@moifort/stack 0.0.0-stage → 0.1.0

package/templates/ios/.github/workflows/ios-upload.yml

@@ -0,0 +1,308 @@
+name: iOS upload
+
+# Archives, signs and uploads one build to App Store Connect. Called by release-ios.yml (a
+# tagged release, then submitted for review) and by testflight-ios.yml (the nightly build for
+# the internal TestFlight group): the signing is the same, only the trigger and what happens
+# to the build afterwards differ.
+
+on:
+  workflow_call:
+    inputs:
+      marketing_version:
+        description: 'Marketing version (CFBundleShortVersionString), e.g. 1.1'
+        type: string
+        required: true
+      skip_upload:
+        description: 'Archive and push the symbols to Sentry, but stop before App Store Connect'
+        type: boolean
+        default: false
+    outputs:
+      build:
+        description: 'The build number (CFBundleVersion): the commit count of HEAD'
+        value: ${{ jobs.check.outputs.build }}
+      exists:
+        description: 'Whether App Store Connect already had this build before the run'
+        value: ${{ jobs.check.outputs.exists }}
+
+permissions:
+  contents: read
+
+jobs:
+  # The build number is the commit count, so it names a commit: a build that already exists
+  # on App Store Connect for this version is this very commit, uploaded before. Re-uploading
+  # it would be refused, and archiving it would spend forty minutes of macOS for nothing — so
+  # this is also what makes the nightly build a no-op when main has not moved.
+  check:
+    name: 🔎 Already on App Store Connect?
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      build: ${{ steps.build.outputs.build }}
+      exists: ${{ steps.check.outputs.exists }}
+      previous: ${{ steps.check.outputs.previous }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0   # git rev-list --count HEAD must see the full history
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Compute the build number
+        id: build
+        run: echo "build=$(git rev-list --count HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Look the build up
+        id: check
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          MARKETING: ${{ inputs.marketing_version }}
+          BUILD: ${{ steps.build.outputs.build }}
+        run: |
+          set -euo pipefail
+          bun scripts/testflight.ts check "$MARKETING" "$BUILD" | tee -a "$GITHUB_OUTPUT"
+          if grep -q '^exists=true' "$GITHUB_OUTPUT"; then
+            echo "::notice::{{APP_NAME}} $MARKETING ($BUILD) is already on App Store Connect — nothing to upload"
+          fi
+
+  # With the `e2e` stack, an end-to-end job gates this one: `needs: [check, e2e]`.
+  upload:
+    name: 📱 iOS build & upload
+    needs: check
+    if: needs.check.outputs.exists != 'true'
+    runs-on: macos-26
+    timeout-minutes: 40
+    outputs:
+      uploaded: ${{ steps.upload.outputs.uploaded }}
+    env:
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+      MARKETING: ${{ inputs.marketing_version }}
+      BUILD: ${{ needs.check.outputs.build }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0   # sentry-cli set-commits --local reads the history
+
+      - name: Select the latest final Xcode
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: latest-stable
+
+      - name: Generate the Xcode project
+        run: |
+          brew install xcodegen
+          (cd ios && xcodegen generate)
+
+      - name: Materialize gitignored build files
+        env:
+          IOS_SENTRY_DSN: ${{ secrets.IOS_SENTRY_DSN }}
+        run: |
+          set -euo pipefail
+          printf '%s' "${{ secrets.IOS_GOOGLE_SERVICE_INFO_PLIST }}" \
+            | openssl base64 -d -A > ios/{{APP_NAME}}/GoogleService-Info.plist
+          # The archived build is the only one that reports to Sentry, and it reads the
+          # DSN from this gitignored file. Copying the example here would ship a build
+          # that reports nothing at all — no crash, no error, no user feedback — and
+          # nothing on the way would say so. Refuse to archive that build.
+          if [ -z "$IOS_SENTRY_DSN" ]; then
+            echo "::error::IOS_SENTRY_DSN is unset — this build could not report anything to Sentry"
+            exit 1
+          fi
+          cat > ios/{{APP_NAME}}/Shared/Secrets.swift <<SWIFT
+          import Foundation
+
+          enum Secrets {
+              static let apiToken = ""
+              static let sentryDsn = "$IOS_SENTRY_DSN"
+          }
+          SWIFT
+
+      - name: Install the App Store Connect API key
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.appstoreconnect/private_keys"
+          printf '%s' "${{ secrets.ASC_KEY_P8 }}" \
+            > "$HOME/.appstoreconnect/private_keys/AuthKey_${ASC_KEY_ID}.p8"
+
+      - name: Import the distribution signing certificate
+        env:
+          IOS_DIST_CERT_P12: ${{ secrets.IOS_DIST_CERT_P12 }}
+          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
+        run: |
+          set -euo pipefail
+          # A dedicated (non-managed) Apple Distribution cert + private key, so signing
+          # never depends on Xcode cloud-managed certificates (unusable from a fresh CI
+          # machine). The .p12 is base64-encoded in the secret; import it into a throwaway
+          # keychain that codesign/xcodebuild search during archive and export.
+          KEYCHAIN="$RUNNER_TEMP/{{APP_SLUG}}-signing.keychain-db"
+          KEYCHAIN_PASSWORD="$(uuidgen)"
+          CERT_PATH="$RUNNER_TEMP/dist-cert.p12"
+          printf '%s' "$IOS_DIST_CERT_P12" | base64 -d > "$CERT_PATH"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security import "$CERT_PATH" -P "$IOS_DIST_CERT_PASSWORD" \
+            -A -t cert -f pkcs12 -k "$KEYCHAIN"
+          security set-key-partition-list -S apple-tool:,apple: \
+            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" >/dev/null
+          # Prepend our keychain to the user search list so xcodebuild finds the identity.
+          security list-keychains -d user -s "$KEYCHAIN" \
+            $(security list-keychains -d user | sed 's/["[:space:]]//g')
+          rm -f "$CERT_PATH"
+          security find-identity -v -p codesigning "$KEYCHAIN"
+
+      - name: Generate Apollo GraphQL code (gitignored, regenerated per build)
+        run: |
+          set -euo pipefail
+          # Resolve SPM so the apollo-ios checkout (and its bundled CLI) exists.
+          xcodebuild -resolvePackageDependencies \
+            -project ios/{{APP_NAME}}.xcodeproj -scheme {{APP_NAME}}
+          # Apollo 2.x ships the CLI as a tarball inside the checkout — extract it.
+          CLI_DIR=$(find "$HOME/Library/Developer/Xcode/DerivedData" -type d \
+            -path "*/SourcePackages/checkouts/apollo-ios/CLI" | head -1)
+          tar -xzf "$CLI_DIR/apollo-ios-cli.tar.gz" -C "$CLI_DIR"
+          chmod +x "$CLI_DIR/apollo-ios-cli"
+          (cd ios && "$CLI_DIR/apollo-ios-cli" generate)
+
+      - name: Install the App Store provisioning profiles
+        env:
+          IOS_PROVISION_PROFILE: ${{ secrets.IOS_PROVISION_PROFILE }}
+        run: |
+          set -euo pipefail
+          PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
+          mkdir -p "$PROFILES_DIR"
+          install_profile() {
+            local name="$1" encoded="$2"
+            if [ -z "$encoded" ]; then
+              echo "::error::$name is unset — create the profile in the Apple Developer portal and store it as a base64 secret"
+              exit 1
+            fi
+            # Xcode looks a profile up by the UUID in its file name. Reading it from
+            # the profile means a renewed profile only needs the secret replaced,
+            # not this step edited.
+            local path="$RUNNER_TEMP/$name.mobileprovision"
+            printf '%s' "$encoded" | base64 -d > "$path"
+            security cms -D -i "$path" > "$RUNNER_TEMP/$name.plist"
+            local uuid
+            uuid=$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$RUNNER_TEMP/$name.plist")
+            mv "$path" "$PROFILES_DIR/$uuid.mobileprovision"
+            echo "Installed provisioning profile $uuid ($name)"
+          }
+          install_profile IOS_PROVISION_PROFILE "$IOS_PROVISION_PROFILE"
+
+      - name: Archive (Release, manual signing with the installed cert and profile)
+        run: |
+          set -euo pipefail
+          # The Release configuration signs manually with the imported distribution
+          # certificate and the installed App Store profile, so the archive never talks
+          # to App Store Connect (its provisioning endpoint intermittently answers 401).
+          xcodebuild -project ios/{{APP_NAME}}.xcodeproj -scheme {{APP_NAME}} \
+            -destination 'generic/platform=iOS' \
+            -archivePath build/{{APP_NAME}}.xcarchive \
+            MARKETING_VERSION="$MARKETING" \
+            CURRENT_PROJECT_VERSION="$BUILD" \
+            archive
+
+      - name: Upload the debug symbols to Sentry
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: polyforms
+          SENTRY_PROJECT: {{APP_SLUG}}-ios
+        run: |
+          set -euo pipefail
+          # A crash report only names functions and lines if the dSYMs of that exact
+          # build reached Sentry. They live in the archive and nowhere else, so this
+          # has to happen here — an unsymbolicated crash cannot be fixed afterwards.
+          if [ -z "$SENTRY_AUTH_TOKEN" ]; then
+            echo "::warning::SENTRY_AUTH_TOKEN is unset — shipping a build Sentry cannot symbolicate"
+            exit 0
+          fi
+          curl -sL https://sentry.io/get-cli/ | bash
+          # --include-sources bundles the Swift sources alongside the symbols, so
+          # an issue shows the code around the crashing line instead of just its
+          # number.
+          sentry-cli debug-files upload --include-sources build/{{APP_NAME}}.xcarchive/dSYMs
+          # The Cocoa SDK stamps this exact release on every event it sends, so
+          # declaring it here with its commits is what lets an issue name the
+          # change that introduced it. --local reads the git history directly:
+          # no Sentry-GitHub integration to configure.
+          RELEASE="{{BUNDLE_ID}}@$MARKETING+$BUILD"
+          sentry-cli releases new "$RELEASE"
+          sentry-cli releases set-commits "$RELEASE" --local --ignore-missing
+          sentry-cli releases finalize "$RELEASE"
+
+      - name: Export a signed .ipa (manual signing)
+        run: |
+          set -euo pipefail
+          xcodebuild -exportArchive \
+            -archivePath build/{{APP_NAME}}.xcarchive \
+            -exportOptionsPlist ios/ExportOptions.plist \
+            -exportPath build/export
+
+      # Lets a manual run prove the archive and the Sentry symbol upload without
+      # spending a build number on App Store Connect. A tag push never sets this.
+      - name: Upload to App Store Connect
+        id: upload
+        if: ${{ inputs.skip_upload != true }}
+        run: |
+          set -euo pipefail
+          xcrun altool --upload-app --type ios \
+            --file build/export/{{APP_NAME}}.ipa \
+            --apiKey "$ASC_KEY_ID" \
+            --apiIssuer "$ASC_ISSUER_ID"
+          echo "uploaded=true" >> "$GITHUB_OUTPUT"
+
+      - name: Archive the .ipa as a run artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: {{APP_NAME}}-ipa
+          path: |
+            build/export/*.ipa
+          if-no-files-found: ignore
+          retention-days: 14
+
+  # Every upload reaches the internal "Nightly" group on its own — the group has access to
+  # all builds and the app declares no non-exempt encryption, so there is no compliance
+  # question to answer. What is left is telling testers what changed: the commit subjects
+  # since the previous upload, whose build number is the commit count it was made from.
+  # The external "Public" group only sees the builds added to it, so each one is added and
+  # submitted to Beta App Review once processed.
+  notes:
+    name: 📝 TestFlight notes
+    needs: [check, upload]
+    if: needs.upload.outputs.uploaded == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 70
+    env:
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+      ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+      MARKETING: ${{ inputs.marketing_version }}
+      BUILD: ${{ needs.check.outputs.build }}
+      PREVIOUS: ${{ needs.check.outputs.previous }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Collect the commit subjects since the previous upload
+        run: |
+          set -euo pipefail
+          SINCE=""
+          if [[ "$PREVIOUS" =~ ^[0-9]+$ ]] && [ "$PREVIOUS" -lt "$BUILD" ]; then
+            SINCE=$(git rev-list --reverse HEAD | sed -n "${PREVIOUS}p")
+          fi
+          RANGE="${SINCE:+$SINCE..}HEAD"
+          git log --no-merges --max-count=30 --format='- %s' "$RANGE" > "$RUNNER_TEMP/whats-new.txt"
+          cat "$RUNNER_TEMP/whats-new.txt"
+
+      - name: Set What to Test and wait for processing
+        run: bun scripts/testflight.ts notes "$MARKETING" "$BUILD" "$RUNNER_TEMP/whats-new.txt"
+
+      - name: Share with the external Public group
+        run: bun scripts/testflight.ts share "$MARKETING" "$BUILD"

package/templates/ios/.github/workflows/release-ios.yml

@@ -0,0 +1,178 @@
+name: Release
+
+on:
+  push:
+    tags: ['ios-v*']
+  workflow_dispatch:
+    inputs:
+      marketing_version:
+        description: 'Marketing version (CFBundleShortVersionString), e.g. 1.1'
+        required: false
+        default: '1.0'
+      skip_upload:
+        description: 'Archive and push the symbols to Sentry, but stop before App Store Connect'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+# Shared with testflight-ios.yml: two uploads at once would race for the same build number.
+concurrency:
+  group: ios-upload
+  cancel-in-progress: false
+
+jobs:
+  version:
+    name: 🏷️ Version
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      marketing: ${{ steps.version.outputs.marketing }}
+      submitted: ${{ steps.submitted.outputs.submitted }}
+    steps:
+      - name: Take the marketing version from the tag, or from the manual run
+        id: version
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.marketing_version }}
+        run: |
+          set -euo pipefail
+          if [ "$GITHUB_REF_TYPE" = "tag" ] && [ "${GITHUB_REF_NAME#ios-v}" != "$GITHUB_REF_NAME" ]; then
+            MARKETING="${GITHUB_REF_NAME#ios-v}"
+          else
+            MARKETING="$INPUT_VERSION"
+          fi
+          echo "marketing=$MARKETING" >> "$GITHUB_OUTPUT"
+          echo "Releasing {{APP_NAME}} $MARKETING"
+
+      - uses: actions/checkout@v7
+
+      - uses: oven-sh/setup-bun@v2
+
+      # A version sent to App Review by hand (the first subscription can only be attached
+      # from the web) is with Apple or on sale: nothing can be uploaded to it or
+      # submitted on it. Its tag then only records the release — the GitHub release is
+      # published, the upload and the submission are skipped.
+      - name: Is the version already with Apple?
+        id: submitted
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          MARKETING: ${{ steps.version.outputs.marketing }}
+        run: |
+          set -euo pipefail
+          bun scripts/testflight.ts submitted "$MARKETING" | tee -a "$GITHUB_OUTPUT"
+          if grep -q '^submitted=true' "$GITHUB_OUTPUT"; then
+            echo "::notice::{{APP_NAME}} $MARKETING is already with Apple — recording the tag, nothing uploaded or submitted"
+          fi
+
+  # Archive, sign and upload, shared with the nightly TestFlight build. When the tagged
+  # commit already went up as a nightly build of the same version, that binary is the one
+  # submitted: nothing is rebuilt.
+  release:
+    needs: version
+    if: needs.version.outputs.submitted != 'true'
+    uses: ./.github/workflows/ios-upload.yml
+    with:
+      marketing_version: ${{ needs.version.outputs.marketing }}
+      skip_upload: ${{ inputs.skip_upload == true }}
+    secrets: inherit
+
+  # After the binary is uploaded, wait for App Store Connect to finish processing it,
+  # then attach it to its version, set the "What's New" from CHANGELOG, and submit for
+  # review (auto-release on approval). No Xcode needed — runs on Linux. Tag pushes only;
+  # a manual workflow_dispatch stops after upload so it can be submitted by hand.
+  #
+  # The App Store panels are uploaded from the Mac before the tag, on request
+  # (stack rule 07-appstore.md): a version without them is refused by App Review.
+  submit:
+    name: 🍎 iOS submit
+    needs: [version, release]
+    # Runs after a skipped upload too (the version is already with Apple), never after a
+    # failed one.
+    if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/ios-v') && needs.release.result != 'failure' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write   # create/update the GitHub release for the tag
+    env:
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+      SUBMIT: ${{ needs.version.outputs.submitted != 'true' }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0   # git rev-list --count HEAD must see the full history
+
+      - uses: ruby/setup-ruby@v1
+        if: env.SUBMIT == 'true'
+        with:
+          ruby-version: '3.4.11'
+          bundler-cache: true
+          working-directory: infra
+
+      - name: Install the App Store Connect API key
+        if: env.SUBMIT == 'true'
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/asc"
+          printf '%s' "${{ secrets.ASC_KEY_P8 }}" > "$RUNNER_TEMP/asc/AuthKey.p8"
+          echo "ASC_KEY_PATH=$RUNNER_TEMP/asc/AuthKey.p8" >> "$GITHUB_ENV"
+
+      - name: Compute version numbers
+        run: |
+          set -euo pipefail
+          echo "BUILD=$(git rev-list --count HEAD)" >> "$GITHUB_ENV"
+          echo "MARKETING=${GITHUB_REF_NAME#ios-v}" >> "$GITHUB_ENV"
+
+      - name: Publish the GitHub release with the full changelog
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # Full (untruncated) bullets of the first "## " section — GitHub has no length cap.
+          NOTES="$RUNNER_TEMP/gh-release-notes.md"
+          awk '/^## /{n++; if (n==2) exit} n==1 && /^- /{print}' CHANGELOG.md > "$NOTES"
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            gh release edit "$GITHUB_REF_NAME" --title "iOS $MARKETING" --notes-file "$NOTES"
+          else
+            gh release create "$GITHUB_REF_NAME" --title "iOS $MARKETING" --notes-file "$NOTES"
+          fi
+
+      - name: Build the "What's New" notes for every App Store locale
+        if: env.SUBMIT == 'true'
+        run: |
+          set -euo pipefail
+          # One release_notes.txt per declared App Store locale. App Store Connect asks for
+          # "What's New" in each of them, and a locale deliver does not write keeps whatever
+          # it had — which on a new version is nothing. One pair per listing of
+          # infra/fastlane/metadata/: notes for a locale with no listing would make
+          # deliver create it with no description and no screenshots, and the
+          # submission would be refused. Add a locale here when its listing exists.
+          #
+          # Bullets under the first "## " section become the notes. App Store caps them at
+          # 4000 chars, so keep whole bullets until ~3900 and drop the rest.
+          for pair in \
+            "fr-FR:CHANGELOG.fr.md" \
+            "en-US:CHANGELOG.md"
+          do
+            locale="${pair%%:*}"
+            source="${pair#*:}"
+            mkdir -p "infra/fastlane/metadata/$locale"
+            awk '/^## /{n++; if (n==2) exit} n==1 && /^- /{print}' "$source" \
+              | awk 'BEGIN{max=3900; total=0} {len=length($0)+1; if (total+len>max) exit; total+=len; print}' \
+              > "infra/fastlane/metadata/$locale/release_notes.txt"
+            if [ ! -s "infra/fastlane/metadata/$locale/release_notes.txt" ]; then
+              echo "::error::No release notes for $locale — $source has no bullet under its first ## heading"
+              exit 1
+            fi
+            echo "---- What's New ($locale from $source), $(wc -c < "infra/fastlane/metadata/$locale/release_notes.txt") chars ----"
+            cat "infra/fastlane/metadata/$locale/release_notes.txt"
+          done
+
+      - name: Attach build and submit for review
+        if: env.SUBMIT == 'true'
+        working-directory: infra
+        run: bundle exec fastlane ios submit

package/templates/ios/.github/workflows/testflight-ios.yml

@@ -0,0 +1,57 @@
+name: TestFlight
+
+# Every night, puts main on the internal TestFlight group ("Nightly" in App Store Connect,
+# which has access to every build), so a change can be tried on a phone without tagging a
+# release that is not one. The build also goes to the external "Public" group through Beta
+# App Review, never to App Review. When main has not moved since the last upload, the build
+# already exists and ios-upload.yml stops before any macOS job.
+
+on:
+  schedule:
+    - cron: '0 1 * * *'   # 03:00 in Paris in summer, 02:00 in winter
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Shared with release-ios.yml: two uploads at once would race for the same build number.
+concurrency:
+  group: ios-upload
+  cancel-in-progress: false
+
+jobs:
+  version:
+    name: 🏷️ Version
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      marketing: ${{ steps.version.outputs.marketing }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0   # the ios-v* tags decide whether a version has shipped
+
+      # The version the next release will carry. The latest versioned heading of
+      # CHANGELOG.md is that release until its tag exists; once it has shipped, App Store
+      # Connect closes its train to new builds, so the nightly moves on to the next minor.
+      - name: Pick the version under development
+        id: version
+        run: |
+          set -euo pipefail
+          LATEST=$(grep -m1 -oE '^## [0-9]+(\.[0-9]+)+' CHANGELOG.md | cut -c4- || true)
+          if [ -z "$LATEST" ]; then
+            MARKETING=1.0
+          elif git rev-parse -q --verify "refs/tags/ios-v$LATEST" >/dev/null; then
+            MARKETING=$(echo "$LATEST" | awk -F. '{ print $1 "." $2 + 1 }')
+          else
+            MARKETING="$LATEST"
+          fi
+          echo "marketing=$MARKETING" >> "$GITHUB_OUTPUT"
+          echo "Nightly build of {{APP_NAME}} $MARKETING"
+
+  testflight:
+    needs: version
+    uses: ./.github/workflows/ios-upload.yml
+    with:
+      marketing_version: ${{ needs.version.outputs.marketing }}
+    secrets: inherit

package/templates/ios/infra/Gemfile

@@ -0,0 +1,5 @@
+source "https://rubygems.org"
+
+# Used only by CI (release-ios.yml `submit` job) to attach the uploaded build to its
+# App Store version and submit it for review. Not needed for local development.
+gem "fastlane"

package/templates/ios/infra/fastlane/Appfile

@@ -0,0 +1 @@
+app_identifier("{{BUNDLE_ID}}")

package/templates/ios/infra/fastlane/Fastfile

@@ -0,0 +1,54 @@
+default_platform(:ios)
+
+platform :ios do
+  # Screenshots are not uploaded from here: `deliver` once put every panel on a version
+  # twice, on a run it reported as successful. They go up from the Mac, on request.
+
+  # Attach the already-uploaded build to its App Store version, set the "What's New"
+  # notes from CHANGELOG.md, and submit for review with automatic release on approval.
+  # The binary is uploaded by the `release` job (altool); this lane never uploads it.
+  desc "Attach the uploaded build to its version and submit it for review (auto-release)."
+  lane :submit do
+    api_key = app_store_connect_api_key(
+      key_id: ENV.fetch("ASC_KEY_ID"),
+      issuer_id: ENV.fetch("ASC_ISSUER_ID"),
+      key_filepath: ENV.fetch("ASC_KEY_PATH")
+    )
+
+    app_id  = "{{BUNDLE_ID}}"
+    version = ENV.fetch("MARKETING")
+    build   = ENV.fetch("BUILD")
+
+    # App Store Connect needs several minutes to finish processing an uploaded build before
+    # it can be attached to a version — until then deliver raises "Build number: N does not
+    # exist". Retry the whole submit (metadata upload is idempotent) until the build is
+    # attachable, giving up after ~30 min.
+    attempts = 0
+    begin
+      deliver(
+        api_key: api_key,
+        app_identifier: app_id,
+        app_version: version,
+        build_number: build,
+        submit_for_review: true,
+        automatic_release: true,
+        force: true,                 # no interactive HTML preview
+        skip_binary_upload: true,    # the binary was already uploaded by the release job
+        skip_screenshots: true,      # screenshots are managed manually, once
+        run_precheck_before_submit: false,
+        submission_information: {
+          export_compliance_uses_encryption: false,
+          add_id_info_uses_idfa: false
+        }
+      )
+    rescue => e
+      attempts += 1
+      if attempts <= 30 && e.message.to_s.match?(/does not exist|still.*process|not.*process/i)
+        UI.message("Build #{build} not processed yet (attempt #{attempts}/30) — waiting 60s…")
+        sleep(60)
+        retry
+      end
+      raise
+    end
+  end
+end

package/templates/ios/infra/fastlane/metadata/copyright.txt

@@ -0,0 +1 @@
+2026 Polyforms

package/templates/ios/infra/fastlane/metadata/en-US/name.txt

@@ -0,0 +1 @@
+{{APP_NAME}}

package/templates/ios/infra/fastlane/metadata/en-US/privacy_url.txt

@@ -0,0 +1 @@
+https://{{APP_SLUG}}.polyforms.co/privacy.html

package/templates/ios/infra/fastlane/metadata/en-US/subtitle.txt

@@ -0,0 +1 @@
+{{APP_TAGLINE}}

package/templates/ios/infra/fastlane/metadata/en-US/support_url.txt

@@ -0,0 +1 @@
+https://{{APP_SLUG}}.polyforms.co

package/templates/ios/infra/fastlane/metadata/fr-FR/name.txt

@@ -0,0 +1 @@
+{{APP_NAME}}

package/templates/ios/infra/fastlane/metadata/fr-FR/privacy_url.txt

@@ -0,0 +1 @@
+https://{{APP_SLUG}}.polyforms.co/privacy.html

package/templates/ios/infra/fastlane/metadata/fr-FR/subtitle.txt

@@ -0,0 +1 @@
+{{APP_TAGLINE}}

package/templates/ios/infra/fastlane/metadata/fr-FR/support_url.txt

@@ -0,0 +1 @@
+https://{{APP_SLUG}}.polyforms.co

package/templates/ios/infra/fastlane/metadata/primary_category.txt

@@ -0,0 +1 @@
+UTILITIES