pal-e-docs

Review: Fastlane SSH build and deploy pipeline for iOS (R2)

review-1644-2026-06-27-r2 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Re-review (round 2) of board item #1644. Round 1 had two findings: one [SCOPE] (arch note missing) and one [BODY] (signing identity ambiguity). The [SCOPE] finding is resolved. The [BODY] finding remains unaddressed.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- Child of #78, Sub-ticket E, dependency chain documented
  • [x] Repo -- ldraney/westside-basketball-ios (to be created by Sub-ticket A). Filed on westside-basketball with explicit transfer note.
  • [x] User Story -- present, well-formed (platform operator perspective)
  • [x] Context -- thorough, includes tmux keychain gotcha, three-stage pipeline, MacBook SSH details
  • [x] File Targets -- 3 files to create, 2 reference paths listed
  • [x] Feature Flag -- None (build infra, acceptable)
  • [x] Acceptance Criteria -- 4 criteria
  • [x] Test Expectations -- 2 manual tests
  • [x] Constraints -- 5 constraints listed
  • [x] Checklist -- standard 3-item
  • [x] Related -- project, parent issue, pipeline docs
All template sections present.

Traceability

  • [x] story:WS-S34 label -- "As a parent, I want to subscribe to my child's team program through the iOS app so that Apple handles monthly billing and automatically enforces the delinquency gate if I fall behind on payments"
  • [x] story note verified -- found in project-westside-basketball user-stories section (Parent role)
  • [x] arch:app-store label -- architecture note arch-app-store EXISTS (note ID 2224, slug "arch-app-store", title "Architecture: App Store Billing"). Covers Apple subscription billing architecture, dependency chain, data model, and key decisions. Round 1 false positive resolved.
  • [x] Forgejo issue -- ldraney/westside-basketball#86, state: open
All three traceability legs verified.

File Targets

  • [x] fastlane/Fastfile -- to be created (extends Sub-ticket B output). Target repo does not exist yet (expected; depends on #81). Acceptable for a dependent ticket.
  • [x] scripts/build-remote.sh -- to be created. Path is reasonable.
  • [x] scripts/import-ci-keychain.sh -- to be created. Path is reasonable.
  • [x] ~/macbook-ssh/connect.sh -- verified: exists at /home/ldraney/macbook-ssh/connect.sh (32 bytes)
  • [ ] ~/secrets/apple-developer/ -- STILL UNRESOLVED from R1: Directory exists and contains .env (114 bytes) and AuthKey_2A6BSP3H76.p8 (257 bytes, App Store Connect API key). No .p12 certificate found. Issue Context still references "The signing cert (dev.p12) may need reimporting after MacBook reboot via import-ci-keychain.sh" -- but no such cert exists on disk. The import-ci-keychain.sh script and File Targets reference need clarification on whether signing uses a .p12 cert (to be created/exported later) or Xcode automatic signing with API key (.p8) authentication.

Repo Placement

OK. Issue is filed on ldraney/westside-basketball because the target repo (westside-basketball-ios) does not exist yet. Explicitly documented with transfer plan. Forgejo API confirms iOS repo returns 404.

Dependencies

  • depends:81 -- #81 "Create westside-basketball-ios repo with Turbo Native shell" (board item 1640, backlog, open) -- REQUIRED: repo must exist
  • depends:84 -- #84 "Fastlane IaC for auto-renewable subscription product" (board item 1641, backlog, open) -- REQUIRED: Fastfile base must exist before adding beta/release lanes
  • depends:85 -- #85 "StoreKit 2 purchase flow in Turbo Native shell" (board item 1642, backlog, open) -- REQUIRED: app code must exist before building
  • parent:78 -- #78 parent issue (board item 1635, backlog, decomposed)
All three dependencies in backlog and open. Dependency chain correctly documented in both board labels and issue body. This ticket is last in the chain (Sub-ticket E) -- it cannot move to in_progress until all three dependencies are complete.

Acceptance Criteria

4 criteria, all manually verifiable. Infrastructure/pipeline work has no automated test path -- manual verification via SSH to MacBook and checking App Store Connect is the correct approach. Test expectations correctly specify manual verification (run build-remote.sh, check TestFlight). Testable and complete.

Blast Radius

Low. Creates new files in a not-yet-existing repo. No existing code modified. No other services use Fastlane or iOS build infrastructure. The SSH/tmux pattern is isolated to the iOS pipeline. No sibling services affected. No similar patterns elsewhere in the codebase (confirmed: no Fastfile, Appfile, Matchfile, build-remote.sh, or import-ci-keychain.sh found anywhere in ~/repos).
Minor note: The pipeline reference docs (~/macbook-ssh/docs/ios-pipeline.md line 213) show direct SSH (ssh macbook "cd ~/{app}-ios && fastlane beta"), while this issue correctly identifies that direct SSH fails due to keychain restrictions and uses tmux instead. The issue's approach is correct; the reference docs may need updating when this ticket ships.

Decomposition Assessment

3 file targets in 1 repo, 4 acceptance criteria. Estimated agent work well under 5 minutes once dependencies are met. No decomposition needed.

Round 1 Finding Resolution

Finding Tag Status
Create architecture note arch-app-store [SCOPE] RESOLVED -- arch-app-store exists (note ID 2224)
Clarify signing identity (.p12 vs .p8) [BODY] NOT RESOLVED -- issue Context still references dev.p12; only .p8 exists on disk

Recommendation

  • [BODY] Clarify signing identity in issue Context and File Targets. The Context section references "The signing cert (dev.p12)" and File Targets lists ~/secrets/apple-developer/ as containing "signing certs and API key". In reality, the directory contains only AuthKey_2A6BSP3H76.p8 (API key) and .env. Either: (a) state that the .p12 cert will be exported from the MacBook Keychain as part of Stage 2 signing setup and does not yet exist on the archbox, or (b) if using Xcode automatic signing with API key authentication, remove the .p12 reference and update import-ci-keychain.sh's purpose accordingly.