gowalk-cicd 1.0.5 → 1.0.7

package/README.md

@@ -176,9 +176,11 @@ The iOS composite action runs on `macos-15` and:
    declared version is already live.
 4. **Computes the next build number** by querying ASC for the latest uploaded
    build and incrementing.
-5. **Provisions signing** at runtime: generates a throwaway Apple Distribution
-   cert + a per-target App Store provisioning profile named `CI-<bundle_id>`.
-   Patches the `.pbxproj` to use Manual signing against those profiles.
+5. **Provisions signing** at runtime: reconciles the App ID's capabilities with
+   the target's entitlements (see below), then generates a throwaway Apple
+   Distribution cert + a per-target App Store provisioning profile named
+   `CI-<bundle_id>`. Patches the `.pbxproj` to use Manual signing against those
+   profiles.
 6. **Archives** with `xcodebuild archive`, exports the IPA, and uploads via
    `xcrun altool`.
 7. **Sets "What's New"** on every declared localization (reads
@@ -191,6 +193,29 @@ The iOS composite action runs on `macos-15` and:
 
 The iOS action requires only the p8. Everything else is derived.
 
+### App ID capabilities
+
+A provisioning profile carries only the capabilities enabled on its App ID.
+Xcode's automatic signing hides this by turning them on as you edit
+entitlements; the ASC API does not, so a CI-issued profile omits them and the
+archive fails with
+
+```
+Provisioning profile "CI-com.example.app" doesn't include the App Attest capability.
+```
+
+Before creating a profile, the action reads the target's
+`CODE_SIGN_ENTITLEMENTS` plist and enables the matching capabilities on the App
+ID — Push Notifications, App Attest, Associated Domains, Sign in with Apple,
+HealthKit, SiriKit, NFC, HomeKit, network extensions and the other plain
+on/off toggles. If it had to turn anything on, it regenerates the profile
+rather than reusing the cached one, which predates the change.
+
+Capabilities that carry values an entitlements file cannot supply — App Groups,
+iCloud containers, Apple Pay merchant IDs, Wallet pass types, Data Protection —
+are **not** enabled automatically. The action emits a `::warning::` naming what
+it saw and leaves those for you to configure in the Apple Developer portal.
+
 ## AI metadata auto-fill
 
 On every run, after the TestFlight upload succeeds, the action:
@@ -319,6 +344,12 @@ pending agreements, retry.
 **Upload fails with provisioning errors** — delete any stale profiles named
 `CI-<bundle_id>` on developer.apple.com and re-run; the action will regenerate.
 
+**"Provisioning profile doesn't include the &lt;X&gt; capability"** — the App ID
+lacks a capability the entitlements declare. The action enables the simple
+toggles itself (see [App ID capabilities](#app-id-capabilities)); if the
+warning names App Groups, iCloud, Apple Pay, Wallet or Data Protection, enable
+and configure that one in the Apple Developer portal, then re-run.
+
 ## Auto-bumping MARKETING_VERSION
 
 When the ASC combined floor (max of pending review, `preReleaseVersions`,

package/action/.daemux-version

@@ -1 +1 @@
-1.0.5
+1.0.7

package/action/scripts/capabilities.py

@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+"""Reconcile an App ID's capabilities with what the app's entitlements need.
+
+A provisioning profile only carries the capabilities enabled on its App ID.
+Xcode's automatic signing hides this by enabling them for you as you edit
+entitlements; the ASC API does not, so a CI-generated profile silently omits
+them and `xcodebuild archive` fails with
+
+    Provisioning profile "CI-<bundle>" doesn't include the App Attest
+    capability.
+
+This module reads the entitlement keys the project actually declares and turns
+on the matching capabilities before the profile is created.
+
+Deliberately narrow: only capabilities that are a plain on/off switch are
+enabled automatically. App Groups, iCloud containers, Apple Pay merchant IDs
+and friends carry settings that cannot be guessed from an entitlements file, so
+they are reported and left to a human. Everything here is best-effort — a
+capability we cannot enable produces a ``::warning::`` and lets the archive
+deliver Apple's own (more specific) error rather than failing the build here.
+"""
+
+from __future__ import annotations
+
+import plistlib
+from pathlib import Path
+
+from asc_common import get_json, request
+
+
+# asc_common.request signals a non-retryable failure with SystemExit, which is
+# a BaseException — `except Exception` sails straight past it. Spelling both
+# out is what makes the "best-effort" promise below actually hold; without it
+# a capability call that Apple rejects kills the whole signing step.
+_API_FAILURES = (Exception, SystemExit)
+
+
+# Entitlement key -> App Store Connect capabilityType, for capabilities that
+# are a bare toggle. An entitlement absent from this map is not an error: most
+# entitlements (keychain-access-groups, get-task-allow, ...) need no App ID
+# capability at all.
+CAPABILITY_BY_ENTITLEMENT = {
+    "aps-environment": "PUSH_NOTIFICATIONS",
+    "com.apple.developer.devicecheck.appattest-environment": "APP_ATTEST",
+    "com.apple.developer.associated-domains": "ASSOCIATED_DOMAINS",
+    "com.apple.developer.applesignin": "APPLE_ID_AUTH",
+    "com.apple.developer.networking.wifi-info": "ACCESS_WIFI_INFORMATION",
+    "com.apple.developer.networking.networkextension": "NETWORK_EXTENSIONS",
+    "com.apple.developer.networking.vpn.api": "PERSONAL_VPN",
+    "com.apple.developer.networking.multipath": "MULTIPATH",
+    "com.apple.developer.networking.HotspotConfiguration": "HOT_SPOT",
+    "com.apple.developer.nfc.readersession.formats": "NFC_TAG_READING",
+    "com.apple.developer.homekit": "HOMEKIT",
+    "com.apple.developer.healthkit": "HEALTHKIT",
+    "com.apple.developer.siri": "SIRIKIT",
+    "com.apple.developer.ClassKit-environment": "CLASSKIT",
+    "com.apple.developer.authentication-services.autofill-credential-provider":
+        "AUTOFILL_CREDENTIAL_PROVIDER",
+    "com.apple.external-accessory.wireless-configuration":
+        "WIRELESS_ACCESSORY_CONFIGURATION",
+    "inter-app-audio": "INTER_APP_AUDIO",
+}
+
+# Capabilities whose App ID configuration carries values (container ids,
+# merchant ids, protection level) that an entitlements file cannot supply
+# unambiguously. Enabling these blind would create a half-configured App ID,
+# so we say what is missing and stop.
+MANUAL_ENTITLEMENTS = {
+    "com.apple.security.application-groups": "App Groups",
+    "com.apple.developer.icloud-container-identifiers": "iCloud",
+    "com.apple.developer.icloud-services": "iCloud",
+    "com.apple.developer.ubiquity-kvstore-identifier": "iCloud",
+    "com.apple.developer.in-app-payments": "Apple Pay",
+    "com.apple.developer.pass-type-identifiers": "Wallet",
+    "com.apple.developer.default-data-protection": "Data Protection",
+}
+
+
+def read_entitlement_keys(path: Path) -> set[str]:
+    """Top-level keys of an entitlements plist; empty when unreadable."""
+    try:
+        with path.open("rb") as handle:
+            data = plistlib.load(handle)
+    except (OSError, plistlib.InvalidFileException, ValueError) as exc:
+        print(f"::warning::could not read entitlements {path}: {exc!r}")
+        return set()
+    return set(data) if isinstance(data, dict) else set()
+
+
+def required_capabilities(entitlement_keys: set[str]) -> set[str]:
+    return {
+        CAPABILITY_BY_ENTITLEMENT[key]
+        for key in entitlement_keys
+        if key in CAPABILITY_BY_ENTITLEMENT
+    }
+
+
+def warn_about_manual_entitlements(entitlement_keys: set[str], bundle_id: str) -> None:
+    for key in sorted(entitlement_keys & set(MANUAL_ENTITLEMENTS)):
+        print(
+            f"::warning::{bundle_id} declares {key}, which needs "
+            f"{MANUAL_ENTITLEMENTS[key]} configured on the App ID with values "
+            f"this action cannot infer. Enable it in the Apple Developer "
+            f"portal if the archive complains."
+        )
+
+
+def enabled_capabilities(token: str, bundle_pk: str) -> set[str]:
+    try:
+        # No `limit` here: this relationship rejects it outright with
+        # PARAMETER_ERROR.ILLEGAL. Apple returns the full capability set.
+        data = get_json(f"/bundleIds/{bundle_pk}/bundleIdCapabilities", token)
+    except _API_FAILURES as exc:
+        print(f"::warning::could not list capabilities for {bundle_pk}: {exc!r}")
+        return set()
+    found = set()
+    for item in data.get("data", []):
+        capability = (item.get("attributes") or {}).get("capabilityType")
+        if capability:
+            found.add(capability)
+    return found
+
+
+def enable_capability(token: str, bundle_pk: str, capability: str) -> bool:
+    body = {
+        "data": {
+            "type": "bundleIdCapabilities",
+            "attributes": {"capabilityType": capability},
+            "relationships": {
+                "bundleId": {"data": {"type": "bundleIds", "id": bundle_pk}}
+            },
+        }
+    }
+    try:
+        # 409 means another writer got there first — the desired end state.
+        response = request(
+            "POST", "/bundleIdCapabilities", token,
+            json_body=body, allow_status={200, 201, 409},
+        )
+    except _API_FAILURES as exc:
+        print(f"::warning::could not enable {capability}: {exc!r}")
+        return False
+    if response.status_code == 409:
+        return False
+    print(f"Enabled {capability} on the App ID")
+    return True
+
+
+def reconcile(token: str, bundle_pk: str, bundle_id: str, entitlement_keys: set[str]) -> bool:
+    """Enable every simple capability the entitlements imply.
+
+    Returns True when something was actually turned on — the caller must then
+    regenerate the profile, because a cached one predates the change and still
+    lacks the capability.
+    """
+    warn_about_manual_entitlements(entitlement_keys, bundle_id)
+    wanted = required_capabilities(entitlement_keys)
+    if not wanted:
+        return False
+    missing = wanted - enabled_capabilities(token, bundle_pk)
+    if not missing:
+        return False
+    print(
+        f"{bundle_id}: entitlements require {', '.join(sorted(missing))} "
+        f"but the App ID does not have them; enabling"
+    )
+    # List, not a generator: `any` short-circuits, and every missing capability
+    # must be attempted, not just up to the first success.
+    return any([
+        enable_capability(token, bundle_pk, capability)
+        for capability in sorted(missing)
+    ])

package/action/scripts/pbxproj_editor.py

@@ -72,12 +72,33 @@ def _bundle_id_from_configs(objects: dict, config_ids: list[str]) -> str:
     return ""
 
 
+def _entitlements_from_configs(objects: dict, config_ids: list[str]) -> str:
+    """First CODE_SIGN_ENTITLEMENTS path across the given configs.
+
+    Needed to reconcile the App ID's capabilities with what the app declares —
+    a profile only carries capabilities enabled on its App ID. Build-setting
+    references are skipped rather than half-expanded; a missed entitlements
+    file costs a clearer error, a wrong one costs a wrong App ID edit.
+    """
+    for cid in config_ids:
+        cfg = objects.get(cid) or {}
+        settings = cfg.get("buildSettings") or {}
+        value = (settings.get("CODE_SIGN_ENTITLEMENTS") or "").strip().strip('"')
+        if value and "$(" not in value and "${" not in value:
+            return value
+    return ""
+
+
 def discover_signable_targets(project_path: str) -> list[dict]:
     """Return one entry per signable native target.
 
-    Each entry: ``{"name": str, "bundle_id": str, "config_ids": [str,...]}``
-    where ``config_ids`` is the list of XCBuildConfiguration UUIDs whose
-    ``buildSettings`` dict we need to patch (typically Debug + Release).
+    Each entry:
+    ``{"name": str, "bundle_id": str, "config_ids": [str,...],
+    "entitlements": str}`` where ``config_ids`` is the list of
+    XCBuildConfiguration UUIDs whose ``buildSettings`` dict we need to patch
+    (typically Debug + Release) and ``entitlements`` is the target's
+    CODE_SIGN_ENTITLEMENTS path relative to the project directory ("" when the
+    target declares none).
     """
     pbx = _load_pbxproj(project_path)
     objects = pbx["objects"]
@@ -95,7 +116,12 @@ def discover_signable_targets(project_path: str) -> list[dict]:
             print(f"skip target {name!r}: no PRODUCT_BUNDLE_IDENTIFIER")
             continue
         targets.append(
-            {"name": name, "bundle_id": bundle_id, "config_ids": config_ids}
+            {
+                "name": name,
+                "bundle_id": bundle_id,
+                "config_ids": config_ids,
+                "entitlements": _entitlements_from_configs(objects, config_ids),
+            }
         )
     if not targets:
         raise SystemExit(

package/action/scripts/prepare_signing.py

@@ -39,6 +39,7 @@ import os
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+import capabilities
 import cert_factory
 import creds_store
 from asc_common import make_jwt
@@ -180,6 +181,29 @@ def _resolve_project_path() -> str:
     return project
 
 
+def _entitlement_keys_by_bundle(project: str, targets: list[dict]) -> dict[str, set[str]]:
+    """bundle_id -> entitlement keys declared by the targets that ship it.
+
+    CODE_SIGN_ENTITLEMENTS is relative to the project directory. Targets
+    sharing a bundle id (an app and its test host, say) contribute a union —
+    a capability any of them needs must be on the App ID.
+    """
+    base = Path(project).parent
+    by_bundle: dict[str, set[str]] = {}
+    for target in targets:
+        relative = target.get("entitlements") or ""
+        if not relative:
+            continue
+        path = base / relative
+        if not path.is_file():
+            print(f"::warning::{target['name']}: entitlements not found at {path}")
+            continue
+        keys = capabilities.read_entitlement_keys(path)
+        if keys:
+            by_bundle.setdefault(target["bundle_id"], set()).update(keys)
+    return by_bundle
+
+
 def main() -> None:
     runner_temp = env("RUNNER_TEMP")
     # TEAM_ID is optional — provision_all_bundles returns the effective
@@ -202,7 +226,8 @@ def main() -> None:
         token, creds_dir
     )
     mappings, effective_team = provision_all_bundles(
-        token, bundle_ids, cert_id, creds_dir=creds_dir, cache_hit=cache_hit
+        token, bundle_ids, cert_id, creds_dir=creds_dir, cache_hit=cache_hit,
+        entitlements_by_bundle=_entitlement_keys_by_bundle(project, targets),
     )
     print("Profile map:")
     for bid, pname, uuid in mappings:

package/action/scripts/profile_manager.py

@@ -43,6 +43,7 @@ import subprocess
 from datetime import datetime
 from pathlib import Path
 
+import capabilities
 import creds_store
 from asc_common import get_json, request
 from pbxproj_editor import PROFILE_PREFIX
@@ -219,16 +220,26 @@ def _provision_bundle(
     creds_dir: Path,
     manifest: dict,
     can_reuse: bool,
+    entitlement_keys: set[str] | None = None,
 ) -> tuple[str, str, str, dict]:
     """Provision one bundle; return ``(name, uuid, team, manifest_entry)``."""
     name = profile_name_for(bid)
+    # Reconcile capabilities BEFORE deciding to reuse. A profile carries only
+    # the capabilities its App ID had when it was issued, so a cached profile
+    # that predates an entitlement being added stays broken forever otherwise
+    # — the archive keeps failing on a capability the App ID now has.
+    bundle_pk = ""
+    if entitlement_keys:
+        bundle_pk = ensure_bundle_id(token, bid)
+        if capabilities.reconcile(token, bundle_pk, bid, entitlement_keys):
+            can_reuse = False
     if can_reuse:
         reused = _try_reuse_cached(bid, name, cert_id, creds_dir, manifest)
         if reused is not None:
             uuid, team_id, entry = reused
             return name, uuid, team_id, entry
 
-    bundle_pk = ensure_bundle_id(token, bid)
+    bundle_pk = bundle_pk or ensure_bundle_id(token, bid)
     delete_profile_by_name(token, name)
     profile_der = create_profile(token, name, bundle_pk, cert_id)
     uuid, team_id, expiration = install_profile(profile_der)
@@ -266,6 +277,7 @@ def provision_all_bundles(
     *,
     creds_dir: Path,
     cache_hit: bool,
+    entitlements_by_bundle: dict[str, set[str]] | None = None,
 ) -> tuple[list[tuple[str, str, str]], str]:
     """Create + install a CI profile for each bundle id, with caching.
 
@@ -291,9 +303,11 @@ def provision_all_bundles(
     results: list[tuple[str, str, str]] = []
     new_entries: list[dict] = []
     effective_team = ""
+    entitlements_by_bundle = entitlements_by_bundle or {}
     for bid in bundle_ids:
         name, uuid, team_id, entry = _provision_bundle(
-            token, bid, cert_id, creds_dir, manifest, can_reuse
+            token, bid, cert_id, creds_dir, manifest, can_reuse,
+            entitlements_by_bundle.get(bid),
         )
         if team_id:
             effective_team = team_id

package/action/scripts/test_capabilities.py

@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""App ID capability reconciliation.
+
+A profile only carries the capabilities its App ID had when Apple issued it,
+so an entitlement the App ID does not know about fails the archive with
+"Provisioning profile ... doesn't include the App Attest capability".
+"""
+
+from __future__ import annotations
+
+import plistlib
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import capabilities
+
+
+ENTITLEMENTS = {
+    "aps-environment": "production",
+    "com.apple.developer.devicecheck.appattest-environment": "production",
+    "keychain-access-groups": ["$(AppIdentifierPrefix)com.gowalk.form"],
+}
+
+
+class ReadEntitlementsTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory()
+        self.path = Path(self.temp.name) / "App.entitlements"
+
+    def tearDown(self) -> None:
+        self.temp.cleanup()
+
+    def test_reads_top_level_keys(self) -> None:
+        with self.path.open("wb") as handle:
+            plistlib.dump(ENTITLEMENTS, handle)
+
+        self.assertEqual(capabilities.read_entitlement_keys(self.path), set(ENTITLEMENTS))
+
+    def test_unreadable_file_is_not_fatal(self) -> None:
+        self.path.write_text("not a plist")
+
+        self.assertEqual(capabilities.read_entitlement_keys(self.path), set())
+
+
+class RequiredCapabilitiesTest(unittest.TestCase):
+    def test_maps_only_known_toggles(self) -> None:
+        # keychain-access-groups needs no App ID capability at all.
+        self.assertEqual(
+            capabilities.required_capabilities(set(ENTITLEMENTS)),
+            {"PUSH_NOTIFICATIONS", "APP_ATTEST"},
+        )
+
+    def test_ignores_entitlements_with_no_capability(self) -> None:
+        self.assertEqual(
+            capabilities.required_capabilities({"get-task-allow", "com.apple.security.get-task-allow"}),
+            set(),
+        )
+
+
+class ReconcileTest(unittest.TestCase):
+    def _response(self, status: int):
+        response = mock.MagicMock()
+        response.status_code = status
+        return response
+
+    def test_enables_only_the_missing_capability(self) -> None:
+        posted: list[str] = []
+
+        def fake_request(method, path, token, **kw):
+            posted.append(kw["json_body"]["data"]["attributes"]["capabilityType"])
+            return self._response(201)
+
+        listed = {"data": [{"attributes": {"capabilityType": "PUSH_NOTIFICATIONS"}}]}
+        with mock.patch.object(capabilities, "get_json", return_value=listed), \
+                mock.patch.object(capabilities, "request", side_effect=fake_request):
+            changed = capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
+
+        self.assertTrue(changed)
+        self.assertEqual(posted, ["APP_ATTEST"])
+
+    def test_no_op_when_the_app_id_already_has_everything(self) -> None:
+        listed = {
+            "data": [
+                {"attributes": {"capabilityType": "PUSH_NOTIFICATIONS"}},
+                {"attributes": {"capabilityType": "APP_ATTEST"}},
+            ]
+        }
+        with mock.patch.object(capabilities, "get_json", return_value=listed), \
+                mock.patch.object(capabilities, "request") as post:
+            changed = capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
+
+        self.assertFalse(changed)
+        post.assert_not_called()
+
+    def test_attempts_every_missing_capability(self) -> None:
+        # `any()` over a generator would stop at the first success and leave
+        # the rest of the capabilities off the App ID.
+        posted: list[str] = []
+
+        def fake_request(method, path, token, **kw):
+            posted.append(kw["json_body"]["data"]["attributes"]["capabilityType"])
+            return self._response(201)
+
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request", side_effect=fake_request):
+            capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
+
+        self.assertEqual(sorted(posted), ["APP_ATTEST", "PUSH_NOTIFICATIONS"])
+
+    def test_existing_capability_race_is_not_a_change(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request", return_value=self._response(409)):
+            changed = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.developer.devicecheck.appattest-environment"},
+            )
+
+        self.assertFalse(changed)
+
+    def test_api_failure_does_not_raise(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request", side_effect=RuntimeError("boom")):
+            changed = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.developer.devicecheck.appattest-environment"},
+            )
+
+        self.assertFalse(changed)
+
+    def test_systemexit_from_asc_does_not_kill_signing(self) -> None:
+        # asc_common.request raises SystemExit, not Exception, so a bare
+        # `except Exception` would let an Apple 4xx abort the whole run.
+        with mock.patch.object(capabilities, "get_json", side_effect=SystemExit("400")), \
+                mock.patch.object(capabilities, "request", side_effect=SystemExit("400")):
+            changed = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.developer.devicecheck.appattest-environment"},
+            )
+
+        self.assertFalse(changed)
+
+    def test_capability_listing_sends_no_limit_parameter(self) -> None:
+        # /bundleIds/{id}/bundleIdCapabilities rejects `limit` with
+        # PARAMETER_ERROR.ILLEGAL rather than ignoring it.
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}) as get:
+            capabilities.enabled_capabilities("tok", "PK")
+
+        get.assert_called_once_with("/bundleIds/PK/bundleIdCapabilities", "tok")
+
+    def test_warns_about_capabilities_it_will_not_guess(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch("builtins.print") as printed:
+            capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.security.application-groups"},
+            )
+
+        warnings = [c.args[0] for c in printed.call_args_list if c.args]
+        self.assertTrue(any("App Groups" in w for w in warnings), warnings)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.5
+1.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {