Expo × GitHub Actions で TestFlight 自動デプロイ（fastlane / EAS）

git clone https://github.com/testkun08080/template-expo-build-cicd.git

echo -n "your-github-username:ghp_xxxxxxxxxxxx" | base64

gh secret set MATCH_GIT_URL --body "https://github.com/your-org/ios-certificates.git"
gh secret set MATCH_PASSWORD --body "your-match-password"
gh secret set MATCH_GIT_BASIC_AUTHORIZATION --body "$(echo -n 'username:ghp_xxx' | base64)"

name: iOS Fastlane Match Build

on:
  push:
    tags:
      - ios-v*
  workflow_dispatch:
    inputs:
      lane:
        description: Fastlane lane to run
        required: true
        default: beta
        type: choice
        options:
          - build
          - upload
          - beta
      artifact_run_id:
        description: Previous workflow run ID (required for upload-only; find it in the Actions run URL)
        required: false
        type: string

concurrency:
  group: ios-fastlane-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build .ipa
    if: github.event_name == 'push' || inputs.lane == 'build' || inputs.lane == 'beta'
    runs-on: macos-latest
    timeout-minutes: 90
    env:
      APP_IDENTIFIER: ${{ vars.APP_IDENTIFIER || 'com.testkun08080.template-expo-build' }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      MATCH_GIT_URL: ${{ secrets.MATCH_GIT_URL }}
      MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
      MATCH_TYPE: ${{ vars.MATCH_TYPE || 'appstore' }}
      APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
      APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
      APP_STORE_CONNECT_API_KEY_P8: ${{ secrets.APP_STORE_CONNECT_API_KEY_P8 }}
      SCHEME_NAME: ${{ vars.SCHEME_NAME || 'templateexpobuild' }}
      BUILD_NUMBER: ${{ github.run_number }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install npm dependencies
        run: npm ci

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.3"
          bundler-cache: true
          working-directory: fastlane

      - name: Validate build configuration
        run: |
          set -euo pipefail
          missing=0
          for name in MATCH_GIT_URL MATCH_PASSWORD MATCH_GIT_BASIC_AUTHORIZATION APPLE_TEAM_ID; do
            if [ -z "${!name:-}" ]; then
              echo "::error::Missing secret: $name"
              missing=1
            fi
          done
          if [ "$missing" -ne 0 ]; then
            exit 1
          fi
        env:
          MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}

      - name: Configure match HTTPS auth
        run: echo "MATCH_GIT_BASIC_AUTHORIZATION=${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}" >> "$GITHUB_ENV"

      - name: Run fastlane build
        working-directory: fastlane
        run: bundle exec fastlane ios build

      - name: Upload IPA artifact
        uses: actions/upload-artifact@v4
        with:
          name: ios-ipa
          path: build/${{ env.SCHEME_NAME }}.ipa
          if-no-files-found: error
          retention-days: 14

  upload:
    name: Upload to TestFlight
    needs: [build]
    if: |
      always() &&
      !cancelled() &&
      (github.event_name == 'push' || inputs.lane == 'upload' || inputs.lane == 'beta') &&
      (needs.build.result == 'success' || inputs.lane == 'upload')
    runs-on: macos-latest
    timeout-minutes: 30
    env:
      APP_IDENTIFIER: ${{ vars.APP_IDENTIFIER || 'com.testkun08080.template-expo-build' }}
      APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
      APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
      APP_STORE_CONNECT_API_KEY_P8: ${{ secrets.APP_STORE_CONNECT_API_KEY_P8 }}
      SCHEME_NAME: ${{ vars.SCHEME_NAME || 'templateexpobuild' }}
      IPA_PATH: ${{ github.workspace }}/build/${{ vars.SCHEME_NAME || 'templateexpobuild' }}.ipa
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.3"
          bundler-cache: true
          working-directory: fastlane

      - name: Validate upload configuration
        run: |
          set -euo pipefail
          if [ "${{ inputs.lane }}" = "upload" ] && [ -z "${{ inputs.artifact_run_id }}" ] && [ "${{ needs.build.result }}" != "success" ]; then
            echo "::error::upload-only requires artifact_run_id from a previous build workflow run"
            exit 1
          fi
          missing=0
          for name in APP_STORE_CONNECT_API_KEY_ID APP_STORE_CONNECT_API_KEY_ISSUER_ID APP_STORE_CONNECT_API_KEY_P8; do
            if [ -z "${!name:-}" ]; then
              echo "::error::Missing secret: $name"
              missing=1
            fi
          done
          if [ "$missing" -ne 0 ]; then
            exit 1
          fi

      - name: Download IPA from this workflow
        if: needs.build.result == 'success'
        uses: actions/download-artifact@v4
        with:
          name: ios-ipa
          path: build

      - name: Download IPA from previous workflow run
        if: inputs.lane == 'upload' && inputs.artifact_run_id != ''
        uses: actions/download-artifact@v4
        with:
          name: ios-ipa
          path: build
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ inputs.artifact_run_id }}

      - name: Run fastlane upload
        working-directory: fastlane
        run: bundle exec fastlane ios upload

git tag ios-v1.0.0
git push origin ios-v1.0.0

gh secret set EXPO_TOKEN --body "your-expo-token"

name: EAS Build

on:
  # push:
  #   branches:
  #     - main
  workflow_dispatch:
    inputs:
      platform:
        description: Build platform
        required: true
        default: ios
        type: choice
        options:
          - ios
          - android
          - all
      profile:
        description: EAS build profile
        required: true
        default: production
        type: string
      submit:
        description: Submit to TestFlight / Play Store after build
        required: false
        default: false
        type: boolean

jobs:
  build:
    name: EAS Build (${{ inputs.platform || 'ios' }})
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Setup EAS
        uses: expo/expo-github-action@v8
        with:
          eas-version: latest
          token: ${{ secrets.EXPO_TOKEN }}

      - name: Run EAS Build
        run: |
          npx eas-cli build \
            --profile "${{ inputs.profile || 'production' }}" \
            --platform "${{ inputs.platform || 'ios' }}" \
            --non-interactive \
            --no-wait

  submit:
    name: EAS Submit to TestFlight
    needs: build
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.submit == true }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Setup EAS
        uses: expo/expo-github-action@v8
        with:
          eas-version: latest
          token: ${{ secrets.EXPO_TOKEN }}

      - name: Submit latest iOS build
        if: ${{ inputs.platform == 'ios' || inputs.platform == 'all' }}
        run: npx eas-cli submit --platform ios --latest --profile production --non-interactive

      - name: Submit latest Android build
        if: ${{ inputs.platform == 'android' || inputs.platform == 'all' }}
        run: npx eas-cli submit --platform android --latest --profile production --non-interactive