feat: create bitrise step by bacarybruno · Pull Request #13 · callstackincubator/ios

bacarybruno · 2025-09-08T23:34:01Z

This PR adds the initial version of the Rock Bitrise workflow.
It is largely based on the existing GitHub Actions workflow, which also served as the reference for the step.sh script.

At this stage, step.sh duplicates some of the logic defined in action.yml.
In future iterations, we can consider extracting the common functionality into a shared script or library so that both Bitrise and GitHub workflows can consume the same code and stay in sync.

Documentation will follow once we align on this PR.

thymikee · 2025-09-09T08:14:38Z

Looks good! How can we test this? Do you have a sample repo you could share?

bacarybruno · 2025-09-09T08:43:24Z

I tested it manually by creating a new rock project, but I can prepare a sample repo yes 👍

bacarybruno · 2025-09-09T18:22:30Z

Hello again!

I tested using this workflow file: bitrise.yml.

It works, but I had to create a dedicated repository to host the Bitrise workflow: bitrise-rock-remote-build-ios, since Bitrise requires the step.yml file to be at the repository root.

So now we have two possible approaches:
1️⃣ Move step.yml and step.sh to the root of the current repo.
2️⃣ Keep a dedicated repo just for the Bitrise workflow.

Which option do you think we should go with? Or do you see another possible solution?

thymikee · 2025-09-10T08:58:47Z

If possible, I'd keep the code colocated. Especially if we could reuse some of these shell scripts

thymikee · 2025-09-10T09:00:08Z

I've invited you to our internal repo for testing Rock's remote builds: https://github.com/callstack-internal/rock-remote-build-test/. I think we should make it public soon, and it could be our test bed for CI workflows we support

bacarybruno · 2025-09-10T11:13:11Z

If possible, I'd keep the code colocated. Especially if we could reuse some of these shell scripts

Good point, I updated the PR to move the bitrise step to the repository root + tested the workflow on rock-remote-build-test.

bacarybruno · 2025-09-12T17:01:55Z

Hello @thymikee the PR is ready as I just updated the readme. Please don't hesitate to ping me if you think there is still something missing.
After this PR I'll do the same for Android, then maybe the website will also need to be updated.

bacarybruno · 2025-09-14T12:49:29Z

fyi in a follow-up PR, I plan to introduce a Bitrise remote cache provider that handles saving and restoring the .rock folder. The main limitation is retrieval in local environments: it’s possible to fetch cache items through the Bitrise API but there’s no server-side filtering. We would need to paginate through the available entries and filter them client-side until the right one is found. https://docs.bitrise.io/en/bitrise-ci/api/api-reference.html#operations-tag-key-value-cache

And also we can't upload programmatically. For that maybe I can do something like this :

ios/action.yml

Line 308 in 08a533d

    
           if: ${{ env.PROVIDER_NAME == 'GitHub' && (!env.ARTIFACT_URL || (inputs.re-sign == 'true' && github.event_name == 'pull_request')) }}

thymikee · 2025-09-14T14:05:50Z

We would need to paginate through the available entries and filter them client-side until the right one is found. https://docs.bitrise.io/en/bitrise-ci/api/api-reference.html#operations-tag-key-value-cache

This is fine, if there's no other way, should still be pretty fast to retrieve available artifacts

And also we can't upload programmatically. For that maybe I can do something like this

Makes sense, if there's no other API (same for GitHub)

thymikee · 2025-09-14T14:14:07Z

+  ARTIFACT_TRAITS="${DESTINATION},${CONFIGURATION},${BITRISE_PULL_REQUEST:-}"
+  envman add --key ARTIFACT_TRAITS --value "$ARTIFACT_TRAITS"
+
+  OUTPUT="$(npx rock remote-cache list -p ios --traits "${ARTIFACT_TRAITS}" --json || true)"


not sure about the || true part. The reason we do || (echo "$OUTPUT" && exit 1) is for escaped shell commands, such as ${npx rock remote-cache ...) here to show error output when they fail and exit

Updated here 374ceb8

thymikee · 2025-09-14T14:15:03Z

+  KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
+
+  security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+  security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+  security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+  CERTIFICATE_PATH="$RUNNER_TEMP/certificate.p12"
+  echo -n "$CERTIFICATE_BASE64" | base64 --decode -o "$CERTIFICATE_PATH"
+  security import "$CERTIFICATE_PATH" -P "$CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+  security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+  security list-keychain -d user -s "$KEYCHAIN_PATH"
+
+  IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | grep -oE '([0-9A-F]{40})' | head -n 1 || true)"
+  echo "Certificate identity: $IDENTITY"
+  envman add --key IDENTITY --value "$IDENTITY"
+
+  mkdir -p "$PROFILE_DIR"
+  PROFILE_PATH="$PROFILE_DIR/$PROVISIONING_PROFILE_NAME.mobileprovision"
+  echo -n "$PROVISIONING_PROFILE_BASE64" | base64 --decode -o "$PROFILE_PATH"


is this the recommended way to process provisioning profiles on Bitrise? we followed the recommendation for GitHub, but just want to make sure this is ok

There are many ways to handle this. Some projects like ours use Fastlane, others rely on one of the recommended options, or even custom setups etc. I’m wondering if we should let each project manage its own signature setup, and simply pass the --identity flag value to the workflow instead.

What do you think about it?

That would look like this b578ca1

and completed here 6db3bdd

thymikee

This looks pretty good already, just small nits 👍🏼

thymikee · 2025-09-14T16:15:09Z

+  ARTIFACT_TRAITS="${DESTINATION},${CONFIGURATION},${BITRISE_PULL_REQUEST:-}"
+  envman add --key ARTIFACT_TRAITS --value "$ARTIFACT_TRAITS"
+
+  OUTPUT="$(npx rock remote-cache list -p ios --traits "${ARTIFACT_TRAITS}" --json || (echo "$OUTPUT" && exit 1))"


OUTPUT needs to evaluate, so we can't wrap everything with " quotes. In GHAction we're using this syntax, I think it should work:

Suggested change

OUTPUT="$(npx rock remote-cache list -p ios --traits "${ARTIFACT_TRAITS}" --json || (echo "$OUTPUT" && exit 1))"

OUTPUT=$(npx rock remote-cache list -p ios --traits "${ARTIFACT_TRAITS}" --json || (echo "$OUTPUT" && exit 1))

Oh right, thanks I'll update

Updated here 395dd01

Hello @thymikee sorry for the ping. Is there something additional that needs to be done on this PR? 🙏

ajanuar · 2025-09-24T03:17:14Z

Hi @bacarybruno , Thanks for this PR 🙌 As a Bitrise user, I’m happy to see this coming in. I’m willing to give it a test on my setup and share feedback.

bacarybruno · 2025-09-24T11:49:25Z

Yes @ajanuar that would be really helpful 🙏

thymikee · 2025-09-25T15:13:37Z

FYI, we've added support for provisioning profile and certificates as files: #14

bacarybruno · 2025-09-28T08:09:50Z

Supporting them will depend on #13 (comment). Do you think we should support them in this workflow?

bacarybruno added 3 commits September 9, 2025 01:26

feat: create bitrise step

91ffa3f

chore: line ends

43b229b

chore: remove placeholder

7aa83e6

chore: rock workflow ios

0ba4bff

refactor: move workflow on root

6f83721

thymikee mentioned this pull request Sep 12, 2025

Azure Devops callstackincubator/rock#566

Open

docs: add docs for bitrise workflow

173d431

thymikee reviewed Sep 14, 2025

View reviewed changes

fix: use no truthy fallback

374ceb8

thymikee reviewed Sep 14, 2025

View reviewed changes

bacarybruno added 2 commits September 14, 2025 19:01

fix: remove double quotes

395dd01

feat: let consumers handle signature setup

b578ca1

bacarybruno requested a review from thymikee September 16, 2025 02:57

chore: remove unused variables

6db3bdd

	OUTPUT="$(npx rock remote-cache list -p ios --traits "${ARTIFACT_TRAITS}" --json \|\| (echo "$OUTPUT" && exit 1))"
	OUTPUT=$(npx rock remote-cache list -p ios --traits "${ARTIFACT_TRAITS}" --json \|\| (echo "$OUTPUT" && exit 1))

Conversation

bacarybruno commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thymikee commented Sep 9, 2025

Uh oh!

bacarybruno commented Sep 9, 2025

Uh oh!

bacarybruno commented Sep 9, 2025

Uh oh!

thymikee commented Sep 10, 2025

Uh oh!

thymikee commented Sep 10, 2025

Uh oh!

bacarybruno commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bacarybruno commented Sep 12, 2025

Uh oh!

bacarybruno commented Sep 14, 2025

Uh oh!

thymikee commented Sep 14, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bacarybruno Sep 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bacarybruno Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thymikee left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ajanuar commented Sep 24, 2025

Uh oh!

bacarybruno commented Sep 24, 2025

Uh oh!

thymikee commented Sep 25, 2025

Uh oh!

bacarybruno commented Sep 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bacarybruno commented Sep 8, 2025 •

edited

Loading

bacarybruno commented Sep 10, 2025 •

edited

Loading

bacarybruno Sep 14, 2025 •

edited

Loading

bacarybruno Sep 17, 2025 •

edited

Loading