Use existing APPLE_ID credentials for TestFlight upload

Reuse the same credentials already used for Mac notarization instead
of requiring a separate App Store Connect API key.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/ios_testflight.yml

@@ -0,0 +1,196 @@
+name: iOS TestFlight
+
+on:
+  workflow_dispatch:
+    inputs:
+      skip_upload:
+        description: 'Skip TestFlight upload (build and archive only)'
+        required: false
+        default: 'false'
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  build-unity:
+    runs-on: [self-hosted, macOS, unity-mac]
+    outputs:
+      xcode_project_path: ${{ steps.build.outputs.xcode_project_path }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          lfs: true
+          clean: true
+          fetch-depth: 0
+
+      - name: Pull LFS files
+        run: git lfs pull
+
+      - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: ios
+        run: ./ci/github_actions/restore_library.sh
+
+      - name: Build iOS Unity Project
+        id: build
+        run: |
+          ./ci/github_actions/build_unity_ios.sh "/tmp/eagle0/eagle0iOS"
+          echo "xcode_project_path=/tmp/eagle0/eagle0iOS" >> $GITHUB_OUTPUT
+
+      - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: ios
+        run: ./ci/github_actions/persist_library.sh
+
+      - name: Upload Addressables to CDN
+        if: success()
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh iOS
+
+      - name: Zip Xcode project for artifact
+        run: |
+          cd /tmp/eagle0
+          # Use tar for speed - Xcode projects have many small files
+          tar -czf eagle0iOS.tar.gz eagle0iOS
+
+      - name: Upload Xcode project
+        uses: actions/upload-artifact@v4
+        with:
+          name: xcode-project-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0iOS.tar.gz
+          retention-days: 1
+
+      - name: Archive Build Log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: editor_ios.log
+          path: /tmp/eagle0/editor_ios.log
+          retention-days: 5
+
+  archive-and-upload:
+    needs: build-unity
+    runs-on: [self-hosted, macOS, unity-mac]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            ci
+            scripts
+
+      - name: Clean download directory
+        run: rm -rf /tmp/eagle0/eagle0iOS
+
+      - name: Download Xcode project
+        uses: actions/download-artifact@v4
+        with:
+          name: xcode-project-${{ github.run_id }}
+          path: /tmp/eagle0
+
+      - name: Extract Xcode project
+        run: |
+          cd /tmp/eagle0
+          tar -xzf eagle0iOS.tar.gz
+          rm eagle0iOS.tar.gz
+          ls -la eagle0iOS/
+
+      - name: Install Signing Certificate
+        env:
+          IOS_CERTIFICATE: ${{ secrets.IOS_CERTIFICATE }}
+          IOS_CERTIFICATE_PWD: ${{ secrets.IOS_CERTIFICATE_PWD }}
+        run: |
+          # Generate random keychain password
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          echo "KEYCHAIN_PASSWORD=$KEYCHAIN_PASSWORD" >> $GITHUB_ENV
+
+          # Decode certificate
+          echo "$IOS_CERTIFICATE" | base64 --decode > certificate.p12
+
+          # Delete any existing keychain from previous runs
+          security delete-keychain ios-build.keychain 2>/dev/null || true
+
+          # Create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" ios-build.keychain
+          security default-keychain -s ios-build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" ios-build.keychain
+          security set-keychain-settings -t 3600 -u ios-build.keychain
+
+          # Import certificate
+          security import certificate.p12 -k ios-build.keychain -P "$IOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" ios-build.keychain
+
+          # Add keychain to search list
+          security list-keychains -d user -s ios-build.keychain login.keychain
+
+          rm certificate.p12
+
+      - name: Install Provisioning Profile
+        env:
+          IOS_PROVISIONING_PROFILE: ${{ secrets.IOS_PROVISIONING_PROFILE }}
+        run: |
+          # Decode provisioning profile
+          echo "$IOS_PROVISIONING_PROFILE" | base64 --decode > profile.mobileprovision
+
+          # Extract UUID from provisioning profile
+          PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin <<< $(security cms -D -i profile.mobileprovision))
+          echo "PROFILE_UUID=$PROFILE_UUID" >> $GITHUB_ENV
+
+          # Install to standard location
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp profile.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/$PROFILE_UUID.mobileprovision
+
+          rm profile.mobileprovision
+          echo "Installed provisioning profile: $PROFILE_UUID"
+
+      - name: Archive and Export IPA
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          chmod +x ./ci/github_actions/archive_ios.sh
+          ./ci/github_actions/archive_ios.sh "/tmp/eagle0/eagle0iOS" "/tmp/eagle0/archive" "$APPLE_TEAM_ID" "$PROFILE_UUID"
+
+      - name: Upload to TestFlight
+        if: ${{ github.event.inputs.skip_upload != 'true' }}
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
+        run: |
+          chmod +x ./ci/github_actions/upload_testflight.sh
+          ./ci/github_actions/upload_testflight.sh "/tmp/eagle0/archive/eagle0.ipa"
+
+      - name: Upload IPA artifact
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: eagle0-ios-${{ github.run_id }}
+          path: /tmp/eagle0/archive/eagle0.ipa
+          retention-days: 7
+
+      - name: Cleanup Keychain
+        if: always()
+        run: |
+          security delete-keychain ios-build.keychain 2>/dev/null || true
+
+  cleanup:
+    needs: [build-unity, archive-and-upload]
+    if: always()
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Delete intermediate artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          artifact_name="xcode-project-${{ github.run_id }}"
+          echo "Deleting artifact: $artifact_name"
+          artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+            -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+          if [ -n "$artifact_id" ]; then
+            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+          fi

ci/github_actions/archive_ios.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+# Archive and export iOS app for App Store / TestFlight
+
+set -euxo pipefail
+
+XCODE_PROJECT_PATH=${1:?Usage: archive_ios.sh <xcode_project_path> <output_path> <team_id> <profile_uuid>}
+OUTPUT_PATH=${2:?Missing output path}
+TEAM_ID=${3:?Missing team ID}
+PROFILE_UUID=${4:?Missing provisioning profile UUID}
+
+ARCHIVE_PATH="$OUTPUT_PATH/eagle0.xcarchive"
+EXPORT_PATH="$OUTPUT_PATH"
+
+echo "Archiving iOS app..."
+echo "  Xcode project: $XCODE_PROJECT_PATH"
+echo "  Archive path: $ARCHIVE_PATH"
+echo "  Team ID: $TEAM_ID"
+
+mkdir -p "$OUTPUT_PATH"
+
+# Find the .xcodeproj file
+XCODEPROJ=$(find "$XCODE_PROJECT_PATH" -name "*.xcodeproj" -maxdepth 1 | head -1)
+if [ -z "$XCODEPROJ" ]; then
+    echo "Error: No .xcodeproj found in $XCODE_PROJECT_PATH"
+    exit 1
+fi
+
+echo "Found Xcode project: $XCODEPROJ"
+
+# Get the scheme name (usually matches the project name)
+SCHEME=$(xcodebuild -list -project "$XCODEPROJ" 2>/dev/null | awk '/Schemes:/{getline; print; exit}' | xargs)
+if [ -z "$SCHEME" ]; then
+    # Fallback: use Unity-iPhone which is the default Unity generates
+    SCHEME="Unity-iPhone"
+fi
+echo "Using scheme: $SCHEME"
+
+# Archive
+xcodebuild archive \
+    -project "$XCODEPROJ" \
+    -scheme "$SCHEME" \
+    -archivePath "$ARCHIVE_PATH" \
+    -destination "generic/platform=iOS" \
+    -allowProvisioningUpdates \
+    CODE_SIGN_STYLE=Manual \
+    DEVELOPMENT_TEAM="$TEAM_ID" \
+    PROVISIONING_PROFILE_SPECIFIER="$PROFILE_UUID" \
+    | xcpretty || xcodebuild archive \
+    -project "$XCODEPROJ" \
+    -scheme "$SCHEME" \
+    -archivePath "$ARCHIVE_PATH" \
+    -destination "generic/platform=iOS" \
+    -allowProvisioningUpdates \
+    CODE_SIGN_STYLE=Manual \
+    DEVELOPMENT_TEAM="$TEAM_ID" \
+    PROVISIONING_PROFILE_SPECIFIER="$PROFILE_UUID"
+
+echo "Archive complete: $ARCHIVE_PATH"
+
+# Create export options plist
+EXPORT_OPTIONS_PLIST="$OUTPUT_PATH/ExportOptions.plist"
+cat > "$EXPORT_OPTIONS_PLIST" << EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>method</key>
+    <string>app-store-connect</string>
+    <key>teamID</key>
+    <string>$TEAM_ID</string>
+    <key>uploadSymbols</key>
+    <true/>
+    <key>signingStyle</key>
+    <string>manual</string>
+    <key>provisioningProfiles</key>
+    <dict>
+        <key>\$(PRODUCT_BUNDLE_IDENTIFIER)</key>
+        <string>$PROFILE_UUID</string>
+    </dict>
+</dict>
+</plist>
+EOF
+
+echo "Exporting IPA..."
+
+# Export IPA
+xcodebuild -exportArchive \
+    -archivePath "$ARCHIVE_PATH" \
+    -exportPath "$EXPORT_PATH" \
+    -exportOptionsPlist "$EXPORT_OPTIONS_PLIST" \
+    -allowProvisioningUpdates \
+    | xcpretty || xcodebuild -exportArchive \
+    -archivePath "$ARCHIVE_PATH" \
+    -exportPath "$EXPORT_PATH" \
+    -exportOptionsPlist "$EXPORT_OPTIONS_PLIST" \
+    -allowProvisioningUpdates
+
+# Find and rename the IPA to a consistent name
+IPA_FILE=$(find "$EXPORT_PATH" -name "*.ipa" | head -1)
+if [ -n "$IPA_FILE" ] && [ "$IPA_FILE" != "$EXPORT_PATH/eagle0.ipa" ]; then
+    mv "$IPA_FILE" "$EXPORT_PATH/eagle0.ipa"
+fi
+
+echo "Export complete: $EXPORT_PATH/eagle0.ipa"
+ls -la "$EXPORT_PATH"

ci/github_actions/build_unity_ios.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+# Build iOS Unity player (generates Xcode project)
+
+set -euxo pipefail
+
+. ./ci/unity_version.sh
+
+WORKSPACE=$(pwd)
+BUILD_PATH=${1:-"/tmp/eagle0/eagle0iOS"}
+LOG_PATH="/tmp/eagle0/editor_ios.log"
+
+echo "Building protos"
+./scripts/build_protos.sh
+
+UNITY_INSTALL_PATH="/Applications/Unity/Hub/Editor"
+
+echo "Building iOS Unity player to: $BUILD_PATH"
+
+mkdir -p "$(dirname "$LOG_PATH")"
+mkdir -p "$BUILD_PATH"
+
+# Build iOS player - this generates an Xcode project
+${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
+   -nographics \
+   -batchmode \
+   -quit \
+   -executeMethod BuildScript.BuildiOSPlayer \
+   -buildPath "$BUILD_PATH" \
+   -logFile "$LOG_PATH" \
+   -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+
+echo "iOS Unity build complete"
+echo "Xcode project generated at: $BUILD_PATH"
+ls -la "$BUILD_PATH"

ci/github_actions/upload_testflight.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+# Upload IPA to TestFlight using Apple ID credentials (same as Mac notarization)
+
+set -euxo pipefail
+
+IPA_PATH=${1:?Usage: upload_testflight.sh <ipa_path>}
+
+if [ ! -f "$IPA_PATH" ]; then
+    echo "Error: IPA file not found: $IPA_PATH"
+    exit 1
+fi
+
+echo "Uploading to TestFlight: $IPA_PATH"
+
+# Uses same credentials as Mac notarization:
+# - APPLE_ID: Your Apple ID email
+# - APP_SPECIFIC_PASSWORD: App-specific password from appleid.apple.com
+
+if [ -z "${APPLE_ID:-}" ]; then
+    echo "Error: APPLE_ID environment variable not set"
+    exit 1
+fi
+
+if [ -z "${APP_SPECIFIC_PASSWORD:-}" ]; then
+    echo "Error: APP_SPECIFIC_PASSWORD environment variable not set"
+    exit 1
+fi
+
+echo "Uploading with xcrun altool..."
+
+xcrun altool --upload-app \
+    --type ios \
+    --file "$IPA_PATH" \
+    --username "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD"
+
+echo "Upload complete! Check App Store Connect for processing status."
+echo "The build should appear in TestFlight within 15-30 minutes after processing."