ci: add App Store submission pipeline via GitHub Actions

.github/workflows/app-store.yml

@@ -0,0 +1,82 @@
+name: App Store Submission
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  upload-to-app-store:
+    name: Archive & Upload to App Store
+    runs-on: macos-15
+    timeout-minutes: 60
+    defaults:
+      run:
+        working-directory: tabatago-swift
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Select Xcode
+        run: sudo xcode-select -switch /Applications/Xcode.app
+
+      - name: Cache SPM dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/Library/Developer/Xcode/DerivedData/**/SourcePackages
+          key: spm-macos-${{ hashFiles('tabatago-swift/project.yml') }}
+          restore-keys: |
+            spm-macos-
+
+      - name: Write App Store Connect API key
+        env:
+          API_KEY_P8: ${{ secrets.APP_STORE_CONNECT_API_KEY_P8 }}
+        run: |
+          printf '%s' "$API_KEY_P8" > "$RUNNER_TEMP/AuthKey.p8"
+
+      - name: Archive
+        run: |
+          xcodebuild archive \
+            -project TabataGo.xcodeproj \
+            -scheme TabataGo \
+            -configuration Release \
+            -archivePath ./build/TabataGo.xcarchive \
+            -allowProvisioningUpdates \
+            -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8" \
+            -authenticationKeyID "${{ secrets.APP_STORE_CONNECT_KEY_ID }}" \
+            -authenticationKeyIssuerID "${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}" \
+            || { echo "❌ Archive failed — check signing and API key permissions"; exit 1; }
+
+      - name: Verify build settings
+        run: |
+          echo "Checking version and build number..."
+          xcodebuild -showBuildSettings \
+            -project TabataGo.xcodeproj \
+            -scheme TabataGo \
+            -configuration Release \
+            | grep -E "MARKETING_VERSION|CURRENT_PROJECT_VERSION"
+
+      - name: Export IPA
+        run: |
+          xcodebuild -exportArchive \
+            -archivePath ./build/TabataGo.xcarchive \
+            -exportPath ./build/export \
+            -exportOptionsPlist ExportOptions.plist \
+            -allowProvisioningUpdates \
+            -authenticationKeyPath "$RUNNER_TEMP/AuthKey.p8" \
+            -authenticationKeyID "${{ secrets.APP_STORE_CONNECT_KEY_ID }}" \
+            -authenticationKeyIssuerID "${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}" \
+            || { echo "❌ Export failed — check ExportOptions.plist and provisioning"; exit 1; }
+
+      # NOTE: The first upload automatically creates the app record in
+      # App Store Connect if one does not already exist.
+      - name: Upload to App Store
+        run: |
+          xcrun altool --upload-app \
+            --type ios \
+            --file ./build/export/TabataGo.ipa \
+            --apiKey "${{ secrets.APP_STORE_CONNECT_KEY_ID }}" \
+            --apiIssuer "${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}" \
+            || { echo "❌ Upload failed — check API key permissions and app record"; exit 1; }