Skip to content

Add TestFlight CI/CD workflow and update signing config#52

Merged
auerbachb merged 9 commits into
mainfrom
issue-51-testflight-workflow
Mar 30, 2026
Merged

Add TestFlight CI/CD workflow and update signing config#52
auerbachb merged 9 commits into
mainfrom
issue-51-testflight-workflow

Conversation

@auerbachb
Copy link
Copy Markdown
Owner

@auerbachb auerbachb commented Mar 30, 2026

Summary

  • Updates bundle ID to com.brettonauerbach.stillpoint and sets Team ID T5UU4BP6AV in ios/project.yml
  • Creates ios/ExportOptions.plist for App Store Connect distribution
  • Adds GitHub Actions workflow (.github/workflows/ios-testflight.yml) triggered by ios-v* tags that builds, archives, and uploads to TestFlight
  • Adds ios/RELEASING.md with setup instructions and release workflow documentation

Closes #51

Test plan

  • Bundle ID in ios/project.yml matches registered App ID (com.brettonauerbach.stillpoint)
  • Team ID in ios/project.yml matches Apple Developer account (T5UU4BP6AV)
  • ExportOptions.plist uses app-store-connect method with automatic signing
  • GitHub Actions workflow triggers only on ios-v* tags
  • Workflow installs certificate and provisioning profile from secrets
  • Workflow generates Xcode project via XcodeGen before building
  • Workflow uses xcodebuild -exportArchive with authentication flags for upload
  • Cleanup step removes keychain, certificate, provisioning profile, and API key
  • RELEASING.md documents all required GitHub secrets
  • RELEASING.md documents tag-based release workflow

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features

    • Automated iOS TestFlight build & upload pipeline triggered by release tags for faster distribution.
  • Documentation

    • Added comprehensive iOS release guide with versioning, tagging, TestFlight/App Store submission steps, required secrets, and troubleshooting.
  • Chores

    • Updated iOS app bundle identifier and signing team configuration.
  • New Config

    • Added export configuration for App Store Connect uploads (automatic signing, symbol upload).

auerbachb and others added 7 commits March 30, 2026 17:13
- Update bundle ID to com.brettonauerbach.stillpoint and set Team ID
- Create ExportOptions.plist for App Store distribution
- Add GitHub Actions workflow triggered by ios-v* tags
- Add RELEASING.md with setup and release instructions

Closes #51

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Update bundleIdPrefix to match new bundle ID
- Remove dead notarytool credentials step
- Add IPA path validation before upload
- Simplify upload step to use altool directly

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove API key file (~/.private_keys/) in cleanup step
- Scope provisioning profile cleanup to the specific file installed

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Use xcodebuild -exportArchive with auth flags for direct upload
- Remove separate Export IPA step (now combined with upload)
- Fix bundleIdPrefix to be a true prefix (com.brettonauerbach)
- Track provisioning profile install path explicitly

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Preserve existing keychains when adding temp keychain to search list
- Remove decoded .p12 certificate in cleanup step

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Team ID and signing style are already set in project.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel Bot commented Mar 30, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
still-point Ignored Ignored Preview Mar 30, 2026 10:01pm

Request Review

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 30, 2026

📝 Walkthrough

Walkthrough

Adds TestFlight release automation: a GitHub Actions workflow triggered by ios-v* tags that generates the Xcode project, installs signing assets (temp keychain, certificate, provisioning), archives and exports the app using App Store Connect API credentials, uploads to TestFlight, and cleans up.

Changes

Cohort / File(s) Summary
GitHub Actions Workflow
​.github/workflows/ios-testflight.yml
New workflow triggered on pushed tags ios-v*; runs on macOS, generates Xcode project, creates/unlocks a temporary keychain, installs decoded .p12 and provisioning profile, archives with xcodebuild, exports and uploads via App Store Connect API key, then always-runs cleanup.
iOS Export Configuration
ios/ExportOptions.plist
New export options file: method=app-store-connect, signingStyle=automatic, teamID=T5UU4BP6AV, uploadSymbols=true, destination=upload.
iOS Project Settings
ios/project.yml
Updated bundle identifiers and team: bundleIdPrefix to com.brettonauerbach, PRODUCT_BUNDLE_IDENTIFIER to com.brettonauerbach.stillpoint, and DEVELOPMENT_TEAM set to T5UU4BP6AV.
Release Documentation
ios/RELEASING.md
New RELEASING guide documenting required GitHub Actions secrets (base64 .p12, .mobileprovision, API key details), tag/version workflow (ios-v{MARKETING_VERSION}), release steps, versioning rules, and troubleshooting notes.

Sequence Diagram(s)

sequenceDiagram
    participant Contributor
    participant GitHubActions as GitHub Actions
    participant XcodeGen
    participant Keychain
    participant Xcode
    participant AppStoreConnect as App Store Connect

    Contributor->>GitHubActions: Push `ios-v*` tag
    GitHubActions->>XcodeGen: Run XcodeGen in `ios/`
    XcodeGen-->>GitHubActions: Project generated
    GitHubActions->>Keychain: Create & unlock temp keychain
    GitHubActions->>Keychain: Import decoded .p12 certificate
    GitHubActions->>GitHubActions: Install provisioning profile
    GitHubActions->>Xcode: xcodebuild archive (uses keychain & profiles)
    Xcode->>Keychain: Request signing key access
    Keychain-->>Xcode: Provide signing key
    Xcode-->>GitHubActions: Produce .xcarchive
    GitHubActions->>AppStoreConnect: xcodebuild -exportArchive + upload (API key)
    AppStoreConnect-->>GitHubActions: Confirm upload
    GitHubActions->>Keychain: Delete temp keychain & cleanup files
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 I nudged a tag and sprang with glee,

Xcode sprouted leaves for me to see,
Keys tucked safe in a tiny chest,
I sent the build on its skyward quest,
TestFlight hummed — carrot clouds, we’re free ✨🛫

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the main changes: adding a TestFlight CI/CD workflow and updating signing configuration.
Linked Issues check ✅ Passed The pull request implements the TestFlight distribution workflow required by issue #51, including CI/CD setup, signing configuration, and release documentation.
Out of Scope Changes check ✅ Passed All changes are directly related to establishing the TestFlight release workflow and signing configuration as specified in the linked issue.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

📋 Issue Planner

Built with CodeRabbit's Coding Plans for faster development and fewer bugs.

View plan used: #51

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch issue-51-testflight-workflow

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ios-testflight.yml:
- Around line 70-90: Add an explicit IPA existence/validation step after the
xcodebuild -exportArchive export (the exportPath $RUNNER_TEMP/export) that
verifies an .ipa was produced and is non-empty before attempting upload: check
for a single .ipa (e.g. glob $RUNNER_TEMP/export/*.ipa), confirm the file exists
and has size >0, log a clear error including the expected path if the check
fails, and exit non-zero to stop the job; place this check immediately after the
xcodebuild -exportArchive invocation so subsequent upload using the same
exportPath and authenticationKeyPath only runs when the IPA validation passes.
- Around line 21-22: The "Install XcodeGen" step repeatedly runs brew install
xcodegen which slows CI; modify the workflow by adding a Homebrew cache step
before the "Install XcodeGen" job (or replace the step with a cached-install
approach) so cached Homebrew bottles and Cellar/Cache paths are restored (e.g.,
cache paths under the runner Homebrew cache and Cellar) and only run brew
install xcodegen when the cache is missing or stale; update the job that
contains the "Install XcodeGen" step to restore the cache, run brew install
conditionally, and save the cache afterward.

In `@ios/project.yml`:
- Line 3: The committed Xcode project is out of sync with project.yml
(bundleIdPrefix: com.brettonauerbach); run xcodegen in the ios directory to
regenerate ios/StillPoint.xcodeproj/project.pbxproj so its bundle identifier and
other generated settings match project.yml, then stage and commit the updated
project.pbxproj (verify the old value com.stillpoint.app is replaced with
com.brettonauerbach).

In `@ios/RELEASING.md`:
- Around line 18-34: Add a blank line before and after each fenced code block in
the RELEASING.md snippet: ensure there is an empty line preceding and following
the ```yaml block that contains MARKETING_VERSION and CURRENT_PROJECT_VERSION,
and likewise add blank lines before and after each ```bash block that contains
the git add/commit and git tag/push commands so the fenced blocks are surrounded
by blank lines per MD031.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 514f1ee6-eced-4257-81b8-ffd91c2bf09f

📥 Commits

Reviewing files that changed from the base of the PR and between cd79296 and 6db8f8d.

📒 Files selected for processing (4)
  • .github/workflows/ios-testflight.yml
  • ios/ExportOptions.plist
  • ios/RELEASING.md
  • ios/project.yml

Comment on lines +21 to +22
- name: Install XcodeGen
run: brew install xcodegen
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Consider caching Homebrew packages for faster builds.

The brew install xcodegen step runs on every workflow execution. Caching can reduce build time.

📝 Optional: Add Homebrew caching
+      - name: Cache Homebrew
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/Library/Caches/Homebrew
+            /usr/local/Cellar/xcodegen
+          key: ${{ runner.os }}-brew-xcodegen-${{ hashFiles('.github/workflows/ios-testflight.yml') }}
+          restore-keys: |
+            ${{ runner.os }}-brew-xcodegen-
+
       - name: Install XcodeGen
-        run: brew install xcodegen
+        run: brew install xcodegen || true
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ios-testflight.yml around lines 21 - 22, The "Install
XcodeGen" step repeatedly runs brew install xcodegen which slows CI; modify the
workflow by adding a Homebrew cache step before the "Install XcodeGen" job (or
replace the step with a cached-install approach) so cached Homebrew bottles and
Cellar/Cache paths are restored (e.g., cache paths under the runner Homebrew
cache and Cellar) and only run brew install xcodegen when the cache is missing
or stale; update the job that contains the "Install XcodeGen" step to restore
the cache, run brew install conditionally, and save the cache afterward.

Comment on lines +70 to +90
- name: Upload to App Store Connect
env:
APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
APPSTORE_API_PRIVATE_KEY: ${{ secrets.APPSTORE_API_PRIVATE_KEY }}
run: |
# Write API key to file for authentication
mkdir -p ~/.private_keys
printf '%s\n' "$APPSTORE_API_PRIVATE_KEY" > ~/.private_keys/AuthKey_${APPSTORE_API_KEY_ID}.p8

# Export and upload in one step using xcodebuild
# The ExportOptions.plist has destination=upload and method=app-store-connect
# which makes xcodebuild upload directly to App Store Connect / TestFlight
xcodebuild -exportArchive \
-archivePath $RUNNER_TEMP/StillPoint.xcarchive \
-exportOptionsPlist ios/ExportOptions.plist \
-exportPath $RUNNER_TEMP/export \
-allowProvisioningUpdates \
-authenticationKeyPath ~/.private_keys/AuthKey_${APPSTORE_API_KEY_ID}.p8 \
-authenticationKeyID "$APPSTORE_API_KEY_ID" \
-authenticationKeyIssuerID "$APPSTORE_API_ISSUER_ID"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Consider adding explicit IPA validation before upload.

The PR objectives mention "IPA path validation" but there's no explicit check that the export produced a valid IPA. While xcodebuild -exportArchive will fail if the archive is invalid, adding an explicit check improves debuggability.

📝 Optional: Add IPA existence check
          xcodebuild -exportArchive \
            -archivePath $RUNNER_TEMP/StillPoint.xcarchive \
            -exportOptionsPlist ios/ExportOptions.plist \
            -exportPath $RUNNER_TEMP/export \
            -allowProvisioningUpdates \
            -authenticationKeyPath ~/.private_keys/AuthKey_${APPSTORE_API_KEY_ID}.p8 \
            -authenticationKeyID "$APPSTORE_API_KEY_ID" \
            -authenticationKeyIssuerID "$APPSTORE_API_ISSUER_ID"
+
+          # Verify export produced an IPA
+          if ! ls $RUNNER_TEMP/export/*.ipa 1>/dev/null 2>&1; then
+            echo "Error: No IPA file found in export directory"
+            exit 1
+          fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Upload to App Store Connect
env:
APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
APPSTORE_API_PRIVATE_KEY: ${{ secrets.APPSTORE_API_PRIVATE_KEY }}
run: |
# Write API key to file for authentication
mkdir -p ~/.private_keys
printf '%s\n' "$APPSTORE_API_PRIVATE_KEY" > ~/.private_keys/AuthKey_${APPSTORE_API_KEY_ID}.p8
# Export and upload in one step using xcodebuild
# The ExportOptions.plist has destination=upload and method=app-store-connect
# which makes xcodebuild upload directly to App Store Connect / TestFlight
xcodebuild -exportArchive \
-archivePath $RUNNER_TEMP/StillPoint.xcarchive \
-exportOptionsPlist ios/ExportOptions.plist \
-exportPath $RUNNER_TEMP/export \
-allowProvisioningUpdates \
-authenticationKeyPath ~/.private_keys/AuthKey_${APPSTORE_API_KEY_ID}.p8 \
-authenticationKeyID "$APPSTORE_API_KEY_ID" \
-authenticationKeyIssuerID "$APPSTORE_API_ISSUER_ID"
- name: Upload to App Store Connect
env:
APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
APPSTORE_API_PRIVATE_KEY: ${{ secrets.APPSTORE_API_PRIVATE_KEY }}
run: |
# Write API key to file for authentication
mkdir -p ~/.private_keys
printf '%s\n' "$APPSTORE_API_PRIVATE_KEY" > ~/.private_keys/AuthKey_${APPSTORE_API_KEY_ID}.p8
# Export and upload in one step using xcodebuild
# The ExportOptions.plist has destination=upload and method=app-store-connect
# which makes xcodebuild upload directly to App Store Connect / TestFlight
xcodebuild -exportArchive \
-archivePath $RUNNER_TEMP/StillPoint.xcarchive \
-exportOptionsPlist ios/ExportOptions.plist \
-exportPath $RUNNER_TEMP/export \
-allowProvisioningUpdates \
-authenticationKeyPath ~/.private_keys/AuthKey_${APPSTORE_API_KEY_ID}.p8 \
-authenticationKeyID "$APPSTORE_API_KEY_ID" \
-authenticationKeyIssuerID "$APPSTORE_API_ISSUER_ID"
# Verify export produced an IPA
if ! ls $RUNNER_TEMP/export/*.ipa 1>/dev/null 2>&1; then
echo "Error: No IPA file found in export directory"
exit 1
fi
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ios-testflight.yml around lines 70 - 90, Add an explicit
IPA existence/validation step after the xcodebuild -exportArchive export (the
exportPath $RUNNER_TEMP/export) that verifies an .ipa was produced and is
non-empty before attempting upload: check for a single .ipa (e.g. glob
$RUNNER_TEMP/export/*.ipa), confirm the file exists and has size >0, log a clear
error including the expected path if the check fails, and exit non-zero to stop
the job; place this check immediately after the xcodebuild -exportArchive
invocation so subsequent upload using the same exportPath and
authenticationKeyPath only runs when the IPA validation passes.

Comment thread ios/project.yml
name: StillPoint
options:
bundleIdPrefix: com.stillpoint
bundleIdPrefix: com.brettonauerbach
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Regenerate ios/StillPoint.xcodeproj/project.pbxproj to match these changes.

The relevant code snippet shows ios/StillPoint.xcodeproj/project.pbxproj still contains the old bundle ID com.stillpoint.app. While the CI workflow runs xcodegen generate before building (which will produce the correct values), the committed project.pbxproj is now out of sync with project.yml.

Run xcodegen generate locally in the ios directory and commit the updated project.pbxproj to keep the repository consistent for local development.

Also applies to: 33-33

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@ios/project.yml` at line 3, The committed Xcode project is out of sync with
project.yml (bundleIdPrefix: com.brettonauerbach); run xcodegen in the ios
directory to regenerate ios/StillPoint.xcodeproj/project.pbxproj so its bundle
identifier and other generated settings match project.yml, then stage and commit
the updated project.pbxproj (verify the old value com.stillpoint.app is replaced
with com.brettonauerbach).

Comment thread ios/RELEASING.md
Comment on lines +18 to +34
1. Update the version in `ios/project.yml`:
```yaml
MARKETING_VERSION: "1.1.0"
CURRENT_PROJECT_VERSION: 2
```

2. Commit the version bump:
```bash
git add ios/project.yml
git commit -m "Bump iOS version to 1.1.0 (build 2)"
```

3. Tag and push:
```bash
git tag ios-v1.1.0
git push origin main --tags
```
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Add blank lines around fenced code blocks.

Per markdown linting (MD031), fenced code blocks should be surrounded by blank lines for better rendering compatibility.

📝 Proposed fix
 1. Update the version in `ios/project.yml`:
+
    ```yaml
    MARKETING_VERSION: "1.1.0"
    CURRENT_PROJECT_VERSION: 2
    ```
+
 2. Commit the version bump:
+
    ```bash
    git add ios/project.yml
    git commit -m "Bump iOS version to 1.1.0 (build 2)"
    ```
+
 3. Tag and push:
+
    ```bash
    git tag ios-v1.1.0
    git push origin main --tags
    ```
🧰 Tools
🪛 markdownlint-cli2 (0.22.0)

[warning] 19-19: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 25-25: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 31-31: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@ios/RELEASING.md` around lines 18 - 34, Add a blank line before and after
each fenced code block in the RELEASING.md snippet: ensure there is an empty
line preceding and following the ```yaml block that contains MARKETING_VERSION
and CURRENT_PROJECT_VERSION, and likewise add blank lines before and after each
```bash block that contains the git add/commit and git tag/push commands so the
fenced blocks are surrounded by blank lines per MD031.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ios/RELEASING.md`:
- Line 10: Update the RELEASING.md entry for P12_PASSWORD to stop instructing
users to store the secret in the project root `.env`; instead state that
P12_PASSWORD should be kept in a secure credential store (e.g., Keychain,
password manager) and, if a local file is absolutely required, explicitly
require that file to be gitignored and never checked into source control
(mention to add it to .gitignore). Reference the P12_PASSWORD variable name in
the note and remove the current text that normalizes storing it in the project
root `.env`.
- Around line 32-33: The docs currently show using "git push origin main --tags"
which can publish unintended local tags; replace that command with a scoped tag
push for the specific release (after running "git tag ios-v1.1.0") by using "git
push origin ios-v1.1.0" (or "git push origin refs/tags/ios-v1.1.0") instead of
"git push origin main --tags" so only the ios-v1.1.0 tag is published.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6e13494e-38e8-486f-b5ca-c1a1511fbc17

📥 Commits

Reviewing files that changed from the base of the PR and between 6db8f8d and 0ff22d5.

📒 Files selected for processing (1)
  • ios/RELEASING.md

Comment thread ios/RELEASING.md Outdated
| Secret | Description | How to get it |
|--------|-------------|---------------|
| `BUILD_CERTIFICATE_BASE64` | Base64-encoded `.p12` distribution certificate | Export from Keychain Access, then `base64 -i cert.p12 \| pbcopy` |
| `P12_PASSWORD` | Password used when exporting the `.p12` | Stored in the project root `.env` file as `P12_PASSWORD` |
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid documenting secret storage in project root .env.

Stating that P12_PASSWORD is kept in a project-root .env normalizes a pattern that can lead to accidental secret commits. Prefer documenting secure local storage (e.g., password manager/Keychain) and, if a file is used, explicitly require it to be gitignored.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@ios/RELEASING.md` at line 10, Update the RELEASING.md entry for P12_PASSWORD
to stop instructing users to store the secret in the project root `.env`;
instead state that P12_PASSWORD should be kept in a secure credential store
(e.g., Keychain, password manager) and, if a local file is absolutely required,
explicitly require that file to be gitignored and never checked into source
control (mention to add it to .gitignore). Reference the P12_PASSWORD variable
name in the note and remove the current text that normalizes storing it in the
project root `.env`.

Comment thread ios/RELEASING.md Outdated
- Remove P12_PASSWORD .env storage reference from RELEASING.md
- Push specific tag instead of --tags to avoid unintended publishes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@auerbachb
Copy link
Copy Markdown
Owner Author

@coderabbitai Fixed in 2ae9cc5:

  • Removed .env reference from RELEASING.md — P12_PASSWORD description now says 'The password you set during .p12 export'
  • Changed git push origin main --tags to git push origin ios-v1.1.0 to scope the push to the specific release tag
  • xcodeproj finding is not applicable — the project is generated by XcodeGen at build time and is gitignored
  • Remaining nitpicks (brew caching, IPA validation, markdown formatting) acknowledged — not critical for this infrequent workflow

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 30, 2026

Tip

For best results, initiate chat on the files or code changes.

@auerbachb Thanks for the summary! All noted:

  • P12_PASSWORD clarification — Good fix; removing the .env reference avoids confusion about where the password lives.
  • Scoped tag push — Agreed, git push origin ios-v1.1.0 is safer than pushing all tags.
  • XcodeGen-generated .xcodeproj — Understood, appreciate the clarification. Flagging a missing .xcodeproj doesn't apply here since it's generated at build time and intentionally gitignored.
  • Remaining nitpicks — Reasonable call for an infrequent release workflow.

✏️ Learnings added
Learnt from: auerbachb
URL: https://github.com/auerbachb/still-point/pull/52

Timestamp: 2026-03-30T22:01:37.842Z
Learning: In the repository auerbachb/still-point, the iOS `.xcodeproj` file is generated at build time by XcodeGen (from `ios/project.yml`) and is gitignored. Flagging a missing `.xcodeproj` in code review is not applicable for this project.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (2)
ios/RELEASING.md (2)

19-34: 🧹 Nitpick | 🔵 Trivial

Markdown linting: Add blank lines around fenced code blocks.

Per MD031, fenced code blocks should be surrounded by blank lines. This was already flagged in a previous review.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@ios/RELEASING.md` around lines 19 - 34, Add blank lines before and after the
fenced YAML code block that contains MARKETING_VERSION and
CURRENT_PROJECT_VERSION so the block is separated from surrounding text per
MD031; specifically, ensure there is an empty line immediately above the opening
```yaml and an empty line immediately below the closing ``` to fix the linting
error for the MARKETING_VERSION/CURRENT_PROJECT_VERSION block.

18-22: ⚠️ Potential issue | 🟡 Minor

Clarify the nested path to version fields in project.yml.

The instruction "Update the version in ios/project.yml" and the example YAML snippet don't show that MARKETING_VERSION and CURRENT_PROJECT_VERSION are nested under targets.StillPoint.settings.base (not at the root level). Users unfamiliar with the project structure might be confused about where to update these values.

📝 Suggested clarification
-1. Update the version in `ios/project.yml`:
+1. Update the version in `ios/project.yml` under `targets.StillPoint.settings.base`:
    ```yaml
+   targets:
+     StillPoint:
+       settings:
+         base:
-   MARKETING_VERSION: "1.1.0"
-   CURRENT_PROJECT_VERSION: 2
+           MARKETING_VERSION: "1.1.0"
+           CURRENT_PROJECT_VERSION: 2
    ```

Alternatively, keep the simplified example but add a note:

 1. Update the version in `ios/project.yml`:
    ```yaml
    MARKETING_VERSION: "1.1.0"
    CURRENT_PROJECT_VERSION: 2
    ```
+   _(These are located under `targets.StillPoint.settings.base` in the YAML structure)_

Based on learnings: The snippet from ios/project.yml:13-45 shows that MARKETING_VERSION and CURRENT_PROJECT_VERSION are nested under targets.StillPoint.settings.base (lines 34-35), not at the top level of the file.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@ios/RELEASING.md` around lines 18 - 22, The doc currently shows
MARKETING_VERSION and CURRENT_PROJECT_VERSION at top-level; update the
instruction/snippet to show they live under the nested path
targets.StillPoint.settings.base (i.e., place MARKETING_VERSION and
CURRENT_PROJECT_VERSION inside targets -> StillPoint -> settings -> base) or add
a short parenthetical note saying "_These fields are located under
targets.StillPoint.settings.base in project.yml_" so readers know exactly where
to change them.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@ios/RELEASING.md`:
- Around line 19-34: Add blank lines before and after the fenced YAML code block
that contains MARKETING_VERSION and CURRENT_PROJECT_VERSION so the block is
separated from surrounding text per MD031; specifically, ensure there is an
empty line immediately above the opening ```yaml and an empty line immediately
below the closing ``` to fix the linting error for the
MARKETING_VERSION/CURRENT_PROJECT_VERSION block.
- Around line 18-22: The doc currently shows MARKETING_VERSION and
CURRENT_PROJECT_VERSION at top-level; update the instruction/snippet to show
they live under the nested path targets.StillPoint.settings.base (i.e., place
MARKETING_VERSION and CURRENT_PROJECT_VERSION inside targets -> StillPoint ->
settings -> base) or add a short parenthetical note saying "_These fields are
located under targets.StillPoint.settings.base in project.yml_" so readers know
exactly where to change them.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0aa39953-441c-4ffa-8145-1ef043ec7de0

📥 Commits

Reviewing files that changed from the base of the PR and between 0ff22d5 and 2ae9cc5.

📒 Files selected for processing (1)
  • ios/RELEASING.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Put app on iPhone via TestFlight

1 participant