@softwareseva/cli 0.1.0

package/templates/modules/deploy-fastlane/files/ios/ExportOptions.plist

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>method</key>
+  <string>app-store-connect</string>
+  <key>teamID</key>
+  <string>{{APPLE_TEAM_ID}}</string>
+  <key>signingStyle</key>
+  <string>manual</string>
+  <key>provisioningProfiles</key>
+  <dict>
+    <key>{{BUNDLE_ID}}</key>
+    <string>match AppStore {{BUNDLE_ID}}</string>
+  </dict>
+  <key>uploadSymbols</key>
+  <true/>
+</dict>
+</plist>

package/templates/modules/deploy-fastlane/files/ios/Fastfile

@@ -0,0 +1,52 @@
+# iOS lanes. Run from ios/: bundle exec fastlane <lane>. Paths are resolved from this file, not the working directory.
+default_platform(:ios)
+
+APP_ROOT = File.expand_path("../..", __dir__)
+BUNDLE_ID = "{{BUNDLE_ID}}"
+
+platform :ios do
+  def api_key
+    app_store_connect_api_key(
+      key_id: ENV.fetch("APP_STORE_CONNECT_API_KEY_ID"),
+      issuer_id: ENV.fetch("APP_STORE_CONNECT_ISSUER_ID"),
+      key_content: ENV.fetch("APP_STORE_CONNECT_API_KEY_CONTENT"),
+      is_key_content_base64: true
+    )
+  end
+
+  def build_ipa(key)
+    setup_ci if ENV["CI"]
+    match(type: "appstore", readonly: is_ci, api_key: key)
+    update_code_signing_settings(
+      use_automatic_signing: false,
+      path: File.join(APP_ROOT, "ios/Runner.xcodeproj"),
+      targets: ["Runner"],
+      team_id: CredentialsManager::AppfileConfig.try_fetch_value(:team_id),
+      profile_name: "match AppStore #{BUNDLE_ID}",
+      code_sign_identity: "Apple Distribution"
+    )
+    build_number = ENV["BUILD_NUMBER"] || (latest_testflight_build_number(api_key: key, app_identifier: BUNDLE_ID) + 1).to_s
+    Dir.chdir(APP_ROOT) do
+      sh("flutter", "build", "ipa", "--release", "--build-number=#{build_number}", "--export-options-plist=ios/ExportOptions.plist")
+    end
+    Dir[File.join(APP_ROOT, "build/ios/ipa/*.ipa")].first || UI.user_error!("No .ipa produced")
+  end
+
+  desc "Create or fetch signing certificates and profiles (run once on a Mac with admin access)"
+  lane :certificates do
+    match(type: "development", api_key: api_key)
+    match(type: "appstore", api_key: api_key)
+  end
+
+  desc "Build and upload to TestFlight"
+  lane :beta do
+    key = api_key
+    upload_to_testflight(api_key: key, ipa: build_ipa(key), skip_waiting_for_build_processing: true)
+  end
+
+  desc "Build and upload to App Store Connect (submit for review in the web UI)"
+  lane :release do
+    key = api_key
+    upload_to_app_store(api_key: key, ipa: build_ipa(key), skip_metadata: true, skip_screenshots: true, submit_for_review: false, precheck_include_in_app_purchases: false)
+  end
+end

package/templates/modules/deploy-fastlane/files/ios/Matchfile

@@ -0,0 +1,5 @@
+git_url(ENV["MATCH_GIT_URL"])
+storage_mode("git")
+type("appstore")
+app_identifier(["{{BUNDLE_ID}}"])
+team_id("{{APPLE_TEAM_ID}}")

package/templates/modules/deploy-fastlane/files/mobile-release.yml

@@ -0,0 +1,87 @@
+name: mobile-release
+
+# Manual run, or push a tag like mobile-v1.4.0 to ship both platforms to their test tracks.
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        type: choice
+        options: [both, ios, android]
+        default: both
+      lane:
+        type: choice
+        options: [beta, release]
+        default: beta
+  push:
+    tags: ["mobile-v*"]
+
+env:
+  LANE: ${{ inputs.lane || 'beta' }}
+  BUILD_NUMBER: ${{ github.run_number }}
+
+jobs:
+  ios:
+    if: ${{ (inputs.platform || 'both') != 'android' }}
+    runs-on: macos-15
+    defaults:
+      run:
+        working-directory: {{APP_DIR}}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: {{FLUTTER_VERSION}}
+          cache: true
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+          working-directory: {{APP_DIR}}
+      - run: flutter pub get
+      - run: bundle exec fastlane ios "$LANE"
+        working-directory: {{APP_DIR}}/ios
+        env:
+          BUNDLE_GEMFILE: ${{ github.workspace }}/{{APP_DIR}}/Gemfile
+          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+          APP_STORE_CONNECT_API_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_API_KEY_CONTENT }}
+          MATCH_GIT_URL: ${{ secrets.MATCH_GIT_URL }}
+          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+          MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
+
+  android:
+    if: ${{ (inputs.platform || 'both') != 'ios' }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: {{APP_DIR}}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: {{FLUTTER_VERSION}}
+          cache: true
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+          working-directory: {{APP_DIR}}
+      - name: Write signing config
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > android/app/upload-keystore.jks
+          printf 'storePassword=%s\nkeyPassword=%s\nkeyAlias=%s\nstoreFile=upload-keystore.jks\n' "$ANDROID_KEYSTORE_PASSWORD" "$ANDROID_KEY_PASSWORD" "$ANDROID_KEY_ALIAS" > android/key.properties
+      - run: flutter pub get
+      - run: bundle exec fastlane android "$LANE"
+        working-directory: {{APP_DIR}}/android
+        env:
+          BUNDLE_GEMFILE: ${{ github.workspace }}/{{APP_DIR}}/Gemfile
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}

package/templates/modules/deploy-fastlane/module.json

@@ -0,0 +1,29 @@
+{
+  "name": "deploy-fastlane",
+  "description": "fastlane lanes and a GitHub Actions workflow that build a Flutter app and upload it to TestFlight / the App Store and Google Play, with certificates from fastlane match and an App Store Connect API key.",
+  "vars": {
+    "APP_DIR": { "detect": "flutterDir", "default": ".", "help": "Flutter project directory relative to the repo root" },
+    "BUNDLE_ID": { "detect": "iosBundleId", "default": "com.example.app" },
+    "PACKAGE_NAME": { "detect": "androidPackage", "default": "com.example.app" },
+    "APPLE_TEAM_ID": { "default": "ABCDE12345", "help": "10-character Apple team id" },
+    "FLUTTER_VERSION": { "default": "stable" }
+  },
+  "files": [
+    { "from": "Gemfile", "to": "{{APP_DIR}}/Gemfile" },
+    { "from": "ios/Fastfile", "to": "{{APP_DIR}}/ios/fastlane/Fastfile" },
+    { "from": "ios/Appfile", "to": "{{APP_DIR}}/ios/fastlane/Appfile" },
+    { "from": "ios/Matchfile", "to": "{{APP_DIR}}/ios/fastlane/Matchfile" },
+    { "from": "ios/ExportOptions.plist", "to": "{{APP_DIR}}/ios/ExportOptions.plist" },
+    { "from": "android/Fastfile", "to": "{{APP_DIR}}/android/fastlane/Fastfile" },
+    { "from": "android/Appfile", "to": "{{APP_DIR}}/android/fastlane/Appfile" },
+    { "from": "android/key.properties.example", "to": "{{APP_DIR}}/android/key.properties.example" },
+    { "from": "mobile-release.yml", "to": ".github/workflows/mobile-release.yml" }
+  ],
+  "next": [
+    "Android signing: add the key.properties block from the deploy-flutter-fastlane skill (references/android-signing.md) to {{APP_DIR}}/android/app/build.gradle.kts.",
+    "Create the upload keystore once: keytool -genkey -v -keystore upload-keystore.jks -keyalg RSA -keysize 2048 -validity 10000 -alias upload (keep it out of git; back it up in a password manager).",
+    "Create a private git repo for match certificates, then from {{APP_DIR}}/ios run: bundle install && bundle exec fastlane certificates",
+    "Upload the first Android build to Google Play by hand (Play Console requires it before the API can upload).",
+    "Set the repository secrets listed by: npx @softwareseva/cli secrets"
+  ]
+}

package/templates/modules/deploy-fastlane/secrets.json

@@ -0,0 +1,16 @@
+{
+  "package": "deploy-fastlane",
+  "secrets": [
+    { "name": "APP_STORE_CONNECT_API_KEY_ID", "usedBy": "iOS upload", "description": "Key id of an App Store Connect API key with App Manager access.", "generate": "App Store Connect > Users and Access > Integrations > App Store Connect API > Team Keys > +", "store": ["ci-secret"] },
+    { "name": "APP_STORE_CONNECT_ISSUER_ID", "usedBy": "iOS upload", "description": "Issuer id shown above the keys list.", "generate": "same page as the key", "store": ["ci-secret"] },
+    { "name": "APP_STORE_CONNECT_API_KEY_CONTENT", "usedBy": "iOS upload", "description": "The AuthKey_XXXX.p8 file, base64-encoded (downloadable once).", "generate": "base64 -i AuthKey_XXXX.p8 | pbcopy", "store": ["ci-secret", "keychain"], "gitignore": ["*.p8"] },
+    { "name": "MATCH_GIT_URL", "usedBy": "iOS signing", "description": "HTTPS URL of the private repo that stores encrypted certificates and profiles.", "generate": "create an empty private repository, e.g. github.com/you/certificates", "store": ["ci-secret"] },
+    { "name": "MATCH_PASSWORD", "usedBy": "iOS signing", "description": "Passphrase that encrypts the match repo.", "generate": "chosen the first time you run fastlane match; store it in a password manager", "store": ["ci-secret", "keychain"], "rotate": "only by re-encrypting the repo (fastlane match change_password)" },
+    { "name": "MATCH_GIT_BASIC_AUTHORIZATION", "usedBy": "iOS signing", "description": "base64 of 'username:token' for a token that can read the match repo.", "generate": "GitHub fine-grained token with read access to the certificates repo; then: printf 'user:token' | base64", "store": ["ci-secret"], "rotate": "when the token expires" },
+    { "name": "ANDROID_KEYSTORE_BASE64", "usedBy": "Android signing", "description": "The upload keystore (.jks), base64-encoded.", "generate": "keytool -genkey ... (see next steps); then base64 -i upload-keystore.jks | pbcopy", "store": ["ci-secret", "keychain"], "gitignore": ["*.jks", "*.keystore", "key.properties"] },
+    { "name": "ANDROID_KEYSTORE_PASSWORD", "usedBy": "Android signing", "description": "Store password of the upload keystore.", "generate": "chosen when creating the keystore", "store": ["ci-secret", "keychain"] },
+    { "name": "ANDROID_KEY_ALIAS", "usedBy": "Android signing", "description": "Alias of the upload key, usually 'upload'.", "generate": "chosen when creating the keystore", "store": ["ci-secret"] },
+    { "name": "ANDROID_KEY_PASSWORD", "usedBy": "Android signing", "description": "Password of the upload key.", "generate": "chosen when creating the keystore", "store": ["ci-secret", "keychain"] },
+    { "name": "PLAY_SERVICE_ACCOUNT_JSON", "usedBy": "Android upload", "description": "JSON key of a Google Cloud service account invited to Play Console with release permissions.", "generate": "Google Cloud > IAM > Service accounts > create > Keys > JSON; Play Console > Users and permissions > invite the service account email with 'Release to testing tracks' (and production if needed).", "store": ["ci-secret"], "gitignore": ["play-service-account*.json"] }
+  ]
+}

package/templates/renovate.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "packageRules": [
+    { "groupName": "kashi", "matchPackageNames": ["/^@softwareseva\\//", "/^kashi_/"], "automerge": false, "schedule": ["before 6am on monday"] }
+  ]
+}