sigh

.github/workflows/deploy-appstore.yml

@@ -8,23 +8,16 @@ on:
 jobs:
   build-and-deploy:
     runs-on: macos-15
+    timeout-minutes: 45
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Select Xcode
-        run: |
-          # Resolve symlink to avoid actool path issues
-          XCODE_PATH=$(readlink -f /Applications/Xcode_26.1.app || echo "/Applications/Xcode_26.1.app")
-          echo "Using: $XCODE_PATH"
-          sudo xcode-select -s "$XCODE_PATH/Contents/Developer"
-          xcodebuild -version
-
-      - name: Install iOS platform
-        run: |
-          sudo xcodebuild -license accept
-          xcodebuild -downloadPlatform iOS
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: "26.1"
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
@@ -35,22 +28,10 @@ jobs:
         run: dotnet workload install maui-ios
 
       - name: Import Signing Certificate
-        env:
-          CERTIFICATE_P12: ${{ secrets.CERTIFICATE_P12 }}
-          CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
-        run: |
-          CERT_PATH=$RUNNER_TEMP/certificate.p12
-          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
-
-          echo -n "$CERTIFICATE_P12" | base64 --decode -o $CERT_PATH
-
-          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security import $CERT_PATH -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security list-keychain -d user -s $KEYCHAIN_PATH
+        uses: apple-actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.CERTIFICATE_P12 }}
+          p12-password: ${{ secrets.CERTIFICATE_PASSWORD }}
 
       - name: Import Provisioning Profile
         env:
@@ -58,7 +39,6 @@ jobs:
         run: |
           PROFILE_PATH=$RUNNER_TEMP/profile.mobileprovision
           echo -n "$PROVISIONING_PROFILE" | base64 --decode -o $PROFILE_PATH
-
           mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
           cp $PROFILE_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
 
@@ -72,27 +52,10 @@ jobs:
             -p:CodesignKey="${{ secrets.CODESIGN_KEY_NAME }}" \
             -p:CodesignProvision="${{ secrets.PROVISIONING_PROFILE_NAME }}"
 
-      - name: Upload to App Store Connect
-        env:
-          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
-          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
-          APP_STORE_CONNECT_KEY: ${{ secrets.APP_STORE_CONNECT_KEY }}
-        run: |
-          KEY_PATH=$RUNNER_TEMP/AuthKey.p8
-          echo -n "$APP_STORE_CONNECT_KEY" > $KEY_PATH
-
-          IPA_PATH=$(find . -name "*.ipa" -type f | head -1)
-          echo "Uploading $IPA_PATH"
-
-          xcrun altool --upload-app \
-            -f "$IPA_PATH" \
-            -t ios \
-            --apiKey "$APP_STORE_CONNECT_KEY_ID" \
-            --apiIssuer "$APP_STORE_CONNECT_ISSUER_ID" \
-            --api-key-path "$KEY_PATH"
-
-      - name: Cleanup
-        if: always()
-        run: |
-          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db 2>/dev/null || true
-          rm -f $RUNNER_TEMP/certificate.p12 $RUNNER_TEMP/profile.mobileprovision $RUNNER_TEMP/AuthKey.p8
+      - name: Upload to TestFlight
+        uses: apple-actions/upload-testflight-build@v3
+        with:
+          app-path: Xamarin.Neo4j/Xamarin.Neo4j/Xamarin.Neo4j.iOS/bin/Release/net10.0-ios/ios-arm64/publish/Xamarin.Neo4j.iOS.ipa
+          issuer-id: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+          api-key-id: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+          api-private-key: ${{ secrets.APP_STORE_CONNECT_KEY }}