recurring-checklist/.gitea/workflows/build-apps.yml

# Push something the apps bundle -> the ingest Mac builds both apps and emails you.
#
# WHY THIS STOPS SHORT OF UPLOADING
#   Uploading needs a build number that has never been used before, and Play will never
#   accept a versionCode twice or accept one that goes down. Bumping it means committing
#   the new number back to this repo on every build, which needs write access from the
#   build machine and permanently changes how the apps are numbered. That is a one-way
#   door, so it is left as a deliberate command: ./release.sh --ios --android
#
#   What this does remove is having to REMEMBER. A change that the apps bundle no longer
#   sits unnoticed: it gets built immediately, you find out straight away if it no longer
#   compiles, and you get an email saying the shipped apps are now behind the website.
#
# WHY THE INGEST MAC AND NOT THE NAS
#   An app build needs Xcode, the Android SDK and the signing keys. The NAS runner is
#   Linux in a container and has none of them. This job runs in HOST mode (label
#   "macos:host") directly on the ingest Mac, which has all three.

name: Build apps

on:
  push:
    branches: [main]
    paths:
      # Only what actually ends up inside an app bundle. Deliberately NOT all of mobile/:
      # release.config.json is excluded so that bumping a build number by hand never
      # triggers a rebuild of the thing that was just built.
      - 'server/public/**'
      - 'mobile/src/**'
      - 'mobile/capacitor.config.json'
      - 'mobile/package.json'
      - '.gitea/workflows/build-apps.yml'
  workflow_dispatch:

jobs:
  build:
    runs-on: macos
    steps:
      - name: Build both apps
        run: |
          set -eu
          export PATH="/usr/local/bin:/opt/homebrew/bin:$PATH"
          APP="$HOME/checklist-app"
          cd "$APP"

          echo "── syncing the checkout ──"
          git pull --ff-only

          echo "── dependencies ──"
          ( cd mobile && npm install --no-audit --no-fund >/dev/null )

          echo "── rebuilding www/ from server/public ──"
          ( cd mobile && node scripts/sync-web.js )

          # Without this the iOS build fails on a missing ios/App/App/public, because that
          # directory is generated rather than committed. release.sh does the same thing.
          echo "── capacitor sync ──"
          ( cd mobile && npx cap sync >/dev/null )

          echo "── android ──"
          ( cd mobile/android && . ../scripts/env.sh && ./gradlew :app:bundleRelease --no-daemon -q )
          AAB="$APP/mobile/android/app/build/outputs/bundle/release/app-release.aab"
          test -f "$AAB"
          echo "   $AAB ($(du -h "$AAB" | cut -f1))"

          echo "── ios ──"
          . mobile/ios-signing.config
          rm -rf mobile/build/App.xcarchive mobile/build/ios
          ( cd mobile/ios/App && xcodebuild -project App.xcodeproj -scheme App \
              -configuration Release -destination 'generic/platform=iOS' \
              -archivePath "$APP/mobile/build/App.xcarchive" \
              DEVELOPMENT_TEAM="$DEVELOPMENT_TEAM" CODE_SIGN_STYLE=Automatic \
              -allowProvisioningUpdates archive -quiet )

          cat > mobile/ExportOptions.plist <<PLIST
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0"><dict>
            <key>method</key><string>app-store-connect</string>
            <key>teamID</key><string>$DEVELOPMENT_TEAM</string>
            <key>destination</key><string>export</string>
            <key>uploadSymbols</key><true/>
          </dict></plist>
          PLIST

          ( cd mobile/ios/App && xcodebuild -exportArchive \
              -archivePath "$APP/mobile/build/App.xcarchive" \
              -exportOptionsPlist "$APP/mobile/ExportOptions.plist" \
              -exportPath "$APP/mobile/build/ios" \
              -allowProvisioningUpdates -quiet )
          IPA="$(find "$APP/mobile/build/ios" -name '*.ipa' | head -1)"
          test -n "$IPA"
          echo "   $IPA ($(du -h "$IPA" | cut -f1))"

      - name: Tell Christian the apps are behind
        if: success()
        run: |
          export PATH="/usr/local/bin:$PATH"
          APP="$HOME/checklist-app"
          cd "$APP"
          V="$(node -e 'const c=require("./mobile/release.config.json");console.log(`${c.version} (ios build ${c.iosBuild}, android code ${c.androidVersionCode})`)')"
          node scripts/alert.js "Apps rebuilt and waiting — shipped versions are now behind" \
"A change landed that the iOS and Android apps bundle, so they were rebuilt on the
ingest Mac. Both built cleanly and are signed and ready.

They are NOT on anyone's phone yet, and will not be until you ship them:

    cd ~/Documents/recurring-checklist-app
    ./release.sh --ios --android

Current numbering: $V

The website already has this change — it deploys on push. Only the apps, which carry
their own copy of the UI, are waiting." || true

      - name: Tell Christian the build broke
        if: failure()
        run: |
          export PATH="/usr/local/bin:$PATH"
          cd "$HOME/checklist-app"
          node scripts/alert.js "App build FAILED on the ingest Mac" \
"A push changed something the apps bundle, and the rebuild did not compile.

The website is unaffected — it deploys separately and is already live with this
change. But the apps cannot be shipped until this builds again.

Full log: http://chronicles-ab.waterschurch.org:3000/christian/recurring-checklist/actions" || true