tabatago/.gitea/workflows/pr-iphone-deploy.yml

# =============================================================================
# TabataGo — PR → Build → Archive → Firebase OTA → Wait LGTM → Merge
# =============================================================================

name: PR → Build → Firebase OTA → LGTM

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]

permissions:
  contents: write
  pull-requests: write

jobs:

  build-deploy:
    name: Build & Deploy to Firebase OTA
    runs-on: macos
    timeout-minutes: 20

    steps:
      - name: Checkout
        run: |
          git clone --depth 1 -b ${{ github.head_ref }} https://x-access-token:${PR_TOKEN}@gitea.1000co.fr/${REPO}.git .
        env:
          PR_TOKEN: ${{ secrets.PR_API_TOKEN }}
          REPO: ${{ github.repository }}

      - name: Setup Xcode
        run: |
          xcodebuild -version

      - name: Setup PATH
        run: echo "/opt/homebrew/bin" >> $GITHUB_PATH

      - name: Clean SPM + Xcode caches (aggressive)
        run: |
          echo "🧹 Nettoyage agressif des caches SPM/Xcode..."

          # Act runner caches
          rm -rf ~/.cache/act/*/hostexecutor/tabatago-swift/build 2>/dev/null || true

          # SPM caches — tous les emplacements connus
          rm -rf ~/Library/Caches/org.swift.swiftpm
          rm -rf ~/Library/org.swift.swiftpm
          rm -rf ~/.swiftpm

          # Xcode DerivedData — suppression COMPLÈTE (le bundle ID a changé,
          # l'ancien dossier TabataGo-* peut être ignoré par le nouveau build)
          rm -rf ~/Library/Developer/Xcode/DerivedData/*

          # Module cache Xcode — des .pcm stale peuvent segfault le linker
          rm -rf ~/Library/Developer/Xcode/DerivedData/ModuleCache.noindex 2>/dev/null || true
          rm -rf ~/Library/Caches/com.apple.dt.Xcode

          # Build artifacts locaux (utilisés par le step "Build app")
          rm -rf build/
          rm -rf .build
          rm -rf tabatago-swift/.build
          rm -rf tabatago-swift/TabataGo.xcodeproj
          rm -rf tabatago-swift/*.xcworkspace 2>/dev/null || true

          # Package.resolved — peut être stale après un changement de bundle ID
          find . -name "Package.resolved" -delete 2>/dev/null || true
          find . -name ".package.resolved" -delete 2>/dev/null || true

          echo "✅ Caches nettoyés"

      - name: Install tools (xcodegen, node, firebase)
        run: |
          brew install xcodegen node || true
          npm install -g firebase-tools

      - name: Generate Xcode project
        run: |
          cd tabatago-swift
          xcodegen generate

      - name: Resolve SPM packages
        run: |
          cd tabatago-swift
          xcodebuild -resolvePackageDependencies \
            -project TabataGo.xcodeproj \
            -scmProvider system

      # STOPGAP — The Mac CI runner has no Apple Developer account signed into
      # Xcode, so provisioning profiles for bundle IDs like
      # fr.millianlmx.tabatago.* can't be auto-created. This bypasses code
      # signing entirely so the build succeeds. The resulting .app will NOT
      # install on physical devices without manual re-signing.
      #
      # REAL FIX (manual, one-time, on the Mac runner):
      #   1. Open Xcode → Settings → Accounts → sign in with the Apple
      #      Developer account.
      #   2. After that, remove CODE_SIGN_IDENTITY="-" and
      #      CODE_SIGNING_REQUIRED=NO below, and
      #      -allowProvisioningUpdates + DEVELOPMENT_TEAM will auto-provision
      #      profiles for any new bundle IDs.
      - name: Build app
        run: |
          cd tabatago-swift
          xcodebuild -list
          xcodebuild build \
            -project TabataGo.xcodeproj \
            -scheme TabataGo \
            -configuration Debug \
            -allowProvisioningUpdates \
            -skipPackagePluginValidation \
            -derivedDataPath ../build/derived \
            -clonedSourcePackagesDirPath ../build/spm-cache \
            SWIFT_ENABLE_EXPLICIT_MODULES=NO \
            ONLY_ACTIVE_ARCH=NO \
            CODE_SIGN_IDENTITY="-" \
            CODE_SIGNING_REQUIRED=NO \
            DEVELOPMENT_TEAM=2MJF39L8VY

      - name: Package IPA
        run: |
          cd tabatago-swift
          mkdir -p Payload build
          APP=$(find ../build/derived -name 'TabataGo.app' -type d | head -1)
          cp -R "$APP" Payload/
          zip -r build/TabataGo.ipa Payload/
          rm -rf Payload

      - name: Deploy to Firebase
        env:
          FIREBASE_APP_ID: ${{ secrets.FIREBASE_APP_ID }}
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
        run: |
          npx firebase appdistribution:distribute tabatago-swift/build/TabataGo.ipa \
            --app "${FIREBASE_APP_ID}" \
            --groups "millian-test" \
            --project tabatago-19a80 \
            --token "${FIREBASE_TOKEN}" \
            --release-notes "PR: ${{ github.event.pull_request.title }}"

      - name: Post "Ready to test" comment
        env:
          GT_TOKEN: ${{ secrets.PR_API_TOKEN }}
          GITEA_URL: https://gitea.1000co.fr
        run: |
          PR="${{ github.event.pull_request.number }}"
          REPO="${{ github.repository }}"
          curl -s -X POST \
            -H "Authorization: token ${GT_TOKEN}" \
            -H "Content-Type: application/json" \
            -d "{\"body\":\"## 📱 Prêt à tester !\\n\\nL\'app est déployée via Firebase.\\n\\n- Teste les changements\\n- Reply **LGTM** pour merger\\n- Reply **KO** pour bloquer\"}" \
            "${GITEA_URL}/api/v1/repos/${REPO}/issues/${PR}/comments"

  wait-approval:
    name: Wait for LGTM comment
    needs: build-deploy
    runs-on: macos
    timeout-minutes: 120

    steps:
      - name: Poll for LGTM
        env:
          GT_TOKEN: ${{ secrets.PR_API_TOKEN }}
          GITEA_URL: https://gitea.1000co.fr
        run: |
          PR="${{ github.event.pull_request.number }}"
          REPO="${{ github.repository }}"
          PR_TITLE="${{ github.event.pull_request.title }}"
          API="${GITEA_URL}/api/v1/repos/${REPO}"
          MAX=240
          TRIES=0

          echo "⏳ Attente LGTM sur PR #${PR}..."

          LAST_ID=$(curl -s -H "Authorization: token ${GT_TOKEN}" \
            "${API}/issues/${PR}/comments" | \
            python3 -c "import json,sys; cs=json.load(sys.stdin); print(cs[-1]['id'] if cs else 0)" 2>/dev/null || echo 0)

          while [ $TRIES -lt $MAX ]; do
            sleep 30
            TRIES=$((TRIES + 1))

            COMMENTS=$(curl -s -H "Authorization: token ${GT_TOKEN}" \
              "${API}/issues/${PR}/comments?since_id=${LAST_ID}")

            if echo "$COMMENTS" | grep -qi '"body": *"LGTM"'; then
              echo "✅ LGTM reçu ! Merge..."
              curl -s -X POST \
                -H "Authorization: token ${GT_TOKEN}" \
                -H "Content-Type: application/json" \
                -d "{\"Do\":\"merge\"}" \
                "${API}/pulls/${PR}/merge"
              echo "✅ Mergée."
              exit 0
            fi

            if echo "$COMMENTS" | grep -qi '"body": *"KO"'; then
              echo "❌ KO reçu. Bloquée."
              exit 1
            fi

            if [ $((TRIES % 4)) -eq 0 ]; then
              echo "   ⏳ ... (${TRIES}/240, $(date +%H:%M))"
            fi
          done
          echo "❌ Timeout 2h."
          exit 1