tabatago/.github/workflows/pr-iphone-deploy.yml

# =============================================================================
# TabataGo — PR → Build → devicectl Deploy → Wait LGTM → Merge
# =============================================================================

name: PR → Build → devicectl Deploy → LGTM

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
    # Only run the iOS build+deploy when the PR actually touches the Swift app
    # or this workflow itself. Docs-only / backend-only / admin-web-only PRs
    # skip the runner entirely (no point rebuilding an unchanged .app).
    paths:
      - 'tabatago-swift/**'
      - '.github/workflows/pr-iphone-deploy.yml'

# Every mutation (comments, merge) goes through the Gitea API with PR_API_TOKEN,
# never the runner's native GITHUB_TOKEN — so a `permissions:` block would be
# a no-op here. Intentionally omitted.
concurrency:
  # Per-PR grouping: superseded pushes cancel the previous pipeline, different
  # PRs still run in parallel. Prevents double-merges and wasted runner time.
  group: pr-iphone-deploy-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:

  build-deploy:
    name: Build & Deploy to iPhone (devicectl)
    runs-on: macos
    timeout-minutes: 30

    steps:
      - name: Checkout
        run: |
          git clone --depth 1 -b ${{ github.head_ref }} https://x-access-token:${PR_TOKEN}@gitea.1000co.fr/${{ github.repository }}.git .
        env:
          PR_TOKEN: ${{ secrets.PR_API_TOKEN }}
          REPO: ${{ github.repository }}

      - name: Setup Xcode
        run: |
          xcodebuild -version

      - name: Setup PATH
        run: echo "/opt/homebrew/bin" >> $GITHUB_PATH

      - name: Clean build artifacts
        run: |
          echo "🧹 Cleaning build artifacts..."

          # Act runner caches
          rm -rf ~/.cache/act/*/hostexecutor/tabatago-swift/build 2>/dev/null || true

          # SPM cache is KEPT between runs — RevenueCat is ~1.10 GiB and takes
          # 5+ minutes to clone; re-cloning on every CI run would waste time
          # and cause random failures on the act_runner sandbox. It lives at
          # build/spm-cache (see -clonedSourcePackagesDirPath in the Build step)
          # so NEVER `rm -rf build/` — only delete build/derived.

          # Xcode DerivedData — suppression COMPLÈTE (le bundle ID a changé,
          # l'ancien dossier TabataGo-* peut être ignoré par le nouveau build)
          rm -rf ~/Library/Developer/Xcode/DerivedData/*

          # Module cache Xcode — des .pcm stale peuvent segfault le linker
          rm -rf ~/Library/Developer/Xcode/DerivedData/ModuleCache.noindex 2>/dev/null || true
          # NOTE: do NOT `rm -rf ~/Library/Caches/com.apple.dt.Xcode` — that is the
          # shared global cache; wiping it slows every subsequent build.

          # Build artifacts locaux — sparing build/spm-cache (see above).
          rm -rf build/derived
          rm -rf build/*.log 2>/dev/null || true
          rm -rf .build
          rm -rf tabatago-swift/.build
          rm -rf tabatago-swift/TabataGo.xcodeproj
          rm -rf tabatago-swift/*.xcworkspace 2>/dev/null || true

          # Package.resolved — peut être stale après un changement de bundle ID
          find . -name "Package.resolved" -delete 2>/dev/null || true
          find . -name ".package.resolved" -delete 2>/dev/null || true

          echo "✅ Caches nettoyés (SPM cache préservé)"

      - name: Install tools (xcodegen, node)
        run: |
          # The act_runner shell can land under Rosetta 2 on Apple Silicon;
          # Homebrew lives in /opt/homebrew (ARM prefix), so run brew natively.
          # (Brew refuses to install/upgrade under Rosetta in the ARM prefix.)
          arch -arm64 brew install xcodegen node

      - name: Write Secrets.xcconfig from Gitea secrets
        env:
          SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
          SUPABASE_ANON_KEY: ${{ secrets.SUPABASE_ANON_KEY }}
          REVENUECAT_API_KEY: ${{ secrets.REVENUECAT_API_KEY }}
          POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
        run: |
          # Preflight: fail loudly if a secret is missing, rather than producing
          # an .app that silently can't reach Supabase/RevenueCat at runtime.
          for v in SUPABASE_URL SUPABASE_ANON_KEY REVENUECAT_API_KEY; do
            val="$(printenv "$v")"
            if [ -z "$val" ]; then
              echo "❌ Secret missing: $v. Add it to Gitea repo secrets."
              exit 1
            fi
          done
          # POSTHOG_API_KEY may legitimately be empty (PostHog not yet wired).
          # NOTE: heredoc body MUST start at column 0 — xcconfig keys are
          # whitespace-sensitive, leading spaces would break the build setting.
          cat > tabatago-swift/Config/Secrets.xcconfig <<EOF
          SUPABASE_URL = ${SUPABASE_URL}
          SUPABASE_ANON_KEY = ${SUPABASE_ANON_KEY}
          REVENUECAT_API_KEY = ${REVENUECAT_API_KEY}
          POSTHOG_API_KEY = ${POSTHOG_API_KEY}
          EOF
          echo "✅ Secrets.xcconfig written (values redacted)"

      - name: Generate Xcode project
        run: |
          cd tabatago-swift
          xcodegen generate

      - name: Resolve SPM packages
        run: |
          cd tabatago-swift
          xcodebuild -resolvePackageDependencies \
            -project TabataGo.xcodeproj \
            -scmProvider system

      - name: Build app
        run: |
          cd tabatago-swift
          xcodebuild build \
            -project TabataGo.xcodeproj \
            -scheme TabataGo \
            -configuration Debug \
            -allowProvisioningUpdates \
            -skipPackagePluginValidation \
            -derivedDataPath ../build/derived \
            -clonedSourcePackagesDirPath ../build/spm-cache \
            SWIFT_ENABLE_EXPLICIT_MODULES=NO \
            ONLY_ACTIVE_ARCH=NO \
            CODE_SIGN_STYLE=Automatic \
            DEVELOPMENT_TEAM=2MJF39L8VY

      - name: Install to iPhone (devicectl)
        run: |
          UDID="00008120-000925CE3672201E"
          APP=$(find build/derived -name 'TabataGo.app' -type d | head -1)

          # devicectl handles both WiFi (network) and wired (USB-C/Thunderbolt)
          # discovery natively — no separate USB-fallback tool needed.
          echo "📱 Installing via devicectl..."
          if xcrun devicectl device install app --device "$UDID" "$APP"; then
            echo "✅ Installed via devicectl"
            exit 0
          fi

          echo "❌ devicectl install failed"
          exit 1


      - name: Post "Ready to test" comment
        env:
          GT_TOKEN: ${{ secrets.PR_API_TOKEN }}
          GITEA_URL: https://gitea.1000co.fr
        run: |
          PR="${{ github.event.pull_request.number }}"
          REPO="${{ github.repository }}"
          curl -s -X POST \
            -H "Authorization: token ${GT_TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"body\":\"## 📱 Prêt à tester !\\n\\nL'app est déployée sur l'iPhone (devicectl).\\n\\n- Teste les changements\\n- Reply **LGTM** pour merger\\n- Reply **KO** pour bloquer\"}" \
            "${GITEA_URL}/api/v1/repos/${REPO}/issues/${PR}/comments"

  wait-approval:
    name: Wait for LGTM comment
    needs: build-deploy
    runs-on: macos
    timeout-minutes: 120

    steps:
      - name: Poll for LGTM
        env:
          GT_TOKEN: ${{ secrets.PR_API_TOKEN }}
          GITEA_URL: https://gitea.1000co.fr
        run: |
          PR="${{ github.event.pull_request.number }}"
          REPO="${{ github.repository }}"
          PR_TITLE="${{ github.event.pull_request.title }}"
          API="${GITEA_URL}/api/v1/repos/${REPO}"
          MAX=240
          TRIES=0

          echo "⏳ Attente LGTM sur PR #${PR}..."

          # Re-fetch ALL comments each cycle (not since_id) so we also catch
          # edits — e.g. a reviewer changing "KO" → "LGTM". Negligible cost for
          # PRs with <50 comments.

          while [ $TRIES -lt $MAX ]; do
            sleep 30
            TRIES=$((TRIES + 1))

            COMMENTS=$(curl -s -H "Authorization: token ${GT_TOKEN}" \
              "${API}/issues/${PR}/comments?limit=50&page=1")

            # Match LGTM/KO anywhere in the body (with a word boundary so "KOM"
            # or "LGTMX" don't trigger). Case-insensitive.
            if echo "$COMMENTS" | grep -qiE '"body":[[:space:]]*"[^"]*\bLGTM\b'; then
              echo "✅ LGTM reçu ! Squash-merge..."
              curl -s -X POST \
                -H "Authorization: token ${GT_TOKEN}" \
                -H "Content-Type: application/json" \
                -d "{\"Do\":\"squash\"}" \
                "${API}/pulls/${PR}/merge"
              echo "✅ Mergée (squash)."
              exit 0
            fi

            if echo "$COMMENTS" | grep -qiE '"body":[[:space:]]*"[^"]*\bKO\b'; then
              echo "❌ KO reçu. Bloquée."
              exit 1
            fi

            if [ $((TRIES % 4)) -eq 0 ]; then
              echo "   ⏳ ... (${TRIES}/240, $(date +%H:%M))"
            fi
          done
          echo "❌ Timeout 2h."
          exit 1