pal-e-docs

Review: Fastlane SSH build and deploy pipeline for iOS

review-1644-2026-06-27 Review

review approved
Project

Verdict: APPROVED

Round 3 re-review. Round 2 finding (incorrect .p12 signing cert reference) has been resolved. Issue now correctly documents Xcode automatic signing with keychain-managed identity. All file targets verified. Scope is clean and appropriately sized.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Child of #78, Sub-ticket E
  • [x] Repo — ldraney/westside-basketball-ios (filed on westside-basketball, transfer note included)
  • [x] User Story — platform operator wants Fastlane build+deploy via SSH
  • [x] Context — SSH keychain gotcha, tmux workaround, three-stage pipeline
  • [x] File Targets — 2 create targets, 2 read-only references
  • [x] Feature Flag — none (build infrastructure)
  • [x] Acceptance Criteria — 4 criteria
  • [x] Test Expectations — 2 manual tests
  • [x] Constraints — tmux, xcargs, SSH alias, dependency ordering
  • [x] Checklist — standard 3 items
  • [x] Related — arch note, project page, parent issue, pipeline docs

Traceability

  • [x] story:WS-S34 label — "As a parent, I want to subscribe to my child's team program through the iOS app so that Apple handles monthly billing and automatically enforces the delinquency gate if I fall behind on payments"
  • [x] story note verified — WS-S34 found in project-westside-basketball user-stories section (Parent role)
  • [x] arch:app-store label — App Store Billing architecture
  • [x] arch note verified — arch-app-store note exists in pal-e-docs (ID 2224)
  • [x] Forgejo issue — ldraney/westside-basketball#86, state: open

File Targets

  • [x] fastlane/Fastfile — to create: beta + release lanes (repo does not exist yet, depends on #81; expected)
  • [x] scripts/build-remote.sh — to create: SSH wrapper with tmux (repo does not exist yet; expected)
  • [x] ~/macbook-ssh/connect.sh — read-only reference: verified exists at /home/ldraney/macbook-ssh/connect.sh
  • [x] ~/secrets/apple-developer/AuthKey_2A6BSP3H76.p8 — read-only reference: verified exists at /home/ldraney/secrets/apple-developer/AuthKey_2A6BSP3H76.p8. Correctly described as App Store Connect API key for Fastlane API auth, NOT code signing.
Round 2 fix verified: No .p12 reference remains. Issue correctly states "Uses Xcode automatic signing (code signing identity managed by MacBook Keychain, not exported .p12)" in AC #4 and explains recovery path in Context section.

Repo Placement

OK. Issue is filed on westside-basketball because westside-basketball-ios does not exist yet (created by dependency #81). Issue includes explicit transfer note: "Transfer after Sub-ticket A completes." This is the correct approach.

Dependencies

  • depends:81 — Create westside-basketball-ios repo with Turbo Native shell (board ID 1640, backlog). REQUIRED: repo must exist before any Fastlane work.
  • depends:84 — Fastlane IaC for auto-renewable subscription product (board ID 1641, backlog). REQUIRED: Fastlane Appfile and initial config must exist; this ticket adds beta/release lanes to existing Fastfile.
  • depends:85 — StoreKit 2 purchase flow in Turbo Native shell (board ID 1642, backlog). REQUIRED: app code must exist for build to have something to compile.
  • parent:78 — iOS StoreKit subscription purchase flow + Fastlane IaC (board ID 1635, backlog, decomposed). Parent decomposition is consistent.
All dependencies are documented in the issue body (Lineage and Constraints sections) and in board labels. Dependency chain is sound and correctly ordered.

Acceptance Criteria

4 criteria, all verifiable:
  • AC 1-2: Manual verification via SSH — testable once MacBook is reachable and dependencies complete
  • AC 3: tmux session handling — verifiable by checking script code
  • AC 4: Xcode automatic signing — verifiable by confirming no .p12 export, no manual cert config
Test expectations are manual (appropriate for SSH-based iOS build pipeline). Commands are realistic.

Blast Radius

Low. This is build infrastructure isolated to the iOS pipeline. The macbook-ssh/docs/ios-pipeline.md confirms the tmux SSH pattern (Stage 3 shows ssh macbook "cd ~/{app}-ios && fastlane beta"). The build-remote.sh script is specific to westside-basketball-ios. No sibling services affected. No shared Fastlane config to break.

Decomposition Assessment

No decomposition needed. 2 file targets in 1 repo, 4 acceptance criteria, estimated agent work well under 5 minutes. Single-pass ticket.

Recommendation

No action needed. Scope is solid, all file targets verified, traceability complete, dependencies documented and correctly ordered. Round 2 finding (incorrect .p12 reference) has been resolved.