Node version 22

.github/workflows/ios-build.yml

@@ -28,7 +28,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
 
       - name: Install backend dependencies & test
@@ -43,10 +43,8 @@ jobs:
     runs-on: macos-14
     env:
       SCHEME: App
-      PROJECT: ios/App/App.xcodeproj
       WORKSPACE: ios/App/App.xcworkspace
       ARCHIVE_PATH: build/App.xcarchive
-      IPA_PATH: build/App.ipa
       EXPORT_OPTIONS: scripts/export-options.plist
 
     steps:
@@ -54,7 +52,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
 
       - name: Install root dependencies
@@ -92,6 +90,12 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/ios-v')
         run: |
           TAG_VERSION="${GITHUB_REF#refs/tags/ios-v}"
+
+          if ! echo "$TAG_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::Invalid tag format '$TAG_VERSION'. Expected semver: X.Y.Z"
+            exit 1
+          fi
+
           MAJOR=$(echo "$TAG_VERSION" | cut -d. -f1)
           MINOR=$(echo "$TAG_VERSION" | cut -d. -f2)
           PATCH=$(echo "$TAG_VERSION" | cut -d. -f3)
@@ -100,11 +104,12 @@ jobs:
           echo "Setting MARKETING_VERSION=$MAJOR.$MINOR.$PATCH"
           echo "Setting CURRENT_PROJECT_VERSION=$BUILD"
 
-          sed -i '' "s/MARKETING_VERSION = .*;/MARKETING_VERSION = $MAJOR.$MINOR.$PATCH;/" ios/App/App.xcodeproj/project.pbxproj
-          sed -i '' "s/CURRENT_PROJECT_VERSION = .*;/CURRENT_PROJECT_VERSION = $BUILD;/" ios/App/App.xcodeproj/project.pbxproj
+          sed -i '' "s/MARKETING_VERSION = [^;]*;/MARKETING_VERSION = $MAJOR.$MINOR.$PATCH;/" ios/App/App.xcodeproj/project.pbxproj
+          sed -i '' "s/CURRENT_PROJECT_VERSION = [^;]*;/CURRENT_PROJECT_VERSION = $BUILD;/" ios/App/App.xcodeproj/project.pbxproj
 
       - name: Build Xcode archive
         run: |
+          set -o pipefail
           xcodebuild archive \
             -workspace "$WORKSPACE" \
             -scheme "$SCHEME" \
@@ -115,19 +120,20 @@ jobs:
             CODE_SIGN_STYLE=Manual \
             DEVELOPMENT_TEAM="${{ secrets.IOS_TEAM_ID }}" \
             PROVISIONING_PROFILE_SPECIFIER="${{ secrets.IOS_PROVISION_PROFILE_NAME }}" \
-            | xcpretty --color || true
+            2>&1 | xcpretty --color
 
       - name: Export IPA
         run: |
-          plutil -replace teamID -string "${{ secrets.IOS_TEAM_ID }}" "$EXPORT_OPTIONS" 2>/dev/null || true
-          plutil -replace provisioningProfiles.net.hacecalor.farmafinder -string "${{ secrets.IOS_PROVISION_PROFILE_NAME }}" "$EXPORT_OPTIONS" 2>/dev/null || true
+          plutil -replace teamID -string "${{ secrets.IOS_TEAM_ID }}" "$EXPORT_OPTIONS"
+          plutil -replace provisioningProfiles.net.hacecalor.farmafinder -string "${{ secrets.IOS_PROVISION_PROFILE_NAME }}" "$EXPORT_OPTIONS"
 
+          set -o pipefail
           xcodebuild -exportArchive \
             -archivePath "$ARCHIVE_PATH" \
             -exportOptionsPlist "$EXPORT_OPTIONS" \
             -exportPath build \
             -allowProvisioningUpdates \
-            | xcpretty --color || true
+            2>&1 | xcpretty --color
 
       - name: Upload artifact (IPA)
         uses: actions/upload-artifact@v4
@@ -140,19 +146,31 @@ jobs:
         if: >
           (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/ios-v')) ||
           (github.event_name == 'workflow_dispatch' && inputs.upload_to_testflight == 'true')
-        run: |
-          xcrun altool \
-            --upload-app \
-            --type ios \
-            --file "$IPA_PATH" \
-            --apiKey "${{ secrets.APP_STORE_API_KEY_ID }}" \
-            --apiIssuer "${{ secrets.APP_STORE_API_ISSUER_ID }}"
         env:
-          API_PRIVATE_KEY: ${{ secrets.APP_STORE_API_PRIVATE_KEY }}
+          APP_STORE_API_KEY_ID: ${{ secrets.APP_STORE_API_KEY_ID }}
+          APP_STORE_API_ISSUER_ID: ${{ secrets.APP_STORE_API_ISSUER_ID }}
+        run: |
+          IPA_PATH=$(find build -name "*.ipa" -maxdepth 1 | head -1)
+          if [ -z "$IPA_PATH" ]; then
+            echo "::error::No IPA found in build/"
+            exit 1
+          fi
+
+          API_PRIVATE_KEY_PATH="$RUNNER_TEMP/app_store_api_key.p8"
+          echo "${{ secrets.APP_STORE_API_PRIVATE_KEY }}" > "$API_PRIVATE_KEY_PATH"
+
+          xcrun notarytool submit "$IPA_PATH" \
+            --key-id "$APP_STORE_API_KEY_ID" \
+            --issuer "$APP_STORE_API_ISSUER_ID" \
+            --key "$API_PRIVATE_KEY_PATH" \
+            --wait
+
+          rm -f "$API_PRIVATE_KEY_PATH"
 
       - name: Summary
         run: |
-          if [ -f "$IPA_PATH" ]; then
+          IPA_PATH=$(find build -name "*.ipa" -maxdepth 1 | head -1)
+          if [ -n "$IPA_PATH" ]; then
             IPA_SIZE=$(du -h "$IPA_PATH" | cut -f1)
             echo "### iOS Build Summary" >> $GITHUB_STEP_SUMMARY
             echo "| Item | Value |" >> $GITHUB_STEP_SUMMARY
@@ -161,6 +179,6 @@ jobs:
             echo "| Tag | ${GITHUB_REF#refs/tags/} |" >> $GITHUB_STEP_SUMMARY
             echo "| Build # | ${{ github.run_number }} |" >> $GITHUB_STEP_SUMMARY
           else
-            echo "::error::IPA not found at $IPA_PATH"
+            echo "::error::IPA not found in build/"
             exit 1
           fi