mobile-build.yml

name: Mobile App CI

permissions:
  contents: read

on:
  push:
    branches: [ master ]
  workflow_dispatch:

# Xcode allocates the production build number during export. Keep that export
# and its eventual upload in one lane so another run cannot choose the same
# number while the first IPA is still being verified. Retain pending app builds
# even when a later push only changes backend files.
concurrency:
  group: maple-ios-production-testflight
  cancel-in-progress: false
  queue: max

jobs:
  changes:
    if: >-
      github.repository == 'MaplePrivacyLabs/Maple' &&
      github.ref == 'refs/heads/master' &&
      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    uses: ./.github/workflows/app-change-detection.yml

  build-ios:
    environment: apple-signing
    needs: changes
    if: >-
      always() && !cancelled() &&
      github.repository == 'MaplePrivacyLabs/Maple' &&
      github.ref == 'refs/heads/master' &&
      (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
      (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')
    runs-on: blacksmith-6vcpu-macos-26
    # The ONNX source build and the app build each allow 90 minutes.
    timeout-minutes: 240
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Select pinned Xcode
        id: select_xcode
        run: python3 scripts/ci/select-xcode.py

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
        with:
          source-tag: v3.23.3
          github-token: ""

      - name: Verify pinned Nix runtime
        run: bash scripts/ci/verify-nix-runtime.sh

      - name: Cache Xcode DerivedData and SourcePackages
        uses: irgaly/xcode-cache@4141f139f00e335c6e1031fb93e667181f86146f # was v1
        with:
          key: xcode-cache-ios-xcode${{ steps.select_xcode.outputs.version }}-${{ steps.select_xcode.outputs.build }}-${{ github.workflow }}-${{ hashFiles('apps/maple-research/frontend/src-tauri/Cargo.lock') }}
          restore-keys: |
            xcode-cache-ios-xcode${{ steps.select_xcode.outputs.version }}-${{ steps.select_xcode.outputs.build }}-${{ github.workflow }}-
            xcode-cache-ios-xcode${{ steps.select_xcode.outputs.version }}-${{ steps.select_xcode.outputs.build }}-

      - name: Cache ONNX Runtime iOS artifact
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
        with:
          path: |
            apps/maple-research/frontend/src-tauri/onnxruntime-ios
          key: release-onnxruntime-ios-artifact-1.23.2-xcode${{ steps.select_xcode.outputs.version }}-${{ steps.select_xcode.outputs.build }}-${{ hashFiles('flake.lock', 'flake.nix', 'scripts/ci/apple-toolchain.json', 'scripts/ci/select-xcode.py', 'scripts/ci/_common.sh', 'scripts/ci/ios-onnxruntime.sh', 'apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh', 'apps/maple-research/frontend/src-tauri/scripts/canonicalize-static-archive.py', 'apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh') }}
          restore-keys: |
            release-onnxruntime-ios-artifact-1.23.2-xcode${{ steps.select_xcode.outputs.version }}-${{ steps.select_xcode.outputs.build }}-

      - name: Prepare ONNX Runtime iOS artifact
        run: nix develop --no-update-lock-file .#apple -c ./scripts/ci/ios-onnxruntime.sh
        timeout-minutes: 90

      - name: Build Tauri iOS App (signed)
        run: nix develop --no-update-lock-file .#apple -c ./scripts/ci/ios-release.sh
        env:
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
          APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_TEAM_ID }}
          MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY: "1"
        timeout-minutes: 90

      - name: Collect iOS release checksums
        run: |
          nix develop --no-update-lock-file .#apple -c ./scripts/ci/attestation-manifest.sh \
            ios-release-artifacts.sha256 \
            apps/maple-research/frontend/src-tauri/target/reproducibility/ios-release-final.sha256 \
            apps/maple-research/frontend/src-tauri/target/reproducibility/ios-release-*.sha256 \
            apps/maple-research/frontend/src-tauri/target/reproducibility/ios-release-*.txt \
            apps/maple-research/frontend/src-tauri/target/reproducibility/ios-onnxruntime-*.sha256
          cat ios-release-artifacts.sha256

      - name: Attest iOS release artifacts
        # Keep uploads/verifiers running if GitHub token policy rejects artifact attestation.
        continue-on-error: true
        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # was v4
        with:
          subject-checksums: ios-release-artifacts.sha256

      - name: Upload iOS App
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4
        with:
          name: maple-ios
          path: |
            apps/maple-research/frontend/src-tauri/gen/apple/build/arm64/*.ipa
            apps/maple-research/frontend/src-tauri/target/reproducibility/*.sha256
            apps/maple-research/frontend/src-tauri/target/reproducibility/*.txt
          retention-days: 5

  verify-ios-artifacts:
    needs: build-ios
    runs-on: macos-26
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          persist-credentials: false

      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
        with:
          source-tag: v3.23.3
          github-token: ""

      - name: Verify pinned Nix runtime
        run: bash scripts/ci/verify-nix-runtime.sh

      - name: Download iOS artifacts
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
        with:
          name: maple-ios
          path: artifacts

      - name: Verify iOS artifact reproducibility proofs
        run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/verify-release-artifacts.sh artifacts ios
        env:
          MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY: "1"

  submit-ios-testflight:
    environment: apple-signing
    if: >-
      github.repository == 'MaplePrivacyLabs/Maple' &&
      github.ref == 'refs/heads/master' &&
      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    needs: verify-ios-artifacts
    runs-on: macos-26
    timeout-minutes: 45
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
        with:
          ref: ${{ github.sha }}
          persist-credentials: false

      - name: Select pinned Xcode
        run: python3 scripts/ci/select-xcode.py

      - name: Download verified iOS artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
        with:
          name: maple-ios
          path: artifacts

      - name: Prepare App Store Connect API key
        env:
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          if [ -z "${APPLE_API_ISSUER}" ] || [ -z "${APPLE_API_KEY}" ] || [ -z "${APPLE_API_PRIVATE_KEY}" ]; then
            echo "APPLE_API_ISSUER, APPLE_API_KEY, and APPLE_API_PRIVATE_KEY are required to submit to TestFlight." >&2
            exit 1
          fi

          mkdir -p "${HOME}/.private_keys"
          key_path="${HOME}/.private_keys/AuthKey_${APPLE_API_KEY}.p8"
          if ! printf '%s' "${APPLE_API_PRIVATE_KEY}" | base64 --decode > "${key_path}" 2>/dev/null; then
            printf '%s' "${APPLE_API_PRIVATE_KEY}" | base64 -D > "${key_path}"
          fi
          chmod 600 "${key_path}"

      - name: Submit verified IPA to TestFlight
        run: |
          set -euo pipefail
          IPA_PATH="$(find artifacts -name "*.ipa" | LC_ALL=C sort | head -n 1)"
          if [ -z "${IPA_PATH}" ]; then
            echo "No IPA found under downloaded artifacts" >&2
            exit 1
          fi

          xcrun altool --upload-app --type ios \
            --file "${IPA_PATH}" \
            --apiKey "${{ secrets.APPLE_API_KEY }}" \
            --apiIssuer "${{ secrets.APPLE_API_ISSUER }}"