fix: update App Store Connect links to point to exact build

.github/workflows/ios-testflight.yml

@@ -38,7 +38,7 @@ jobs:
     # Repository-level secrets: distribution certificate, App Store Connect API keys
     environment:
       name: ${{ inputs.environment }}
-      url: https://appstoreconnect.apple.com
+      url: ${{ steps.build_url.outputs.url || format('https://appstoreconnect.apple.com/apps/{0}/testflight/ios', vars.APP_STORE_APP_ID) }}
 
     defaults:
       run:
@@ -370,6 +370,78 @@ jobs:
           echo "IPA exported successfully"
           ls -la build/ipa/
 
+      - name: Record latest build before upload
+        id: pre_upload
+        env:
+          API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+          ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+          BUNDLE_ID: ${{ vars.APP_BUNDLE_ID }}
+        run: |
+          LATEST_BUILD_ID=$(node << 'SCRIPT'
+          const crypto = require('crypto');
+          const https = require('https');
+          const fs = require('fs');
+
+          const keyId = process.env.API_KEY_ID;
+          const issuerId = process.env.ISSUER_ID;
+          const keyPath = `${process.env.HOME}/private_keys/AuthKey_${keyId}.p8`;
+          const bundleId = process.env.BUNDLE_ID;
+
+          function base64url(buf) {
+            return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+          }
+
+          function generateJWT() {
+            const key = fs.readFileSync(keyPath, 'utf8');
+            const header = { alg: 'ES256', kid: keyId, typ: 'JWT' };
+            const now = Math.floor(Date.now() / 1000);
+            const payload = { iss: issuerId, iat: now, exp: now + 1200, aud: 'appstoreconnect-v1' };
+            const h = base64url(Buffer.from(JSON.stringify(header)));
+            const p = base64url(Buffer.from(JSON.stringify(payload)));
+            const input = `${h}.${p}`;
+            const sig = crypto.sign('SHA256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' });
+            return `${input}.${base64url(sig)}`;
+          }
+
+          function apiGet(token, path) {
+            return new Promise((resolve, reject) => {
+              https.get({
+                hostname: 'api.appstoreconnect.apple.com',
+                path,
+                headers: { Authorization: `Bearer ${token}` }
+              }, res => {
+                let data = '';
+                res.on('data', c => data += c);
+                res.on('end', () => {
+                  if (res.statusCode !== 200) reject(new Error(`HTTP ${res.statusCode}`));
+                  else resolve(JSON.parse(data));
+                });
+              }).on('error', reject);
+            });
+          }
+
+          async function main() {
+            const token = generateJWT();
+            const apps = await apiGet(token, `/v1/apps?filter[bundleId]=${encodeURIComponent(bundleId)}`);
+            if (!apps.data?.length) throw new Error('App not found');
+
+            const appId = apps.data[0].id;
+            const builds = await apiGet(token, `/v1/builds?filter[app]=${appId}&sort=-uploadedDate&limit=1`);
+            if (builds.data?.length) {
+              process.stdout.write(builds.data[0].id);
+            }
+          }
+
+          main().catch(e => {
+            process.stderr.write(`Error: ${e.message}\n`);
+            process.exit(1);
+          });
+          SCRIPT
+          ) || LATEST_BUILD_ID=""
+
+          echo "latest_build_id=${LATEST_BUILD_ID}" >> $GITHUB_OUTPUT
+          echo "Latest build before upload: ${LATEST_BUILD_ID:-none}"
+
       - name: Upload to TestFlight
         working-directory: ./app/ios
         env:
@@ -398,6 +470,119 @@ jobs:
           echo "Successfully uploaded to TestFlight!"
           echo "The build will be available in TestFlight within 10-15 minutes"
 
+      - name: Get TestFlight build URL
+        id: build_url
+        env:
+          API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+          ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+          APP_APPLE_ID: ${{ vars.APP_STORE_APP_ID }}
+          BUNDLE_ID: ${{ vars.APP_BUNDLE_ID }}
+          PRE_UPLOAD_BUILD_ID: ${{ steps.pre_upload.outputs.latest_build_id }}
+        run: |
+          FALLBACK_URL="https://appstoreconnect.apple.com/apps/${APP_APPLE_ID}/testflight/ios"
+
+          BUILD_ID=$(node << 'SCRIPT'
+          const crypto = require('crypto');
+          const https = require('https');
+          const fs = require('fs');
+
+          const keyId = process.env.API_KEY_ID;
+          const issuerId = process.env.ISSUER_ID;
+          const keyPath = `${process.env.HOME}/private_keys/AuthKey_${keyId}.p8`;
+          const bundleId = process.env.BUNDLE_ID;
+          const preUploadBuildId = process.env.PRE_UPLOAD_BUILD_ID || '';
+
+          function base64url(buf) {
+            return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+          }
+
+          function generateJWT() {
+            const key = fs.readFileSync(keyPath, 'utf8');
+            const header = { alg: 'ES256', kid: keyId, typ: 'JWT' };
+            const now = Math.floor(Date.now() / 1000);
+            const payload = { iss: issuerId, iat: now, exp: now + 1200, aud: 'appstoreconnect-v1' };
+            const h = base64url(Buffer.from(JSON.stringify(header)));
+            const p = base64url(Buffer.from(JSON.stringify(payload)));
+            const input = `${h}.${p}`;
+            const sig = crypto.sign('SHA256', Buffer.from(input), { key, dsaEncoding: 'ieee-p1363' });
+            return `${input}.${base64url(sig)}`;
+          }
+
+          function apiGet(token, path) {
+            return new Promise((resolve, reject) => {
+              https.get({
+                hostname: 'api.appstoreconnect.apple.com',
+                path,
+                headers: { Authorization: `Bearer ${token}` }
+              }, res => {
+                let data = '';
+                res.on('data', c => data += c);
+                res.on('end', () => {
+                  if (res.statusCode !== 200) reject(new Error(`HTTP ${res.statusCode}: ${data.substring(0, 300)}`));
+                  else resolve(JSON.parse(data));
+                });
+              }).on('error', reject);
+            });
+          }
+
+          const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+          async function main() {
+            const token = generateJWT();
+
+            process.stderr.write(`Looking up app: ${bundleId}\n`);
+            const apps = await apiGet(token, `/v1/apps?filter[bundleId]=${encodeURIComponent(bundleId)}`);
+            if (!apps.data?.length) throw new Error('App not found');
+
+            const appId = apps.data[0].id;
+            process.stderr.write(`App API ID: ${appId}\n`);
+            process.stderr.write(`Pre-upload latest build: ${preUploadBuildId || 'none'}\n`);
+
+            // Builds typically appear in the API ~2 min after altool upload.
+            // Wait 90s before first check, then poll every 15s for up to 8 more attempts.
+            process.stderr.write('Waiting 90s for Apple to register the build...\n');
+            await sleep(90000);
+
+            for (let i = 1; i <= 8; i++) {
+              if (i > 1) await sleep(15000);
+              process.stderr.write(`Attempt ${i}/8: checking for new build...\n`);
+
+              const builds = await apiGet(token,
+                `/v1/builds?filter[app]=${appId}&sort=-uploadedDate&limit=1&fields[builds]=version,processingState`
+              );
+
+              if (builds.data?.length) {
+                const latest = builds.data[0];
+                if (latest.id !== preUploadBuildId) {
+                  process.stderr.write(`Found new build: ${latest.id} (version: ${latest.attributes?.version}, state: ${latest.attributes?.processingState})\n`);
+                  process.stdout.write(latest.id);
+                  return;
+                }
+                process.stderr.write(`Latest build ${latest.id} is still the pre-upload build, waiting...\n`);
+              }
+            }
+
+            throw new Error('New build not found after polling');
+          }
+
+          main().catch(e => {
+            process.stderr.write(`Error: ${e.message}\n`);
+            process.exit(1);
+          });
+          SCRIPT
+          ) || BUILD_ID=""
+
+          if [ -n "$BUILD_ID" ]; then
+            BUILD_URL="https://appstoreconnect.apple.com/apps/${APP_APPLE_ID}/testflight/ios/${BUILD_ID}"
+            echo "Found TestFlight build: ${BUILD_ID}"
+          else
+            BUILD_URL="${FALLBACK_URL}"
+            echo "Could not find build in App Store Connect API, using fallback URL"
+          fi
+
+          echo "url=${BUILD_URL}" >> $GITHUB_OUTPUT
+          echo "TestFlight URL: ${BUILD_URL}"
+
       - name: Upload build artifacts
         if: always()
         uses: actions/upload-artifact@v4
@@ -505,6 +690,6 @@ jobs:
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### Next Steps:" >> $GITHUB_STEP_SUMMARY
           echo "1. Wait 10-15 minutes for App Store Connect processing" >> $GITHUB_STEP_SUMMARY
-          echo "2. Check TestFlight: [App Store Connect](https://appstoreconnect.apple.com/apps/${{ vars.APP_STORE_APP_ID }}/testflight/ios)" >> $GITHUB_STEP_SUMMARY
+          echo "2. Check TestFlight: [App Store Connect](${{ steps.build_url.outputs.url }})" >> $GITHUB_STEP_SUMMARY
           echo "3. Merge the version bump PR to sync build numbers" >> $GITHUB_STEP_SUMMARY
           echo "4. Add internal/external testers as needed" >> $GITHUB_STEP_SUMMARY