xcode-deploy.yml

#
# This source file is part of the Schmiedmayer Lab open-source organization
#
# SPDX-FileCopyrightText: 2026 Schmiedmayer Lab and the project authors (see CONTRIBUTORS.md)
#
# SPDX-License-Identifier: MIT
#

name: Deploy Xcode Project

on:
  workflow_call:
    inputs:
      job_name:
        description: |
          Custom name for the job displayed in the GitHub Actions UI.
          Useful to override the default name when called from other reusable workflows.
        required: false
        type: string
        default: 'Deploy Xcode Project'
      command:
        description: |
          Trusted shell command to run after checkout, Xcode setup, signing setup, and file injection.
        required: true
        type: string
      path:
        description: |
          The path where the project is located. Defaults to $GITHUB_WORKSPACE.
        required: false
        type: string
        default: '.'
      runs_on_labels:
        description: |
          JSON-based collection of labels indicating which type of GitHub runner should be chosen.
        required: false
        type: string
        default: '["macos-26"]'
      xcode_version:
        description: |
          The Xcode version used for deployment.
        required: false
        type: string
        default: 'latest-stable'
      environment:
        description: |
          GitHub deployment environment to optionally adjust access to variables and secrets with additional protection rules.
          https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment
        required: false
        type: string
        default: ''
      setup_signing:
        description: |
          Set up the keychain to include the Apple certificate and provisioning profile.
        required: false
        type: boolean
        default: false
      injected_secret_file_path:
        description: |
          Path where the Base64-decoded INJECTED_SECRET_FILE_BASE64 secret should be written.
          The path defines the file name and extension.
        required: false
        type: string
        default: ''
      checkout_submodules:
        description: |
          Flag indicating if submodules should be automatically checked out.
        required: false
        type: boolean
        default: false
      checkout_lfs:
        description: |
          Flag indicating if Git LFS should be used when running the checkout step.
        required: false
        type: boolean
        default: false
    secrets:
      BUILD_CERTIFICATE_BASE64:
        description: |
          The Base64-encoded Apple signing certificate used to build your iOS application.
        required: false
      P12_PASSWORD:
        description: |
          The password for the Apple signing certificate.
        required: false
      BUILD_PROVISION_PROFILE_BASE64:
        description: |
          The Base64-encoded Apple provisioning profile used to build your main application (e.g. iOS app).
        required: false
      BUILD_SECONDARY_PROVISION_PROFILE_BASE64:
        description: |
          The Base64-encoded Apple provisioning profile used to build an accompanying application (e.g. watchOS app).
        required: false
      APP_STORE_CONNECT_API_KEY_ID:
        description: |
          The key ID of the API key created in the App Store Connect API keys section.
        required: false
      APP_STORE_CONNECT_ISSUER_ID:
        description: |
          The issuer ID of the App Store Connect API is displayed in the App Store Connect API keys section.
        required: false
      APP_STORE_CONNECT_API_KEY_BASE64:
        description: |
          The content of the key created in App Store Connect condensed into a Base64 representation.
          Can be generated using, e.g., `$ base64 -i AuthKey_ABCDEFGHIJ.p8 | pbcopy`.
        required: false
      APPLE_ID:
        description: |
          The Apple ID you use to access the App Store Connect API.
        required: false
      CHECKOUT_TOKEN:
        description: |
          The personal access token (PAT) to use with the checkout action.
        required: false
      INJECTED_SECRET_FILE_BASE64:
        description: |
          Base64-encoded file contents to write to injected_secret_file_path.
        required: false

jobs:
  deploy_xcode:
    name: ${{ inputs.job_name }}
    runs-on: ${{ fromJson(inputs.runs_on_labels) }}
    defaults:
      run:
        working-directory: ${{ inputs.path }}
    environment: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@v7
        with:
          # This is GitHub's way of implementing ternary expressions (see https://docs.github.com/en/actions/learn-github-actions/expressions)
          token: ${{ secrets.CHECKOUT_TOKEN != '' && secrets.CHECKOUT_TOKEN || github.token }}
          submodules: ${{ inputs.checkout_submodules }}
          lfs: ${{ inputs.checkout_lfs }}
      - uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: ${{ inputs.xcode_version }}
      - name: Use selected Xcode for this job
        run: echo "DEVELOPER_DIR=$MD_APPLE_SDK_ROOT/Contents/Developer" >> "$GITHUB_ENV"
      - name: Check environment
        run: |
          xcodebuild -version
          swift --version
          echo "github-hosted: ${{ runner.environment == 'github-hosted' }}"
          echo "environment: ${{ inputs.environment }}"
      - name: Install the Apple certificate and provisioning profile
        if: ${{ inputs.setup_signing }}
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
          BUILD_SECONDARY_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_SECONDARY_PROVISION_PROFILE_BASE64 }}
        run: |
          # Create Variables
          CERTIFICATE_PATH="$RUNNER_TEMP/build_certificate.p12"
          PP_PATH="$RUNNER_TEMP/build_pp.mobileprovision"
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 32)"
          echo "::add-mask::$KEYCHAIN_PASSWORD"

          # Import Certificate and Provisioning Profile from Secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o "$CERTIFICATE_PATH"
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o "$PP_PATH"

          # Create a Temporary Keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          # Import Certificate to the Keychain
          security import "$CERTIFICATE_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

          # Apply Provisioning Profile
          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
          UUID=$(grep UUID -A1 -a "$PP_PATH" | grep -io "[-A-F0-9]\{36\}")
          cp "$PP_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/$UUID.mobileprovision"

          # Secondary Provisioning Profile
          if [ -n "$BUILD_SECONDARY_PROVISION_PROFILE_BASE64" ]; then
              PP_SECONDARY_PATH="$RUNNER_TEMP/build_pp_secondary.mobileprovision"
              echo -n "$BUILD_SECONDARY_PROVISION_PROFILE_BASE64" | base64 --decode -o "$PP_SECONDARY_PATH"
              SECONDARY_UUID=$(grep UUID -A1 -a "$PP_SECONDARY_PATH" | grep -io "[-A-F0-9]\{36\}")
              cp "$PP_SECONDARY_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/$SECONDARY_UUID.mobileprovision"
          fi
      - name: Write injected secret file
        if: ${{ inputs.injected_secret_file_path != '' }}
        env:
          INJECTED_SECRET_FILE_BASE64: ${{ secrets.INJECTED_SECRET_FILE_BASE64 }}
          INJECTED_SECRET_FILE_PATH: ${{ inputs.injected_secret_file_path }}
        run: |
          if [ -z "$INJECTED_SECRET_FILE_BASE64" ]; then
              echo "INJECTED_SECRET_FILE_BASE64 must be provided when injected_secret_file_path is set."
              exit 1
          fi

          mkdir -p "$(dirname "$INJECTED_SECRET_FILE_PATH")"
          echo -n "$INJECTED_SECRET_FILE_BASE64" | base64 --decode -o "$INJECTED_SECRET_FILE_PATH"
      - name: Run deployment command
        env:
          APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          COMMAND: ${{ inputs.command }}
          # Package fetches answer GitHub's challenge with the job token; anonymous clones are throttled per address.
          GIT_CONFIG_COUNT: 1
          GIT_CONFIG_KEY_0: url.https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/.insteadOf
          GIT_CONFIG_VALUE_0: https://github.com/
        run: |
          bash -eo pipefail -c "$COMMAND"
      - name: Clean up keychain and provisioning profile
        if: ${{ always() && inputs.setup_signing }}
        run: |
          security delete-keychain "$RUNNER_TEMP/app-signing.keychain-db" || true
          rm -rf ~/Library/MobileDevice/Provisioning\ Profiles || true
      - name: Clean up injected secret file
        if: ${{ always() && inputs.injected_secret_file_path != '' }}
        env:
          INJECTED_SECRET_FILE_PATH: ${{ inputs.injected_secret_file_path }}
        run: |
          rm -rf "$INJECTED_SECRET_FILE_PATH" || true