gowalk-cicd 1.0.0

package/action/scripts/mmv_floor_check.py

@@ -0,0 +1,265 @@
+#!/usr/bin/env python3
+"""
+Floor-check helpers for manage_marketing_version.
+
+The combined floor is the max versionString across:
+  - /appStoreVersions (caller-provided, ship-blocking states only)
+  - /preReleaseVersions (TestFlight trains)
+  - /builds->preReleaseVersion (hidden trains visible only via builds)
+
+Plus an independent narrow per-state ground-truth query as defence-in-depth
+against truncated/buggy main fetches.
+
+This module owns the semver primitives, the floor-resolving wrappers
+that tests patch (``fetch_versions``, ``get_ground_truth_floor``,
+``get_combined_floor``), and the strict/non-strict assertion that
+``decide_for_version`` runs before REUSE/CREATE branching.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+
+import asc_version_fetch
+import version_utils
+
+
+SEM_RE = re.compile(r"^(\d+)\.(\d+)(?:\.(\d+))?$")
+
+# DESIGN DECISION: auto-bump policy is read from the env var so the action
+# step can wire it from `inputs.marketing-version-auto-bump` without a
+# CLI-flag re-plumb of every helper. Default 'rollover' matches the action
+# input default -- patch with carry at .9 (1.0.9 -> 1.1.0) is the more
+# natural semver progression for unattended CI. ``'patch'`` is preserved
+# unchanged for consumers pinning the historical (unbounded) behavior.
+# ``'none'`` preserves the historical fail-the-build path.
+_AUTO_BUMP_ENV = "MARKETING_VERSION_AUTO_BUMP"
+
+# DESIGN DECISION: auto-bump must only fire when the resulting bumped
+# value can be committed back to the repo in the same run. The
+# commit-back step in action.yml is gated on `event=push` AND
+# `ref=refs/heads/<default_branch>`. Auto-bumping on any other event
+# (workflow_dispatch, pull_request, push to feature branches) would
+# upload an IPA at the bumped version while git stays at the old
+# value, causing the next run to recompute against stale state and
+# either re-bump or drift.
+#
+# These envs are set by the action.yml step from
+# ``${{ github.event_name }}`` and ``${{ github.ref }}`` /
+# ``${{ github.event.repository.default_branch }}``. Empty / unset
+# values are treated as "context unknown -> refuse to auto-bump"
+# (defensive: when run outside the GitHub Actions context, e.g. local
+# dev or a third-party orchestrator, the safe default is to require a
+# human bump).
+_EVENT_ENV = "GITHUB_EVENT_NAME"
+_REF_ENV = "GITHUB_REF"
+_DEFAULT_BRANCH_ENV = "GITHUB_DEFAULT_BRANCH"
+
+# These constants and helpers are intentionally public (no leading
+# underscore) because manage_marketing_version.py imports them across the
+# module boundary. Module-internal helpers below keep the leading
+# underscore to mark them as private.
+MIGRATION_HINT = (
+    "See .github/actions/swift-app/MIGRATION.md for the "
+    "migration procedure."
+)
+BUILD_SETTING_SOURCES = (
+    "project.yml [xcodegen], the .xcodeproj's MARKETING_VERSION xcconfig, "
+    "or Info.plist's CFBundleShortVersionString"
+)
+
+
+def semver_tuple(version_string: str) -> tuple[int, int, int]:
+    """Parse 'M.m[.p]' -> (M, m, p). Non-semver returns (-1,-1,-1) so it
+    sorts below any real version."""
+    m = SEM_RE.match(version_string or "")
+    if not m:
+        return (-1, -1, -1)
+    return (int(m.group(1)), int(m.group(2)), int(m.group(3) or "0"))
+
+
+def bump_patch_for_message(floor: str) -> str:
+    """Suggest a next-patch value to surface in error text. Best-effort."""
+    m = SEM_RE.match(floor or "")
+    if not m:
+        return f"{floor} (bump above this)"
+    major, minor = int(m.group(1)), int(m.group(2))
+    patch = int(m.group(3) or "0")
+    return f"{major}.{minor}.{patch + 1}"
+
+
+def fetch_versions(app_id: str, token: str) -> list[dict]:
+    return asc_version_fetch.fetch_versions(app_id, token)
+
+
+def get_ground_truth_floor(app_id: str, token: str) -> str | None:
+    return asc_version_fetch.get_ground_truth_floor(app_id, token, semver_tuple)
+
+
+def get_combined_floor(
+    app_id: str, token: str, appstore_versions: list[dict],
+) -> tuple[str | None, dict[str, str | None]]:
+    """Wrapper around asc_version_fetch.get_combined_floor that forwards
+    both the floor AND the per-source breakdown so the cross-check error
+    message can name the real source contributing the binding floor (not
+    a synthesized one)."""
+    return asc_version_fetch.get_combined_floor(
+        app_id, token, semver_tuple, appstore_versions=appstore_versions,
+    )
+
+
+def _resolve_floor(app_id: str, token: str, appstore_versions: list[dict]):
+    """Return (floor, per_source). floor is None when every ASC source is
+    empty (true first-release case). Late-binds the seam wrappers via the
+    parent ``manage_marketing_version`` module so test patches at
+    ``mmv.get_combined_floor`` / ``mmv.get_ground_truth_floor`` win."""
+    import manage_marketing_version as mmv
+    combined, per_source = mmv.get_combined_floor(
+        app_id, token, appstore_versions,
+    )
+    narrow = mmv.get_ground_truth_floor(app_id, token)
+    candidates = [c for c in (combined, narrow) if c]
+    floor = max(candidates, key=semver_tuple) if candidates else None
+    return floor, per_source
+
+
+def _floor_error(target: str, floor: str, per_source: dict, *, strict: bool) -> None:
+    relation = "strictly greater than" if strict else "greater than or equal to"
+    print(
+        f"::error::MARKETING_VERSION {target} in your project's build "
+        f"settings (typically " + BUILD_SETTING_SOURCES + f") must be "
+        f"{relation} the App Store Connect floor {floor}. Bump it (e.g. "
+        f"to {bump_patch_for_message(floor)}), commit, and rerun. "
+        f"Sources contributing to floor: "
+        f"appStoreVersions={per_source.get('appStoreVersions') or '<none>'}, "
+        f"preReleaseVersions={per_source.get('preReleaseVersions') or '<none>'}, "
+        f"buildsViaPreRelease={per_source.get('buildsViaPreRelease') or '<none>'}. "
+        + MIGRATION_HINT,
+        file=sys.stderr,
+    )
+    raise SystemExit(2)
+
+
+def _persist_context_ok(policy: str) -> bool:
+    """True when this run can persist a project-file bump back to the
+    default branch via the action's commit-back step. The commit-back
+    step is gated on ``event=push`` AND ``ref=refs/heads/<default>``;
+    any other context (workflow_dispatch / pull_request / push to a
+    feature branch) would upload an IPA at the bumped version while
+    git stays at the old value, drifting the project from ASC.
+
+    On refusal, emits the ``::warning::`` describing why this run
+    cannot persist the bump (event/ref/default_branch values from the
+    environment). The warning names the active policy (rollover /
+    patch / minor) so consumers reading CI logs can see which mode
+    was attempted. Side-effecting the warning here -- rather than at
+    the caller -- keeps ``maybe_auto_bump`` under the per-function LOC
+    cap without splitting the env-read + warning into two helpers
+    (which would also push the file over the per-file functions cap)."""
+    event = (os.environ.get(_EVENT_ENV) or "").strip()
+    ref = (os.environ.get(_REF_ENV) or "").strip()
+    default_branch = (os.environ.get(_DEFAULT_BRANCH_ENV) or "").strip()
+    ok = (
+        event == "push"
+        and bool(default_branch)
+        and ref == f"refs/heads/{default_branch}"
+    )
+    if ok:
+        return True
+    print(
+        f"::warning::auto-bump={policy} is enabled, but this run "
+        f"cannot persist the bump (event={event or '<unset>'}, "
+        f"ref={ref or '<unset>'}, "
+        f"default_branch={default_branch or '<unset>'}). The "
+        f"action's commit-back step only runs on push to "
+        f"refs/heads/{default_branch or '<unset>'}; auto-bumping on "
+        f"any other event would upload an IPA at the bumped version "
+        f"while git stays at the old value. Falling back to fail-on-"
+        f"floor; either push to the default branch with auto-bump "
+        f"enabled, or manually bump MARKETING_VERSION and rerun.",
+        file=sys.stderr,
+    )
+    return False
+
+
+def maybe_auto_bump(target: str, floor: str) -> str | None:
+    """Return the bumped version when auto-bump is enabled, the run
+    can persist the bump, and writes succeed. Returns None when policy
+    is 'none', the persistence context disallows commit-back, or the
+    project-file write failed -- the caller falls back to the historical
+    ``_floor_error`` path.
+
+    Public seam so ``manage_marketing_version`` can fire the auto-roll
+    when target == a terminal-state floor row (READY_FOR_SALE auto-roll)
+    -- not just when target < floor (the historical floor-violation
+    case).
+
+    Side effects: writes the new version into the project file (pbxproj
+    / xcconfig / Info.plist / project.yml depending on resolution) and
+    updates ``os.environ['MARKETING_VERSION']`` so downstream steps see
+    the bumped value. ``version_utils.write_marketing_version`` ALSO
+    runs ``git add -f`` on the touched path so the auto-bump is staged
+    in the index before any later step (e.g. prepare_signing) mutates
+    the same file."""
+    policy = (os.environ.get(_AUTO_BUMP_ENV) or "rollover").strip().lower()
+    if policy == "none":
+        return None
+    if policy not in ("rollover", "patch", "minor"):
+        print(
+            f"::warning::Unknown {_AUTO_BUMP_ENV}={policy!r}; "
+            f"falling back to fail-on-floor behavior",
+            file=sys.stderr,
+        )
+        return None
+    if not _persist_context_ok(policy):
+        return None
+    new_version = version_utils.compute_next_version(target, floor, policy)
+    if not version_utils.write_marketing_version(new_version):
+        print(
+            f"::warning::auto-bump could not locate a writable "
+            f"MARKETING_VERSION source (pbxproj or Info.plist); "
+            f"falling back to fail-on-floor behavior",
+            file=sys.stderr,
+        )
+        return None
+    os.environ["MARKETING_VERSION"] = new_version
+    print(
+        f"::notice::mmv: auto-bumped {target} -> {new_version} "
+        f"(policy={policy}, ASC floor was {floor})",
+        file=sys.stderr,
+    )
+    return new_version
+
+
+def assert_target_meets_floor(
+    target: str, app_id: str, token: str,
+    *, appstore_versions: list[dict], strict: bool,
+) -> str:
+    """Reject when the floor outranks `target`. ``strict=True`` requires
+    target > floor (CREATE: a new row must not collide with anything
+    shipped/uploaded). ``strict=False`` allows target == floor (REUSE:
+    the editable matching target IS a floor contributor, so equality is
+    expected and fine).
+
+    Returns the effective target (which may differ from the input when
+    auto-bump fires on the non-strict pre-check). Callers MUST use the
+    returned value for any subsequent floor-relative reasoning, otherwise
+    they'd compare a stale target against the post-bump state.
+    """
+    floor, per_source = _resolve_floor(app_id, token, appstore_versions)
+    if floor is None:
+        return target
+    target_t, floor_t = semver_tuple(target), semver_tuple(floor)
+    ok = target_t > floor_t if strict else target_t >= floor_t
+    if ok:
+        relation = ">" if strict else ">="
+        print(f"[decision] floor_check OK: target={target} {relation} "
+              f"floor={floor}", file=sys.stderr)
+        return target
+    bumped = maybe_auto_bump(target, floor)
+    if bumped is not None:
+        return bumped
+    _floor_error(target, floor, per_source, strict=strict)
+    raise AssertionError("unreachable")  # _floor_error raises SystemExit

package/action/scripts/next_build_number.py

@@ -0,0 +1,195 @@
+#!/usr/bin/env python3
+"""
+Query App Store Connect for the highest-numbered build across every
+source that can surface an in-flight upload, and print ``<highest + 1>``
+to stdout.
+
+Why multiple sources
+--------------------
+Apple's ``/builds`` endpoint normally lists every build regardless of
+``processingState`` (PROCESSING, VALID, INVALID, EXPIRED), but there is
+a window right after altool completes where a freshly-uploaded build
+only shows up reliably under its ``preReleaseVersion`` relationship.
+Missing that build is catastrophic: the script would return a value
+altool already rejected on the previous run, causing the next upload
+to fail with::
+
+    The bundle version must be higher than the previously uploaded
+    version: 'N'.
+
+So we union build versions from BOTH ``/builds`` and
+``/preReleaseVersions?include=builds`` before taking the max.
+
+Environment
+-----------
+  ASC_KEY_ID           API key ID
+  ASC_ISSUER_ID        API issuer ID
+  ASC_KEY_PATH         Path to the .p8 key file
+  APP_STORE_APPLE_ID   App Store numeric app id
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+from asc_common import get_json, make_jwt
+
+
+def env(name: str) -> str:
+    val = os.environ.get(name)
+    if not val:
+        if name == "APP_STORE_APPLE_ID":
+            raise SystemExit(
+                "::error::APP_STORE_APPLE_ID is empty. This usually means "
+                "auto-detect could not resolve PRODUCT_BUNDLE_IDENTIFIER from "
+                "your Xcode project (check the auto-detect: ... log lines in the "
+                "'Resolve credentials + auto-detect' step above). Fix options: "
+                "(1) commit your .xcodeproj or add an xcodegen project.yml; "
+                "(2) pass `app-store-apple-id:` explicitly via the action's `with:` block."
+            )
+        raise SystemExit(f"missing env var: {name}")
+    return val
+
+
+def _build_version_int(build: dict) -> int | None:
+    try:
+        return int(build.get("attributes", {}).get("version"))
+    except (TypeError, ValueError):
+        return None
+
+
+def _log_newest(builds: list[dict], limit: int = 3) -> None:
+    """Print the newest few builds (by uploadedDate) to stderr for debugging."""
+    def _uploaded(b: dict) -> str:
+        return (b.get("attributes") or {}).get("uploadedDate") or ""
+
+    newest = sorted(builds, key=_uploaded, reverse=True)[:limit]
+    for b in newest:
+        attrs = b.get("attributes") or {}
+        print(
+            f"ASC build: v={attrs.get('version')!r} "
+            f"state={attrs.get('processingState')!r} "
+            f"uploaded={attrs.get('uploadedDate')!r}",
+            file=sys.stderr,
+        )
+
+
+def fetch_build_versions(app_id: str, token: str) -> set[int]:
+    """Versions from GET /builds?filter[app]=... (all processingStates)."""
+    data = get_json(
+        "/builds",
+        token,
+        params={
+            "filter[app]": app_id,
+            "sort": "-version",
+            "limit": "200",
+        },
+    )
+    builds = data.get("data", []) or []
+    print(f"ASC /builds: scanning {len(builds)} builds", file=sys.stderr)
+    _log_newest(builds)
+    return {n for n in map(_build_version_int, builds) if n is not None}
+
+
+def fetch_prerelease_versions(app_id: str, token: str) -> set[int]:
+    """Versions reached via /preReleaseVersions?include=builds.
+
+    Fresh uploads occasionally appear in the ``included`` build records
+    here before ``/builds`` catches up; harvest both the relationship
+    edges and the included build resources.
+    """
+    data = get_json(
+        "/preReleaseVersions",
+        token,
+        params={
+            "filter[app]": app_id,
+            "include": "builds",
+            "limit": "200",
+        },
+    )
+    included = data.get("included", []) or []
+    builds = [r for r in included if r.get("type") == "builds"]
+    print(
+        f"ASC /preReleaseVersions: scanning {len(builds)} included builds",
+        file=sys.stderr,
+    )
+    _log_newest(builds)
+    return {n for n in map(_build_version_int, builds) if n is not None}
+
+
+def _read_pbxproj_build_number() -> int | None:
+    """Best-effort local fallback: read CURRENT_PROJECT_VERSION from pbxproj.
+
+    Returns the maximum integer CURRENT_PROJECT_VERSION found across all
+    XCBuildConfiguration blocks of the first discovered .xcodeproj at the
+    current working directory. Returns None if nothing usable is found
+    (no project, parse failure, all values are non-numeric / interpolated).
+    """
+    try:
+        projects = sorted(Path(".").glob("*.xcodeproj"))
+        if not projects:
+            return None
+        pbx = projects[0] / "project.pbxproj"
+        if not pbx.exists():
+            return None
+        out = subprocess.check_output(
+            ["plutil", "-convert", "json", "-o", "-", str(pbx)]
+        )
+        objects = (json.loads(out).get("objects") or {})
+    except (subprocess.CalledProcessError, json.JSONDecodeError, OSError):
+        return None
+
+    values: set[int] = set()
+    for obj in objects.values():
+        if not isinstance(obj, dict):
+            continue
+        settings = obj.get("buildSettings") or {}
+        raw = settings.get("CURRENT_PROJECT_VERSION")
+        if raw is None:
+            continue
+        try:
+            values.add(int(str(raw).strip()))
+        except ValueError:
+            continue
+    return max(values) if values else None
+
+
+def resolve_next_build_number(app_id: str, token: str) -> int:
+    """Aggregate every known source of uploaded build versions."""
+    versions = fetch_build_versions(app_id, token)
+    versions |= fetch_prerelease_versions(app_id, token)
+    highest = max(versions, default=0)
+    print(f"ASC highest build version seen: {highest}", file=sys.stderr)
+    return highest + 1
+
+
+def main() -> None:
+    app_id = env("APP_STORE_APPLE_ID")
+    try:
+        token = make_jwt(env("ASC_KEY_ID"), env("ASC_ISSUER_ID"), env("ASC_KEY_PATH"))
+        print(resolve_next_build_number(app_id, token))
+        return
+    except SystemExit:
+        raise
+    except Exception as exc:  # noqa: BLE001 - last-resort safety net
+        print(
+            f"::warning::ASC build lookup failed ({exc!r}); "
+            "falling back to pbxproj CURRENT_PROJECT_VERSION + 1",
+            file=sys.stderr,
+        )
+
+    local = _read_pbxproj_build_number()
+    if local is None:
+        raise SystemExit(
+            "::error::could not resolve next build number from ASC or pbxproj; "
+            "fix ASC credentials or commit a CURRENT_PROJECT_VERSION in the Xcode project"
+        )
+    print(local + 1)
+
+
+if __name__ == "__main__":
+    main()

package/action/scripts/pbxproj_editor.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""
+Xcode ``project.pbxproj`` helpers.
+
+Parses native targets and patches their XCBuildConfiguration buildSettings
+blocks with manual signing values, while keeping the file's original
+OpenStep format (comments, ordering, the !$*UTF8*$! header) intact. SwiftPM
+and other non-native targets are ignored so their build settings stay on
+whatever defaults Xcode / SwiftPM picked.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+from pathlib import Path
+
+
+PROFILE_PREFIX = "CI-"
+
+# Product types that must be signed with a provisioning profile. App
+# extensions share the common ``com.apple.product-type.app-extension``
+# prefix (Message Filter, Widgets, NetworkExtension, WatchKit, etc).
+_SIGNABLE_PRODUCT_TYPES = {
+    "com.apple.product-type.application",
+    "com.apple.product-type.application.on-demand-install-capable",
+    "com.apple.product-type.application.watchapp2",
+    "com.apple.product-type.watchkit2-extension",
+}
+_SIGNABLE_PRODUCT_PREFIXES = (
+    "com.apple.product-type.app-extension",
+)
+
+_SIGNING_KEYS = {
+    "CODE_SIGN_STYLE": "Manual",
+    "CODE_SIGN_IDENTITY": '"Apple Distribution"',
+    "CODE_SIGNING_ALLOWED": "YES",
+    "CODE_SIGNING_REQUIRED": "YES",
+}
+_STRIP_KEYS = ("PROVISIONING_PROFILE",)
+
+_SETTING_LINE = re.compile(r"^(\s*)([A-Z_][A-Z0-9_]*)\s*=\s*(.+);\s*$")
+
+
+# --------------------------------------------------------------------------- #
+# Parsing                                                                     #
+# --------------------------------------------------------------------------- #
+
+def _load_pbxproj(project_path: str) -> dict:
+    pbx = Path(project_path) / "project.pbxproj"
+    out = subprocess.check_output(
+        ["plutil", "-convert", "json", "-o", "-", str(pbx)]
+    )
+    return json.loads(out)
+
+
+def _is_signable_product_type(product_type: str) -> bool:
+    if product_type in _SIGNABLE_PRODUCT_TYPES:
+        return True
+    return any(product_type.startswith(p) for p in _SIGNABLE_PRODUCT_PREFIXES)
+
+
+def _bundle_id_from_configs(objects: dict, config_ids: list[str]) -> str:
+    """Return the first non-empty bundle id across the given configs."""
+    for cid in config_ids:
+        cfg = objects.get(cid) or {}
+        settings = cfg.get("buildSettings") or {}
+        bid = (settings.get("PRODUCT_BUNDLE_IDENTIFIER") or "").strip()
+        if bid and "$(" not in bid and "${" not in bid:
+            return bid
+    return ""
+
+
+def discover_signable_targets(project_path: str) -> list[dict]:
+    """Return one entry per signable native target.
+
+    Each entry: ``{"name": str, "bundle_id": str, "config_ids": [str,...]}``
+    where ``config_ids`` is the list of XCBuildConfiguration UUIDs whose
+    ``buildSettings`` dict we need to patch (typically Debug + Release).
+    """
+    pbx = _load_pbxproj(project_path)
+    objects = pbx["objects"]
+    targets: list[dict] = []
+    for obj in objects.values():
+        if obj.get("isa") != "PBXNativeTarget":
+            continue
+        if not _is_signable_product_type(obj.get("productType") or ""):
+            continue
+        name = obj.get("name") or "<unknown>"
+        config_list = objects.get(obj.get("buildConfigurationList")) or {}
+        config_ids = list(config_list.get("buildConfigurations") or [])
+        bundle_id = _bundle_id_from_configs(objects, config_ids)
+        if not bundle_id:
+            print(f"skip target {name!r}: no PRODUCT_BUNDLE_IDENTIFIER")
+            continue
+        targets.append(
+            {"name": name, "bundle_id": bundle_id, "config_ids": config_ids}
+        )
+    if not targets:
+        raise SystemExit(
+            f"discover_signable_targets: no signable targets found in "
+            f"{project_path}"
+        )
+    return targets
+
+
+# --------------------------------------------------------------------------- #
+# Mutation                                                                    #
+# --------------------------------------------------------------------------- #
+
+def patch_project_signing(
+    project_path: str,
+    targets: list[dict],
+    team_id: str,
+) -> None:
+    """Set manual signing + per-target profile name for every target.
+
+    Edits the pbxproj as text so formatting (comments, ordering, header)
+    survives. Scope is strictly the XCBuildConfiguration blocks referenced
+    by the ``targets`` list. SwiftPM / resource-bundle configs stay put.
+    """
+    pbx_path = Path(project_path) / "project.pbxproj"
+    text = pbx_path.read_text(encoding="utf-8")
+    for target in targets:
+        profile_name = f"{PROFILE_PREFIX}{target['bundle_id']}"
+        for cid in target["config_ids"]:
+            text = _apply_signing_to_config(text, cid, team_id, profile_name)
+        print(
+            f"Patched {target['name']!r} -> {profile_name} "
+            f"(configs={len(target['config_ids'])})"
+        )
+    pbx_path.write_text(text, encoding="utf-8")
+    subprocess.check_call(["plutil", "-lint", str(pbx_path)])
+
+
+def _apply_signing_to_config(
+    text: str, config_id: str, team_id: str, profile_name: str
+) -> str:
+    start = text.find(f"\t\t{config_id} ")
+    if start < 0:
+        start = text.find(f"\t\t{config_id}\t")
+    if start < 0:
+        start = text.find(f"{config_id} = {{")
+    if start < 0:
+        raise SystemExit(
+            f"patch_project_signing: config {config_id} not found"
+        )
+    key = "buildSettings = {"
+    s_idx = text.find(key, start)
+    if s_idx < 0:
+        raise SystemExit(
+            f"patch_project_signing: buildSettings not found for {config_id}"
+        )
+    end = _match_brace(text, s_idx + len(key) - 1)
+    if end < 0:
+        raise SystemExit(
+            f"patch_project_signing: unbalanced buildSettings for {config_id}"
+        )
+    inner = text[s_idx + len(key): end]
+    patched = _patch_inner_settings(inner, team_id, profile_name)
+    return text[: s_idx + len(key)] + patched + text[end:]
+
+
+def _match_brace(text: str, open_idx: int) -> int:
+    """Return the index of the ``}`` that closes the ``{`` at ``open_idx``."""
+    depth = 0
+    i = open_idx
+    while i < len(text):
+        ch = text[i]
+        if ch == "{":
+            depth += 1
+        elif ch == "}":
+            depth -= 1
+            if depth == 0:
+                return i
+        i += 1
+    return -1
+
+
+def _patch_inner_settings(
+    inner: str, team_id: str, profile_name: str
+) -> str:
+    """Rewrite build-setting lines inside one buildSettings block."""
+    values = dict(_SIGNING_KEYS)
+    values["DEVELOPMENT_TEAM"] = team_id
+    values["PROVISIONING_PROFILE_SPECIFIER"] = f'"{profile_name}"'
+
+    lines = inner.splitlines(keepends=True)
+    emitted: set[str] = set()
+    out: list[str] = []
+    for line in lines:
+        m = _SETTING_LINE.match(line)
+        if not m:
+            out.append(line)
+            continue
+        indent, key_name = m.group(1), m.group(2)
+        if key_name in _STRIP_KEYS:
+            continue
+        if key_name in values:
+            out.append(f"{indent}{key_name} = {values[key_name]};\n")
+            emitted.add(key_name)
+            continue
+        out.append(line)
+
+    missing = [k for k in values if k not in emitted]
+    if missing:
+        indent = "\t\t\t\t"
+        for line in lines:
+            m = _SETTING_LINE.match(line)
+            if m:
+                indent = m.group(1)
+                break
+        tail = out[-1] if out else ""
+        new_lines = [f"{indent}{k} = {values[k]};\n" for k in missing]
+        if tail.strip() == "":
+            out = out[:-1] + new_lines + [tail]
+        else:
+            out = out + new_lines
+    return "".join(out)