build-ipa.yml

name: Build IPA

on:
  push:
    branches: [main, 'cursor/**']
    tags: ['v*']
  pull_request:
  workflow_dispatch:
    inputs:
      signing:
        description: 'Signing mode'
        required: true
        default: unsigned
        type: choice
        options:
          - unsigned
          - manual
      configuration:
        description: 'Xcode configuration'
        required: true
        default: Release
        type: choice
        options:
          - Release
          - Debug
      publish_prerelease:
        description: 'Publish GitHub prerelease from this run'
        required: true
        default: false
        type: boolean
      prerelease_tag:
        description: 'Tag for prerelease (e.g. v0.1.0-beta.2). Empty = auto timestamp'
        required: false
        default: ''

permissions:
  contents: write

concurrency:
  group: ipa-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ipa:
    name: macOS IPA
    runs-on: macos-15
    timeout-minutes: 90
    env:
      CONFIGURATION: ${{ github.event.inputs.configuration || 'Release' }}
      SIGNING: ${{ github.event.inputs.signing || 'unsigned' }}
      LITE: '0'
      BOTH: '0'
      EVERYWHERE_CORE_MIN_VERSION: '2026.10.24'

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Select Xcode
        run: |
          sudo xcode-select -s /Applications/Xcode.app
          xcodebuild -version

      - name: Install Ruby deps
        run: gem install --user-install xcodeproj

      - name: Cache DerivedData / SPM
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            DerivedData
            ~/Library/Caches/org.swift.swiftpm
            ~/Library/Developer/Xcode/DerivedData
          key: ${{ runner.os }}-spm-${{ hashFiles('Scripts/wire_project.rb', 'PATCHES.md') }}
          restore-keys: |
            ${{ runner.os }}-spm-

      - name: Import signing cert (optional)
        if: ${{ env.SIGNING == 'manual' }}
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
          TEAM_ID: ${{ secrets.TEAM_ID }}
        run: |
          set -euo pipefail
          if [[ -z "${BUILD_CERTIFICATE_BASE64:-}" || -z "${BUILD_PROVISION_PROFILE_BASE64:-}" ]]; then
            echo "manual signing requested but cert/profile secrets are missing" >&2
            exit 1
          fi
          CERT_PATH="$RUNNER_TEMP/build_certificate.p12"
          PROFILE_PATH="$RUNNER_TEMP/build_pp.mobileprovision"
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
          echo "$BUILD_CERTIFICATE_BASE64" | base64 --decode > "$CERT_PATH"
          echo "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode > "$PROFILE_PATH"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
          PROFILE_UUID=$(security cms -D -i "$PROFILE_PATH" | plutil -extract UUID raw -)
          cp "$PROFILE_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/$PROFILE_UUID.mobileprovision"
          echo "DEVELOPMENT_TEAM=${TEAM_ID}" >> "$GITHUB_ENV"
          echo "Installed profile $PROFILE_UUID"

      - name: Build IPA
        env:
          DEVELOPMENT_TEAM: ${{ secrets.TEAM_ID }}
        run: |
          set -euo pipefail
          chmod +x Scripts/ci_export_ipa.sh Scripts/resign_ipa.sh build.sh
          # One full VPN IPA for ESign / one-file install (app + PacketTunnel)
          BOTH=0 LITE=0 ./Scripts/ci_export_ipa.sh
          ls -lah build/ipa/

      - name: Rename IPA with version
        id: meta
        run: |
          set -euo pipefail
          REF="${GITHUB_REF_NAME}"
          SHA_SHORT="${GITHUB_SHA::7}"
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            VER="$REF"
          elif [[ -n "${{ github.event.inputs.prerelease_tag }}" ]]; then
            VER="${{ github.event.inputs.prerelease_tag }}"
          else
            VER="v0.0.0-dev.${SHA_SHORT}"
          fi

          SRC="$(ls build/ipa/DecoderSec-unsigned.ipa build/ipa/*.ipa 2>/dev/null | head -n1)"
          [[ -n "$SRC" ]] || { echo "no IPA produced"; exit 1; }
          # Single user-facing name + versioned copy
          cp "$SRC" "build/ipa/DecoderSec.ipa"
          mv "$SRC" "build/ipa/DecoderSec-${VER}.ipa"
          rm -f build/ipa/*lite* || true

          echo "version=$VER" >> "$GITHUB_OUTPUT"
          PRE=false
          if [[ "$VER" =~ (alpha|beta|rc|dev|pre) ]]; then PRE=true; fi
          if [[ "${{ github.event.inputs.publish_prerelease }}" == "true" ]]; then PRE=true; fi
          echo "prerelease=$PRE" >> "$GITHUB_OUTPUT"
          ls -lah build/ipa/

      - name: Upload IPA artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: DecoderSec-ipa-${{ steps.meta.outputs.version }}
          path: |
            build/ipa/DecoderSec.ipa
            build/ipa/DecoderSec-*.ipa
            build/*.xcarchive
          if-no-files-found: error
          retention-days: 30

      - name: Publish GitHub Release (tags)
        if: startsWith(github.ref, 'refs/tags/v')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            build/ipa/DecoderSec.ipa
            build/ipa/DecoderSec-${{ steps.meta.outputs.version }}.ipa
          generate_release_notes: true
          prerelease: ${{ steps.meta.outputs.prerelease == 'true' }}
          name: decoder sec. ${{ steps.meta.outputs.version }}
          body: |
            ## decoder sec. `${{ steps.meta.outputs.version }}`

            **Один файл:** [`DecoderSec.ipa`](https://github.com/decoder-dev/decoder-sec/releases/download/${{ steps.meta.outputs.version }}/DecoderSec.ipa)

            ### ESign (один раз)
            1. Скачай `DecoderSec.ipa`
            2. Открой в **ESign** → Импорт
            3. Подпись сертификатом с **Network Extension / VPN** (платный)
            4. Установи → открой → добавь конфиг → Connect

            Внутри: приложение + PacketTunnel. Без App Groups. Bundle ID extension подхватывается после ремапа ESign автоматически.

            - Default IDs: `com.decodersec.app` + `com.decodersec.app.PacketTunnel`
            - Engines: Xray / sing-box / mihomo
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Publish GitHub Prerelease (manual)
        if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.publish_prerelease == 'true' }}
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.meta.outputs.version }}
          name: decoder sec. ${{ steps.meta.outputs.version }}
          prerelease: true
          generate_release_notes: true
          files: |
            build/ipa/DecoderSec.ipa
            build/ipa/DecoderSec-${{ steps.meta.outputs.version }}.ipa
          body: |
            Один файл: `DecoderSec.ipa` — ESign → подпись с Network Extension → установка.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  core-freshness:
    name: Check EverywhereCore / Xray freshness
    runs-on: ubuntu-latest
    timeout-minutes: 10
    continue-on-error: true
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Compare pinned floor vs latest EverywhereCore + Xray
        run: |
          set -euo pipefail
          PIN=$(ruby -e "puts File.read('Scripts/wire_project.rb')[/EVERYWHERE_CORE_MIN_VERSION = ENV.fetch\\('EVERYWHERE_CORE_MIN_VERSION', '([^']+)'\\)/, 1]")
          echo "Pinned EverywhereCore floor: $PIN"
          LATEST=$(curl -fsSL https://api.github.com/repos/NodePassProject/EverywhereCore/releases/latest | python3 -c 'import sys,json; print(json.load(sys.stdin)["tag_name"].lstrip("v"))')
          echo "Latest EverywhereCore: $LATEST"
          XRAY=$(curl -fsSL https://proxy.golang.org/github.com/xtls/xray-core/@latest)
          echo "Latest Xray (Go proxy): $XRAY"
          curl -fsSL "https://raw.githubusercontent.com/NodePassProject/EverywhereCore/v${LATEST}/go/go.mod" -o /tmp/everywherecore.go.mod
          CORE_MOD=$(awk '/xray-core/{print; exit}' /tmp/everywherecore.go.mod)
          echo "Xray in latest EverywhereCore: $CORE_MOD"
          if [[ "$LATEST" > "$PIN" ]]; then
            echo "::warning::EverywhereCore floor $PIN is behind latest $LATEST — bump Scripts/wire_project.rb"
          else
            echo "Floor is current (>= latest tag)."
          fi