feat: iOS Release Pipeline with Fastlane Match #33
Conversation
- Add unified release.yml workflow for version detection and auto-release - Configure Fastlane with Match for certificate management - Add Fastfile, Matchfile, and Appfile configurations - Update .gitignore for Fastlane artifacts - Create comprehensive setup documentation This pipeline automatically: 1. Detects version changes in Info.plist 2. Creates git tags for new versions 3. Builds and uploads to TestFlight 4. Creates GitHub releases
Code Coverage Report ❌Current coverage: 0% |
There was a problem hiding this comment.
Pull Request Overview
This PR implements an automated iOS release pipeline similar to the existing Android release process. It adds Fastlane for build automation and certificate management, replacing the previous manual approach with a streamlined workflow that automatically detects version changes, creates tags, and uploads to TestFlight.
Key Changes
- Automated pipeline: Single workflow with version detection and automated tagging
- Fastlane integration: Complete configuration for certificate management via Match and TestFlight uploads
- Security improvements: Uses SSH deploy keys and base64-encoded API keys instead of PAT tokens
Reviewed Changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.github/workflows/release.yml |
Complete workflow rewrite with two-job pipeline for version checking and TestFlight release |
fastlane/Fastfile |
Defines lanes for certificate sync, beta releases, and App Store submissions |
fastlane/Matchfile |
Configuration for code signing certificate management via git repository |
fastlane/Appfile |
App-specific configuration with bundle ID and team settings |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
fastlane/Fastfile
Outdated
| api_key = app_store_connect_api_key( | ||
| key_id: ENV["APP_STORE_CONNECT_API_KEY_KEY_ID"], | ||
| issuer_id: ENV["APP_STORE_CONNECT_API_KEY_ISSUER_ID"], | ||
| key_filepath: ENV["APP_STORE_CONNECT_API_KEY_KEY"], | ||
| in_house: false | ||
| ) |
There was a problem hiding this comment.
The API key creation is duplicated across multiple lanes (beta, release, create_app_version, download_metadata). Consider extracting this into a helper method to reduce code duplication.
Copilot uses AI. Check for mistakes.
| build_app( | ||
| scheme: "V2er", | ||
| export_method: "app-store", | ||
| export_options: { | ||
| provisioningProfiles: { | ||
| "v2er.app" => "match AppStore v2er.app" | ||
| } | ||
| }, | ||
| clean: true, | ||
| output_directory: "./build", | ||
| output_name: "V2er.ipa" | ||
| ) |
There was a problem hiding this comment.
The build_app configuration is duplicated between beta and release lanes. Consider extracting this into a shared method to maintain consistency and reduce duplication.
Copilot uses AI. Check for mistakes.
.github/workflows/release.yml
Outdated
| # Get current version from Info.plist | ||
| CURRENT_VERSION=$(grep -A1 "CFBundleShortVersionString" V2er/Info.plist | tail -1 | sed 's/.*<string>\(.*\)<\/string>/\1/' | xargs) | ||
| CURRENT_BUILD=$(grep -A1 "CFBundleVersion" V2er/Info.plist | tail -1 | sed 's/.*<string>\(.*\)<\/string>/\1/' | xargs) |
There was a problem hiding this comment.
The regex patterns for parsing Info.plist are complex and fragile. Consider using a more robust XML parser like plutil or PlistBuddy which are available on the runner and handle XML parsing more reliably.
| # Get current version from Info.plist | |
| CURRENT_VERSION=$(grep -A1 "CFBundleShortVersionString" V2er/Info.plist | tail -1 | sed 's/.*<string>\(.*\)<\/string>/\1/' | xargs) | |
| CURRENT_BUILD=$(grep -A1 "CFBundleVersion" V2er/Info.plist | tail -1 | sed 's/.*<string>\(.*\)<\/string>/\1/' | xargs) | |
| # Get current version from Info.plist using plutil for robust XML parsing | |
| CURRENT_VERSION=$(/usr/bin/plutil -extract CFBundleShortVersionString xml1 -o - V2er/Info.plist | grep '<string>' | sed 's/.*<string>\(.*\)<\/string>.*/\1/' | xargs) | |
| CURRENT_BUILD=$(/usr/bin/plutil -extract CFBundleVersion xml1 -o - V2er/Info.plist | grep '<string>' | sed 's/.*<string>\(.*\)<\/string>.*/\1/' | xargs) |
Copilot uses AI. Check for mistakes.
| - name: Archive app | ||
| mkdir -p ~/.appstoreconnect/private_keys | ||
| echo "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > ~/.appstoreconnect/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8 |
There was a problem hiding this comment.
The API key file is created with default permissions which may be too permissive. Consider setting restrictive file permissions (e.g., 600) on the private key file to improve security.
| echo "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > ~/.appstoreconnect/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8 | |
| echo "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > ~/.appstoreconnect/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8 | |
| chmod 600 ~/.appstoreconnect/private_keys/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8 |
Copilot uses AI. Check for mistakes.
- Extract duplicated API key and build config into helper methods in Fastfile - Use plutil for robust Info.plist parsing instead of fragile regex - Set restrictive permissions (600) on API key file for improved security - Reduce code duplication across lanes
Code Coverage Report ❌Current coverage: 0% |
1 participant
Summary
Changes
GitHub Actions Workflow
.github/workflows/release.yml- Unified pipeline with two jobs:version-check: Detects version changes and creates tagsbuild-and-release: Builds and uploads to TestFlight when new tag is createdFastlane Configuration
fastlane/Fastfile- Defines lanes for beta and releasefastlane/Matchfile- Certificate management configurationfastlane/Appfile- App identifier and team configurationOther Changes
.gitignore- Added Fastlane artifactsSETUP_RELEASE_PIPELINE.md- Comprehensive setup documentationHow It Works
Setup Required
Before merging, the following secrets need to be configured in GitHub:
DEPLOY_KEY- SSH private key for certificates repoMATCH_GIT_URL- Certificates repository URLMATCH_PASSWORD- Match encryption passwordAPP_STORE_CONNECT_KEY_ID- API Key IDAPP_STORE_CONNECT_ISSUER_ID- Issuer IDAPP_STORE_CONNECT_API_KEY_BASE64- Base64 encoded .p8 fileTEAM_ID- Apple Developer Team IDTesting
Related