & upload binary steps (added when build scripts are created)
+      # - name: Build iOS
+      #   if: inputs.skip_build != 'true'
+      #   run: scripts/ci/ios/build.sh
+
+      # - name: Upload binary
+      #   if: inputs.skip_build != 'true'
+      #   run: scripts/ci/ios/upload-binary.sh
+
+      - name: Save CI state cache
+        if: always()
+        uses: actions/cache/save@v4
+        with:
+          path: .ci-state
+          key: ci-state-ios-${{ github.ref_name }}-${{ github.run_id }}