gowalk-cicd 1.0.0

package/android-action/scripts/test_sign_bundle.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+
+
+@unittest.skipUnless(
+    shutil.which("keytool") and shutil.which("jarsigner") and shutil.which("zip"),
+    "Java signing tools are unavailable",
+)
+class SignBundleIntegrationTest(unittest.TestCase):
+    def test_signs_an_unsigned_bundle(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            keystore = root / "upload.jks"
+            bundle = root / "app-release.aab"
+            properties = root / "android-signing.properties"
+            password = "test-password"
+            subprocess.run(
+                [
+                    "keytool",
+                    "-genkeypair",
+                    "-noprompt",
+                    "-keystore",
+                    str(keystore),
+                    "-storepass",
+                    password,
+                    "-keypass",
+                    password,
+                    "-alias",
+                    "upload",
+                    "-keyalg",
+                    "RSA",
+                    "-dname",
+                    "CN=CI Test",
+                    "-validity",
+                    "1",
+                ],
+                check=True,
+                capture_output=True,
+            )
+            properties.write_text(
+                "storePassword=test-password\n"
+                "keyPassword=test-password\n"
+                "keyAlias=upload\n"
+            )
+            with zipfile.ZipFile(bundle, "w") as archive:
+                archive.writestr("base/manifest/AndroidManifest.xml", b"fixture")
+
+            subprocess.run(
+                [
+                    sys.executable,
+                    str(Path(__file__).with_name("sign_bundle.py")),
+                    "--bundle",
+                    str(bundle),
+                    "--properties",
+                    str(properties),
+                    "--keystore",
+                    str(keystore),
+                ],
+                check=True,
+                capture_output=True,
+            )
+
+            verified = subprocess.run(
+                ["jarsigner", "-verify", str(bundle)],
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertEqual(verified.returncode, 0, verified.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/bin/cli.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import updateNotifier from 'update-notifier';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
+
+const notifier = updateNotifier({ pkg });
+
+const args = process.argv.slice(2);
+let dryRun = false;
+
+for (const arg of args) {
+  switch (arg) {
+    case '-v':
+    case '--version':
+      console.log(pkg.version);
+      process.exit(0);
+    case '-h':
+    case '--help':
+      console.log(`Usage: npx gowalk-cicd [options]
+
+Installs iOS TestFlight and Android Google Play actions plus one deploy
+workflow into the current app project. Re-run anytime to update them.
+
+What it writes:
+  .github/actions/swift-app/   - vendored composite action (action.yml + scripts/)
+  .github/actions/android-app/ - Flutter Android build/sign action
+  .github/workflows/deploy.yml - dual-platform workflow
+
+Options:
+  --dry-run        Print what would happen without writing files
+  -v, --version    Show version number
+  -h, --help       Show this help message
+
+Examples:
+  cd my-app && npx --yes gowalk-cicd
+  npx --yes gowalk-cicd --dry-run
+
+After install:
+  1. Place your App Store Connect API key at creds/AuthKey_<KEY_ID>_Issuer_<UUID>.p8
+  2. Add the Android upload keystore, signing properties, and Play service account
+  3. Make the repo PRIVATE (credentials are read from creds/)
+  4. Commit + push to main -- CI builds both platforms`);
+      process.exit(0);
+    case '--dry-run':
+      dryRun = true;
+      break;
+    default:
+      console.error(`Unknown option: ${arg}`);
+      console.error(`Run with --help for usage.`);
+      process.exit(2);
+  }
+}
+
+const { runInstall } = await import('../src/install.mjs');
+await runInstall({ dryRun });
+
+notifier.notify();

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "gowalk-cicd",
+  "version": "1.0.0",
+  "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
+  "type": "module",
+  "bin": {
+    "gowalk-cicd": "./bin/cli.mjs"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "action/",
+    "!action/**/__pycache__/**",
+    "!action/**/*.py[cod]",
+    "android-action/",
+    "!android-action/**/__pycache__/**",
+    "!android-action/**/*.py[cod]",
+    "templates/",
+    "README.md",
+    "CLAUDE.md"
+  ],
+  "keywords": [
+    "ios",
+    "android",
+    "flutter",
+    "swift",
+    "testflight",
+    "google-play",
+    "github-actions",
+    "ci",
+    "app-store-connect",
+    "gowalk"
+  ],
+  "author": {
+    "name": "Gowalk"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/gowalk-public/gowalk-cicd.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "npm run test:installer && npm run test:android && npm run test:ios",
+    "test:installer": "node --test test/*.test.mjs",
+    "test:android": "python3 -m unittest discover -s android-action/scripts -p 'test_*.py'",
+    "test:ios": "python3 -m unittest discover -s action/scripts -p 'test_*.py'"
+  },
+  "dependencies": {
+    "update-notifier": "^7.3.1"
+  }
+}

package/src/install.mjs

@@ -0,0 +1,208 @@
+// Installer for gowalk-cicd.
+//
+// Copies the vendored composite action (action/) and the thin workflow
+// template (templates/deploy.yml) into the consumer's repo so their
+// app project can ship to TestFlight and Google Play from GitHub Actions.
+//
+// Intentionally simple: overwrite-on-update semantics, no scope flag,
+// no uninstall. Re-running `npx gowalk-cicd` updates both actions.
+
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { dirname } from 'node:path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const PACKAGE_DIR = resolve(__dirname, '..');
+
+const ACTION_SRC = join(PACKAGE_DIR, 'action');
+const ANDROID_ACTION_SRC = join(PACKAGE_DIR, 'android-action');
+const WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy.yml');
+const PACKAGE_JSON = join(PACKAGE_DIR, 'package.json');
+
+// Target paths inside the consumer repo. These are relative to the repo
+// root we discover below.
+const ACTION_DEST_REL = join('.github', 'actions', 'swift-app');
+const ANDROID_ACTION_DEST_REL = join('.github', 'actions', 'android-app');
+const WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy.yml');
+const VERSION_MARKER_REL = join('.github', 'actions', 'swift-app', '.daemux-version');
+const ANDROID_VERSION_MARKER_REL = join('.github', 'actions', 'android-app', '.daemux-version');
+
+// Lines we treat as ignoring credentials. If any appears in the consumer's
+// .gitignore, CI will not see one or both platform keys. We warn instead of
+// auto-editing, because
+// .gitignore is git-tracked and silent edits are the wrong default.
+const CRED_IGNORE_PATTERNS = [
+  /^\s*creds\/?\s*$/,
+  /^\s*\/creds\/?\s*$/,
+  /^\s*\*\.p8\s*$/,
+  /^\s*\*\.(?:jks|keystore)\s*$/,
+  /^\s*creds\/\*\s*$/,
+];
+
+function findRepoRoot(startDir) {
+  // Walk up until we find .git; fall back to startDir so the installer
+  // still works outside a git repo (e.g. dry-run in a scratch directory).
+  let dir = resolve(startDir);
+  while (true) {
+    if (existsSync(join(dir, '.git'))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return resolve(startDir);
+    dir = parent;
+  }
+}
+
+function isDistributionFile(path) {
+  const parts = path.split(/[\\/]/);
+  return !parts.includes('__pycache__')
+    && !path.endsWith('.pyc')
+    && !path.endsWith('.DS_Store');
+}
+
+function countFiles(dir) {
+  let n = 0;
+  for (const entry of readdirSync(dir)) {
+    const p = join(dir, entry);
+    if (!isDistributionFile(p)) continue;
+    const st = statSync(p);
+    if (st.isDirectory()) n += countFiles(p);
+    else n += 1;
+  }
+  return n;
+}
+
+function ensureDir(p) {
+  mkdirSync(p, { recursive: true });
+}
+
+function copyAction(source, destination, repoRoot, dryRun) {
+  const dest = join(repoRoot, destination);
+  const fileCount = countFiles(source);
+  const existed = existsSync(dest);
+  if (dryRun) {
+    console.log(`  [dry-run] ${existed ? 'update' : 'create'} ${destination}/ (${fileCount} files)`);
+    return { dest, existed, fileCount };
+  }
+  ensureDir(dirname(dest));
+  // force:true + overwrites existing files; we keep extra files the
+  // consumer may have added alongside so nothing vanishes unexpectedly.
+  cpSync(source, dest, { recursive: true, force: true, filter: isDistributionFile });
+  console.log(`  ${existed ? 'Updated' : 'Created'} ${destination}/ (${fileCount} files)`);
+  return { dest, existed, fileCount };
+}
+
+function copyWorkflow(repoRoot, dryRun) {
+  const dest = join(repoRoot, WORKFLOW_DEST_REL);
+  const existed = existsSync(dest);
+  if (dryRun) {
+    console.log(`  [dry-run] ${existed ? 'overwrite' : 'create'} ${WORKFLOW_DEST_REL}`);
+    return { dest, existed };
+  }
+  ensureDir(dirname(dest));
+  cpSync(WORKFLOW_TEMPLATE, dest, { force: true });
+  console.log(`  ${existed ? 'Overwrote' : 'Created'} ${WORKFLOW_DEST_REL}`);
+  return { dest, existed };
+}
+
+function writeVersionMarkers(repoRoot, dryRun) {
+  // Reads this package's own version from package.json and stamps it
+  // into the consumer repo as the source of truth for autoupdate's
+  // "am I current?" check (see autoupdate_check.sh). Read + write are
+  // paired into one function — the marker exclusively reflects the
+  // just-installed package version, so there's no value in exposing
+  // the read separately.
+  const pkg = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8'));
+  const version = String(pkg.version || '').trim();
+  const destinations = [VERSION_MARKER_REL, ANDROID_VERSION_MARKER_REL];
+  if (!version) {
+    console.log('  [warn] package.json has no version; skipping version markers');
+    return { version, written: false };
+  }
+  for (const destination of destinations) {
+    const dest = join(repoRoot, destination);
+    if (dryRun) {
+      console.log(`  [dry-run] write ${destination} (${version})`);
+      continue;
+    }
+    ensureDir(dirname(dest));
+    writeFileSync(dest, version);
+    console.log(`  Wrote ${destination} (${version})`);
+  }
+  return { version, written: !dryRun };
+}
+
+function checkGitignore(repoRoot) {
+  const gi = join(repoRoot, '.gitignore');
+  if (!existsSync(gi)) return { path: gi, exists: false, offenders: [] };
+  const lines = readFileSync(gi, 'utf8').split(/\r?\n/);
+  const offenders = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (CRED_IGNORE_PATTERNS.some((re) => re.test(line))) {
+      offenders.push({ lineNumber: i + 1, text: line });
+    }
+  }
+  return { path: gi, exists: true, offenders };
+}
+
+function printGitignoreWarning(result) {
+  if (!result.exists || result.offenders.length === 0) return;
+  console.log('');
+  console.log('WARNING: .gitignore excludes required CI credentials.');
+  console.log(`  File: ${result.path}`);
+  for (const { lineNumber, text } of result.offenders) {
+    console.log(`  Line ${lineNumber}: ${text}`);
+  }
+  console.log('');
+  console.log('  The actions read Apple and Android keys from creds/ in the checkout.');
+  console.log('  Remove those lines from .gitignore manually, then commit the .p8 file.');
+  console.log('  (Your repo MUST be private — never do this in a public repo.)');
+}
+
+function printSummary(repoRoot) {
+  console.log('');
+  console.log('Done.');
+  console.log('');
+  console.log('Next steps:');
+  console.log(`  1. Place your ASC API key:`);
+  console.log(`       ${join(relative(process.cwd(), repoRoot) || '.', 'creds', 'AuthKey_<KEY_ID>_Issuer_<UUID>.p8')}`);
+  console.log(`     (filename must include the 10-char KEY_ID and the issuer UUID)`);
+  console.log(`  2. Add creds/android-upload-key.jks and creds/android-signing.properties.`);
+  console.log(`  3. Add a Google Play service-account JSON anywhere under creds/.`);
+  console.log(`  4. Ensure the repo is PRIVATE; these long-lived credentials must remain private.`);
+  console.log(`  5. Commit and push to main. GitHub Actions builds both platforms.`);
+  console.log('');
+  console.log('Re-run this installer anytime to update the vendored action:');
+  console.log('  npx --yes gowalk-cicd');
+}
+
+export async function runInstall({ dryRun = false } = {}) {
+  const repoRoot = findRepoRoot(process.cwd());
+  console.log(`Installing gowalk-cicd into ${repoRoot}${dryRun ? ' (dry-run)' : ''}`);
+  console.log('');
+
+  copyAction(ACTION_SRC, ACTION_DEST_REL, repoRoot, dryRun);
+  copyAction(ANDROID_ACTION_SRC, ANDROID_ACTION_DEST_REL, repoRoot, dryRun);
+  writeVersionMarkers(repoRoot, dryRun);
+  copyWorkflow(repoRoot, dryRun);
+
+  const gi = checkGitignore(repoRoot);
+  printGitignoreWarning(gi);
+
+  if (dryRun) {
+    console.log('');
+    console.log('Dry-run complete. No files were written.');
+    return;
+  }
+
+  printSummary(repoRoot);
+}

package/templates/deploy.yml

@@ -0,0 +1,150 @@
+name: Mobile Deploy
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**/*.md'
+      - '.gitignore'
+      - 'creds/**'
+      - '.github/actions/swift-app/**'
+      - '.github/actions/android-app/**'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  models: read
+
+concurrency:
+  group: mobile-deploy-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ios:
+    name: iOS TestFlight
+    runs-on: macos-15
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+      - name: Detect Flutter
+        id: flutter
+        shell: bash
+        run: |
+          if [ -f pubspec.yaml ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Set up Flutter
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: stable
+          cache: true
+      - name: Cache CocoaPods
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: |
+            ios/Pods
+            ~/Library/Caches/CocoaPods
+          key: pods-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock', 'pubspec.lock') }}
+          restore-keys: pods-${{ runner.os }}-
+      - name: Prepare Flutter iOS project
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        run: |
+          flutter pub get
+          flutter build ios --release --no-codesign --config-only
+      - uses: ./.github/actions/swift-app
+        with:
+          project: ${{ steps.flutter.outputs.enabled == 'true' && 'ios/Runner.xcodeproj' || '' }}
+          workspace: ${{ steps.flutter.outputs.enabled == 'true' && 'ios/Runner.xcworkspace' || '' }}
+          scheme: ${{ steps.flutter.outputs.enabled == 'true' && 'Runner' || '' }}
+          run-tests: 'false'  # tests belong to the CI gate, not the deploy path
+
+  android:
+    name: Android Google Play
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      # Two Android delivery modes:
+      #   * bitrise — the upload key + Play service account live in Bitrise,
+      #     not the repo, so the GitHub runner cannot sign. Drop a
+      #     creds/bitrise.json ({"enabled":true,"app_slug":"...",...}) and this
+      #     job triggers the Bitrise workflow (which holds the secrets) and
+      #     waits for it. See android-action/scripts/bitrise_deploy.py.
+      #   * local  — default; build + sign + upload on the GitHub runner using
+      #     creds/android-upload-key.jks + creds/android-signing.properties.
+      - name: Select Android deploy mode
+        id: mode
+        shell: bash
+        run: |
+          if [ -f creds/bitrise.json ] && \
+             [ "$(python3 -c "import json,sys;print(json.load(open('creds/bitrise.json')).get('enabled',False))" 2>/dev/null)" = "True" ]; then
+            echo "mode=bitrise" >> "$GITHUB_OUTPUT"
+          else
+            echo "mode=local" >> "$GITHUB_OUTPUT"
+          fi
+
+      # --- Bitrise mode ---------------------------------------------------
+      - name: Deploy Android via Bitrise
+        if: ${{ steps.mode.outputs.mode == 'bitrise' }}
+        shell: bash
+        env:
+          BITRISE_API_TOKEN: ${{ secrets.BITRISE_API_TOKEN }}
+        run: python3 .github/actions/android-app/scripts/bitrise_deploy.py
+
+      # --- Local mode -----------------------------------------------------
+      - name: Set up Java
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: gradle
+      - name: Set up Flutter
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: stable
+          cache: true
+      - name: Build and sign Android release
+        id: android
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        uses: ./.github/actions/android-app
+      - name: Retain signed Android App Bundle
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: android-${{ steps.android.outputs.package-name }}-${{ steps.android.outputs.build-number }}
+          path: ${{ steps.android.outputs.bundle-path }}
+          if-no-files-found: error
+          retention-days: 30
+      - name: Install Google Play preflight dependencies
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        shell: bash
+        run: python3 -m pip install --disable-pip-version-check 'google-auth>=2.40,<3' 'requests>=2.32,<3'
+      - name: Check Google Play API readiness
+        id: play
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        shell: bash
+        env:
+          PACKAGE_NAME: ${{ steps.android.outputs.package-name }}
+          SERVICE_ACCOUNT: ${{ steps.android.outputs.play-service-account }}
+        run: |
+          python3 .github/actions/android-app/scripts/play_preflight.py \
+            --package "$PACKAGE_NAME" \
+            --service-account "$SERVICE_ACCOUNT"
+      - name: Upload Android release to Google Play
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
+        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        with:
+          serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
+          packageName: ${{ steps.android.outputs.package-name }}
+          releaseFiles: ${{ steps.android.outputs.bundle-path }}
+          tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
+          status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}