Release TestFlight

The Mobile TestFlight workflow (.github/workflows/mobile-testflight.yml) and a local run both call scripts/mobile-testflight.ts. It prebuilds the production app (com.katacode.app) with OTA off, archives with automatic signing for team ZBZKKWF95G, and uploads to App Store Connect. The build number is the UTC upload minute (YYYYMMDDHHmm). Setup and background are in docs/operations/release.md#mobile-testflight.

Bare gh in this repo targets upstream. Pass -R gannonh/kata-code on every call.

1. Check prerequisites

gh secret list -R gannonh/kata-code | grep -E '^APPLE_API_(KEY|KEY_ID|ISSUER)\b'
gh workflow view mobile-testflight.yml -R gannonh/kata-code >/dev/null

CI needs all three secrets and the workflow on main. If either is missing, CI can't run, so tell the user which piece is missing and go to the local path (step 4). Point to the one-time setup in the release doc for the secrets, since creating the App Store Connect app record and the API key needs a human.

2. Dispatch and watch

Build from main unless the user names another ref. Pass -f upload=false when they want a signed build without an upload.

run_url="$(gh workflow run mobile-testflight.yml -R gannonh/kata-code --ref main 2>&1 | grep -Eo 'https://github.com/[^ ]+/actions/runs/[0-9]+')"
run_id="${run_url##*/}"
gh run watch "$run_id" -R gannonh/kata-code --exit-status --interval 60

gh workflow run prints the URL of the run it created when GitHub returns one. Watch that run, not the latest one in gh run list, which can belong to someone else's dispatch. If no URL comes back, upgrade gh rather than guessing the run.

A run takes roughly 30 to 60 minutes. Run the watch in the background and wait for it to exit instead of polling.

3. Report or triage

On success, read the result line from the log:

gh run view "$run_id" -R gannonh/kata-code --log | grep -E 'Uploaded Kata Code|Exported Kata Code'

Report the version, build number, commit, and run URL. Say that App Store Connect processes the build before TestFlight lists it. Do not claim the build is installable until the user confirms it appears.

On failure, find the first error with gh run view "$run_id" -R gannonh/kata-code --log-failed, then match it:

4. Local fallback

Use this path when CI can't run, for example when the workflow isn't on main yet or the API key isn't set up. It needs macOS with Xcode, CocoaPods, the repo installed (vp i), and Xcode > Settings > Accounts signed in to team ZBZKKWF95G. If xcodebuild reports Unable to log in with account, the Xcode session expired. Only the user can fix that, by signing in again.

export OP_SERVICE_ACCOUNT_TOKEN=...   # the Expo config loads Clerk and relay settings from 1Password
node scripts/mobile-testflight.ts               # add --no-upload to stop after export

If export stalls with an idle codesign child of xcodebuild -exportArchive, macOS is waiting on a keychain prompt for the local Apple Distribution key. Ask the user to enter their login password and choose Always Allow. CI uses a fresh keychain and never sees this prompt.

Without Clerk and relay config the script refuses to upload and names the missing variables. --no-upload still builds, for checking that the app compiles and signs.