chore: remove double build for macos ne and ios (#3464)

* feat: upload iOS and macOS NE builds to TestFlight on version tags

* chore: bump version

.github/actions/apple-setup-provisioning-profile/action.yml

@@ -14,7 +14,6 @@ runs:
     - name: Setup provisioning profile
       shell: bash
       run: |
-        PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
         TEMP_FILE=$(mktemp)
 
         echo "${{ inputs.provisioning_profile_base64 }}" | base64 --decode > "$TEMP_FILE"
@@ -26,6 +25,12 @@ runs:
           exit 1
         fi
 
-        mkdir -p "$PROFILES_DIR"
-        mv "$TEMP_FILE" "$PROFILES_DIR/$PROFILE_UUID.mobileprovision"
-        echo "Installed profile: $PROFILE_UUID"
+        PROFILE_EXTENSION=mobileprovision
+        grep -aq "<string>OSX</string>" "$TEMP_FILE" && PROFILE_EXTENSION=provisionprofile
+
+        for PROFILES_DIR in "$HOME/Library/MobileDevice/Provisioning Profiles" "$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"; do
+          mkdir -p "$PROFILES_DIR"
+          cp "$TEMP_FILE" "$PROFILES_DIR/$PROFILE_UUID.$PROFILE_EXTENSION"
+        done
+        rm -f "$TEMP_FILE"
+        echo "Installed profile: $PROFILE_UUID.$PROFILE_EXTENSION"

.github/workflows/deploy.yml

@@ -417,12 +417,24 @@ jobs:
         APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
         APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
         APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
+        CONFIGURE_ONLY: ${{ startsWith(github.ref, 'refs/tags/') && 'true' || '' }}
+      shell: bash
       run: |
-        sh deploy/build.sh -t ios | \
-          sed -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/d' | \
-          sed -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/d' | \
-          sed -e '/-DPROD_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DPROD_AGW_PUBLIC_KEY/d' | \
-          sed -e '/-DDEV_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DDEV_AGW_PUBLIC_KEY/d'
+        sh deploy/build.sh -t ios | sed -f deploy/hide_secrets.sed
+
+    - name: 'Archive for App Store'
+      if: startsWith(github.ref, 'refs/tags/')
+      working-directory: deploy
+      shell: bash
+      run: fastlane ios archive 2>&1 | sed -f hide_secrets.sed
+
+    - name: 'Upload App Store package'
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/ios/AmneziaVPN.ipa
+        archive: false
+        retention-days: 7
 
 # ------------------------------------------------------
 
@@ -631,12 +643,7 @@ jobs:
 
     env:
       QT_VERSION: 6.10.1
-
-      MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
-
-      MAC_APP_CERT_CERT: ${{ secrets.MAC_APP_CERT_CERT }}
-      MAC_SIGNER_ID: ${{ secrets.MAC_SIGNER_ID }}
-      MAC_APP_CERT_PW: ${{ secrets.MAC_APP_CERT_PW }}
+      KEYCHAIN_PASSWORD: ""
 
       PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
       PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
@@ -654,13 +661,37 @@ jobs:
         submodules: 'true'
         fetch-depth: 10
 
-    - uses: ./.github/actions/apple-setup-provisioning-profile
+    - uses: ./.github/actions/apple-setup-keychain
+      id: setup-keychain
       with:
-        provisioning_profile_base64: ${{ secrets.MAC_APP_PROVISIONING_PROFILE }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
 
-    - uses: ./.github/actions/apple-setup-provisioning-profile
+    - name: 'Install signing certificate'
+      uses: ./.github/actions/apple-install-cert
       with:
-        provisioning_profile_base64: ${{ secrets.MAC_NE_PROVISIONING_PROFILE }}
+        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+        cert-base64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }}
+        cert-password: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }}
+
+    - name: 'Install installer certificate'
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: ./.github/actions/apple-install-cert
+      with:
+        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
+        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+        cert-base64: ${{ secrets.MAC_APPSTORE_INSTALLER_CERT_BASE64 }}
+        cert-password: ${{ secrets.MAC_APPSTORE_INSTALLER_CERT_PASSWORD }}
+
+    - name: 'Install app provisioning profile'
+      uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.APPSTORE_CONNECT_MAC_PROVISIONING }}
+
+    - name: 'Install NE provisioning profile'
+      uses: ./.github/actions/apple-setup-provisioning-profile
+      with:
+        provisioning_profile_base64: ${{ secrets.APPSTORE_CONNECT_MAC_NE_PROVISIONING }}
 
     - name: 'Setup xcode'
       uses: maxim-lobanov/setup-xcode@v1
@@ -679,18 +710,6 @@ jobs:
         set-env: 'true'
         extra: '--base ${{ env.QT_MIRROR }}'
 
-    - name: 'Install go'
-      uses: actions/setup-go@v5
-      with:
-        go-version: '1.24'
-        cache: false
-
-    - name: 'Setup gomobile'
-      run: |
-          export PATH=$PATH:~/go/bin
-          go install golang.org/x/mobile/cmd/gomobile@latest
-          gomobile init
-
     - name: 'Setup python'
       uses: actions/setup-python@v6
       with:
@@ -700,15 +719,32 @@ jobs:
       run: pip install "conan==2.28.0"
 
     - name: 'Build project'
-      run: |
-        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos/bin"
-        bash deploy/build_macos_ne.sh
+      env:
+        QT_INSTALL_DIR: ${{ runner.temp }}
+        CONFIGURE_ONLY: ${{ startsWith(github.ref, 'refs/tags/') && 'true' || '' }}
+      shell: bash
+      run: deploy/build.sh -t macos-ne | sed -f deploy/hide_secrets.sed
 
     - name: 'Upload unpacked artifact'
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
       uses: actions/upload-artifact@v4
       with:
         name: AmneziaVPN_MacOS_unpacked
-        path: deploy/build/client/AmneziaVPN.app
+        path: deploy/build/client/Release/AmneziaVPN.app
+        retention-days: 7
+
+    - name: 'Archive for App Store'
+      if: startsWith(github.ref, 'refs/tags/')
+      working-directory: deploy
+      shell: bash
+      run: fastlane mac archive 2>&1 | sed -f hide_secrets.sed
+
+    - name: 'Upload App Store package'
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: actions/upload-artifact@v7
+      with:
+        path: deploy/build/osx/AmneziaVPN.pkg
+        archive: false
         retention-days: 7
 
 # ------------------------------------------------------
@@ -1702,3 +1738,47 @@ jobs:
           gh release create "$TAG" dist/* --repo "$GITHUB_REPOSITORY" \
             --title "$TAG" --notes-file release-notes.md --draft --prerelease --verify-tag
         fi
+
+# ------------------------------------------------------
+
+  TestFlight:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [Build-Linux-Ubuntu, Build-Windows, Build-iOS, Build-MacOS, Build-MacOS-NE, Build-Android]
+    runs-on: macos-26
+
+    env:
+      APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
+      APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
+      APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
+
+    defaults:
+      run:
+        working-directory: deploy
+        shell: bash
+
+    steps:
+    - name: 'Get fastlane config'
+      uses: actions/checkout@v4
+      with:
+        sparse-checkout: |
+          deploy/fastlane
+          deploy/hide_secrets.sed
+        sparse-checkout-cone-mode: false
+
+    - name: 'Download iOS package'
+      uses: actions/download-artifact@v8
+      with:
+        name: AmneziaVPN.ipa
+        path: deploy/build/ios
+
+    - name: 'Download macOS package'
+      uses: actions/download-artifact@v8
+      with:
+        name: AmneziaVPN.pkg
+        path: deploy/build/osx
+
+    - name: 'Upload iOS build to TestFlight'
+      run: fastlane ios testflight_upload 2>&1 | sed -f hide_secrets.sed
+
+    - name: 'Upload macOS build to TestFlight'
+      run: fastlane mac testflight_upload 2>&1 | sed -f hide_secrets.sed

CMakeLists.txt

@@ -5,7 +5,7 @@ set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(PROJECT AmneziaVPN)
 if(NOT AMNEZIAVPN_VERSION)
-    set(AMNEZIAVPN_VERSION 5.1.1.0 CACHE STRING "Client app version")
+    set(AMNEZIAVPN_VERSION 5.1.1.2 CACHE STRING "Client app version")
 endif()
 
 set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)

client/cmake/branding/ios.cmake

@@ -32,14 +32,14 @@ endif()
 
 # -- signing
 if(NOT CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER)
-    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS app provisioning profile specifier for release")
+    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.amneziaVPN" CACHE STRING "iOS app provisioning profile specifier for release")
 endif()
 if(NOT CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG)
-    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS app provisioning profile specifier for debug")
+    set(CLIENT_IOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.amneziaVPN" CACHE STRING "iOS app provisioning profile specifier for debug")
 endif()
 if(NOT CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER)
-    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS network extension provisioning profile specifier for release")
+    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER "distr ios.org.amnezia.amneziaVPN.NE" CACHE STRING "iOS network extension provisioning profile specifier for release")
 endif()
 if(NOT CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER_DEBUG)
-    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.AmneziaVPN" CACHE STRING "iOS network extension provisioning profile specifier for debug")
+    set(CLIENT_IOS_NE_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev ios.org.amnezia.amneziaVPN.NE" CACHE STRING "iOS network extension provisioning profile specifier for debug")
 endif()

client/cmake/branding/macos.cmake

@@ -24,7 +24,7 @@ endif()
 
 # -- signing
 if(NOT CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER)
-    set(CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER "distr macos.org.amnezia.AmneziaVPN" CACHE STRING "macOS app provisioning profile specifier for release")
+    set(CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER "distr macos.org.amnezia.amneziaVPN" CACHE STRING "macOS app provisioning profile specifier for release")
 endif()
 if(NOT CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG)
     set(CLIENT_MACOS_PROVISIONING_PROFILE_SPECIFIER_DEBUG "dev macos.org.amnezia.AmneziaVPN" CACHE STRING "macOS app provisioning profile specifier for debug")

deploy/build.sh

@@ -35,6 +35,7 @@ while [[ $# -gt 0 ]]; do
         --aab)              : ${BUILD_AAB=true};     shift   ;;
         --apk)              : ${BUILD_APK=true};     shift   ;;
         --play)             : ${BUILD_PLAY=true};    shift   ;;
+        --configure-only)   : ${CONFIGURE_ONLY=true}; shift  ;;
         --help|-h|?)
             echo "Usage: $0 [options]"
             echo "  Options:"
@@ -49,6 +50,7 @@ while [[ $# -gt 0 ]]; do
             echo "  --aab                     - whether to build AAB. only applicable to Android"
             echo "  --apk                     - whether to build APK. use with --play. only applicable to Android"
             echo "  --play                    - build Play flavor (Google Play Billing). use with --aab or --apk. only applicable to Android"
+            echo "  --configure-only          - run CMake configure and skip the build"
             exit 0
             ;;
         *) echo "Unknown arg \"$1\". Use $0 -h to get help"; exit 1 ;;
@@ -217,6 +219,7 @@ if [[ -n "$FORCE" ]]; then
 fi
 
 run_traced cmake -S "$SOURCE_PATH" -B "$BUILD_PATH" "${args[@]}"
+[[ -n "$CONFIGURE_ONLY" ]] && exit 0
 run_traced cmake --build "$BUILD_PATH" --config "$CMAKE_BUILD_TYPE" --parallel "$JOBS"
 
 if [[ -n "$BUILD_AAB" ]]; then

deploy/fastlane/Fastfile

@@ -0,0 +1,42 @@
+def archive_build(app_platform)
+  build_app(
+    project: "build/AmneziaVPN.xcodeproj",
+    scheme: "AmneziaVPN",
+    configuration: "Release",
+    export_method: "app-store",
+    output_directory: "build/#{app_platform}",
+    output_name: "AmneziaVPN"
+  )
+end
+
+def authorize_app_store_connect
+  key = ENV.fetch("APPSTORE_CONNECT_PRIVATE_KEY")
+  app_store_connect_api_key(
+    key_id: ENV.fetch("APPSTORE_CONNECT_KEY_ID"),
+    issuer_id: ENV.fetch("APPSTORE_CONNECT_ISSUER_ID"),
+    key_content: key,
+    is_key_content_base64: !key.include?("PRIVATE KEY")
+  )
+end
+
+platform :ios do
+  lane :archive do
+    archive_build("ios")
+  end
+
+  lane :testflight_upload do
+    authorize_app_store_connect
+    upload_to_testflight(ipa: "build/ios/AmneziaVPN.ipa", skip_waiting_for_build_processing: true)
+  end
+end
+
+platform :mac do
+  lane :archive do
+    archive_build("osx")
+  end
+
+  lane :testflight_upload do
+    authorize_app_store_connect
+    upload_to_testflight(app_platform: "osx", pkg: "build/osx/AmneziaVPN.pkg", skip_waiting_for_build_processing: true)
+  end
+end

deploy/hide_secrets.sed

@@ -0,0 +1,9 @@
+s/\(_ENDPOINT\\\{0,1\}=\\\{0,1\}"\)[^"]*/\1***/g
+/-Xcc -DPROD_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }
+/-Xcc -DPROD_AGW_PUBLIC_KEY/d
+/-Xcc -DDEV_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }
+/-Xcc -DDEV_AGW_PUBLIC_KEY/d
+/-DPROD_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }
+/-DPROD_AGW_PUBLIC_KEY/d
+/-DDEV_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }
+/-DDEV_AGW_PUBLIC_KEY/d