ios-build-and-test.yml

name: iOS Build and Appium Tests

# Permissions are scoped to individual jobs for least privilege
# See job definitions below for specific permission requirements

on:
  # Manual trigger only
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment'
        required: false
        type: choice
        options:
          - test
        default: 'test'
      build-mode:
        description: 'Build configuration'
        required: true
        type: choice
        options:
          - Debug
          - Release
        default: 'Release'
      platform-version:
        description: 'iOS platform version for simulator'
        required: false
        type: string
        default: '26.0'
      device-name:
        description: 'iOS simulator device name'
        required: false
        type: string
        default: 'iPhone 16'
      test-suite:
        description: 'Test suite to run'
        required: false
        type: choice
        options:
          - welcome
          - home
          - navigation
          - failing
          - all
        default: 'welcome'
      test-spec:
        description: 'Specific test file to run (overrides test-suite)'
        required: false
        type: string
        default: ''
      artifact-url:
        description: 'URL to pre-built app artifact (skips build if provided)'
        required: false
        type: string
        default: ''

  # Reusable workflow (called from other workflows)
  workflow_call:
    inputs:
      environment:
        description: 'Environment'
        required: false
        type: string
        default: 'test'
      build-mode:
        description: 'Build configuration'
        required: false
        type: string
        default: 'Release'
      platform-version:
        description: 'iOS platform version for simulator'
        required: false
        type: string
        default: '26.0'
      device-name:
        description: 'iOS simulator device name'
        required: false
        type: string
        default: 'iPhone 16'
      test-suite:
        description: 'Test suite to run'
        required: false
        type: string
        default: 'welcome'
      test-spec:
        description: 'Specific test file to run (overrides test-suite)'
        required: false
        type: string
        default: ''
      artifact-url:
        description: 'URL to pre-built app artifact (skips build if provided)'
        required: false
        type: string
        default: ''

env:
  BUILD_MODE: ${{ inputs.build-mode || github.event.inputs.build-mode || 'Release' }}
  PLATFORM_VERSION: ${{ inputs.platform-version || github.event.inputs.platform-version || '26.0' }}
  DEVICE_NAME: ${{ inputs.device-name || github.event.inputs.device-name || 'iPhone 16' }}
  DEFAULT_APPIUM_VERSION: '3.1.1'

jobs:
  build-ios:
    name: Build iOS App
    # Skip build if artifact-url is provided
    if: ${{ inputs.artifact-url == '' && github.event.inputs.artifact-url == '' }}
    runs-on: macos-26
    timeout-minutes: 45
    permissions:
      contents: write  # Required for creating releases
      actions: read    # Required for artifact operations

    defaults:
      run:
        working-directory: ./app
  
    outputs:
      app_path: ${{ steps.find-artifacts.outputs.app_path }}
      artifact_name: ${{ steps.artifact-url.outputs.artifact_name }}
      download_url: ${{ steps.artifact-url.outputs.download_url }}
      api_url: ${{ steps.artifact-url.outputs.api_url }}
      release_tag: ${{ steps.create-release.outputs.release_tag }}
      asset_url: ${{ steps.create-release.outputs.asset_url }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Read Appium version from package.json
        id: appium-version
        env:
          DEFAULT_APPIUM_VERSION: ${{ env.DEFAULT_APPIUM_VERSION }}
          GITHUB_WORKSPACE: ${{ github.workspace }}
        run: |
          echo "Reading Appium version from app/package.json"
          APP_VER=$(node -e "const p=require(process.env.GITHUB_WORKSPACE + '/app/package.json'); const v=(p.devDependencies&&p.devDependencies.appium)||(p.dependencies&&p.dependencies.appium)||process.env.DEFAULT_APPIUM_VERSION; console.log(String(v).replace(/^[^0-9]*/,''));")
          echo "appium_version=$APP_VER" >> $GITHUB_OUTPUT
          echo "Detected Appium version: $APP_VER"

      - name: Select Xcode version
        run: |
          echo "📋 Selecting default Xcode"
          sudo xcode-select -switch /Applications/Xcode.app/Contents/Developer
          xcodebuild -version

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20.x'

      - name: Cache node modules
        uses: actions/cache@v4
        id: npm-cache
        with:
          path: |
            app/node_modules
            ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json', '**/*-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Cache CocoaPods
        uses: actions/cache@v4
        id: pods-cache
        with:
          path: |
            app/ios/Pods
            ~/Library/Caches/CocoaPods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock', '**/*.lock') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Install dependencies
        run: npm ci

      - name: Run tests before build
        run: npm test

      - name: Create .env file
        run: |
          cat > .env <<EOF
          # Auth0 Configuration (Test Environment)
          AUTH0_DOMAIN=login-test.pyracloud.com
          AUTH0_CLIENT_ID=${{ secrets.AUTH0_CLIENT_ID_TEST }}
          AUTH0_AUDIENCE=https://api-test.pyracloud.com/
          AUTH0_SCOPE=openid profile email offline_access
          AUTH0_API_URL=https://api.s1.show/public/
          AUTH0_OTP_DIGITS=6
          AUTH0_SCHEME=com.softwareone.marketplaceMobile
          LOG_LEVEL=info
          TEMPORARY_AUTH0_TOKEN=
          EOF

      - name: Verify .env file
        run: |
          echo "🔍 Verifying .env file..."
          
          # Check file exists
          if [ ! -f ".env" ]; then
            echo "❌ ERROR: .env file not created"
            exit 1
          fi
          
          # Show .env structure (masking sensitive values)
          echo "📄 .env file contents (masked):"
          while IFS= read -r line || [ -n "$line" ]; do
            if [[ "$line" =~ ^[[:space:]]*# ]] || [[ -z "$line" ]]; then
              echo "$line"
            elif [[ "$line" =~ ^([A-Z_][A-Z0-9_]*)=(.*)$ ]]; then
              key="${BASH_REMATCH[1]}"
              value="${BASH_REMATCH[2]}"
              if [ -n "$value" ]; then
                echo "$key=***[${#value} chars]"
              else
                echo "$key=[EMPTY]"
              fi
            else
              echo "$line"
            fi
          done < .env
          
          # Verify required variables have values
          REQUIRED_VARS="AUTH0_DOMAIN AUTH0_CLIENT_ID AUTH0_SCHEME"
          MISSING_VARS=""
          
          for var in $REQUIRED_VARS; do
            value=$(grep "^$var=" .env | cut -d'=' -f2-)
            if [ -z "$value" ]; then
              MISSING_VARS="$MISSING_VARS $var"
              echo "❌ $var is empty or missing"
            else
              echo "✅ $var is set"
            fi
          done
          
          if [ -n "$MISSING_VARS" ]; then
            echo ""
            echo "❌ ERROR: Missing required environment variables:$MISSING_VARS"
            echo "Please ensure the AUTH0_CLIENT_ID_TEST secret is configured in GitHub repository settings."
            exit 1
          fi
          
          echo ""
          echo "✅ All required environment variables are set"

      - name: Get version info
        id: version
        working-directory: ./app
        run: |
          # Create a temporary script to read from app.config.js with proper environment
          cat > read_version.mjs << 'EOF'
          import config from './app.config.js';
          console.log(config.expo.version);
          EOF
          VERSION=$(node read_version.mjs)
          rm read_version.mjs
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "📱 Building version $VERSION"

      - name: Configure build environment
        working-directory: ./app
        run: |
          echo "🔧 Configuring build environment for ${{ env.BUILD_MODE }} mode..."
          
          if [ "${{ env.BUILD_MODE }}" = "Release" ]; then
            echo "🎯 Configuring for STANDALONE PRODUCTION app"
            # Create standalone app configuration
            echo "EAS_NO_VCS=1" >> .env
            echo "EXPO_NO_DOTENV=1" >> .env
          else
            echo "🛠️ Configuring for DEVELOPMENT app with Expo Dev Tools"
          fi

      - name: Expo prebuild (generate native iOS project)
        working-directory: ./app
        run: |
          echo "📦 Generating native iOS project with Expo..."
          
          if [ "${{ env.BUILD_MODE }}" = "Release" ]; then
            echo "🎯 Building standalone app (production-ready)"
            # Use production prebuild without dev client
            npx expo prebuild --platform ios --clean
          else
            echo "🛠️ Building development app (with dev tools)"  
            npx expo prebuild --platform ios --clean
          fi
          
          echo "✅ Native iOS project generated with CocoaPods installed"

      - name: Build iOS app for Simulator
        working-directory: ./app
        run: |
          echo "🔨 Building for iOS SIMULATOR in ${{ env.BUILD_MODE }} mode..."
          cd ios
          WORKSPACE=$(find . -maxdepth 1 -name "*.xcworkspace" -type d | head -1 | xargs basename)
          SCHEME=$(basename "$WORKSPACE" .xcworkspace)

          echo "Using workspace: $WORKSPACE"
          echo "Using scheme: $SCHEME"

          # Build for iOS Simulator (not generic device!)
          xcodebuild -workspace "$WORKSPACE" \
            -scheme "$SCHEME" \
            -configuration ${{ env.BUILD_MODE }} \
            -sdk iphonesimulator \
            -destination 'generic/platform=iOS Simulator' \
            -derivedDataPath build/DerivedData \
            CODE_SIGN_IDENTITY="" \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGNING_ALLOWED=NO \
            build

          echo "SCHEME=$SCHEME" >> $GITHUB_ENV
          echo "✅ Simulator build completed"

      - name: Find and prepare .app artifact
        id: find-artifacts
        working-directory: ./app
        run: |
          # The simulator build outputs to Debug-iphonesimulator or Release-iphonesimulator
          BUILD_DIR="ios/build/DerivedData/Build/Products/${{ env.BUILD_MODE }}-iphonesimulator"
          
          echo "Looking for .app in: $BUILD_DIR"
          ls -la "$BUILD_DIR" || true
          
          # Find the .app bundle
          APP_PATH=$(find "$BUILD_DIR" -name "*.app" -type d -maxdepth 1 | head -n 1)
          
          if [ -z "$APP_PATH" ]; then
            echo "❌ No .app found in expected location"
            echo "Searching entire build directory..."
            find ios/build -name "*.app" -type d
            exit 1
          fi
          
          APP_NAME=$(basename "$APP_PATH")
          echo "app_path=$APP_PATH" >> $GITHUB_OUTPUT
          echo "app_name=$APP_NAME" >> $GITHUB_OUTPUT
          echo "✅ Found app: $APP_PATH"
          
          # Verify it's a valid .app bundle
          if [ -f "$APP_PATH/Info.plist" ]; then
            BUNDLE_ID=$(/usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" "$APP_PATH/Info.plist")
            echo "Bundle ID: $BUNDLE_ID"
          fi

      - name: Package app for artifact upload
        if: steps.find-artifacts.outputs.app_path != ''
        id: package-app
        working-directory: ./app
        run: |
          BUILD_DIR="ios/build/DerivedData/Build/Products/${{ env.BUILD_MODE }}-iphonesimulator"
          cd "$BUILD_DIR"
          APP_DIR=$(basename "${{ steps.find-artifacts.outputs.app_path }}")
          
          echo "📦 Creating app bundle zip from: $APP_DIR"
          echo "📍 Current directory: $(pwd)"
          echo "📍 Full BUILD_DIR path: $(realpath .)"
          zip -r app_bundle.zip "$APP_DIR"
          
          echo "✅ App bundle created at: $(pwd)/app_bundle.zip"
          echo "zip_path=$BUILD_DIR/app_bundle.zip" >> $GITHUB_OUTPUT
          
          # Verify the zip file was created
          if [ -f app_bundle.zip ]; then
            echo "🎯 Zip file verified: $(ls -lh app_bundle.zip)"
            echo "🎯 Absolute path: $(realpath app_bundle.zip)"
          else
            echo "❌ ERROR: app_bundle.zip was not created"
            exit 1
          fi

      - name: Upload iOS Simulator app artifact
        if: steps.find-artifacts.outputs.app_path != ''
        id: upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: ios-app-${{ env.BUILD_MODE }}-${{ steps.version.outputs.version }}-build-${{ github.sha }}
          path: app/${{ steps.package-app.outputs.zip_path }}
          retention-days: 30
          if-no-files-found: error

      - name: Generate artifact download URL
        if: steps.find-artifacts.outputs.app_path != ''
        id: artifact-url
        run: |
          # Get the artifact ID from the upload
          ARTIFACT_NAME="ios-app-${{ env.BUILD_MODE }}-${{ steps.version.outputs.version }}-build-${{ github.sha }}"
          
          # Create download URL that can be used in other workflows
          DOWNLOAD_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts"
          
          # Also create a direct API URL for programmatic access
          API_URL="https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts"
          
          echo "artifact_name=$ARTIFACT_NAME" >> $GITHUB_OUTPUT
          echo "download_url=$DOWNLOAD_URL" >> $GITHUB_OUTPUT
          echo "api_url=$API_URL" >> $GITHUB_OUTPUT
          
          echo "## 📦 Artifact Information" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Artifact Name:** \`$ARTIFACT_NAME\`" >> $GITHUB_STEP_SUMMARY
          echo "**Download URL:** [$DOWNLOAD_URL]($DOWNLOAD_URL)" >> $GITHUB_STEP_SUMMARY
          echo "**API URL:** \`$API_URL\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 🔗 Use in Other Workflows:" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`yaml" >> $GITHUB_STEP_SUMMARY
          echo "- name: Download Build Artifact" >> $GITHUB_STEP_SUMMARY
          echo "  uses: actions/download-artifact@v4" >> $GITHUB_STEP_SUMMARY
          echo "  with:" >> $GITHUB_STEP_SUMMARY
          echo "    name: $ARTIFACT_NAME" >> $GITHUB_STEP_SUMMARY
          echo "    github-token: \${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_STEP_SUMMARY
          echo "    repository: ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
          echo "    run-id: ${{ github.run_id }}" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

      - name: Create downloadable release asset (for cross-workflow access)
        if: steps.find-artifacts.outputs.app_path != '' && github.event_name != 'pull_request'
        id: create-release
        working-directory: ./app
        run: |
          # Create a pre-release with the build artifact for easy download
          TAG_NAME="build-${{ env.BUILD_MODE }}-${{ github.sha }}-${{ github.run_number }}"
          RELEASE_NAME="iOS Build ${{ env.BUILD_MODE }} - ${{ steps.version.outputs.version }}"
          
          echo "🚀 Creating release: $RELEASE_NAME"
          echo "📁 Using zip file: ${{ steps.package-app.outputs.zip_path }}"
          
          # Verify the zip file exists before creating release
          if [ ! -f "${{ steps.package-app.outputs.zip_path }}" ]; then
            echo "❌ ERROR: Zip file not found at ${{ steps.package-app.outputs.zip_path }}"
            echo "🔍 Searching for app_bundle.zip files:"
            find . -name "app_bundle.zip" -type f 2>/dev/null || true
            exit 1
          fi
          
          # Create release
          gh release create "$TAG_NAME" \
            --title "$RELEASE_NAME" \
            --notes "Automated iOS build for commit ${{ github.sha }}" \
            --prerelease \
            "${{ steps.package-app.outputs.zip_path }}#iOS-App-${{ env.BUILD_MODE }}.zip"
          
          # Get the release asset download URL
          ASSET_URL=$(gh release view "$TAG_NAME" --json assets --jq '.assets[0].url')
          
          echo "release_tag=$TAG_NAME" >> $GITHUB_OUTPUT
          echo "asset_url=$ASSET_URL" >> $GITHUB_OUTPUT
          
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 🚀 Release Asset Created:" >> $GITHUB_STEP_SUMMARY
          echo "**Release Tag:** \`$TAG_NAME\`" >> $GITHUB_STEP_SUMMARY
          echo "**Asset URL:** [$ASSET_URL]($ASSET_URL)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📋 Copy-Paste for External Workflows:" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`yaml" >> $GITHUB_STEP_SUMMARY
          echo "download_url: \"$ASSET_URL\"" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### 📋 Copy-Paste for Local Testing:" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
          echo "./scripts/run-local-test.sh --platform ios --build-from-artifact $ASSET_URL welcome" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Build Summary
        if: always()
        run: |
          echo "## iOS Simulator Build Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Build Mode:** ${{ env.BUILD_MODE }}" >> $GITHUB_STEP_SUMMARY
          echo "**Target:** iOS Simulator" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** ${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ -n "${{ steps.find-artifacts.outputs.app_path }}" ]; then
            echo "✅ **Build Status:** Success" >> $GITHUB_STEP_SUMMARY
            echo "**App:** ${{ steps.find-artifacts.outputs.app_name }}" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ **Build Status:** Failed" >> $GITHUB_STEP_SUMMARY
          fi

  install-and-test-ios:
    name: Install and Test iOS App
    needs: build-ios
    # Always run, but handle skipped build job
    if: ${{ always() && (needs.build-ios.result == 'success' || needs.build-ios.result == 'skipped') }}
    runs-on: macos-26
    timeout-minutes: 60
    environment: ${{ inputs.environment || 'test' }}
    permissions:
      actions: read  # Required for downloading artifacts
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Read Appium version from package.json
        id: appium-version
        env:
          DEFAULT_APPIUM_VERSION: ${{ env.DEFAULT_APPIUM_VERSION }}
          GITHUB_WORKSPACE: ${{ github.workspace }}
        run: |
          echo "Reading Appium version from app/package.json"
          APP_VER=$(node -e "const p=require(process.env.GITHUB_WORKSPACE + '/app/package.json'); const v=(p.devDependencies&&p.devDependencies.appium)||(p.dependencies&&p.dependencies.appium)||process.env.DEFAULT_APPIUM_VERSION; console.log(String(v).replace(/^[^0-9]*/,''));")
          echo "appium_version=$APP_VER" >> $GITHUB_OUTPUT
          echo "Detected Appium version: $APP_VER"
        
      # Install phase using composite action template
      - name: Install iOS App
        id: install-ios
        uses: ./.github/actions/ios-install
        with:
          artifact_name: ${{ needs.build-ios.outputs.artifact_name || '' }}
          download_url: ${{ inputs.artifact-url || github.event.inputs.artifact-url || '' }}
          ios_version: ${{ inputs.platform-version || github.event.inputs.platform-version || '26.0' }}
          device_name: ${{ inputs.device-name || github.event.inputs.device-name || 'iPhone 16' }}
          
      # Test phase using composite action template  
      - name: Test iOS App
        uses: ./.github/actions/ios-test
        with:
          device_uuid: ${{ steps.install-ios.outputs.device_udid }}
          ios_version: ${{ inputs.platform-version || github.event.inputs.platform-version || '26.0' }}
          device_name: ${{ inputs.device-name || github.event.inputs.device-name || 'iPhone 16' }}
          node_version: '20'
          appium_version: ${{ steps.appium-version.outputs.appium_version }}
          app_bundle_id: ${{ steps.install-ios.outputs.bundle_id }}
          airtable_email: ${{ secrets.AIRTABLE_EMAIL }}
          airtable_api_token: ${{ secrets.AIRTABLE_API_TOKEN }}
          airtable_base_id: ${{ secrets.AIRTABLE_BASE_ID }}
          airtable_table_name: ${{ secrets.AIRTABLE_TABLE_NAME }}
          airtable_from_email: ${{ secrets.AIRTABLE_FROM_EMAIL }}
          # API configuration (optional - for API validation tests)
          api_base_url: ${{ vars.API_BASE_URL || '' }}
          api_ops_token: ${{ secrets.API_OPS_TOKEN || '' }}
          # Test selection
          test_suite: ${{ inputs.test-suite || github.event.inputs.test-suite || 'welcome' }}
          test_spec: ${{ inputs.test-spec || github.event.inputs.test-spec || '' }}
          # ReportPortal configuration (optional)
          report_portal_api_key: ${{ secrets.REPORT_PORTAL_API_KEY || '' }}
          report_portal_endpoint: ${{ vars.REPORT_PORTAL_ENDPOINT }}
          report_portal_project: ${{ vars.REPORT_PORTAL_PROJECT }}
          report_portal_launch_name: "iOS Appium Tests - ${{ inputs.build-mode || 'Release' }}"