gowalk-cicd 1.0.55 → 1.0.56

package/CLAUDE.md

@@ -99,8 +99,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
 - Signing material should use encrypted Actions secrets. `deploy.yml`
-  materializes `ASC_KEY_P8` + its ID/issuer and the Android keystore,
-  properties and Play service account into an ephemeral runner checkout.
+  materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
+  (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_JSON`,
+  `IOS_DISTRIBUTION_CERT_REGISTRY_JSON`), and the Android keystore, properties
+  and Play service account into an ephemeral runner checkout.
   Tracked `creds/` files remain a backward-compatible fallback.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and

package/README.md

@@ -40,21 +40,30 @@ account or domain.
 
 ## iOS credentials
 
-1. Create an **App Store Connect API key** with the **App Manager** role
-   (App Store Connect → Users and Access → Keys → generate).
-2. Download the `.p8` and save it into your repo at:
+Use encrypted repository secrets for both the App Store Connect API key and
+the reusable Apple Distribution identity:
+
+- `ASC_KEY_P8`, `ASC_KEY_ID`, `ASC_ISSUER_ID`
+- `IOS_DISTRIBUTION_P12_BASE64`
+- `IOS_DISTRIBUTION_CERT_META_JSON`
+- `IOS_DISTRIBUTION_CERT_REGISTRY_JSON`
+
+The workflow materializes them with mode `0600` only in the ephemeral runner
+checkout. Secret-backed signing files are never staged or committed by the
+composite action. The distribution identity files come from the signing
+registry provisioner; pass their paths to the secret tooling without printing
+their contents.
+
+Legacy private repositories can still provide the API key at:
+
    ```
    creds/AuthKey_<KEY_ID>_Issuer_<ISSUER_UUID>.p8
    ```
-   Example: `creds/AuthKey_ABC123DEFG_Issuer_69a6de70-xxxx-47e3-e053-5b8c7c11a4d1.p8`
-   The filename encodes both the `KEY_ID` and the `ISSUER_ID` — the composite
-   action parses them from the filename.
-3. The repo **must be private**. The p8 is a long-lived credential; never
-   commit it to a public repo.
-4. (First time only, per app) Create the app record in App Store Connect. See
-   [First-time app setup](#first-time-app-setup) below.
-5. The existing metadata-rich form
-   `*(key_id_<KEY_ID>_issuer_<UUID>_vendor_id_<ID>).p8` is also accepted.
+
+The filename encodes both the key ID and issuer ID. The metadata-rich form
+`*(key_id_<KEY_ID>_issuer_<UUID>_vendor_id_<ID>).p8` is also accepted. Never
+commit this fallback to a public repository. The app record must already exist
+in App Store Connect; see [First-time app setup](#first-time-app-setup).
 
 ## Backend deploy (Python + Postgres, Docker)
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.55
+1.0.56

package/action/action.yml

@@ -10,12 +10,9 @@
 name: iOS native TestFlight deploy
 description: >
   Build a native Swift/SwiftUI iOS app on a macOS runner and upload it to
-  TestFlight. Provisions an Apple Distribution cert + App Store provisioning
-  profiles at runtime via the App Store Connect API and persists them under
-  ``creds/`` so subsequent runs reuse the same identity (cert auto-renews at
-  T-30 days). Caller workflow MUST grant ``permissions: contents: write`` so
-  the action can commit the refreshed signing identity back to the default
-  branch on push events. Only secrets required are the ASC API key trio.
+  TestFlight. Reuses an encrypted Apple Distribution identity when supplied,
+  or provisions one through App Store Connect for legacy checkout-backed
+  consumers. App Store provisioning profiles are reconciled at runtime.
 
 inputs:
   project:
@@ -60,6 +57,12 @@ inputs:
       listing or revoking any existing certificate.
     required: false
     default: "revoke-oldest"
+  persist-signing-cache:
+    description: >
+      Commit refreshed signing files back to the default branch. Set to
+      'false' when credentials were materialized from encrypted secrets.
+    required: false
+    default: "true"
   upload:
     description: "Set to 'false' to stop after producing the IPA"
     required: false
@@ -518,6 +521,7 @@ runs:
       # commit and clutter PR diffs). The signing identity is a long-lived
       # artifact owned by the canonical branch.
       if: ${{ inputs.archive == 'true'
+            && inputs.persist-signing-cache == 'true'
             && github.event_name == 'push'
             && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
       shell: bash

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.55
+1.0.56

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.55
+1.0.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.55",
+  "version": "1.0.56",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -213,6 +213,8 @@ function printSummary() {
   console.log('Next steps:');
   console.log('  Recommended: configure encrypted Actions secrets:');
   console.log('    ASC_KEY_P8, ASC_KEY_ID, ASC_ISSUER_ID');
+  console.log('    IOS_DISTRIBUTION_P12_BASE64, IOS_DISTRIBUTION_CERT_META_JSON');
+  console.log('    IOS_DISTRIBUTION_CERT_REGISTRY_JSON');
   console.log('    ANDROID_UPLOAD_KEY_BASE64, ANDROID_SIGNING_PROPERTIES');
   console.log('    GOOGLE_PLAY_SERVICE_ACCOUNT_JSON');
   console.log('  The workflow materializes them with mode 0600 only on its ephemeral runner.');

package/templates/deploy.yml

@@ -36,18 +36,35 @@ jobs:
           fetch-depth: 0
           persist-credentials: true
       - name: Materialize encrypted iOS credentials
+        id: ios_credentials
         shell: bash
         env:
           CI_ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
           CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
           CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          CI_DISTRIBUTION_P12: ${{ secrets.IOS_DISTRIBUTION_P12_BASE64 }}
+          CI_DISTRIBUTION_META: ${{ secrets.IOS_DISTRIBUTION_CERT_META_JSON }}
+          CI_DISTRIBUTION_REGISTRY: ${{ secrets.IOS_DISTRIBUTION_CERT_REGISTRY_JSON }}
         run: |
-          [ -n "${CI_ASC_KEY_P8:-}" ] || exit 0
-          : "${CI_ASC_KEY_ID:?ASC_KEY_ID secret is required with ASC_KEY_P8}"
-          : "${CI_ASC_ISSUER_ID:?ASC_ISSUER_ID secret is required with ASC_KEY_P8}"
           umask 077
           mkdir -p creds
-          printf '%s' "$CI_ASC_KEY_P8" > "creds/AuthKey_${CI_ASC_KEY_ID}_Issuer_${CI_ASC_ISSUER_ID}.p8"
+          if [ -n "${CI_ASC_KEY_P8:-}" ]; then
+            : "${CI_ASC_KEY_ID:?ASC_KEY_ID secret is required with ASC_KEY_P8}"
+            : "${CI_ASC_ISSUER_ID:?ASC_ISSUER_ID secret is required with ASC_KEY_P8}"
+            printf '%s' "$CI_ASC_KEY_P8" \
+              > "creds/AuthKey_${CI_ASC_KEY_ID}_Issuer_${CI_ASC_ISSUER_ID}.p8"
+          fi
+          if [ -z "${CI_DISTRIBUTION_P12:-}${CI_DISTRIBUTION_META:-}${CI_DISTRIBUTION_REGISTRY:-}" ]; then
+            echo "source=checkout" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          : "${CI_DISTRIBUTION_P12:?IOS_DISTRIBUTION_P12_BASE64 secret is required}"
+          : "${CI_DISTRIBUTION_META:?IOS_DISTRIBUTION_CERT_META_JSON secret is required}"
+          : "${CI_DISTRIBUTION_REGISTRY:?IOS_DISTRIBUTION_CERT_REGISTRY_JSON secret is required}"
+          printf '%s' "$CI_DISTRIBUTION_P12" | base64 -D > creds/cert.p12
+          printf '%s' "$CI_DISTRIBUTION_META" > creds/cert.meta.json
+          printf '%s' "$CI_DISTRIBUTION_REGISTRY" > creds/cert.registry.json
+          echo "source=encrypted" >> "$GITHUB_OUTPUT"
       - name: Detect Flutter
         id: flutter
         shell: bash
@@ -141,6 +158,8 @@ jobs:
           # is locked in review. Default-branch deploys retain metadata automation.
           manage-app-store-version: >-
             ${{ github.ref_name == github.event.repository.default_branch && 'true' || 'false' }}
+          persist-signing-cache: >-
+            ${{ steps.ios_credentials.outputs.source == 'encrypted' && 'false' || 'true' }}
           # Repository variable FIREBASE_APP_ID: the app's Firebase App ID(s),
           # comma-separated when it ships both platforms. With an iOS id the
           # action uploads the archive's dSYMs to Crashlytics before TestFlight.