ios-testflight.yml

name: iOS TestFlight Deployment
run-name: "iOS TestFlight Deployment → ${{ inputs.environment }}"

on:
  workflow_dispatch:
    inputs:
      version_bump:
        description: 'Version bump type'
        required: false
        default: 'build'
        type: choice
        options:
          - none
          - build
          - patch
          - minor
          - major
      environment:
        description: 'Target environment'
        required: true
        default: 'test'
        type: choice
        options:
          - test
          - qa
          - prod

env:
  NODE_VERSION: '20'
  DEVELOPMENT_TEAM: '47PY6J2KQC'

jobs:
  deploy-testflight:
    name: Build and Deploy to TestFlight
    runs-on: macos-26
    timeout-minutes: 60
    # Environment provides: Auth0 config, iOS provisioning profile, app bundle ID, app store ID
    # Repository-level secrets: distribution certificate, App Store Connect API keys
    environment:
      name: ${{ inputs.environment }}
      url: ${{ steps.build_url.outputs.url || format('https://appstoreconnect.apple.com/apps/{0}/testflight/ios', vars.APP_STORE_APP_ID) }}

    defaults:
      run:
        working-directory: ./app

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Save build commit SHA
        id: build_commit
        run: |
          echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
          echo "Build commit: $(git rev-parse HEAD)"

      - name: Select Xcode version
        run: |
          echo "Selecting default Xcode"
          sudo xcode-select -switch /Applications/Xcode.app/Contents/Developer
          xcodebuild -version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Cache node modules
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            ./app/node_modules
            ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Cache CocoaPods
        uses: actions/cache@v4
        id: pods-cache
        with:
          path: |
            ./app/ios/Pods
            ~/Library/Caches/CocoaPods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Setup environment variables
        run: |
          # Auth0 config from environment variables and secrets
          # AUTH0_CLIENT_ID comes from the target environment (test/prod)
          # Other Auth0 vars come from environment variables
          cat > .env << EOF
          AUTH0_DOMAIN=${{ vars.AUTH0_DOMAIN }}
          AUTH0_CLIENT_ID=${{ secrets.AUTH0_CLIENT_ID }}
          AUTH0_AUDIENCE=${{ vars.AUTH0_AUDIENCE }}
          AUTH0_SCOPE=${{ vars.AUTH0_SCOPE }}
          AUTH0_API_URL=${{ vars.AUTH0_API_URL }}
          AUTH0_OTP_DIGITS=${{ vars.AUTH0_OTP_DIGITS }}
          AUTH0_SCHEME=${{ vars.AUTH0_SCHEME }}
          APP_BUNDLE_ID=${{ vars.APP_BUNDLE_ID }}
          APP_ENVIRONMENT=${{ inputs.environment }}
          APPLICATION_INSIGHTS_CONNECTION_STRING=${{ secrets.APPLICATION_INSIGHTS_CONNECTION_STRING }}
          TEMPORARY_AUTH0_TOKEN=
          EOF
          echo "Environment variables configured for ${{ inputs.environment }} environment"

          # Verify critical variables are set
          if [ -z "${{ vars.AUTH0_DOMAIN }}" ]; then
            echo "::error::AUTH0_DOMAIN is not set in ${{ inputs.environment }} environment"
            exit 1
          fi
          if [ -z "${{ secrets.AUTH0_CLIENT_ID }}" ]; then
            echo "::error::AUTH0_CLIENT_ID secret is not set in ${{ inputs.environment }} environment"
            exit 1
          fi
          echo "Auth0 configuration validated ✓"

      - name: Increment build number
        id: version
        run: |
          # Get current version and build number from app.config.js
          cat > read_config.mjs << 'SCRIPT'
          import config from './app.config.js';
          console.log(JSON.stringify({
            version: config.expo.version,
            buildNumber: config.expo.ios?.buildNumber || "1"
          }));
          SCRIPT
          CONFIG_JSON=$(node read_config.mjs)
          rm read_config.mjs

          CURRENT_VERSION=$(echo $CONFIG_JSON | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin', 'utf8')).version")
          CURRENT_BUILD=$(echo $CONFIG_JSON | node -p "JSON.parse(require('fs').readFileSync('/dev/stdin', 'utf8')).buildNumber")

          echo "Current version: $CURRENT_VERSION"
          echo "Current build number: $CURRENT_BUILD"

          VERSION_BUMP="${{ inputs.version_bump }}"
          if [ -z "$VERSION_BUMP" ]; then
            VERSION_BUMP="build"
          fi

          case "$VERSION_BUMP" in
            major)
              NEW_VERSION=$(echo $CURRENT_VERSION | awk -F. '{print $1+1".0.0"}')
              NEW_BUILD=1
              ;;
            minor)
              NEW_VERSION=$(echo $CURRENT_VERSION | awk -F. '{print $1"."$2+1".0"}')
              NEW_BUILD=1
              ;;
            patch)
              NEW_VERSION=$(echo $CURRENT_VERSION | awk -F. '{print $1"."$2"."$3+1}')
              NEW_BUILD=1
              ;;
            none)
              NEW_VERSION=$CURRENT_VERSION
              NEW_BUILD=$CURRENT_BUILD
              ;;
            build|*)
              NEW_VERSION=$CURRENT_VERSION
              NEW_BUILD=$((CURRENT_BUILD + 1))
              ;;
          esac

          echo "New version: $NEW_VERSION"
          echo "New build number: $NEW_BUILD"

          # Update version and buildNumber in app.config.js
          # Handle both single and double quotes in the config file
          node -e "
            const fs = require('fs');
            let configContent = fs.readFileSync('app.config.js', 'utf8');
            configContent = configContent.replace(/version: ['\"][^'\"]+['\"]/, \"version: '$NEW_VERSION'\");
            configContent = configContent.replace(/buildNumber: ['\"][^'\"]+['\"]/, \"buildNumber: '$NEW_BUILD'\");
            fs.writeFileSync('app.config.js', configContent);
          "

          echo "Updated app.config.js with version $NEW_VERSION and build number $NEW_BUILD"
          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "build=$NEW_BUILD" >> $GITHUB_OUTPUT

      - name: Prebuild iOS native project
        run: |
          echo "Generating native iOS project with Expo..."
          npx expo prebuild --platform ios --clean
          echo "Native iOS project generated"

      - name: Update Info.plist with correct build number
        run: |
          NEW_BUILD="${{ steps.version.outputs.build }}"
          NEW_VERSION="${{ steps.version.outputs.version }}"
          
          # Find the Info.plist file
          INFO_PLIST=$(find ios -name "Info.plist" -path "*/SoftwareOne/*" | head -1)
          if [ -z "$INFO_PLIST" ]; then
            INFO_PLIST=$(find ios -name "Info.plist" -not -path "*/Pods/*" -not -path "*/build/*" | head -1)
          fi
          
          if [ -z "$INFO_PLIST" ]; then
            echo "::error::Could not find Info.plist"
            exit 1
          fi
          
          echo "Found Info.plist at: $INFO_PLIST"
          
          # Update CFBundleVersion (build number) and CFBundleShortVersionString (version)
          /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $NEW_BUILD" "$INFO_PLIST"
          /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $NEW_VERSION" "$INFO_PLIST"
          
          echo "Updated Info.plist:"
          echo "  CFBundleVersion: $(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$INFO_PLIST")"
          echo "  CFBundleShortVersionString: $(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$INFO_PLIST")"
          
          # Also update project.pbxproj to ensure version consistency
          PBXPROJ=$(find ios -name "project.pbxproj" | head -1)
          if [ -n "$PBXPROJ" ]; then
            echo "Updating $PBXPROJ with build number $NEW_BUILD"
            sed -i '' "s/CURRENT_PROJECT_VERSION = [^;]*;/CURRENT_PROJECT_VERSION = $NEW_BUILD;/g" "$PBXPROJ"
            sed -i '' "s/MARKETING_VERSION = [^;]*;/MARKETING_VERSION = $NEW_VERSION;/g" "$PBXPROJ"
            echo "Updated project.pbxproj"
          fi

      - name: Configure Xcode project with Team ID
        run: |
          XCODE_PROJECT=$(find ios -maxdepth 1 -name "*.xcodeproj" -type d | head -1)
          echo "Found Xcode project: $XCODE_PROJECT"

          gem install xcodeproj

          ruby << RUBY
          require 'xcodeproj'
          project_path = '${XCODE_PROJECT}'
          project = Xcodeproj::Project.open(project_path)

          project.targets.each do |target|
            target.build_configurations.each do |config|
              config.build_settings['DEVELOPMENT_TEAM'] = '${{ env.DEVELOPMENT_TEAM }}'
            end
          end

          project.save
          puts "Development team configured for all targets"
          RUBY

      - name: Setup App Store Connect API
        run: |
          # iOS signing secrets are at repository level
          mkdir -p ~/private_keys
          echo "${{ secrets.APP_STORE_CONNECT_API_KEY_CONTENT }}" | base64 -d > ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8

          if [ -f ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8 ]; then
            echo "App Store Connect API key file created"
            echo "File size: $(wc -c < ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8) bytes"
          else
            echo "Failed to create API key file"
            exit 1
          fi

      - name: Setup iOS Distribution Certificate
        run: |
          # iOS signing secrets are at repository level
          KEYCHAIN_NAME="build.keychain"
          KEYCHAIN_PASSWORD="$(openssl rand -base64 32)"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_NAME"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"

          security list-keychains -d user -s "$KEYCHAIN_NAME" $(security list-keychains -d user | sed 's/\"//g')
          security default-keychain -s "$KEYCHAIN_NAME"

          echo "${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_P12_BASE64 }}" | base64 --decode > certificate.p12
          security import certificate.p12 -k "$KEYCHAIN_NAME" -P "${{ secrets.IOS_DISTRIBUTION_CERTIFICATE_PASSWORD }}" -T /usr/bin/codesign -T /usr/bin/security -T /usr/bin/xcodebuild
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"

          echo "Installed certificates:"
          security find-identity -v -p codesigning "$KEYCHAIN_NAME"

          echo "Distribution certificate installed"
          echo "KEYCHAIN_NAME=$KEYCHAIN_NAME" >> $GITHUB_ENV
          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV

      - name: Install Provisioning Profile
        run: |
          # Provisioning profile is environment-specific (test/qa/prod)
          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
          echo "${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}" | base64 --decode > profile.mobileprovision

          PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin <<< $(security cms -D -i profile.mobileprovision))
          cp profile.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/$PROFILE_UUID.mobileprovision

          echo "Provisioning profile installed: $PROFILE_UUID"
          echo "PROVISIONING_PROFILE_UUID=$PROFILE_UUID" >> $GITHUB_ENV

      - name: Archive iOS app
        working-directory: ./app/ios
        run: |
          WORKSPACE=$(find . -maxdepth 1 -name "*.xcworkspace" -type d | head -1 | xargs basename)
          SCHEME=$(basename "$WORKSPACE" .xcworkspace)

          echo "Using workspace: $WORKSPACE"
          echo "Using scheme: $SCHEME"

          xcodebuild -workspace "$WORKSPACE" \
            -scheme "$SCHEME" \
            -configuration Release \
            -derivedDataPath build/DerivedData \
            -archivePath "build/${SCHEME}.xcarchive" \
            -destination "generic/platform=iOS" \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY="Apple Distribution" \
            PROVISIONING_PROFILE_SPECIFIER="${{ vars.IOS_PROVISIONING_PROFILE_NAME }}" \
            DEVELOPMENT_TEAM="${{ env.DEVELOPMENT_TEAM }}" \
            archive

          echo "Archive created successfully"
          echo "SCHEME=$SCHEME" >> $GITHUB_ENV

      - name: Export IPA for App Store
        working-directory: ./app/ios
        run: |
          cat > ExportOptions.plist << EOF
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>destination</key>
            <string>export</string>
            <key>method</key>
            <string>app-store</string>
            <key>signingStyle</key>
            <string>manual</string>
            <key>teamID</key>
            <string>${{ env.DEVELOPMENT_TEAM }}</string>
            <key>signingCertificate</key>
            <string>Apple Distribution</string>
            <key>provisioningProfiles</key>
            <dict>
              <key>${{ vars.APP_BUNDLE_ID }}</key>
              <string>${{ vars.IOS_PROVISIONING_PROFILE_NAME }}</string>
            </dict>
            <key>uploadSymbols</key>
            <true/>
            <key>compileBitcode</key>
            <false/>
            <key>stripSwiftSymbols</key>
            <true/>
          </dict>
          </plist>
          EOF

          xcodebuild -exportArchive \
            -archivePath "build/${{ env.SCHEME }}.xcarchive" \
            -exportPath build/ipa \
            -exportOptionsPlist ExportOptions.plist

          echo "IPA exported successfully"
          ls -la build/ipa/

      - name: Record latest build before upload
        id: pre_upload
        env:
          API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          BUNDLE_ID: ${{ vars.APP_BUNDLE_ID }}
        run: |
          LATEST_BUILD_ID=$(node << 'SCRIPT'
          const crypto = require('crypto');
          const https = require('https');
          const fs = require('fs');

          const keyId = process.env.API_KEY_ID;
          const issuerId = process.env.ISSUER_ID;
          const keyPath = `${process.env.HOME}/private_keys/AuthKey_${keyId}.p8`;
          const bundleId = process.env.BUNDLE_ID;

          function base64url(buf) {
            return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
          }

          function generateJWT() {
            const key = fs.readFileSync(keyPath, 'utf8');
            const header = { alg: 'ES256', kid: keyId, typ: 'JWT' };
            const now = Math.floor(Date.now() / 1000);
            const payload = { iss: issuerId, iat: now, exp: now + 1200, aud: 'appstoreconnect-v1' };
            const h = base64url(Buffer.from(JSON.stringify(header)));
            const p = base64url(Buffer.from(JSON.stringify(payload)));
            const input = `${h}.${p}`;
            const sig = crypto.sign('SHA256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' });
            return `${input}.${base64url(sig)}`;
          }

          function apiGet(token, path) {
            return new Promise((resolve, reject) => {
              https.get({
                hostname: 'api.appstoreconnect.apple.com',
                path,
                headers: { Authorization: `Bearer ${token}` }
              }, res => {
                let data = '';
                res.on('data', c => data += c);
                res.on('end', () => {
                  if (res.statusCode !== 200) reject(new Error(`HTTP ${res.statusCode}`));
                  else resolve(JSON.parse(data));
                });
              }).on('error', reject);
            });
          }

          async function main() {
            const token = generateJWT();
            const apps = await apiGet(token, `/v1/apps?filter[bundleId]=${encodeURIComponent(bundleId)}`);
            if (!apps.data?.length) throw new Error('App not found');

            const appId = apps.data[0].id;
            const builds = await apiGet(token, `/v1/builds?filter[app]=${appId}&sort=-uploadedDate&limit=1`);
            if (builds.data?.length) {
              process.stdout.write(builds.data[0].id);
            }
          }

          main().catch(e => {
            process.stderr.write(`Error: ${e.message}\n`);
            process.exit(1);
          });
          SCRIPT
          ) || LATEST_BUILD_ID=""

          echo "latest_build_id=${LATEST_BUILD_ID}" >> $GITHUB_OUTPUT
          echo "Latest build before upload: ${LATEST_BUILD_ID:-none}"

      - name: Upload to TestFlight
        working-directory: ./app/ios
        env:
          API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
        run: |
          echo "Uploading to TestFlight..."

          IPA_PATH=$(find build/ipa -maxdepth 1 -type f -name "*.ipa" | head -1)
          if [[ -z "$IPA_PATH" ]]; then
            echo "No .ipa file found in build/ipa"
            ls -R build/ipa || true
            exit 1
          fi

          echo "Using IPA: $IPA_PATH"

          xcrun altool --upload-app \
            -f "$IPA_PATH" \
            -t ios \
            --apiKey ${API_KEY_ID} \
            --apiIssuer ${ISSUER_ID} \
            --private-key @file:~/private_keys/AuthKey_${API_KEY_ID}.p8 \
            --verbose

          echo "Successfully uploaded to TestFlight!"
          echo "The build will be available in TestFlight within 10-15 minutes"

      - name: Get TestFlight build URL
        id: build_url
        env:
          API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          APP_APPLE_ID: ${{ vars.APP_STORE_APP_ID }}
          BUNDLE_ID: ${{ vars.APP_BUNDLE_ID }}
          PRE_UPLOAD_BUILD_ID: ${{ steps.pre_upload.outputs.latest_build_id }}
        run: |
          FALLBACK_URL="https://appstoreconnect.apple.com/apps/${APP_APPLE_ID}/testflight/ios"

          BUILD_ID=$(node << 'SCRIPT'
          const crypto = require('crypto');
          const https = require('https');
          const fs = require('fs');

          const keyId = process.env.API_KEY_ID;
          const issuerId = process.env.ISSUER_ID;
          const keyPath = `${process.env.HOME}/private_keys/AuthKey_${keyId}.p8`;
          const bundleId = process.env.BUNDLE_ID;
          const preUploadBuildId = process.env.PRE_UPLOAD_BUILD_ID || '';

          function base64url(buf) {
            return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
          }

          function generateJWT() {
            const key = fs.readFileSync(keyPath, 'utf8');
            const header = { alg: 'ES256', kid: keyId, typ: 'JWT' };
            const now = Math.floor(Date.now() / 1000);
            const payload = { iss: issuerId, iat: now, exp: now + 1200, aud: 'appstoreconnect-v1' };
            const h = base64url(Buffer.from(JSON.stringify(header)));
            const p = base64url(Buffer.from(JSON.stringify(payload)));
            const input = `${h}.${p}`;
            const sig = crypto.sign('SHA256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' });
            return `${input}.${base64url(sig)}`;
          }

          function apiGet(token, path) {
            return new Promise((resolve, reject) => {
              https.get({
                hostname: 'api.appstoreconnect.apple.com',
                path,
                headers: { Authorization: `Bearer ${token}` }
              }, res => {
                let data = '';
                res.on('data', c => data += c);
                res.on('end', () => {
                  if (res.statusCode !== 200) reject(new Error(`HTTP ${res.statusCode}: ${data.substring(0, 300)}`));
                  else resolve(JSON.parse(data));
                });
              }).on('error', reject);
            });
          }

          const sleep = ms => new Promise(r => setTimeout(r, ms));

          async function main() {
            const token = generateJWT();

            process.stderr.write(`Looking up app: ${bundleId}\n`);
            const apps = await apiGet(token, `/v1/apps?filter[bundleId]=${encodeURIComponent(bundleId)}`);
            if (!apps.data?.length) throw new Error('App not found');

            const appId = apps.data[0].id;
            process.stderr.write(`App API ID: ${appId}\n`);
            process.stderr.write(`Pre-upload latest build: ${preUploadBuildId || 'none'}\n`);

            // Builds typically appear in the API ~2 min after altool upload.
            // Wait 90s before first check, then poll every 15s for up to 8 more attempts.
            process.stderr.write('Waiting 90s for Apple to register the build...\n');
            await sleep(90000);

            for (let i = 1; i <= 8; i++) {
              if (i > 1) await sleep(15000);
              process.stderr.write(`Attempt ${i}/8: checking for new build...\n`);

              const builds = await apiGet(token,
                `/v1/builds?filter[app]=${appId}&sort=-uploadedDate&limit=1&fields[builds]=version,processingState`
              );

              if (builds.data?.length) {
                const latest = builds.data[0];
                if (latest.id !== preUploadBuildId) {
                  process.stderr.write(`Found new build: ${latest.id} (version: ${latest.attributes?.version}, state: ${latest.attributes?.processingState})\n`);
                  process.stdout.write(latest.id);
                  return;
                }
                process.stderr.write(`Latest build ${latest.id} is still the pre-upload build, waiting...\n`);
              }
            }

            throw new Error('New build not found after polling');
          }

          main().catch(e => {
            process.stderr.write(`Error: ${e.message}\n`);
            process.exit(1);
          });
          SCRIPT
          ) || BUILD_ID=""

          if [ -n "$BUILD_ID" ]; then
            BUILD_URL="https://appstoreconnect.apple.com/apps/${APP_APPLE_ID}/testflight/ios/${BUILD_ID}"
            echo "Found TestFlight build: ${BUILD_ID}"
          else
            BUILD_URL="${FALLBACK_URL}"
            echo "Could not find build in App Store Connect API, using fallback URL"
          fi

          echo "url=${BUILD_URL}" >> $GITHUB_OUTPUT
          echo "TestFlight URL: ${BUILD_URL}"

      - name: Upload build artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ios-testflight-${{ steps.version.outputs.version }}-${{ steps.version.outputs.build }}
          path: |
            app/ios/build/ipa/*.ipa
            app/ios/build/${{ env.SCHEME }}.xcarchive/dSYMs/
          retention-days: 30

      - name: Create version bump PR
        if: success() && inputs.version_bump != 'none'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          BUILD="${{ steps.version.outputs.build }}"
          BRANCH_NAME="chore/version-bump-${VERSION}-build${BUILD}"

          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"

          # Always create version bump PR from main branch
          # This ensures the PR only contains version changes, even when deploying from a feature branch
          # Discard local changes (version was bumped for build) before switching to main
          git fetch origin main
          git checkout -f main
          git reset --hard origin/main

          # Apply version bump to main branch
          node -e "
            const fs = require('fs');
            let configContent = fs.readFileSync('app.config.js', 'utf8');
            configContent = configContent.replace(/version: ['\"][^'\"]+['\"]/, \"version: '$VERSION'\");
            configContent = configContent.replace(/buildNumber: ['\"][^'\"]+['\"]/, \"buildNumber: '$BUILD'\");
            fs.writeFileSync('app.config.js', configContent);
          "

          # Create a new branch for the version bump
          git checkout -b "$BRANCH_NAME"
          git add app.config.js
          git commit -m "chore: bump version to ${VERSION} build ${BUILD} [skip ci]"
          git push origin "$BRANCH_NAME"

          # Create PR using gh cli
          gh pr create \
            --title "chore: bump version to ${VERSION} build ${BUILD}" \
            --body "$(cat <<EOF
          ## Version Bump

          This PR was automatically created by the TestFlight deployment workflow.

          - **Version:** ${VERSION}
          - **Build Number:** ${BUILD}
          - **Environment:** ${{ inputs.environment }}

          ### Changes
          - Updated version/buildNumber in \`app/app.config.js\`

          This PR should be merged to keep the version numbers in sync with TestFlight.
          EOF
          )" \
            --base main \
            --head "$BRANCH_NAME"

          echo "PR created for version bump"

      - name: Create release tag
        if: success()
        run: |
          TAG="v${{ steps.version.outputs.version }}-build${{ steps.version.outputs.build }}-${{ inputs.environment }}"
          BUILD_COMMIT="${{ steps.build_commit.outputs.sha }}"

          # Check if tag already exists
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "::warning::Tag $TAG already exists, skipping tag creation"
          else
            # Create tag on the original build commit, not current HEAD
            git tag -a "$TAG" "$BUILD_COMMIT" -m "TestFlight release ${{ steps.version.outputs.version }}+${{ steps.version.outputs.build }} (${{ inputs.environment }})"
            git push origin "$TAG"
            echo "Created tag $TAG on commit $BUILD_COMMIT"
          fi

      - name: Clean up sensitive files
        if: always()
        run: |
          rm -rf ~/private_keys
          rm -f ios/ExportOptions.plist
          rm -f .env
          rm -f certificate.p12
          rm -f profile.mobileprovision
          if [ -n "$KEYCHAIN_NAME" ]; then
            security delete-keychain "$KEYCHAIN_NAME" || true
          fi

      - name: Summary
        if: success()
        run: |
          echo "## TestFlight Deployment Complete!" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Build Number:** ${{ steps.version.outputs.build }}" >> $GITHUB_STEP_SUMMARY
          echo "**Bundle ID:** ${{ vars.APP_BUNDLE_ID }}" >> $GITHUB_STEP_SUMMARY
          echo "**Environment:** ${{ inputs.environment }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Next Steps:" >> $GITHUB_STEP_SUMMARY
          echo "1. Wait 10-15 minutes for App Store Connect processing" >> $GITHUB_STEP_SUMMARY
          echo "2. Check TestFlight: [App Store Connect](${{ steps.build_url.outputs.url }})" >> $GITHUB_STEP_SUMMARY
          echo "3. Merge the version bump PR to sync build numbers" >> $GITHUB_STEP_SUMMARY
          echo "4. Add internal/external testers as needed" >> $GITHUB_STEP_SUMMARY