feat: harden Aiden On The Go setup and remote pairing

.github/workflows/aiden-on-the-go-external-testflight.yml

@@ -0,0 +1,193 @@
+# Maintainer-only: uploads a build to the Aiden On The Go app's external TestFlight.
+# Requires the repo's APP_STORE_CONNECT_* secrets (App Store Connect API key),
+# which forks and contributors do not have. Repository CI lives in .github/workflows/ci.yml.
+
+# Run manually from the Actions tab (workflow_dispatch).
+name: Aiden On The Go External TestFlight
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm_external_review:
+        description: "Type EXTERNAL_REVIEW to confirm this upload can be submitted to Beta App Review."
+        required: true
+        type: string
+      build_number:
+        description: "Optional CFBundleVersion override. Leave blank to use the next App Store Connect build number."
+        required: false
+        type: string
+
+run-name: "Aiden On The Go external TestFlight from ${{ github.ref_name }}"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: aiden-on-the-go-external-testflight
+  cancel-in-progress: false
+
+jobs:
+  upload:
+    name: Archive and Upload
+    runs-on: macos-26
+    environment: aiden-on-the-go-external-testflight
+    timeout-minutes: 60
+
+    env:
+      APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}
+      EXPORT_OPTIONS_PLIST: ios/ci/ExternalTestFlightExportOptions.plist
+      PROJECT_PATH: ios/AidenOnTheGo.xcodeproj
+      SCHEME: AidenOnTheGo
+      TEAM_ID: 5WP229CBB8
+
+    steps:
+      - name: Check manual gate
+        env:
+          CONFIRM_EXTERNAL_REVIEW: ${{ inputs.confirm_external_review }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${GITHUB_REF_NAME}" != "main" ]]; then
+            echo "External TestFlight uploads must be run from main. Current ref: ${GITHUB_REF_NAME}" >&2
+            exit 1
+          fi
+
+          if [[ "${CONFIRM_EXTERNAL_REVIEW}" != "EXTERNAL_REVIEW" ]]; then
+            echo "Re-run with confirm_external_review set to EXTERNAL_REVIEW." >&2
+            exit 1
+          fi
+
+      - name: Check required secrets
+        run: |
+          set -euo pipefail
+
+          missing=0
+          for name in APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_PRIVATE_KEY; do
+            if [[ -z "${!name}" ]]; then
+              echo "Missing required secret: ${name}" >&2
+              missing=1
+            fi
+          done
+
+          exit "${missing}"
+
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+
+      - name: Set output paths
+        run: |
+          set -euo pipefail
+
+          {
+            echo "ARCHIVE_PATH=${RUNNER_TEMP}/AidenOnTheGo.xcarchive"
+            echo "DERIVED_DATA_PATH=${RUNNER_TEMP}/DerivedData"
+            echo "EXPORT_PATH=${RUNNER_TEMP}/ExternalTestFlightExport"
+          } >> "${GITHUB_ENV}"
+
+      - name: Detect marketing version
+        run: |
+          set -euo pipefail
+
+          marketing_version="$(
+            xcodebuild \
+              -showBuildSettings \
+              -project "${PROJECT_PATH}" \
+              -scheme "${SCHEME}" \
+              -configuration Release 2>/dev/null |
+              awk -F'= ' '/MARKETING_VERSION/ { print $2; exit }'
+          )"
+
+          if [[ -z "${marketing_version}" ]]; then
+            echo "Could not detect MARKETING_VERSION from Xcode build settings." >&2
+            exit 1
+          fi
+
+          echo "MARKETING_VERSION=${marketing_version}" >> "${GITHUB_ENV}"
+          echo "Using marketing version ${marketing_version}"
+
+      - name: Write App Store Connect key
+        run: |
+          set -euo pipefail
+
+          key_path="${RUNNER_TEMP}/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8"
+          if [[ "${APP_STORE_CONNECT_PRIVATE_KEY}" == *"\\n"* ]]; then
+            printf "%s" "${APP_STORE_CONNECT_PRIVATE_KEY}" | perl -pe 's/\\n/\n/g' > "${key_path}"
+          else
+            printf "%s" "${APP_STORE_CONNECT_PRIVATE_KEY}" > "${key_path}"
+          fi
+          chmod 600 "${key_path}"
+          echo "APP_STORE_CONNECT_KEY_PATH=${key_path}" >> "${GITHUB_ENV}"
+
+      # ENFORCE_OPEN_TRAIN fails this step in seconds — instead of the upload
+      # step after an expensive archive — when the marketing version's
+      # pre-release train is already closed by an approved App Store version
+      # (bitten 2026-06-02 with 1.0 and 2026-08-04 with 1.4).
+      - name: Check release train and select build number
+        env:
+          BUNDLE_ID: sbtbiswas.AidenOnTheGo
+          REQUESTED_BUILD_NUMBER: ${{ inputs.build_number }}
+          ENFORCE_OPEN_TRAIN: "1"
+        run: |
+          set -euo pipefail
+
+          build_number="$(ruby ios/ci/select_testflight_build_number.rb)"
+          echo "BUILD_NUMBER=${build_number}" >> "${GITHUB_ENV}"
+          echo "Using build number ${build_number}"
+
+      - name: Show upload target
+        run: |
+          set -euo pipefail
+
+          echo "Uploading external-capable TestFlight build"
+          echo "Commit SHA: ${GITHUB_SHA}"
+          echo "Marketing version: ${MARKETING_VERSION}"
+          echo "Build number: ${BUILD_NUMBER}"
+          echo "Export options: ${EXPORT_OPTIONS_PLIST}"
+          echo "This workflow uploads only; App Store Connect external group assignment and Beta App Review submission remain manual."
+
+      - name: Show Xcode version
+        run: xcodebuild -version
+
+      - name: Resolve Swift packages
+        run: |
+          set -euo pipefail
+
+          xcodebuild \
+            -resolvePackageDependencies \
+            -project "${PROJECT_PATH}" \
+            -scheme "${SCHEME}"
+
+      - name: Archive
+        run: |
+          set -euo pipefail
+
+          xcodebuild \
+            -project "${PROJECT_PATH}" \
+            -scheme "${SCHEME}" \
+            -configuration Release \
+            -destination "generic/platform=iOS" \
+            -archivePath "${ARCHIVE_PATH}" \
+            -derivedDataPath "${DERIVED_DATA_PATH}" \
+            -allowProvisioningUpdates \
+            -authenticationKeyPath "${APP_STORE_CONNECT_KEY_PATH}" \
+            -authenticationKeyID "${APP_STORE_CONNECT_KEY_ID}" \
+            -authenticationKeyIssuerID "${APP_STORE_CONNECT_ISSUER_ID}" \
+            DEVELOPMENT_TEAM="${TEAM_ID}" \
+            CURRENT_PROJECT_VERSION="${BUILD_NUMBER}" \
+            archive
+
+      - name: Upload to App Store Connect
+        run: |
+          set -euo pipefail
+
+          xcodebuild \
+            -exportArchive \
+            -archivePath "${ARCHIVE_PATH}" \
+            -exportPath "${EXPORT_PATH}" \
+            -exportOptionsPlist "${EXPORT_OPTIONS_PLIST}" \
+            -allowProvisioningUpdates \
+            -authenticationKeyPath "${APP_STORE_CONNECT_KEY_PATH}" \
+            -authenticationKeyID "${APP_STORE_CONNECT_KEY_ID}" \
+            -authenticationKeyIssuerID "${APP_STORE_CONNECT_ISSUER_ID}"

.github/workflows/aiden-on-the-go-internal-testflight.yml

@@ -0,0 +1,187 @@
+# Maintainer-only: uploads a build to the Aiden On The Go app's internal TestFlight.
+# Requires the repo's APP_STORE_CONNECT_* secrets (App Store Connect API key),
+# which forks and contributors do not have. Repository CI lives in .github/workflows/ci.yml.
+
+# Run manually from the Actions tab (workflow_dispatch).
+name: Aiden On The Go Internal TestFlight
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm_internal_only:
+        description: "Type INTERNAL to confirm this upload is for internal TestFlight only."
+        required: true
+        type: string
+      build_number:
+        description: "Optional CFBundleVersion override. Leave blank to use the next App Store Connect build number."
+        required: false
+        type: string
+
+run-name: "Aiden On The Go internal TestFlight from ${{ github.ref_name }}"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: aiden-on-the-go-internal-testflight
+  cancel-in-progress: false
+
+jobs:
+  upload:
+    name: Archive and Upload
+    runs-on: macos-26
+    environment: aiden-on-the-go-internal-testflight
+    timeout-minutes: 60
+
+    env:
+      APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+      APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+      APP_STORE_CONNECT_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}
+      EXPORT_OPTIONS_PLIST: ios/ci/TestFlightExportOptions.plist
+      PROJECT_PATH: ios/AidenOnTheGo.xcodeproj
+      SCHEME: AidenOnTheGo
+      TEAM_ID: 5WP229CBB8
+
+    steps:
+      - name: Check manual gate
+        env:
+          CONFIRM_INTERNAL_ONLY: ${{ inputs.confirm_internal_only }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${GITHUB_REF_NAME}" != "main" ]]; then
+            echo "Internal TestFlight uploads must be run from main. Current ref: ${GITHUB_REF_NAME}" >&2
+            exit 1
+          fi
+
+          if [[ "${CONFIRM_INTERNAL_ONLY}" != "INTERNAL" ]]; then
+            echo "Re-run with confirm_internal_only set to INTERNAL." >&2
+            exit 1
+          fi
+
+      - name: Check required secrets
+        run: |
+          set -euo pipefail
+
+          missing=0
+          for name in APP_STORE_CONNECT_KEY_ID APP_STORE_CONNECT_ISSUER_ID APP_STORE_CONNECT_PRIVATE_KEY; do
+            if [[ -z "${!name}" ]]; then
+              echo "Missing required secret: ${name}" >&2
+              missing=1
+            fi
+          done
+
+          exit "${missing}"
+
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+
+      - name: Set output paths
+        run: |
+          set -euo pipefail
+
+          {
+            echo "ARCHIVE_PATH=${RUNNER_TEMP}/AidenOnTheGo.xcarchive"
+            echo "DERIVED_DATA_PATH=${RUNNER_TEMP}/DerivedData"
+            echo "EXPORT_PATH=${RUNNER_TEMP}/TestFlightExport"
+          } >> "${GITHUB_ENV}"
+
+      - name: Detect marketing version
+        run: |
+          set -euo pipefail
+
+          marketing_version="$(
+            xcodebuild \
+              -showBuildSettings \
+              -project "${PROJECT_PATH}" \
+              -scheme "${SCHEME}" \
+              -configuration Release 2>/dev/null |
+              awk -F'= ' '/MARKETING_VERSION/ { print $2; exit }'
+          )"
+
+          if [[ -z "${marketing_version}" ]]; then
+            echo "Could not detect MARKETING_VERSION from Xcode build settings." >&2
+            exit 1
+          fi
+
+          echo "MARKETING_VERSION=${marketing_version}" >> "${GITHUB_ENV}"
+          echo "Using marketing version ${marketing_version}"
+
+      - name: Write App Store Connect key
+        run: |
+          set -euo pipefail
+
+          key_path="${RUNNER_TEMP}/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8"
+          if [[ "${APP_STORE_CONNECT_PRIVATE_KEY}" == *"\\n"* ]]; then
+            printf "%s" "${APP_STORE_CONNECT_PRIVATE_KEY}" | perl -pe 's/\\n/\n/g' > "${key_path}"
+          else
+            printf "%s" "${APP_STORE_CONNECT_PRIVATE_KEY}" > "${key_path}"
+          fi
+          chmod 600 "${key_path}"
+          echo "APP_STORE_CONNECT_KEY_PATH=${key_path}" >> "${GITHUB_ENV}"
+
+      - name: Select build number
+        env:
+          BUNDLE_ID: sbtbiswas.AidenOnTheGo
+          REQUESTED_BUILD_NUMBER: ${{ inputs.build_number }}
+        run: |
+          set -euo pipefail
+
+          build_number="$(ruby ios/ci/select_testflight_build_number.rb)"
+          echo "BUILD_NUMBER=${build_number}" >> "${GITHUB_ENV}"
+          echo "Using build number ${build_number}"
+
+      - name: Show upload target
+        run: |
+          set -euo pipefail
+
+          echo "Uploading internal-only TestFlight build"
+          echo "Commit SHA: ${GITHUB_SHA}"
+          echo "Marketing version: ${MARKETING_VERSION}"
+          echo "Build number: ${BUILD_NUMBER}"
+          echo "Export options: ${EXPORT_OPTIONS_PLIST}"
+
+      - name: Show Xcode version
+        run: xcodebuild -version
+
+      - name: Resolve Swift packages
+        run: |
+          set -euo pipefail
+
+          xcodebuild \
+            -resolvePackageDependencies \
+            -project "${PROJECT_PATH}" \
+            -scheme "${SCHEME}"
+
+      - name: Archive
+        run: |
+          set -euo pipefail
+
+          xcodebuild \
+            -project "${PROJECT_PATH}" \
+            -scheme "${SCHEME}" \
+            -configuration Release \
+            -destination "generic/platform=iOS" \
+            -archivePath "${ARCHIVE_PATH}" \
+            -derivedDataPath "${DERIVED_DATA_PATH}" \
+            -allowProvisioningUpdates \
+            -authenticationKeyPath "${APP_STORE_CONNECT_KEY_PATH}" \
+            -authenticationKeyID "${APP_STORE_CONNECT_KEY_ID}" \
+            -authenticationKeyIssuerID "${APP_STORE_CONNECT_ISSUER_ID}" \
+            DEVELOPMENT_TEAM="${TEAM_ID}" \
+            CURRENT_PROJECT_VERSION="${BUILD_NUMBER}" \
+            archive
+
+      - name: Upload to App Store Connect
+        run: |
+          set -euo pipefail
+
+          xcodebuild \
+            -exportArchive \
+            -archivePath "${ARCHIVE_PATH}" \
+            -exportPath "${EXPORT_PATH}" \
+            -exportOptionsPlist "${EXPORT_OPTIONS_PLIST}" \
+            -allowProvisioningUpdates \
+            -authenticationKeyPath "${APP_STORE_CONNECT_KEY_PATH}" \
+            -authenticationKeyID "${APP_STORE_CONNECT_KEY_ID}" \
+            -authenticationKeyIssuerID "${APP_STORE_CONNECT_ISSUER_ID}"