recurring-checklist/.gitea/workflows/build-apps.yml

# Push something the apps bundle -> the ingest Mac builds both apps and emails you.
#
# WHY THIS STOPS SHORT OF UPLOADING
#   Uploading needs a build number that has never been used before, and Play will never
#   accept a versionCode twice or accept one that goes down. Bumping it means committing
#   the new number back to this repo on every build, which needs write access from the
#   build machine and permanently changes how the apps are numbered. That is a one-way
#   door, so it is left as a deliberate command: ./release.sh --ios --android
#
#   What this does remove is having to REMEMBER. A change that the apps bundle no longer
#   sits unnoticed: it gets built immediately, you find out straight away if it no longer
#   compiles, and you get an email saying the shipped apps are now behind the website.
#
# WHY THE INGEST MAC AND NOT THE NAS
#   An app build needs Xcode, the Android SDK and the signing keys. The NAS runner is
#   Linux in a container and has none of them. This job runs in HOST mode (label
#   "macos:host") directly on the ingest Mac, which has all three.

name: Build apps

on:
  push:
    branches: [main]
    paths:
      # Only what actually ends up inside an app bundle. Deliberately NOT all of mobile/:
      # release.config.json is excluded so that bumping a build number by hand never
      # triggers a rebuild of the thing that was just built.
      - 'server/public/**'
      - 'mobile/src/**'
      - 'mobile/capacitor.config.json'
      - 'mobile/package.json'
      - '.gitea/workflows/build-apps.yml'
  workflow_dispatch:

jobs:
  build:
    runs-on: macos
    steps:
      - name: Build both apps
        run: |
          set -eu
          export PATH="/usr/local/bin:/opt/homebrew/bin:$PATH"
          APP="$HOME/checklist-app"
          cd "$APP"

          echo "── syncing the checkout ──"
          git pull --ff-only

          echo "── dependencies ──"
          ( cd mobile && npm install --no-audit --no-fund >/dev/null )

          echo "── rebuilding www/ from server/public ──"
          ( cd mobile && node scripts/sync-web.js )

          # Without this the iOS build fails on a missing ios/App/App/public, because that
          # directory is generated rather than committed. release.sh does the same thing.
          echo "── capacitor sync ──"
          ( cd mobile && npx cap sync >/dev/null )

          echo "── android ──"
          ( cd mobile/android && . ../scripts/env.sh && ./gradlew :app:bundleRelease --no-daemon -q )
          AAB="$APP/mobile/android/app/build/outputs/bundle/release/app-release.aab"
          test -f "$AAB"
          echo "   $AAB ($(du -h "$AAB" | cut -f1))"

          echo "── ios ──"
          . mobile/ios-signing.config
          rm -rf mobile/build/App.xcarchive mobile/build/ios
          ( cd mobile/ios/App && xcodebuild -project App.xcodeproj -scheme App \
              -configuration Release -destination 'generic/platform=iOS' \
              -archivePath "$APP/mobile/build/App.xcarchive" \
              DEVELOPMENT_TEAM="$DEVELOPMENT_TEAM" CODE_SIGN_STYLE=Automatic \
              -allowProvisioningUpdates archive -quiet )

          cat > mobile/ExportOptions.plist <<PLIST
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0"><dict>
            <key>method</key><string>app-store-connect</string>
            <key>teamID</key><string>$DEVELOPMENT_TEAM</string>
            <key>destination</key><string>export</string>
            <key>uploadSymbols</key><true/>
          </dict></plist>
          PLIST

          ( cd mobile/ios/App && xcodebuild -exportArchive \
              -archivePath "$APP/mobile/build/App.xcarchive" \
              -exportOptionsPlist "$APP/mobile/ExportOptions.plist" \
              -exportPath "$APP/mobile/build/ios" \
              -allowProvisioningUpdates -quiet )
          IPA="$(find "$APP/mobile/build/ios" -name '*.ipa' | head -1)"
          test -n "$IPA"
          echo "   $IPA ($(du -h "$IPA" | cut -f1))"

      - name: Tell Christian the apps are behind
        if: success()
        run: |
          export PATH="/usr/local/bin:$PATH"
          cd "$HOME/checklist-app"
          V="$(node -e 'const c=require("./mobile/release.config.json");console.log(`${c.version} (ios build ${c.iosBuild}, android code ${c.androidVersionCode})`)')"
          # The body is built with a heredoc rather than a bare multi-line argument: an
          # argument that starts at column 0 ends the YAML block scalar and makes this whole
          # file unparseable, which Gitea reports only by silently never running it.
          BODY="$(cat <<MSG
          A change landed that the iOS and Android apps bundle, so they were rebuilt on the
          ingest Mac. Both built cleanly and are signed and ready.

          They are NOT on anyone's phone yet, and will not be until you ship them:

              cd ~/Documents/recurring-checklist-app
              ./release.sh --ios --android

          Current numbering: $V

          The website already has this change — it deploys on push. Only the apps, which
          carry their own copy of the UI, are waiting.
          MSG
          )"
          node scripts/alert.js "Apps rebuilt and waiting — shipped versions are now behind" "$BODY" || true

      - name: Tell Christian the build broke
        if: failure()
        run: |
          export PATH="/usr/local/bin:$PATH"
          cd "$HOME/checklist-app"
          BODY="$(cat <<MSG
          A push changed something the apps bundle, and the rebuild did not compile.

          The website is unaffected — it deploys separately and is already live with this
          change. But the apps cannot be shipped until this builds again.

          Full log:
          http://chronicles-ab.waterschurch.org:3000/christian/recurring-checklist/actions
          MSG
          )"
          node scripts/alert.js "App build FAILED on the ingest Mac" "$BODY" || true