gowalk-cicd 1.0.0

package/action/scripts/prepare_signing.py

@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+"""
+Prepare iOS code signing on a fresh CI runner (manual-signing variant).
+
+Caching: the Apple Distribution cert + per-bundle provisioning profiles
+live under the workspace's ``creds/`` directory and are reused across
+runs. See ``creds_store.py`` for the on-disk layout and reuse rules.
+This script orchestrates the load-or-regen flow:
+
+  1. Try to reuse the cached cert (decrypts + NotAfter > 30d +
+     ``GET /certificates/{cert_id}`` = 200).
+  2. On miss, invalidate the cache and create a fresh cert via
+     ``cert_factory`` (handling Apple's per-team cap of 2 by revoking
+     the OLDEST existing one).
+  3. Hand the cert id + cache_hit flag to ``provision_all_bundles``,
+     which decides per-bundle whether to reuse a cached profile or
+     create a new one and updates the manifest.
+  4. Orphan profiles (manifest entries for bundles no longer in the
+     target list) get GC'd from disk + manifest.
+  5. After successful prep the workspace ``creds/`` tree is dirty with
+     any refreshed artifacts; ``action.yml`` commits the diff back when
+     the run is on the default branch.
+
+Sibling modules: ``cert_factory`` (key+CSR+ASC POST), ``keychain``
+(throwaway runner keychain), ``profile_manager`` (per-bundle profile
+lifecycle), ``profile_io`` (CMS decode), ``creds_store`` (on-disk cache).
+
+Env inputs: ASC_KEY_ID, ASC_ISSUER_ID, ASC_KEY_PATH (key trio), PROJECT
+(.xcodeproj), TEAM_ID (optional; derived from profile plist when empty),
+RUNNER_TEMP, CREDS_DIR (optional override; defaults to
+``$GITHUB_WORKSPACE/creds``). Writes nothing to stdout that would leak
+secrets.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import cert_factory
+import creds_store
+from asc_common import make_jwt
+from keychain import setup_keychain
+from pbxproj_editor import discover_signable_targets, patch_project_signing
+from profile_manager import provision_all_bundles
+
+
+def env(name: str) -> str:
+    val = os.environ.get(name)
+    if not val:
+        raise SystemExit(f"missing env var: {name}")
+    return val
+
+
+def optional_env(name: str) -> str:
+    return os.environ.get(name, "")
+
+
+def _load_or_create_cert(
+    token: str, creds_dir: Path
+) -> tuple[str, bytes, str, bool]:
+    """Return ``(cert_id, p12_bytes, password, cache_hit)``.
+
+    Cache hit when the on-disk cert decrypts, NotAfter > 30d away, and
+    Apple confirms the cert id is still alive. On miss the cache is
+    invalidated, a new cert is created (handling Apple's per-team cap),
+    and the cache is repopulated atomically.
+    """
+    cached = creds_store.load_cached_cert(creds_dir)
+    if cached and creds_store.verify_cert_alive(token, cached.cert_id):
+        print(
+            f"Reusing cached distribution cert {cached.cert_id} "
+            f"(NotAfter {cached.not_after.isoformat()})"
+        )
+        # Warn when inside T-60d..T-30d so operators see renewal is pending
+        # but auto-renew has not yet fired.
+        now = datetime.now(timezone.utc)
+        renew_at = now + timedelta(days=creds_store.RENEW_THRESHOLD_DAYS)
+        warn_at = now + timedelta(days=creds_store.WARN_THRESHOLD_DAYS)
+        if renew_at < cached.not_after <= warn_at:
+            print(
+                f"::warning::Cert {cached.cert_id} expires in "
+                f"{(cached.not_after - now).days}d; auto-renew fires at "
+                f"{creds_store.RENEW_THRESHOLD_DAYS}d remaining."
+            )
+        return cached.cert_id, cached.p12_bytes, cached.password, True
+
+    if cached:
+        print(
+            f"Cached cert {cached.cert_id} no longer alive on Apple; "
+            "invalidating cache and regenerating"
+        )
+    creds_store.invalidate_cache(creds_dir)
+
+    private_key, csr_b64 = cert_factory.generate_key_and_csr()
+    cert_id, cert_der = cert_factory.create_distribution_cert(
+        token, csr_b64.decode()
+    )
+    password = creds_store.P12_PASSWORD
+    p12_bytes = cert_factory.serialize_p12(private_key, cert_der, password)
+    not_after = creds_store.cert_not_after_from_der(cert_der)
+    creds_store.write_cert_bundle(
+        creds_dir, cert_id, p12_bytes, password, not_after
+    )
+    print(f"Persisted fresh cert bundle to {creds_dir}")
+    return cert_id, p12_bytes, password, False
+
+
+def _resolve_creds_dir() -> Path:
+    """Return the workspace creds/ root, honoring the CREDS_DIR override."""
+    override = optional_env("CREDS_DIR")
+    if override:
+        return Path(override)
+    workspace = optional_env("GITHUB_WORKSPACE") or os.getcwd()
+    return Path(workspace) / "creds"
+
+
+def _resolve_pbx_team(effective_team: str, configured_team: str) -> str:
+    """Pick the team Xcode must see and warn on mismatch with config.
+
+    The ASC API key is bound to a single developer team. Every profile
+    it issues lives in THAT team, so Xcode's ``DEVELOPMENT_TEAM`` must
+    match it exactly — otherwise the profile can't be matched to the
+    target at archive time. If the ci.config.yaml team differs, warn
+    and use the profile's team as the source of truth.
+    """
+    pbx_team = effective_team or configured_team
+    if not pbx_team:
+        raise SystemExit(
+            "Unable to determine Apple developer team. The installed "
+            "provisioning profile did not expose a TeamIdentifier and no "
+            "TEAM_ID was provided. Set `app.team_id` in ci.config.yaml. "
+            "Find your team id at https://developer.apple.com/account -> "
+            "Membership (look for 'Team ID')."
+        )
+    if effective_team and configured_team and effective_team != configured_team:
+        print(
+            f"::warning::Config team {configured_team} differs from ASC API "
+            f"key's team {effective_team}; patching pbxproj with "
+            f"{effective_team} (the team that actually issued the "
+            "provisioning profiles)."
+        )
+    return pbx_team
+
+
+def _write_signing_map(
+    runner_temp: str, pbx_team: str, mappings: list
+) -> None:
+    """Persist mapping for the downstream Export IPA step.
+
+    ``ExportOptions.plist`` needs a ``provisioningProfiles`` dict and
+    the effective team that issued the profiles.
+    """
+    map_path = Path(runner_temp) / "signing_map.json"
+    map_path.write_text(
+        json.dumps(
+            {
+                "team_id": pbx_team,
+                "profiles": {bid: pname for bid, pname, _ in mappings},
+            },
+            indent=2,
+        )
+    )
+    print(f"Wrote signing map to {map_path}")
+
+
+def _resolve_project_path() -> str:
+    """Return the .xcodeproj path; reject WORKSPACE-only mode loudly."""
+    project = optional_env("PROJECT")
+    if optional_env("WORKSPACE") and not project:
+        raise SystemExit(
+            "prepare_signing: WORKSPACE-only mode is not supported; the "
+            "underlying .xcodeproj must be passed via PROJECT so we can "
+            "patch its signing settings."
+        )
+    if not project:
+        raise SystemExit("prepare_signing: PROJECT env var is required")
+    return project
+
+
+def main() -> None:
+    runner_temp = env("RUNNER_TEMP")
+    # TEAM_ID is optional — provision_all_bundles returns the effective
+    # team from the installed profile's plist; see _resolve_pbx_team.
+    team_id = optional_env("TEAM_ID")
+    project = _resolve_project_path()
+    token = make_jwt(env("ASC_KEY_ID"), env("ASC_ISSUER_ID"), env("ASC_KEY_PATH"))
+    creds_dir = _resolve_creds_dir()
+
+    targets = discover_signable_targets(project)
+    bundle_ids = sorted({t["bundle_id"] for t in targets})
+    print(f"Signable targets ({len(targets)}):")
+    for t in targets:
+        print(
+            f"  - {t['name']} -> {t['bundle_id']} "
+            f"({len(t['config_ids'])} configs)"
+        )
+
+    cert_id, p12_bytes, p12_pass, cache_hit = _load_or_create_cert(
+        token, creds_dir
+    )
+    mappings, effective_team = provision_all_bundles(
+        token, bundle_ids, cert_id, creds_dir=creds_dir, cache_hit=cache_hit
+    )
+    print("Profile map:")
+    for bid, pname, uuid in mappings:
+        print(f"  {bid} -> {pname} ({uuid})")
+
+    pbx_team = _resolve_pbx_team(effective_team, team_id)
+    patch_project_signing(project, targets, pbx_team)
+    _write_signing_map(runner_temp, pbx_team, mappings)
+
+    # Stage p12 in $RUNNER_TEMP for the keychain importer (the cache copy
+    # under creds/cert.p12 stays untouched as the source of truth).
+    p12_path = Path(runner_temp) / "cert.p12"
+    p12_path.write_bytes(p12_bytes)
+    setup_keychain(p12_path, p12_pass, runner_temp)
+
+
+if __name__ == "__main__":
+    main()

package/action/scripts/profile_io.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""
+On-disk + plist-decode helpers for ``.mobileprovision`` files.
+
+Split from ``profile_manager.py`` so the ASC-API-facing module stays
+focused on lifecycle (create / delete / install) and this module owns
+the file-format gymnastics (CMS envelope decode via ``security cms -D``,
+plist date normalisation).
+
+Nothing in this module talks to App Store Connect. Callers pass raw DER
+bytes and receive parsed Python primitives.
+"""
+
+from __future__ import annotations
+
+import plistlib
+import subprocess
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+# Apple guarantees ``ExpirationDate`` in every issued profile; if it is
+# missing or non-datetime the profile is malformed — treat as already-
+# expired so callers never reuse it.
+_EXPIRED_SENTINEL = datetime(1970, 1, 1, tzinfo=timezone.utc)
+
+
+def decode_profile_plist(profile_der: bytes, scratch_dir: Path) -> dict:
+    """Run ``security cms -D`` against ``profile_der`` and parse the plist.
+
+    The decoded payload's only authoritative source is the macOS
+    ``security`` binary; ``plistlib`` alone can't parse the CMS envelope.
+    ``scratch_dir`` is used for a temporary file (``security`` only
+    accepts file paths, not stdin); it is created if missing.
+
+    May raise ``subprocess.CalledProcessError`` (decode failure),
+    ``ValueError`` (plist parse failure), or ``OSError`` (filesystem
+    failure). Callers that want graceful cache fallback must catch.
+    """
+    scratch_dir.mkdir(parents=True, exist_ok=True)
+    tmp_path = scratch_dir / "tmp.mobileprovision"
+    tmp_path.write_bytes(profile_der)
+    try:
+        decoded = subprocess.check_output(
+            ["security", "cms", "-D", "-i", str(tmp_path)]
+        )
+    finally:
+        tmp_path.unlink(missing_ok=True)
+    return plistlib.loads(decoded)
+
+
+def ensure_utc(value) -> datetime:
+    """Normalise a plist datetime to a UTC-aware ``datetime``.
+
+    Plist dates parsed by ``plistlib`` come back as naive UTC; explicitly
+    attach ``timezone.utc`` so downstream comparisons stay timezone-safe.
+    Anything that is not a ``datetime`` returns the expired sentinel so
+    a malformed profile is never treated as reusable.
+    """
+    if not isinstance(value, datetime):
+        return _EXPIRED_SENTINEL
+    if value.tzinfo is None:
+        return value.replace(tzinfo=timezone.utc)
+    return value.astimezone(timezone.utc)

package/action/scripts/profile_manager.py

@@ -0,0 +1,307 @@
+#!/usr/bin/env python3
+"""
+Provisioning profile lifecycle helpers for the iOS native TestFlight action.
+
+Talks to the App Store Connect API to:
+
+* Register a bundle ID if it doesn't exist yet (``ensure_bundle_id``).
+* Delete any stale profile with the same name and create a fresh one that
+  references the just-issued distribution cert (``delete_profile_by_name``,
+  ``create_profile``).
+* Install the resulting ``.mobileprovision`` into every Xcode profile
+  directory (Xcode 15 and Xcode 16+ use different paths).
+
+Caching
+-------
+
+``provision_all_bundles`` is now cache-aware. Callers pass the workspace
+``creds_dir`` and a ``cache_hit`` flag indicating whether the cert was
+itself reused from cache. The function:
+
+  * If the manifest's cached cert_id matches the current cert_id AND the
+    cert was reused, it tries to reuse each bundle's profile from disk
+    (``find_reusable_profile``) before falling back to a fresh
+    ``create_profile`` round-trip. Profile create on Apple's side is
+    rate-limited and disturbs the team's profile-list view, so caching
+    is worth it.
+  * If the cert changed (cap rotation, expiry, manual revoke) it forces
+    a full regen — Apple invalidates a profile the moment its leaf cert
+    goes away, so reusing the on-disk file would archive an unsigned
+    binary.
+  * After the loop it GCs orphan ``.mobileprovision`` files whose bundle
+    is no longer in ``bundle_ids`` (e.g. an extension was deleted from
+    the target list) and rewrites the manifest with the current set.
+
+Xcode pbxproj editing lives in ``pbxproj_editor.py``; this file is
+ASC-facing only.
+"""
+
+from __future__ import annotations
+
+import base64
+import subprocess
+from datetime import datetime
+from pathlib import Path
+
+import creds_store
+from asc_common import get_json, request
+from pbxproj_editor import PROFILE_PREFIX
+from profile_io import decode_profile_plist, ensure_utc
+
+
+# Xcode 16+ moved the canonical profile directory. Older Xcode releases
+# used ~/Library/MobileDevice/Provisioning Profiles/. Write to BOTH so the
+# same script works on macos-14 (Xcode 15) and macos-15 (Xcode 26).
+_PROFILE_DIRS = [
+    Path.home() / "Library/Developer/Xcode/UserData/Provisioning Profiles",
+    Path.home() / "Library/MobileDevice/Provisioning Profiles",
+]
+
+
+# --------------------------------------------------------------------------- #
+# ASC bundle ID registration                                                  #
+# --------------------------------------------------------------------------- #
+
+def ensure_bundle_id(token: str, identifier: str) -> str:
+    """Return the ASC primary key for ``identifier``; register if missing."""
+    data = get_json(
+        "/bundleIds",
+        token,
+        params={"filter[identifier]": identifier, "limit": "5"},
+    )
+    for item in data.get("data", []):
+        if item["attributes"]["identifier"] == identifier:
+            return item["id"]
+    return _register_bundle_id(token, identifier)
+
+
+def _register_bundle_id(token: str, identifier: str) -> str:
+    body = {
+        "data": {
+            "type": "bundleIds",
+            "attributes": {
+                "identifier": identifier,
+                "name": identifier.replace(".", "-"),
+                "platform": "IOS",
+            },
+        }
+    }
+    resp = request("POST", "/bundleIds", token, json_body=body)
+    bundle_pk = resp.json()["data"]["id"]
+    print(f"Registered new bundle id {identifier!r} (pk={bundle_pk})")
+    return bundle_pk
+
+
+# --------------------------------------------------------------------------- #
+# Profile lifecycle                                                           #
+# --------------------------------------------------------------------------- #
+
+def profile_name_for(bundle_id: str) -> str:
+    return f"{PROFILE_PREFIX}{bundle_id}"
+
+
+def delete_profile_by_name(token: str, name: str) -> None:
+    """Delete every existing profile with the given name (paginated scan)."""
+    deleted_any = False
+    next_path: str | None = "/profiles?limit=200"
+    while next_path:
+        data = get_json(next_path, token)
+        for p in data.get("data", []):
+            if (p["attributes"].get("name") or "") == name:
+                pid = p["id"]
+                print(f"Deleting stale profile {pid} ({name})")
+                request("DELETE", f"/profiles/{pid}", token)
+                deleted_any = True
+        next_link = (data.get("links") or {}).get("next")
+        if not next_link:
+            break
+        idx = next_link.find("/v1")
+        next_path = next_link[idx + len("/v1"):] if idx >= 0 else None
+    if not deleted_any:
+        print(f"No existing profile named {name!r}")
+
+
+def create_profile(
+    token: str, name: str, bundle_pk: str, cert_id: str
+) -> bytes:
+    body = {
+        "data": {
+            "type": "profiles",
+            "attributes": {
+                "name": name,
+                "profileType": "IOS_APP_STORE",
+            },
+            "relationships": {
+                "bundleId": {"data": {"type": "bundleIds", "id": bundle_pk}},
+                "certificates": {
+                    "data": [{"type": "certificates", "id": cert_id}]
+                },
+            },
+        }
+    }
+    resp = request("POST", "/profiles", token, json_body=body)
+    payload = resp.json()["data"]["attributes"]["profileContent"]
+    return base64.b64decode(payload)
+
+
+def install_profile(profile_der: bytes) -> tuple[str, str, datetime]:
+    """Install the raw profile into every Xcode-visible directory.
+
+    Returns ``(uuid, team_id, expiration)``. ``team_id`` is the team
+    Apple assigned to the profile — the effective team that Xcode
+    expects to find in ``DEVELOPMENT_TEAM``. ``expiration`` is the
+    profile's ``ExpirationDate`` normalised to UTC; the caller persists
+    it in the cache manifest.
+    """
+    plist = decode_profile_plist(profile_der, _PROFILE_DIRS[0])
+    uuid = plist["UUID"]
+    team_ids = plist.get("TeamIdentifier") or []
+    team_id = team_ids[0] if team_ids else ""
+    profile_name = plist.get("Name") or "<unknown>"
+    expiration = ensure_utc(plist.get("ExpirationDate"))
+    final_name = f"{uuid}.mobileprovision"
+    for directory in _PROFILE_DIRS:
+        directory.mkdir(parents=True, exist_ok=True)
+        (directory / final_name).write_bytes(profile_der)
+    print(
+        f"  profile {profile_name!r}: uuid={uuid} team={team_id} "
+        f"exp={expiration.isoformat()} dirs={[str(d) for d in _PROFILE_DIRS]}"
+    )
+    return uuid, team_id, expiration
+
+
+# --------------------------------------------------------------------------- #
+# Orchestration                                                               #
+# --------------------------------------------------------------------------- #
+
+def _try_reuse_cached(
+    bid: str,
+    name: str,
+    cert_id: str,
+    creds_dir: Path,
+    manifest: dict,
+) -> tuple[str, str, dict] | None:
+    """Return ``(uuid, team, entry)`` if a cached profile reinstalls cleanly.
+
+    A corrupt .mobileprovision (truncated, manually edited, ``security
+    cms`` decode failure) must NEVER abort the build — log and return
+    ``None`` so the caller falls through to the fresh-create path.
+    """
+    cached = creds_store.find_reusable_profile(manifest, bid, cert_id, creds_dir)
+    if cached is None:
+        return None
+    try:
+        der = creds_store.profile_path(creds_dir, cached.uuid).read_bytes()
+        uuid, team_id, _ = install_profile(der)
+    except (OSError, subprocess.CalledProcessError, ValueError, KeyError) as exc:
+        print(
+            f"::warning::cached profile {cached.filename!r} unusable "
+            f"({exc!r}); regenerating"
+        )
+        return None
+    # cached.expiration is already UTC-aware (load_profile_manifest routes
+    # it through _parse_iso); no astimezone needed.
+    entry = {
+        "bundle_id": bid,
+        "name": cached.name or name,
+        "uuid": uuid,
+        "filename": f"{uuid}.mobileprovision",
+        "expiration": cached.expiration.isoformat(),
+    }
+    print(f"Reused cached profile {name} -> {uuid} ({bid})")
+    return uuid, team_id, entry
+
+
+def _provision_bundle(
+    token: str,
+    bid: str,
+    cert_id: str,
+    creds_dir: Path,
+    manifest: dict,
+    can_reuse: bool,
+) -> tuple[str, str, str, dict]:
+    """Provision one bundle; return ``(name, uuid, team, manifest_entry)``."""
+    name = profile_name_for(bid)
+    if can_reuse:
+        reused = _try_reuse_cached(bid, name, cert_id, creds_dir, manifest)
+        if reused is not None:
+            uuid, team_id, entry = reused
+            return name, uuid, team_id, entry
+
+    bundle_pk = ensure_bundle_id(token, bid)
+    delete_profile_by_name(token, name)
+    profile_der = create_profile(token, name, bundle_pk, cert_id)
+    uuid, team_id, expiration = install_profile(profile_der)
+    creds_store.write_cached_profile(creds_dir, uuid, profile_der)
+    entry = {
+        "bundle_id": bid,
+        "name": name,
+        "uuid": uuid,
+        "filename": f"{uuid}.mobileprovision",
+        "expiration": expiration.isoformat(),
+    }
+    print(f"Installed fresh profile {name} -> {uuid} ({bid})")
+    return name, uuid, team_id, entry
+
+
+def _gc_orphan_profiles(
+    creds_dir: Path, old_manifest: dict, new_entries: list[dict]
+) -> None:
+    """Remove cached .mobileprovision files for bundles no longer present."""
+    new_uuids = {e["uuid"] for e in new_entries}
+    for raw in old_manifest.get("profiles", []):
+        uuid = raw.get("uuid")
+        if not uuid or uuid in new_uuids:
+            continue
+        path = creds_store.profile_path(creds_dir, uuid)
+        if path.exists():
+            path.unlink(missing_ok=True)
+            print(f"GC'd orphan profile {uuid} ({raw.get('bundle_id')!r})")
+
+
+def provision_all_bundles(
+    token: str,
+    bundle_ids: list[str],
+    cert_id: str,
+    *,
+    creds_dir: Path,
+    cache_hit: bool,
+) -> tuple[list[tuple[str, str, str]], str]:
+    """Create + install a CI profile for each bundle id, with caching.
+
+    Returns ``(mappings, team_id)`` where mappings is a list of
+    ``(bundle_id, profile_name, uuid)`` tuples and ``team_id`` is the
+    team Apple assigned to the profiles (shared — the ASC API key binds
+    every profile it issues to a single team).
+
+    ``cache_hit`` says whether the cert came from cache. ``creds_dir``
+    is the workspace ``creds/`` root. When the manifest's cert_id
+    differs from ``cert_id`` we force a full regen — Apple invalidates
+    every profile bound to the prior cert the moment that cert is
+    revoked, so reusing on-disk profiles would archive unsigned bits.
+    """
+    manifest = creds_store.load_profile_manifest(creds_dir)
+    can_reuse = cache_hit and manifest.get("cert_id") == cert_id
+    if cache_hit and not can_reuse:
+        print(
+            f"Manifest cert_id {manifest.get('cert_id')!r} differs from "
+            f"current {cert_id!r}; regenerating all profiles"
+        )
+
+    results: list[tuple[str, str, str]] = []
+    new_entries: list[dict] = []
+    effective_team = ""
+    for bid in bundle_ids:
+        name, uuid, team_id, entry = _provision_bundle(
+            token, bid, cert_id, creds_dir, manifest, can_reuse
+        )
+        if team_id:
+            effective_team = team_id
+        results.append((bid, name, uuid))
+        new_entries.append(entry)
+
+    _gc_orphan_profiles(creds_dir, manifest, new_entries)
+    creds_store.write_profile_manifest(
+        creds_dir, {"cert_id": cert_id, "profiles": new_entries}
+    )
+    return results, effective_team