diff --git a/scripts/ci/compile-ios.sh b/scripts/ci/compile-ios.sh index 33512d5..fe7ad94 100755 --- a/scripts/ci/compile-ios.sh +++ b/scripts/ci/compile-ios.sh @@ -1,16 +1,17 @@ #!/usr/bin/env bash # compile-ios.sh — build signed iOS IPA and upload to TestFlight (App Store Connect) # -# 需要的 CI secrets（缺任意一个则优雅跳过，不阻塞流水线）： -# IOS_DIST_CERT_P12_BASE64 Apple Distribution 证书 (.p12) 的 base64 -# IOS_DIST_CERT_PASSWORD .p12 导出密码 -# IOS_PROVISIONING_PROFILE_BASE64 App Store 类型 provisioning profile (.mobileprovision) 的 base64 -# IOS_TEAM_ID Apple Developer Team ID（10 位） -# APPSTORE_API_KEY_ID App Store Connect API Key ID -# APPSTORE_API_ISSUER_ID App Store Connect API Issuer ID -# APPSTORE_API_KEY_P8_BASE64 API Key (.p8) 的 base64 +# 用**本机 login keychain 的 Apple Distribution 证书** + **本机已装的 App Store +# provisioning profile** + **本机 App Store Connect key(.p8)** 签名/上传。 +# mac-runner 就是开发机,这些分发材料常驻本机,不再从 base64 secret 导入 +# (原方案 IOS_DIST_CERT_P12_BASE64 里的证书过期 → archive 报 "No valid code +# signing certificates";本机 login 里那张有效,2026-07 改用本机材料)。 # -# 详见 docs/ios-signing.md。 +# 需要 env(非机密标识,gitea secret/变量;缺则用已知默认): +# IOS_TEAM_ID(默认 BYL4KQHMTN)/ APPSTORE_API_KEY_ID(默认 3PZTHR8YMJ)/ +# APPSTORE_API_ISSUER_ID(必填,无默认) +# 需要本机:Apple Distribution 证书在 login keychain;App Store profile 已装; +# ~/.appstoreconnect/private_keys/AuthKey_.p8 存在。 set -euo pipefail # shellcheck source=scripts/ci/_env.sh @@ -19,7 +20,7 @@ set -euo pipefail TAG="$1" VER="${TAG#client-v}" -# CFBundleVersion（build 号）必须单调递增，否则 TestFlight 拒绝重复上传。 +# CFBundleVersion(build 号)必须单调递增,否则 TestFlight 拒绝重复上传。 MAJOR="$(echo "$VER" | cut -d. -f1)" MINOR="$(echo "$VER" | cut -d. -f2)" PATCH="$(echo "$VER" | cut -d. -f3)" @@ -27,81 +28,62 @@ BUILD=$(( MAJOR * 10000 + MINOR * 100 + PATCH )) echo "==> compile-ios: version=${VER} build=${BUILD}" -# --- 凭证缺失则跳过（账号/证书尚未配置时不阻塞发版）--- -if [ -z "${IOS_DIST_CERT_P12_BASE64:-}" ] || \ - [ -z "${IOS_PROVISIONING_PROFILE_BASE64:-}" ] || \ - [ -z "${APPSTORE_API_KEY_P8_BASE64:-}" ]; then - echo "==> compile-ios: SKIP — iOS signing secrets not configured (see docs/ios-signing.md)" - exit 0 +TEAM_ID="${IOS_TEAM_ID:-BYL4KQHMTN}" +KEY_ID="${APPSTORE_API_KEY_ID:-3PZTHR8YMJ}" +ISSUER="${APPSTORE_API_ISSUER_ID:-}" +BUNDLE_ID="com.yanmei.jiu" +P8="$HOME/.appstoreconnect/private_keys/AuthKey_${KEY_ID}.p8" + +# --- 前置检查:本机分发材料齐备(缺则 fail-fast,不产出未签名/无法上传的包)--- +if ! security find-identity -v -p codesigning \ + | grep -qF "Apple Distribution: Yanmei (beijing) Technology Co., Ltd (${TEAM_ID})"; then + echo "ERROR: login keychain 未找到 Apple Distribution 证书(团队 ${TEAM_ID})——无法签名 iOS。" >&2 + echo " 在本机 Xcode 登录 Apple ID / 装好分发证书后重试。" >&2 + exit 1 +fi +if [ ! -f "$P8" ]; then + echo "ERROR: 缺 App Store Connect key: $P8" >&2 + exit 1 +fi +if [ -z "$ISSUER" ]; then + echo "ERROR: 缺 APPSTORE_API_ISSUER_ID(App Store Connect Issuer ID)——公证/上传需要。" >&2 + exit 1 fi WORK="$(mktemp -d)" -cleanup() { - # 恢复默认搜索列表（构建期临时独占，见下）——失败路径也必须恢复 - security list-keychains -d user -s login.keychain-db 2>/dev/null || true - security delete-keychain "$KEYCHAIN" 2>/dev/null || true - rm -rf "$WORK" - rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/jiu-ci.mobileprovision" 2>/dev/null || true -} -trap cleanup EXIT +# shellcheck disable=SC2064 +trap "rm -rf '$WORK'" EXIT -# --- 1. 临时 keychain 导入发行证书 --- -KEYCHAIN="$WORK/jiu-ci.keychain-db" -KEYCHAIN_PWD="ci-temp-$$" -security create-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN" -security set-keychain-settings -lut 21600 "$KEYCHAIN" -security unlock-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN" - -echo "${IOS_DIST_CERT_P12_BASE64}" | base64 --decode > "$WORK/dist.p12" -security import "$WORK/dist.p12" -k "$KEYCHAIN" \ - -P "${IOS_DIST_CERT_PASSWORD:-}" -T /usr/bin/codesign -T /usr/bin/security -# 补齐证书链：p12 只含叶子证书，独占搜索列表后 login 里的 Apple WWDR 中间证书 -# 不可见会报 errSecInternalComponent(unable to build chain)——把本机已有的 -# WWDR 中间证书（纯公钥）一并导入临时 keychain。 -security find-certificate -a -c "Apple Worldwide Developer Relations" -p \ - ~/Library/Keychains/login.keychain-db /Library/Keychains/System.keychain \ - > "$WORK/wwdr.pem" 2>/dev/null || true -if [ -s "$WORK/wwdr.pem" ]; then - security import "$WORK/wwdr.pem" -k "$KEYCHAIN" -T /usr/bin/codesign 2>/dev/null || true -else - echo "WARN: 本机未找到 Apple WWDR 中间证书，签名可能报 unable to build chain" >&2 +# --- 自动发现已装的 App Store 分发 profile(AppID=TEAM.BUNDLE、无 ProvisionedDevices)--- +PROFILE_NAME="" +PDIR="$HOME/Library/MobileDevice/Provisioning Profiles" +if [ -d "$PDIR" ]; then + for p in "$PDIR"/*.mobileprovision; do + [ -e "$p" ] || continue + plist="$(security cms -D -i "$p" 2>/dev/null)" || continue + appid="$(printf '%s' "$plist" | /usr/libexec/PlistBuddy -c 'Print :Entitlements:application-identifier' /dev/stdin 2>/dev/null || true)" + # App Store profile:AppID 匹配且无 ProvisionedDevices(区别于开发/AdHoc profile) + if [ "$appid" = "${TEAM_ID}.${BUNDLE_ID}" ] \ + && ! printf '%s' "$plist" | /usr/libexec/PlistBuddy -c 'Print :ProvisionedDevices' /dev/stdin >/dev/null 2>&1; then + PROFILE_NAME="$(printf '%s' "$plist" | /usr/libexec/PlistBuddy -c 'Print :Name' /dev/stdin 2>/dev/null || true)" + [ -n "$PROFILE_NAME" ] && break + fi + done fi -# 允许 codesign 非交互访问私钥 -security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PWD" "$KEYCHAIN" >/dev/null -# 构建期独占搜索列表（fastlane 同款）：只见临时 keychain，隔离本机其他项目的 -# 同名「Apple Distribution」证书（2026-07-07 事故：login 里另一项目的新证书被 -# xcodebuild 优先选中，与 Jiu App Store profile 不配对 → archive 失败）。 -# trap cleanup 恢复 login，失败路径也不遗留。 -security list-keychains -d user -s "$KEYCHAIN" +[ -n "$PROFILE_NAME" ] || PROFILE_NAME="Jiu App Store" # 已知已装 profile 名兜底 +echo "==> compile-ios: 使用 provisioning profile '${PROFILE_NAME}'" -# --- 2. 安装 provisioning profile --- -PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles" -mkdir -p "$PROFILES_DIR" -echo "${IOS_PROVISIONING_PROFILE_BASE64}" | base64 --decode > "$WORK/profile.mobileprovision" -# 解出 profile 的 Name 与 UUID（ExportOptions 需要） -security cms -D -i "$WORK/profile.mobileprovision" > "$WORK/profile.plist" -PROFILE_NAME="$(/usr/libexec/PlistBuddy -c 'Print :Name' "$WORK/profile.plist")" -PROFILE_UUID="$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$WORK/profile.plist")" -cp "$WORK/profile.mobileprovision" "$PROFILES_DIR/${PROFILE_UUID}.mobileprovision" -echo "==> compile-ios: profile '${PROFILE_NAME}' (${PROFILE_UUID})" - -# --- 3. App Store Connect API Key（供上传使用）--- -API_KEYS_DIR="$HOME/.appstoreconnect/private_keys" -mkdir -p "$API_KEYS_DIR" -echo "${APPSTORE_API_KEY_P8_BASE64}" | base64 --decode > "$API_KEYS_DIR/AuthKey_${APPSTORE_API_KEY_ID}.p8" - -# --- 4. 同步版本号 --- +# --- 同步版本号 --- sed -i '' "s/^version:.*/version: ${VER}+${BUILD}/" client/pubspec.yaml -# --- 5. 生成 ExportOptions.plist（manual 签名，app-store 分发）--- -BUNDLE_ID="com.yanmei.jiu" +# --- ExportOptions.plist(manual 签名,app-store 分发)--- cat > "$WORK/ExportOptions.plist" < methodapp-store - teamID${IOS_TEAM_ID} + teamID${TEAM_ID} signingStylemanual uploadBitcode uploadSymbols @@ -113,7 +95,7 @@ cat > "$WORK/ExportOptions.plist" < EOF -# --- 6. 构建签名 IPA --- +# --- 构建签名 IPA(用 login keychain 的分发证书 + 上面的 profile)--- cd client flutter build ipa --release \ --build-name="${VER}" \ @@ -124,17 +106,17 @@ flutter build ipa --release \ "--dart-define=APP_VERSION=v${VER}" cd .. -IPA="$(ls client/build/ios/ipa/*.ipa | head -1)" +IPA="$(ls client/build/ios/ipa/*.ipa 2>/dev/null | head -1)" if [ -z "$IPA" ] || [ ! -f "$IPA" ]; then echo "ERROR: IPA not found" >&2 exit 1 fi echo "==> compile-ios: built ${IPA}" -# --- 7. 上传 TestFlight（App Store Connect）--- +# --- 上传 TestFlight(App Store Connect;本机 .p8 由 key-id 自动定位)--- echo "==> compile-ios: uploading to TestFlight" xcrun altool --upload-app -f "$IPA" -t ios \ - --apiKey "${APPSTORE_API_KEY_ID}" \ - --apiIssuer "${APPSTORE_API_ISSUER_ID}" + --apiKey "${KEY_ID}" \ + --apiIssuer "${ISSUER}" echo "==> compile-ios: done — uploaded build ${BUILD} to TestFlight"