fix: pass provisioning profiles explicitly when exporting Apple archives

.github/workflows/deploy.yml

@@ -377,7 +377,7 @@ jobs:
     - name: 'Setup xcode'
       uses: maxim-lobanov/setup-xcode@v1
       with:
-        xcode-version: '26.0'
+        xcode-version: '26.4'
 
     - name: 'Install desktop Qt'
       uses: jurplel/install-qt-action@v3
@@ -417,6 +417,7 @@ jobs:
         APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
         APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
         APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
+        CONFIGURE_ONLY: ${{ startsWith(github.ref, 'refs/tags/') && 'true' || '' }}
       shell: bash
       run: |
         sh deploy/build.sh -t ios | sed -f deploy/hide_secrets.sed
@@ -720,10 +721,12 @@ jobs:
     - name: 'Build project'
       env:
         QT_INSTALL_DIR: ${{ runner.temp }}
+        CONFIGURE_ONLY: ${{ startsWith(github.ref, 'refs/tags/') && 'true' || '' }}
       shell: bash
       run: deploy/build.sh -t macos-ne | sed -f deploy/hide_secrets.sed
 
     - name: 'Upload unpacked artifact'
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
       uses: actions/upload-artifact@v4
       with:
         name: AmneziaVPN_MacOS_unpacked
@@ -1693,7 +1696,7 @@ jobs:
 
   Pre-Release:
     if: startsWith(github.ref, 'refs/tags/')
-    needs: [Build-Linux-Ubuntu, Build-MacOS, Build-Android]
+    needs: [Build-Linux-Ubuntu, Build-Windows, Build-iOS, Build-MacOS, Build-MacOS-NE, Build-Android]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -1779,3 +1782,36 @@ jobs:
 
     - name: 'Upload macOS build to TestFlight'
       run: fastlane mac testflight_upload 2>&1 | sed -f hide_secrets.sed
+
+# ------------------------------------------------------
+
+  Google-Play:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [Build-Linux-Ubuntu, Build-Windows, Build-iOS, Build-MacOS, Build-MacOS-NE, Build-Android]
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: deploy
+        shell: bash
+
+    steps:
+    - name: 'Get fastlane config'
+      uses: actions/checkout@v4
+      with:
+        sparse-checkout: |
+          deploy/fastlane
+          deploy/hide_secrets.sed
+        sparse-checkout-cone-mode: false
+
+    - name: 'Download Play AABs'
+      uses: actions/download-artifact@v8
+      with:
+        pattern: 'AmneziaVPN_*_play.aab'
+        path: deploy/build/android
+        merge-multiple: true
+
+    - name: 'Upload to Google Play beta'
+      env:
+        GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+      run: fastlane android play_upload 2>&1 | sed -f hide_secrets.sed

CMakeLists.txt

@@ -5,7 +5,7 @@ set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(PROJECT AmneziaVPN)
 if(NOT AMNEZIAVPN_VERSION)
-    set(AMNEZIAVPN_VERSION 5.1.1.2 CACHE STRING "Client app version")
+    set(AMNEZIAVPN_VERSION 5.1.1.4 CACHE STRING "Client app version")
 endif()
 
 set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)

client/cmake/macos_ne.cmake

@@ -156,6 +156,12 @@ message(${QtCore_location})
 
 get_filename_component(QT_BIN_DIR_DETECTED "${QtCore_location}/../../../../../bin" ABSOLUTE)
 
+set(MACDEPLOYQT_ARGS -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR})
+if(Qt6_VERSION VERSION_GREATER_EQUAL 6.11)
+    list(APPEND MACDEPLOYQT_ARGS -no-codesign)
+endif()
+
+# $<TARGET_BUNDLE_DIR> points to the build tree; xcodebuild archive builds the bundle elsewhere
 add_custom_command(TARGET ${PROJECT} POST_BUILD
-    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:${PROJECT}> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR} -no-codesign
+    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt \${TARGET_BUILD_DIR}/\${WRAPPER_NAME} ${MACDEPLOYQT_ARGS}
 )

deploy/build.sh

@@ -35,6 +35,7 @@ while [[ $# -gt 0 ]]; do
         --aab)              : ${BUILD_AAB=true};     shift   ;;
         --apk)              : ${BUILD_APK=true};     shift   ;;
         --play)             : ${BUILD_PLAY=true};    shift   ;;
+        --configure-only)   : ${CONFIGURE_ONLY=true}; shift  ;;
         --help|-h|?)
             echo "Usage: $0 [options]"
             echo "  Options:"
@@ -49,6 +50,7 @@ while [[ $# -gt 0 ]]; do
             echo "  --aab                     - whether to build AAB. only applicable to Android"
             echo "  --apk                     - whether to build APK. use with --play. only applicable to Android"
             echo "  --play                    - build Play flavor (Google Play Billing). use with --aab or --apk. only applicable to Android"
+            echo "  --configure-only          - run CMake configure and skip the build"
             exit 0
             ;;
         *) echo "Unknown arg \"$1\". Use $0 -h to get help"; exit 1 ;;
@@ -217,6 +219,7 @@ if [[ -n "$FORCE" ]]; then
 fi
 
 run_traced cmake -S "$SOURCE_PATH" -B "$BUILD_PATH" "${args[@]}"
+[[ -n "$CONFIGURE_ONLY" ]] && exit 0
 run_traced cmake --build "$BUILD_PATH" --config "$CMAKE_BUILD_TYPE" --parallel "$JOBS"
 
 if [[ -n "$BUILD_AAB" ]]; then

deploy/fastlane/Fastfile

@@ -1,9 +1,21 @@
-def archive_build(app_platform)
+def cmake_cache_value(name)
+  File.read("../build/CMakeCache.txt")[/^#{name}:\w+=(.*)$/, 1]
+end
+
+def archive_build(app_platform, profile_platform)
+  app_identifier = cmake_cache_value("BUILD_IOS_APP_IDENTIFIER")
   build_app(
     project: "build/AmneziaVPN.xcodeproj",
     scheme: "AmneziaVPN",
     configuration: "Release",
     export_method: "app-store",
+    export_options: {
+      signingStyle: "manual",
+      provisioningProfiles: {
+        app_identifier => cmake_cache_value("CLIENT_#{profile_platform}_PROVISIONING_PROFILE_SPECIFIER"),
+        "#{app_identifier}.network-extension" => cmake_cache_value("CLIENT_#{profile_platform}_NE_PROVISIONING_PROFILE_SPECIFIER")
+      }
+    },
     output_directory: "build/#{app_platform}",
     output_name: "AmneziaVPN"
   )
@@ -21,7 +33,7 @@ end
 
 platform :ios do
   lane :archive do
-    archive_build("ios")
+    archive_build("ios", "IOS")
   end
 
   lane :testflight_upload do
@@ -32,7 +44,7 @@ end
 
 platform :mac do
   lane :archive do
-    archive_build("osx")
+    archive_build("osx", "MACOS")
   end
 
   lane :testflight_upload do
@@ -40,3 +52,19 @@ platform :mac do
     upload_to_testflight(app_platform: "osx", pkg: "build/osx/AmneziaVPN.pkg", skip_waiting_for_build_processing: true)
   end
 end
+
+platform :android do
+  lane :play_upload do
+    upload_to_play_store(
+      package_name: "org.amnezia.vpn",
+      track: "beta",
+      release_status: "draft",
+      aab_paths: Dir["../build/android/*_play.aab"].map { |path| File.expand_path(path) },
+      json_key_data: ENV.fetch("GOOGLE_PLAY_SERVICE_ACCOUNT_JSON"),
+      skip_upload_metadata: true,
+      skip_upload_changelogs: true,
+      skip_upload_images: true,
+      skip_upload_screenshots: true
+    )
+  end
+end