This document is the canonical guide for CI/CD, App Store metadata automation, and production release execution.
.github/workflows/ci.yml: runs validation and build checks for code quality..github/workflows/release.yml: auto-creates GitHub releases onmainusingrelease/*tags..github/workflows/deploy.yml: deploys to App Store Connect when a manualv*tag is pushed..github/workflows/build-enterprise.yml: builds an enterprise IPA on demand (manual trigger, any OS)..github/workflows/setup-match.yml: one-time signing setup for match/certificates.
Trigger: merge/push to main.
Outcome:
- GitHub release tag in
release/YYYY.MM.DD.Nformat. - Release notes generated from commits.
- No App Store deployment.
Trigger: push a semantic tag like v1.2.3.
Command sequence:
git checkout main
git pull
git tag v1.2.3
git push origin v1.2.3Outcome:
- Deploy workflow builds, signs, and uploads to App Store Connect.
- Metadata generation and upload are included in deployment.
Trigger: manual — via GitHub Actions (any OS) or local Mac build.
- Go to Actions > "Build Enterprise IPA" > "Run workflow" in GitHub.
- Download the
enterprise-ipaartifact when the run completes.
Or via CLI:
gh workflow run build-enterprise.yml
gh run download --name enterprise-ipanpm run ios:enterprise:buildOutcome:
- Signed
.ipaproduced (locally atios/App/build/App.ipa, or as a CI artifact). - No App Store upload. Upload the IPA to your MDM solution for device distribution.
See ios-development.md — Enterprise Distribution for full prerequisites and details.
Run these before creating a deploy tag:
npm ci
npm run validate:all
npm run buildIf iOS release owner is on macOS:
npm run ios:buildMetadata templates live under ios/App/fastlane/metadata/en-US/ and are rendered from env values during release.
Key commands:
npm run validate:metadata
npm run prepare:metadataFastlane uploads generated metadata from ios/App/fastlane/.generated-metadata.
During release, Fastlane updates the copyright line to the current year while preserving company name format.
Local verification:
ruby scripts/test-copyright-automation.rbRequired secrets are maintained in GitHub repository secrets (deploy/signing/API auth). Common examples include App Store API keys and match credentials.
Use setup-match.yml once for initial signing bootstrap or whenever certificates/profiles are re-established.
- CI failures before tagging: see troubleshooting.md
- iOS/Xcode/signing issues: see ios-development.md
- Operational rollback/escalation: see runbook.md
- Confirm who owns
v*tag creation and approval. - Confirm who rotates App Store and signing credentials.
- Validate at least one end-to-end dry run by the new team.
- Record release owner and backup owner in your team ops system.