ci: finish release.yml's TestFlight upload, rule out Xcode Cloud for this repo (KC-71)

Spent considerable effort trying to connect Xcode Cloud directly to
this repo's self-hosted Gitea - confirmed not achievable. GitHub
Enterprise's provider option hits Gitea's missing /api/v3/ path;
GitLab Self-Managed rejects Gitea's UUID-format OAuth2 Client IDs
against App Store Connect's 64-char-hex requirement (verified by
actually creating a real OAuth2 app and having it rejected). Also
stood up Tailscale Funnel on the Gitea host for real public HTTPS
access regardless (was LAN-only before), and switched origin to it.

Replaced release.yml's commented-out altool placeholder (defunct -
Apple retired that upload path in 2023) with the current supported
approach: xcodebuild -exportArchive with API-key auth flags handles
export and TestFlight upload in a single step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -36,51 +36,31 @@ jobs:
             -archivePath "$RUNNER_TEMP/KisaniCal.xcarchive" \
             -allowProvisioningUpdates
 
-      - name: Export IPA
+      # Write the App Store Connect API key to disk. xcodebuild's auto-discovery
+      # looks for exactly this filename pattern under ~/private_keys.
+      - name: Write App Store Connect API key
+        run: |
+          mkdir -p ~/private_keys
+          echo "${{ secrets.APP_STORE_CONNECT_API_KEY_P8 }}" > ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8
+
+      # Export AND upload in one step: passing the API key credentials to
+      # -exportArchive makes xcodebuild upload directly to App Store Connect
+      # (method "app-store" in ExportOptions.plist) — no separate altool/
+      # Transporter step needed. (altool's own upload path was retired by
+      # Apple in 2023; this is the current supported mechanism.)
+      - name: Export IPA and upload to TestFlight
         run: |
           set -o pipefail
           xcodebuild -exportArchive \
             -archivePath "$RUNNER_TEMP/KisaniCal.xcarchive" \
             -exportOptionsPlist ExportOptions.plist \
             -exportPath "$RUNNER_TEMP/export" \
-            -allowProvisioningUpdates
+            -allowProvisioningUpdates \
+            -authenticationKeyPath ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8 \
+            -authenticationKeyID ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }} \
+            -authenticationKeyIssuerID ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           ls -la "$RUNNER_TEMP/export"
 
-      # ------------------------------------------------------------------
-      # PLACEHOLDER: Upload to TestFlight / App Store Connect.
-      #
-      # Add these as Gitea repo secrets:  Settings → Actions → Secrets
-      #   APP_STORE_CONNECT_API_KEY_ID     (the "Key ID" from App Store Connect)
-      #   APP_STORE_CONNECT_ISSUER_ID      (the "Issuer ID")
-      #   APP_STORE_CONNECT_API_KEY_P8     (contents of the AuthKey_XXXX.p8 file)
-      #
-      # Then uncomment ONE of the approaches below.
-      # ------------------------------------------------------------------
-
-      # --- Option A: modern notarytool / App Store Connect API key (recommended) ---
-      # - name: Write API key to file
-      #   run: |
-      #     mkdir -p ~/private_keys
-      #     echo "${{ secrets.APP_STORE_CONNECT_API_KEY_P8 }}" > ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8
-      #
-      # - name: Upload to TestFlight (altool with API key)
-      #   run: |
-      #     xcrun altool --upload-app \
-      #       --type ios \
-      #       --file "$RUNNER_TEMP/export/KisaniCal.ipa" \
-      #       --apiKey "${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}" \
-      #       --apiIssuer "${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}"
-
-      # --- Option B: notarytool (for notarizing a macOS build, not iOS TestFlight) ---
-      # - name: Notarize
-      #   run: |
-      #     xcrun notarytool submit "$RUNNER_TEMP/export/KisaniCal.ipa" \
-      #       --key ~/private_keys/AuthKey_${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}.p8 \
-      #       --key-id "${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}" \
-      #       --issuer "${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}" \
-      #       --wait
-
-      - name: Notice
-        run: |
-          echo "IPA exported. TestFlight upload step is a commented-out placeholder."
-          echo "Add App Store Connect API-key secrets and uncomment Option A in release.yml."
+      - name: Clean up API key
+        if: always()
+        run: rm -rf ~/private_keys