Add instructions on how to set up App Store signing

[kitallis]

• Ensure your app builds locally if you're changing the bundle identifier
• Ensure you have access to the keys tab in your new account: https://appstoreconnect.apple.com/access/api and create a new key https://docs.tramline.app/integrations/distribution/app_store#generate-an-api-key
• Ensure you can create certificates from https://developer.apple.com/account/resources/certificates/list
• Setup an iOS Distribution (App Store and Ad Hoc) certificate – Certificates are used for code signing
• Setup an App Store Distribution provisioning profile – Provisioning profiles are complements to certificates that hold device / app identifiers that have access to run the app.
• Assign your devices to this said profile
• Replace your Github Actions variables. Refer to this https://docs.tramline.app/integrations/ci-cd/#supported-integrations-1

[abhisd123]

Hey @kitallis, I intend to contribute to this documentation task. Is this done already or still an open task? Please do let me know. Cheers!!

[pratul]

Hi @abhisd123 this is still open. Happy to review your PR if you raise one!

[arnab]

Hey @kitallis we have match working (along with Apple entitlements). Here is what we have:

Matchfile

git_url("https://github.com/orcalabs-dev/orcapod_app_appstore_secrets.git")

storage_mode("git")

type("appstore")

# For all available options run `fastlane match --help`
# Remove the # in the beginning of the line to enable the other options

# The docs are available on https://docs.fastlane.tools/actions/match

Fastfile

# This file contains the fastlane.tools configuration
# You can find the documentation at https://docs.fastlane.tools
#
# For a list of all available actions, check out
#
#     https://docs.fastlane.tools/actions
#
# For a list of all available plugins, check out
#
#     https://docs.fastlane.tools/plugins/available-plugins
#

# Uncomment the line if you want fastlane to automatically update itself
# update_fastlane

default_platform(:ios)

platform :ios do
  desc "Build and ship app"
  lane :build_and_ship_app do |options|
    setup_ci if ENV['CI']

    match(type: "appstore", readonly: is_ci)

    app_identifier = CredentialsManager::AppfileConfig.try_fetch_value(:app_identifier)
    team_id = CredentialsManager::AppfileConfig.try_fetch_value(:team_id)

    profile_mapping = lane_context[SharedValues::MATCH_PROVISIONING_PROFILE_MAPPING]
    profile_name = profile_mapping[app_identifier]
    profile_path = ENV["sigh_" + app_identifier + "_appstore_profile-path"]
    codesigning_identity = ENV["sigh_" + app_identifier + "_appstore_certificate-name"]

    update_code_signing_settings(
      use_automatic_signing: false,
      team_id: team_id,
      bundle_identifier: app_identifier,
      code_sign_identity: "iPhone Distribution",
      sdk: "iphoneos*",
      build_configurations: ["Release"],
      entitlements_file_path: "Runner/Runner.entitlements",
      profile_name: profile_name,
    )

    update_project_provisioning(
      xcodeproj: 'Runner.xcodeproj',
      target_filter: 'Runner',
      build_configuration: 'Release',
      profile: profile_path,
    )

    build_app(
      workspace: "Runner.xcworkspace",
      scheme: "Runner",
      export_method: "app-store",
      export_team_id: team_id,
      output_directory: "../build/ios/ipa",
      output_name: "Metacast.ipa",
      clean: true,
      xcconfig: "Flutter/Generated.xcconfig",
      codesigning_identity: codesigning_identity,
      export_options: {
        signingStyle: "manual",
        provisioningProfiles: profile_mapping,
      },
      silent: true # Hide extremely verbose XCode output
    )

    if (options[:ship_to_testflight]) then
      ipa_path = lane_context[SharedValues::IPA_OUTPUT_PATH]
      UI.message("Uploading ipa to TestFlight: #{ipa_path}")
      upload_to_testflight(
        # To avoid 2FA, and use FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD instead, both apple_id
        # and skip_waiting_for_build_processing must be set. See:
        # https://docs.fastlane.tools/actions/upload_to_testflight/
        # The apple_id value is taken from Apple ID property in the App Information section in
        # App Store Connect: https://appstoreconnect.apple.com/apps/REDACTED/distribution/info
        apple_id: 'REDACTED',
        skip_waiting_for_build_processing: true,
        ipa: ipa_path
      )
    end
  end

  desc "Build the app & ship it to TestFlight"
  lane :build_app_and_ship_to_testflight do
    build_and_ship_app(ship_to_testflight: true)
  end

  desc "Build the app, but do not ship it anywhere"
  lane :build_app_only_do_not_ship do
    build_and_ship_app(ship_to_testflight: false)
  end

end

Github workflow

name: Tramline iOS Fastlane Release

on:
  workflow_dispatch:
    inputs:
      tramline-input:
        required: false
        description: "Tramline input"

jobs:
  deploy:
    # https://warpbuild.com/ & https://app.warpbuild.com/dashboard/runners
    runs-on: warp-macos-14-arm64-6x
    steps:
      - name: Configure Tramline
        id: tramline
        uses: tramlinehq/deploy-action@v0.1.6
        with:
          input: ${{ github.event.inputs.tramline-input }}

      - name: Set up ruby env
        uses: ruby/setup-ruby@v1.171.0
        with:
          ruby-version: 3.2.1
          bundler-cache: true

      - name: Setup the flutter environment
        uses: subosito/flutter-action@v2
        with:
          channel: 'stable'
          flutter-version: '3.27.3'
          cache: true

      - name: Cache Flutter dependencies
        uses: actions/cache@v2
        with:
          path: .pub-cache
          key: ${{ runner.os }}-pub-cache-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-pub-cache-

      - name: Cache Pods
        uses: actions/cache@v2
        with:
          path: ios/Pods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Flutter doctor
        run: flutter doctor

      - name: Get flutter dependencies
        run: flutter pub get

      - name: Generate code with build_runner
        run: flutter pub run build_runner build

      - name: Build iOS app archive (unsigned)
        run: |
          flutter build ipa --release \
            --build-number=${{ steps.tramline.outputs.version_code }} \
            --build-name=${{ steps.tramline.outputs.version_name }} \
            --no-codesign

      - name: List generated archive
        run: |
          echo "Generated ios archive:"
          ls -la build/ios/archive

      - name: Prepare ios app signing
          # See https://docs.fastlane.tools/actions/match/
          # Update FASTLANE_MATCH_PERSONAL_ACCESS_TOKEN:
        # 1. generate new token at https://github.com/settings/tokens?type=beta
        # 2. update the token at https://github.com/orcalabs-dev/orcapod_app/settings/secrets/actions
        # 3. Note the username of the person who generated the token in the line below:
        run: |
          echo "MATCH_GIT_BASIC_AUTHORIZATION=$(echo -n "arnab:${{ secrets.FASTLANE_MATCH_PERSONAL_ACCESS_TOKEN }}" | base64)" >> $GITHUB_ENV

      - name: Build signed ipa and ship to TestFlight
        working-directory: ./ios
        run: |
          bundle install
          bundle exec fastlane ios build_app_and_ship_to_testflight
        env:
          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
          FASTLANE_USER: 'REDACTED'
          FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD: ${{ secrets.FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD }}

      - name: Upload generated ios IPA to artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ios_ipa_${{ steps.tramline.outputs.version_code }}
          path: build/ios/ipa/*.ipa
          include-hidden-files: true