diff --git a/.github/workflows/release-healthchat.yml b/.github/workflows/release-healthchat.yml new file mode 100644 index 000000000..7ec685f84 --- /dev/null +++ b/.github/workflows/release-healthchat.yml @@ -0,0 +1,133 @@ +name: Release HealthChat + +on: + push: + tags: + - 'healthchat-v*' + workflow_dispatch: + inputs: + version: + description: 'Marketing version (e.g. 26.7.4). Must be 1-3 dot-separated integers — Apple rejects anything else.' + required: true + type: string + release_notes_override: + description: 'Optional release notes. If empty, falls back to the HEALTHCHAT_CHANGES.md section for the given version.' + required: false + type: string + +permissions: + # Minimum needed for actions/checkout to clone an internal repo. The workflow does not push, + # comment, or create releases — everything else authenticates with the ASC key and .p12. + contents: read + +concurrency: + group: release-healthchat-${{ github.event.inputs.version || github.ref_name }} + cancel-in-progress: false + +jobs: + release: + name: Build & upload to TestFlight + runs-on: [self-hosted, macOS] + timeout-minutes: 90 + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + # This repo's only submodule is element-hq's private Enterprise repo, which Novaloop + # cannot clone. Checking out submodules fails the job on its very first step. + submodules: false + persist-credentials: false + + - name: Record toolchain + # HealthChat: nothing pins Xcode (the runner carries a single globally-selected one), so this + # log line is the only record of which compiler produced a given TestFlight build. + run: xcodebuild -version + + - name: Resolve marketing version + id: version + env: + # Read via env, never `${{ }}` inside the script: the input is attacker-controlled text + # that GitHub would splice into the shell before the regex below could reject it. + INPUT_VERSION: ${{ github.event.inputs.version }} + run: | + set -euo pipefail + if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then + VERSION="$INPUT_VERSION" + else + VERSION="${GITHUB_REF_NAME#healthchat-v}" + fi + # Apple caps CFBundleShortVersionString at three integers. The Fastfile guards this too, + # but failing here costs seconds instead of a signing run. + if ! [[ "$VERSION" =~ ^[0-9]+(\.[0-9]+){0,2}$ ]]; then + echo "::error::Invalid marketing version '$VERSION' — expected 1-3 dot-separated integers, e.g. 26.7.4" + exit 1 + fi + echo "version=$VERSION" >> "$GITHUB_OUTPUT" + echo "Resolved marketing version: $VERSION" + + - name: Extract release notes + id: notes + env: + VERSION: ${{ steps.version.outputs.version }} + OVERRIDE: ${{ github.event.inputs.release_notes_override }} + run: | + set -euo pipefail + if [[ -n "$OVERRIDE" ]]; then + NOTES="$OVERRIDE" + echo "Using release notes from the workflow input" + elif [[ ! -f HEALTHCHAT_CHANGES.md ]]; then + echo "::error::HEALTHCHAT_CHANGES.md is missing — it is the release-notes source" + exit 1 + else + NOTES=$(awk -v ver="$VERSION" ' + /^## Changes in / { + if (found) { exit } + if ($0 ~ "## Changes in " ver "( |$|\\()") { found = 1; next } + } + found { print } + ' HEALTHCHAT_CHANGES.md | sed '/^[[:space:]]*$/{N;/^\n$/D;}') + if [[ -z "$NOTES" ]]; then + NOTES="HealthChat ${VERSION} — automated build from ${GITHUB_REF_NAME}." + echo "::warning::No HEALTHCHAT_CHANGES.md section found for $VERSION — using fallback" + fi + fi + { + echo 'notes<> "$GITHUB_OUTPUT" + + - name: Bundle install + run: | + bundle config path vendor/bundle + bundle install --jobs 4 --retry 3 + + - name: Import signing certificate + uses: apple-actions/import-codesign-certs@b610f78488812c1e56b20e6df63ec42d833f2d14 # v6.0.0 + with: + p12-file-base64: ${{ secrets.HEALTHCHAT_CERTIFICATES_P12 }} + p12-password: ${{ secrets.HEALTHCHAT_CERTIFICATES_P12_PASSWORD }} + + - name: Build & upload to TestFlight + run: bundle exec fastlane release_testflight + env: + # Passed via env rather than lane options so multi-line notes containing quotes, + # $, or backticks survive without shell escaping. + HEALTHCHAT_MARKETING_VERSION: ${{ steps.version.outputs.version }} + HEALTHCHAT_RELEASE_NOTES: ${{ steps.notes.outputs.notes }} + APPSTORECONNECT_KEY_ID: ${{ secrets.HEALTHCHAT_ASC_KEY_ID }} + APPSTORECONNECT_KEY_ISSUER_ID: ${{ secrets.HEALTHCHAT_ASC_KEY_ISSUER_ID }} + APPSTORECONNECT_KEY_CONTENT: ${{ secrets.HEALTHCHAT_ASC_KEY_CONTENT }} + TEAM_ID: '6G37K72W82' + + - name: Upload artifacts + if: always() + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: healthchat-${{ steps.version.outputs.version }} + path: | + out/ElementX.ipa + out/ElementX.app.dSYM.zip + build/Logs/Gym/*.log + retention-days: 90 + if-no-files-found: warn diff --git a/.gitignore b/.gitignore index 05265eb34..0cc5151ae 100644 --- a/.gitignore +++ b/.gitignore @@ -18,9 +18,22 @@ DerivedData/ .swiftpm .netrc +# fastlane +# +# It is recommended to not store the screenshots in the git repo. +# Instead, use fastlane to re-generate the screenshots whenever they are needed. +# For more information about the recommended setup visit: +# https://docs.fastlane.tools/best-practices/source-control/#source-control + +fastlane/report.xml +fastlane/Preview.html +fastlane/screenshots/**/*.png +fastlane/test_output +towncrier.toml.tmp +version_changes.md + build /vendor/ -*/xcshareddata/xcodecloud ## macOS Files .DS_Store @@ -37,5 +50,9 @@ test_output Components/Secrets/vendor/* !Components/Secrets/vendor/package-2 -# Local SDK development override -matrix-rust-components-swift +# fastlane release outputs +out/ +provisioning_profiles/ +# Regenerated by every fastlane invocation, including on the runner. Ignored rather than +# committed, matching element-ios. +fastlane/README.md diff --git a/Gemfile b/Gemfile new file mode 100644 index 000000000..cdd3a6b34 --- /dev/null +++ b/Gemfile @@ -0,0 +1,6 @@ +source "https://rubygems.org" + +gem "fastlane" + +plugins_path = File.join(File.dirname(__FILE__), 'fastlane', 'Pluginfile') +eval_gemfile(plugins_path) if File.exist?(plugins_path) diff --git a/Gemfile.lock b/Gemfile.lock new file mode 100644 index 000000000..9943c21d9 --- /dev/null +++ b/Gemfile.lock @@ -0,0 +1,350 @@ +GEM + remote: https://rubygems.org/ + specs: + CFPropertyList (3.0.8) + abbrev (0.1.2) + addressable (2.9.0) + public_suffix (>= 2.0.2, < 8.0) + artifactory (3.0.17) + atomos (0.1.3) + aws-eventstream (1.4.0) + aws-partitions (1.1269.0) + aws-sdk-core (3.254.0) + aws-eventstream (~> 1, >= 1.3.0) + aws-partitions (~> 1, >= 1.992.0) + aws-sigv4 (~> 1.9) + base64 + bigdecimal + jmespath (~> 1, >= 1.6.1) + logger + aws-sdk-kms (1.130.0) + aws-sdk-core (~> 3, >= 3.254.0) + aws-sigv4 (~> 1.5) + aws-sdk-s3 (1.227.0) + aws-sdk-core (~> 3, >= 3.254.0) + aws-sdk-kms (~> 1) + aws-sigv4 (~> 1.5) + aws-sigv4 (1.12.1) + aws-eventstream (~> 1, >= 1.0.2) + babosa (1.0.4) + base64 (0.3.0) + benchmark (0.5.0) + bigdecimal (4.1.2) + claide (1.1.0) + colored (1.2) + colored2 (3.1.2) + commander (4.6.0) + highline (~> 2.0.0) + csv (3.3.5) + declarative (0.0.20) + digest-crc (0.7.0) + rake (>= 12.0.0, < 14.0.0) + domain_name (0.6.20240107) + dotenv (2.8.1) + emoji_regex (3.2.3) + excon (1.5.0) + logger + faraday (1.10.6) + faraday-em_http (~> 1.0) + faraday-em_synchrony (~> 1.0) + faraday-excon (~> 1.1) + faraday-httpclient (~> 1.0) + faraday-multipart (~> 1.0) + faraday-net_http (~> 1.0) + faraday-net_http_persistent (~> 1.0) + faraday-patron (~> 1.0) + faraday-rack (~> 1.0) + faraday-retry (~> 1.0) + ruby2_keywords (>= 0.0.4) + faraday-cookie_jar (0.0.8) + faraday (>= 0.8.0) + http-cookie (>= 1.0.0) + faraday-em_http (1.0.0) + faraday-em_synchrony (1.0.1) + faraday-excon (1.1.0) + faraday-httpclient (1.0.1) + faraday-multipart (1.2.0) + multipart-post (~> 2.0) + faraday-net_http (1.0.2) + faraday-net_http_persistent (1.2.0) + faraday-patron (1.0.0) + faraday-rack (1.0.0) + faraday-retry (1.0.4) + faraday_middleware (1.2.1) + faraday (~> 1.0) + fastimage (2.4.1) + fastlane (2.237.0) + CFPropertyList (>= 2.3, < 5.0.0) + abbrev (~> 0.1) + addressable (>= 2.9.0, < 3.0.0) + artifactory (~> 3.0) + aws-sdk-s3 (~> 1.197) + babosa (>= 1.0.3, < 2.0.0) + base64 (~> 0.2) + benchmark (>= 0.1.0) + bundler (>= 2.4.0, < 5.0.0) + colored (~> 1.2) + commander (~> 4.6) + csv (~> 3.3) + dotenv (>= 2.1.1, < 3.0.0) + emoji_regex (>= 0.1, < 4.0) + excon (>= 0.71.0, < 2.0.0) + faraday (~> 1.0) + faraday-cookie_jar (~> 0.0.6) + faraday_middleware (~> 1.0) + fastimage (>= 2.1.0, < 3.0.0) + fastlane-sirp (>= 1.1.0) + gh_inspector (>= 1.1.2, < 2.0.0) + google-apis-androidpublisher_v3 (~> 0.3) + google-apis-playcustomapp_v1 (~> 0.1) + google-cloud-env (>= 1.6.0, < 2.3.0) + google-cloud-storage (~> 1.31) + highline (~> 2.0) + http-cookie (~> 1.0.5) + json (< 3.0.0) + jwt (>= 2.10.3, < 4) + logger (>= 1.6, < 2.0) + mini_magick (>= 4.9.4, < 5.0.0) + multi_json (~> 1.12) + multipart-post (>= 2.0.0, < 3.0.0) + mutex_m (~> 0.3) + naturally (~> 2.2) + nkf (~> 0.2) + optparse (>= 0.1.1, < 1.0.0) + ostruct (>= 0.1.0) + plist (>= 3.1.0, < 4.0.0) + rubyzip (>= 2.0.0, < 3.0.0) + security (= 0.1.5) + simctl (~> 1.6.3) + terminal-notifier (>= 2.0.0, < 3.0.0) + terminal-table (~> 3) + tty-screen (>= 0.6.3, < 1.0.0) + tty-spinner (>= 0.8.0, < 1.0.0) + word_wrap (~> 1.0.0) + xcodeproj (>= 1.13.0, < 2.0.0) + xcpretty (~> 0.4.1) + xcpretty-travis-formatter (>= 0.0.3, < 2.0.0) + fastlane-plugin-brew (0.1.1) + fastlane-plugin-xcodegen (1.1.0) + fastlane-plugin-brew (~> 0.1.1) + fastlane-sirp (1.1.0) + gh_inspector (1.1.3) + google-apis-androidpublisher_v3 (0.104.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-core (0.18.0) + addressable (~> 2.5, >= 2.5.1) + googleauth (~> 1.9) + httpclient (>= 2.8.3, < 3.a) + mini_mime (~> 1.0) + mutex_m + representable (~> 3.0) + retriable (>= 2.0, < 4.a) + google-apis-iamcredentials_v1 (0.28.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-playcustomapp_v1 (0.18.0) + google-apis-core (>= 0.15.0, < 2.a) + google-apis-storage_v1 (0.64.0) + google-apis-core (>= 0.15.0, < 2.a) + google-cloud-core (1.9.0) + google-cloud-env (>= 1.0, < 3.a) + google-cloud-errors (~> 1.0) + google-cloud-env (2.2.2) + base64 (~> 0.2) + faraday (>= 1.0, < 3.a) + google-cloud-errors (1.7.0) + google-cloud-storage (1.62.0) + addressable (~> 2.8) + digest-crc (~> 0.4) + google-apis-core (>= 0.18, < 2) + google-apis-iamcredentials_v1 (~> 0.18) + google-apis-storage_v1 (>= 0.42) + google-cloud-core (~> 1.6) + googleauth (~> 1.9) + mini_mime (~> 1.0) + google-logging-utils (0.2.0) + googleauth (1.17.1) + faraday (>= 1.0, < 3.a) + google-cloud-env (~> 2.2) + google-logging-utils (~> 0.1) + jwt (>= 1.4, < 4.0) + os (>= 0.9, < 2.0) + pstore (~> 0.1) + signet (>= 0.16, < 2.a) + highline (2.0.3) + http-cookie (1.0.8) + domain_name (~> 0.5) + httpclient (2.9.0) + mutex_m + jmespath (1.6.2) + json (2.21.1) + jwt (3.2.0) + base64 + logger (1.7.0) + mini_magick (4.13.2) + mini_mime (1.1.5) + multi_json (1.21.1) + multipart-post (2.4.1) + mutex_m (0.3.0) + nanaimo (0.4.0) + naturally (2.3.0) + nkf (0.3.0) + optparse (0.8.1) + os (1.1.4) + ostruct (0.6.3) + plist (3.7.2) + pstore (0.2.1) + public_suffix (7.0.5) + rake (13.4.2) + representable (3.2.0) + declarative (< 0.1.0) + trailblazer-option (>= 0.1.1, < 0.2.0) + uber (< 0.2.0) + retriable (3.8.0) + rexml (3.4.4) + rouge (3.28.0) + ruby2_keywords (0.0.5) + rubyzip (2.4.1) + security (0.1.5) + signet (0.22.0) + addressable (~> 2.8) + faraday (>= 0.17.5, < 3.a) + jwt (>= 1.5, < 4.0) + simctl (1.6.10) + CFPropertyList + naturally + terminal-notifier (2.0.0) + terminal-table (3.0.2) + unicode-display_width (>= 1.1.1, < 3) + trailblazer-option (0.1.2) + tty-cursor (0.7.1) + tty-screen (0.8.2) + tty-spinner (0.9.3) + tty-cursor (~> 0.7) + uber (0.1.0) + unicode-display_width (2.6.0) + word_wrap (1.0.0) + xcodeproj (1.28.1) + CFPropertyList (>= 2.3.3, < 4.0) + atomos (~> 0.1.3) + base64 + claide (>= 1.0.2, < 2.0) + colored2 (~> 3.1) + nanaimo (~> 0.4.0) + nkf + rexml (>= 3.3.6, < 4.0) + xcpretty (0.4.1) + rouge (~> 3.28.0) + xcpretty-travis-formatter (1.0.1) + xcpretty (~> 0.2, >= 0.0.7) + +PLATFORMS + arm64-darwin-25 + ruby + +DEPENDENCIES + fastlane + fastlane-plugin-xcodegen + +CHECKSUMS + CFPropertyList (3.0.8) sha256=2c99d0d980536d3d7ab252f7bd59ac8be50fbdd1ff487c98c949bb66bb114261 + abbrev (0.1.2) sha256=ad1b4eaaaed4cb722d5684d63949e4bde1d34f2a95e20db93aecfe7cbac74242 + addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af + artifactory (3.0.17) sha256=3023d5c964c31674090d655a516f38ca75665c15084140c08b7f2841131af263 + atomos (0.1.3) sha256=7d43b22f2454a36bace5532d30785b06de3711399cb1c6bf932573eda536789f + aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b + aws-partitions (1.1269.0) sha256=80beca6c8a35ddfc11b0b529424ea6167ace3da92cd7368847ce694679dedea5 + aws-sdk-core (3.254.0) sha256=ee3e3220b8468a3c9e59daba18e6ec897bf5c7ce8adcc0670cfa2f1f092112fe + aws-sdk-kms (1.130.0) sha256=a2e83662ca31b77a2a19c9aa2f40a98165a67270c18c718fe1c70d0cbd7cd749 + aws-sdk-s3 (1.227.0) sha256=552b23bf9a37c7db4957e9291543e61c8de886cf31d1d45ea3b429df0feea939 + aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00 + babosa (1.0.4) sha256=18dea450f595462ed7cb80595abd76b2e535db8c91b350f6c4b3d73986c5bc99 + base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b + benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c + bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd + claide (1.1.0) sha256=6d3c5c089dde904d96aa30e73306d0d4bd444b1accb9b3125ce14a3c0183f82e + colored (1.2) sha256=9d82b47ac589ce7f6cab64b1f194a2009e9fd00c326a5357321f44afab2c1d2c + colored2 (3.1.2) sha256=b13c2bd7eeae2cf7356a62501d398e72fde78780bd26aec6a979578293c28b4a + commander (4.6.0) sha256=7d1ddc3fccae60cc906b4131b916107e2ef0108858f485fdda30610c0f2913d9 + csv (3.3.5) sha256=6e5134ac3383ef728b7f02725d9872934f523cb40b961479f69cf3afa6c8e73f + declarative (0.0.20) sha256=8021dd6cb17ab2b61233c56903d3f5a259c5cf43c80ff332d447d395b17d9ff9 + digest-crc (0.7.0) sha256=64adc23a26a241044cbe6732477ca1b3c281d79e2240bcff275a37a5a0d78c07 + domain_name (0.6.20240107) sha256=5f693b2215708476517479bf2b3802e49068ad82167bcd2286f899536a17d933 + dotenv (2.8.1) sha256=c5944793349ae03c432e1780a2ca929d60b88c7d14d52d630db0508c3a8a17d8 + emoji_regex (3.2.3) sha256=ecd8be856b7691406c6bf3bb3a5e55d6ed683ffab98b4aa531bb90e1ddcc564b + excon (1.5.0) sha256=c503ad1d0123bc8ab2a062ff3789dc891ec368cb9e13765ab88a9c58c8bb6d50 + faraday (1.10.6) sha256=7ff4802a6b312876a2241b3e641ce0d5045e168dd871b422c35b505e5261ad4d + faraday-cookie_jar (0.0.8) sha256=0140605823f8cc63c7028fccee486aaed8e54835c360cffc1f7c8c07c4299dbb + faraday-em_http (1.0.0) sha256=7a3d4c7079789121054f57e08cd4ef7e40ad1549b63101f38c7093a9d6c59689 + faraday-em_synchrony (1.0.1) sha256=bf3ce45dcf543088d319ab051f80985ea6d294930635b7a0b966563179f81750 + faraday-excon (1.1.0) sha256=b055c842376734d7f74350fe8611542ae2000c5387348d9ba9708109d6e40940 + faraday-httpclient (1.0.1) sha256=4c8ff1f0973ff835be8d043ef16aaf54f47f25b7578f6d916deee8399a04d33b + faraday-multipart (1.2.0) sha256=7d89a949693714176f612323ca13746a2ded204031a6ba528adee788694ef757 + faraday-net_http (1.0.2) sha256=63992efea42c925a20818cf3c0830947948541fdcf345842755510d266e4c682 + faraday-net_http_persistent (1.2.0) sha256=0b0cbc8f03dab943c3e1cc58d8b7beb142d9df068b39c718cd83e39260348335 + faraday-patron (1.0.0) sha256=dc2cd7b340bb3cc8e36bcb9e6e7eff43d134b6d526d5f3429c7a7680ddd38fa7 + faraday-rack (1.0.0) sha256=ef60ec969a2bb95b8dbf24400155aee64a00fc8ba6c6a4d3968562bcc92328c0 + faraday-retry (1.0.4) sha256=dc659233777fabf96c69c2ffe56c0a5d2c102af90321a42cc6c90157bcd716aa + faraday_middleware (1.2.1) sha256=d45b78c8ee864c4783fbc276f845243d4a7918a67301c052647bacabec0529e9 + fastimage (2.4.1) sha256=c64bebd46b6fd8943ab70c1e6e85ff728f970f2e48f92ecd249b6bc3a540ad20 + fastlane (2.237.0) sha256=bb1e867bc070fb328741b5e6e7606d5ba596941a9ecca0478f60ef22d1009db9 + fastlane-plugin-brew (0.1.1) sha256=c2d1c98ead82f78818621b5b1eb123e0bf9da7e1a7b3efeaac77a776725a7fbf + fastlane-plugin-xcodegen (1.1.0) sha256=9bbed6c2ea21ca6869567e350d0b62cf41770949d15e40869058d689f1a6d06d + fastlane-sirp (1.1.0) sha256=10bc94f9682efd8e1badfb31452a76dd8981f1f3a33717c765fde6d75b54d847 + gh_inspector (1.1.3) sha256=04cca7171b87164e053aa43147971d3b7f500fcb58177698886b48a9fc4a1939 + google-apis-androidpublisher_v3 (0.104.0) sha256=3bf7f0dee23ae71e070e279848374834853204e304831cf6aa76fa435a4d6eff + google-apis-core (0.18.0) sha256=96b057816feeeab448139ed5b5c78eab7fc2a9d8958f0fbc8217dedffad054ee + google-apis-iamcredentials_v1 (0.28.0) sha256=0a92ffe6cc39c569554af2a77a25dfc61519ed8bbb64ab04cffdd352dc5ef106 + google-apis-playcustomapp_v1 (0.18.0) sha256=44b277b9dee4a59ac5e9d98be1485edc5e382d2f9d73c79ae8908a455786a254 + google-apis-storage_v1 (0.64.0) sha256=75b11afa2edcee859b84c7a6972ee4456314eeef5f762827fd6cf5c5ffaf93f2 + google-cloud-core (1.9.0) sha256=ab55409f51488e8deefb6edcc1ce4771dfb5da2fe7b3bc075709a030c2b682a4 + google-cloud-env (2.2.2) sha256=94bed40e05a67e9468ce1cb38389fba9a90aa8fc62fc9e173204c1dca59e21e7 + google-cloud-errors (1.7.0) sha256=6e682f42d89aae08689f36f28495de629d756da076bafff0003bac7f8042ebb3 + google-cloud-storage (1.62.0) sha256=e2c3c08bf8fd40d50be92304084942203314d4fc0ee52028e99f9359c3ad1330 + google-logging-utils (0.2.0) sha256=675462b4ea5affa825a3442694ca2d75d0069455a1d0956127207498fca3df7b + googleauth (1.17.1) sha256=0f7e6fc70e204cee1b2d71f1e1de2d3b349d432404197fe68ebf7fa23d0821b9 + highline (2.0.3) sha256=2ddd5c127d4692721486f91737307236fe005352d12a4202e26c48614f719479 + http-cookie (1.0.8) sha256=b14fe0445cf24bf9ae098633e9b8d42e4c07c3c1f700672b09fbfe32ffd41aa6 + httpclient (2.9.0) sha256=4b645958e494b2f86c2f8a2f304c959baa273a310e77a2931ddb986d83e498c8 + jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1 + json (2.21.1) sha256=13a43df75d95641443f5702dff350f237164a9d811ff0f2c2800d4d980220583 + jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7 + logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203 + mini_magick (4.13.2) sha256=71d6258e0e8a3d04a9a0a09784d5d857b403a198a51dd4f882510435eb95ddd9 + mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef + multi_json (1.21.1) sha256=e6126a31808e3b4d19f483c775ceac34df190dffa62adfb63a165ee14ba68080 + multipart-post (2.4.1) sha256=9872d03a8e552020ca096adadbf5e3cb1cd1cdd6acd3c161136b8a5737cdb4a8 + mutex_m (0.3.0) sha256=cfcb04ac16b69c4813777022fdceda24e9f798e48092a2b817eb4c0a782b0751 + nanaimo (0.4.0) sha256=faf069551bab17f15169c1f74a1c73c220657e71b6e900919897a10d991d0723 + naturally (2.3.0) sha256=459923cf76c2e6613048301742363200c3c7e4904c324097d54a67401e179e01 + nkf (0.3.0) sha256=357a8dbeba38b727b75930f665146546076a394a1c243faf634ff176e3588895 + optparse (0.8.1) sha256=42bea10d53907ccff4f080a69991441d611fbf8733b60ed1ce9ee365ce03bd1a + os (1.1.4) sha256=57816d6a334e7bd6aed048f4b0308226c5fb027433b67d90a9ab435f35108d3f + ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912 + plist (3.7.2) sha256=d37a4527cc1116064393df4b40e1dbbc94c65fa9ca2eec52edf9a13616718a42 + pstore (0.2.1) sha256=03904d0f2c66579e96d1e6704cdabc0c88df7ea8ed8782d9f3569f6f6c702c1a + public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623 + rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701 + representable (3.2.0) sha256=cc29bf7eebc31653586849371a43ffe36c60b54b0a6365b5f7d95ec34d1ebace + retriable (3.8.0) sha256=9f2f1b0207594c7817f17f671587b8ec7587387ac6cebda6c941a802bb98a8e5 + rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142 + rouge (3.28.0) sha256=0d6de482c7624000d92697772ab14e48dca35629f8ddf3f4b21c99183fd70e20 + ruby2_keywords (0.0.5) sha256=ffd13740c573b7301cf7a2e61fc857b2a8e3d3aff32545d6f8300d8bae10e3ef + rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615 + security (0.1.5) sha256=3a977a0eca7706e804c96db0dd9619e0a94969fe3aac9680fcfc2bf9b8a833b7 + signet (0.22.0) sha256=b76d495ccb07ad35dbc89f3e920665a9d8ed717141955034005d7843dcfe4780 + simctl (1.6.10) sha256=b99077f4d13ad81eace9f86bf5ba4df1b0b893a4d1b368bd3ed59b5b27f9236b + terminal-notifier (2.0.0) sha256=7a0d2b2212ab9835c07f4b2e22a94cff64149dba1eed203c04835f7991078cea + terminal-table (3.0.2) sha256=f951b6af5f3e00203fb290a669e0a85c5dd5b051b3b023392ccfd67ba5abae91 + trailblazer-option (0.1.2) sha256=20e4f12ea4e1f718c8007e7944ca21a329eee4eed9e0fa5dde6e8ad8ac4344a3 + tty-cursor (0.7.1) sha256=79534185e6a777888d88628b14b6a1fdf5154a603f285f80b1753e1908e0bf48 + tty-screen (0.8.2) sha256=c090652115beae764336c28802d633f204fb84da93c6a968aa5d8e319e819b50 + tty-spinner (0.9.3) sha256=0e036f047b4ffb61f2aa45f5a770ec00b4d04130531558a94bfc5b192b570542 + uber (0.1.0) sha256=5beeb407ff807b5db994f82fa9ee07cfceaa561dad8af20be880bc67eba935dc + unicode-display_width (2.6.0) sha256=12279874bba6d5e4d2728cef814b19197dbb10d7a7837a869bab65da943b7f5a + word_wrap (1.0.0) sha256=f556d4224c812e371000f12a6ee8102e0daa724a314c3f246afaad76d82accc7 + xcodeproj (1.28.1) sha256=6f12670f00739d9817ca27ac89d6ef01cc86050e22a0bc08a3131487e5b5cddc + xcpretty (0.4.1) sha256=b14c50e721f6589ee3d6f5353e2c2cfcd8541fa1ea16d6c602807dd7327f3892 + xcpretty-travis-formatter (1.0.1) sha256=aacc332f17cb7b2cba222994e2adc74223db88724fe76341483ad3098e232f93 + +BUNDLED WITH + 4.0.3 diff --git a/HEALTHCHAT_CHANGES.md b/HEALTHCHAT_CHANGES.md new file mode 100644 index 000000000..89e10544c --- /dev/null +++ b/HEALTHCHAT_CHANGES.md @@ -0,0 +1,16 @@ +# HealthChat Changes + +Release notes for HealthChat builds of Element X. Each release adds a section at the +top; the release workflow extracts the one matching the version being released and +uses it as the TestFlight "What to Test" text. + +The heading format is load-bearing — `.github/workflows/release-healthchat.yml` +matches `## Changes in ` exactly. + +Upstream's `CHANGES.md` tracks element-hq's own releases and must not be edited here. + +## Changes in 26.07.3 (2026-07-15) + +🙌 Improvements + +- First HealthChat release built from Element X. diff --git a/fastlane/.env.default b/fastlane/.env.default new file mode 100644 index 000000000..9ae191661 --- /dev/null +++ b/fastlane/.env.default @@ -0,0 +1,42 @@ +## Project configuration + +PROJECT_PATH=ElementX.xcodeproj +SCHEME=ElementX + +MAIN_TARGET=ElementX +NSE_TARGET=NSE +SHARE_EXTENSION_TARGET=ShareExtension + +MAIN_BUNDLE_ID=ch.healthchat.element +NSE_BUNDLE_ID=ch.healthchat.element.nse +SHARE_EXTENSION_BUNDLE_ID=ch.healthchat.element.shareextension + +## Build configuration + +DERIVED_DATA_PATH=build +IPA_NAME=ElementX +ARCHIVE_PATH=out/ElementX.xcarchive +BUILD_OUTPUT_DIRECTORY=out +BUILD_LOG_DIRECTORY=build/Logs/Gym/ + +## Provisioning profile files + +PROVISIONING_PROFILES_PATH=./provisioning_profiles/ + +MAIN_PROVISIONING_PROFILE_FILENAME=main.mobileprovision +NSE_PROVISIONING_PROFILE_FILENAME=nse.mobileprovision +SHARE_EXTENSION_PROVISIONING_PROFILE_FILENAME=share_extension.mobileprovision + +## App Store code signing + +APPSTORE_CODESIGNING_IDENTITY="Apple Distribution: E-HealthSolutions GmbH (6G37K72W82)" +APPSTORE_SIGNING_CERTIFICATE="Apple Distribution: E-HealthSolutions GmbH (6G37K72W82)" + +APPSTORE_MAIN_PROVISIONING_PROFILE_SPECIFIER="HealthChat App Store" +APPSTORE_NSE_PROVISIONING_PROFILE_SPECIFIER="HealthChat NSE: App Store" +APPSTORE_SHARE_EXTENSION_PROVISIONING_PROFILE_SPECIFIER="HealthChat Share Extension: App Store" + +## Account information + +TEAM_ID=6G37K72W82 +# APPLE_ID is set as a shell environment variable on the machine running fastlane. diff --git a/fastlane/Appfile b/fastlane/Appfile new file mode 100644 index 000000000..e52c08cab --- /dev/null +++ b/fastlane/Appfile @@ -0,0 +1,5 @@ +# For more information about the Appfile, see: +# https://docs.fastlane.tools/advanced/#appfile + +apple_id ENV["APPLE_ID"] +team_id ENV["TEAM_ID"] diff --git a/fastlane/Fastfile b/fastlane/Fastfile new file mode 100644 index 000000000..f3bac58e9 --- /dev/null +++ b/fastlane/Fastfile @@ -0,0 +1,154 @@ +default_platform :ios + +# No Xcode version pin: novaloop-mac-studio-001 carries a single, globally-selected Xcode, so +# whatever xcode-select points at is by definition the one we build with. Pinning bought nothing +# and risked everything — a version the runner lacks sends xcodes into a multi-GB authenticated +# download that no CI secret can satisfy, hanging the release. Change the runner's Xcode instead. +platform :ios do + #### Public #### + + desc "Builds the App Store ipa and uploads it to TestFlight (internal testers only)" + # Named release_testflight to avoid colliding with fastlane's built-in :testflight action. + lane :release_testflight do |options| + # Accept inputs via options (local) or env vars (CI — lets the workflow pass multi-line + # release notes without shell-escaping them). + marketing_version = options[:marketing_version] || ENV["HEALTHCHAT_MARKETING_VERSION"] + release_notes = options[:release_notes] || ENV["HEALTHCHAT_RELEASE_NOTES"] + + UI.user_error!("'marketing_version' is required (pass the option or set HEALTHCHAT_MARKETING_VERSION)") if marketing_version.to_s.empty? + + # Apple caps CFBundleShortVersionString at three period-separated integers. The workflow's + # regex is laxer and accepts markers like 26.07.3-rc1, so catch it here — otherwise the run + # dies at the upload step after ~30 minutes of signing, looking exactly like a signing failure. + unless marketing_version =~ /\A\d+(\.\d+){0,2}\z/ + UI.user_error!("'marketing_version' must be 1-3 dot-separated integers (got '#{marketing_version}'). " \ + "Apple rejects anything else at upload. Put markers in the tag or release notes instead.") + end + + build_number = options[:build_number] || generate_build_number + + build_release(marketing_version: marketing_version, build_number: build_number) + + upload_to_testflight( + ipa: lane_context[SharedValues::IPA_OUTPUT_PATH], + skip_submission: true, + skip_waiting_for_build_processing: true, + changelog: release_notes, + distribute_external: false, + ) + end + + #### Private #### + + desc "Builds the signed App Store ipa" + private_lane :build_release do |options| + marketing_version = options[:marketing_version] + build_number = options[:build_number] + UI.user_error!("'build_number' parameter is missing") if build_number.to_s.empty? + + if is_ci + %w[APPSTORECONNECT_KEY_ID APPSTORECONNECT_KEY_ISSUER_ID APPSTORECONNECT_KEY_CONTENT].each do |key| + UI.user_error!("'#{key}' environment variable should be set to use this lane") if ENV[key].to_s.empty? + end + + app_store_connect_api_key( + key_id: ENV["APPSTORECONNECT_KEY_ID"], + issuer_id: ENV["APPSTORECONNECT_KEY_ISSUER_ID"], + key_content: ENV["APPSTORECONNECT_KEY_CONTENT"] + ) + else + UI.user_error!("'APPLE_ID' environment variable should be set to use this lane") if ENV["APPLE_ID"].to_s.empty? + end + + team_id = CredentialsManager::AppfileConfig.try_fetch_value(:team_id) + UI.user_error!("Failed to fetch the team id from the Appfile") if team_id.to_s.empty? + + # Inject the version at build time rather than rewriting project.yml, so no tracked file ever + # carries a release-only value. All three targets resolve CFBundleShortVersionString and + # CFBundleVersion from these settings, which keeps the app and its extensions consistent — + # App Store rejects an upload where they disagree. + xcargs_hash = { + "MARKETING_VERSION" => marketing_version, + "CURRENT_PROJECT_VERSION" => build_number, + "CODE_SIGN_STYLE" => "Manual", + } + xcargs = xcargs_hash.map { |k, v| "#{k}=#{v.to_s.shellescape}" }.join(" ") + + xcodegen(spec: "project.yml") + clear_derived_data(derived_data_path: ENV["DERIVED_DATA_PATH"]) + + download_provisioning_profiles + disable_automatic_code_signing(path: ENV["PROJECT_PATH"]) + update_project_provisioning_profiles + + build_app( + clean: true, + scheme: ENV["SCHEME"], + xcargs: xcargs, + export_method: "app-store", + derived_data_path: ENV["DERIVED_DATA_PATH"], + archive_path: ENV["ARCHIVE_PATH"], + output_directory: ENV["BUILD_OUTPUT_DIRECTORY"], + output_name: "#{ENV['IPA_NAME']}.ipa", + buildlog_path: ENV["BUILD_LOG_DIRECTORY"], + codesigning_identity: ENV["APPSTORE_CODESIGNING_IDENTITY"], + skip_profile_detection: true, + export_options: { + method: "app-store", + signingStyle: "manual", + teamID: team_id, + signingCertificate: ENV["APPSTORE_SIGNING_CERTIFICATE"], + provisioningProfiles: { + ENV["MAIN_BUNDLE_ID"] => ENV["APPSTORE_MAIN_PROVISIONING_PROFILE_SPECIFIER"], + ENV["NSE_BUNDLE_ID"] => ENV["APPSTORE_NSE_PROVISIONING_PROFILE_SPECIFIER"], + ENV["SHARE_EXTENSION_BUNDLE_ID"] => ENV["APPSTORE_SHARE_EXTENSION_PROVISIONING_PROFILE_SPECIFIER"], + }, + }, + ) + end + + desc "Downloads the three App Store provisioning profiles" + private_lane :download_provisioning_profiles do + { + ENV["MAIN_BUNDLE_ID"] => [ENV["APPSTORE_MAIN_PROVISIONING_PROFILE_SPECIFIER"], ENV["MAIN_PROVISIONING_PROFILE_FILENAME"]], + ENV["NSE_BUNDLE_ID"] => [ENV["APPSTORE_NSE_PROVISIONING_PROFILE_SPECIFIER"], ENV["NSE_PROVISIONING_PROFILE_FILENAME"]], + ENV["SHARE_EXTENSION_BUNDLE_ID"] => [ENV["APPSTORE_SHARE_EXTENSION_PROVISIONING_PROFILE_SPECIFIER"], ENV["SHARE_EXTENSION_PROVISIONING_PROFILE_FILENAME"]], + }.each do |bundle_id, (profile_name, filename)| + get_provisioning_profile( + app_identifier: bundle_id, + provisioning_name: profile_name, + ignore_profiles_with_different_name: true, + adhoc: false, + skip_certificate_verification: false, + output_path: ENV["PROVISIONING_PROFILES_PATH"], + filename: filename, + readonly: true, + ) + end + end + + desc "Points each target at its downloaded provisioning profile" + private_lane :update_project_provisioning_profiles do + { + ENV["MAIN_TARGET"] => ENV["MAIN_PROVISIONING_PROFILE_FILENAME"], + ENV["NSE_TARGET"] => ENV["NSE_PROVISIONING_PROFILE_FILENAME"], + ENV["SHARE_EXTENSION_TARGET"] => ENV["SHARE_EXTENSION_PROVISIONING_PROFILE_FILENAME"], + }.each do |target, filename| + update_project_provisioning( + xcodeproj: ENV["PROJECT_PATH"], + profile: "#{ENV['PROVISIONING_PROFILES_PATH']}#{filename}", + # Anchored: target_filter is a regex, and an unanchored "NSE" or "ElementX" would also + # match any future target containing that substring. + target_filter: "^#{target}$", + build_configuration: "Release", + ) + end + end +end + +# Generates a build number from the current timestamp. Monotonic across runs, so a retry never +# collides with a build number App Store Connect has already seen. +def generate_build_number + require 'date' + DateTime.now.strftime("%Y%m%d%H%M%S") +end diff --git a/fastlane/Pluginfile b/fastlane/Pluginfile new file mode 100644 index 000000000..83a6cba8a --- /dev/null +++ b/fastlane/Pluginfile @@ -0,0 +1,5 @@ +# Autogenerated by fastlane +# +# Ensure this file is checked in to source control! + +gem 'fastlane-plugin-xcodegen'