[ci] Move CI to native Mac mini runner, drop Bitrise

- Remove bitrise.yml (no longer used, replaced by Gitea Actions on
  a native macos-build:host runner - Docker VM-based macos-ctl/
  macos-release runners are dead per earlier session)
- test.yml: push-triggered on any branch except develop/release/main,
  runs fastlane tests (coverage) instead of raw xcodebuild
- beta.yml: PR-to-develop triggered, builds + uploads to TestFlight;
  drops the dead wake/sleep-macos-vm jobs, uses the archive-API
  checkout workaround (see go-gitea/gitea#21819), points at the real
  ci-build.keychain-db instead of the old ci-signing.keychain-db name
- release.yml removed: release/main run nothing automated per the
  agreed branch flow, promotion is manual
- Fastfile: add a tests lane (coverage) so the workflow just calls
  fastlane, matching LC Wallet's convention

.gitea/workflows/beta.yml

@@ -1,37 +1,24 @@
-name: Beta (TestFlight)
+name: Beta (TestFlight, on PR to develop)
 
 on:
-  push:
+  pull_request:
     branches:
       - develop
 
 jobs:
-  wake-macos-vm:
-    runs-on: macos-ctl
-    steps:
-      - name: Start macOS VM container
-        run: docker start macos
-
   build-and-upload:
-    needs: wake-macos-vm
-    runs-on: macos-release
+    runs-on: macos-build
 
     env:
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
-      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
-      BUILD_NUMBER: ${{ gitea.run_number }}
+      BUILD_NUMBER: ${{ github.run_number }}
 
     steps:
-      - name: Checkout
+      - name: Checkout repository (workaround - Gitea git-upload-pack bug, see go-gitea/gitea#21819)
         run: |
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_ASKPASS=/bin/false
-          export SSH_ASKPASS=/bin/false
-          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
-          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
-          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
-          git checkout "${{ gitea.sha }}"
+          curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            -o /tmp/repo.tar.gz \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
+          tar -xzf /tmp/repo.tar.gz --strip-components=1 -C "$GITHUB_WORKSPACE"
 
       - name: Write App Store Connect API key
         run: |
@@ -48,20 +35,11 @@ jobs:
 
       - name: Unlock keychain and run fastlane beta
         run: |
-          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-signing.keychain-db
-          security list-keychains -d user -s ~/Library/Keychains/ci-signing.keychain-db ~/Library/Keychains/login.keychain-db
-          security default-keychain -d user -s ~/Library/Keychains/ci-signing.keychain-db
+          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-build.keychain-db
+          security list-keychains -d user -s ~/Library/Keychains/ci-build.keychain-db ~/Library/Keychains/login.keychain-db
           security find-identity -v -p codesigning
           fastlane beta
 
       - name: Clean up API key
         if: always()
         run: rm -f fastlane/apikey.json
-
-  sleep-macos-vm:
-    needs: build-and-upload
-    if: always()
-    runs-on: macos-ctl
-    steps:
-      - name: Stop macOS VM container
-        run: docker stop macos

.gitea/workflows/release.yml

@@ -1,85 +0,0 @@
-name: Release (App Store Connect)
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  wake-macos-vm:
-    runs-on: macos-ctl
-    steps:
-      - name: Start macOS VM container
-        run: docker start macos
-
-  build-archive-deliver:
-    needs: wake-macos-vm
-    runs-on: macos-release
-
-    env:
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
-      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
-      BUILD_NUMBER: ${{ gitea.run_number }}
-
-    steps:
-      - name: Checkout
-        run: |
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_ASKPASS=/bin/false
-          export SSH_ASKPASS=/bin/false
-          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
-          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
-          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
-          git checkout "${{ gitea.sha }}"
-
-      - name: Verify ASC secrets
-        run: |
-          if [ -z "${{ secrets.ASC_KEY_ID }}" ]; then
-            echo "ERROR: ASC_KEY_ID is empty"
-            exit 1
-          fi
-
-      - name: Write App Store Connect API key
-        run: |
-          cat > fastlane/apikey.json <<EOF
-          {
-            "key_id": "${{ secrets.ASC_KEY_ID }}",
-            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
-            "key": "${{ secrets.ASC_KEY_CONTENT }}",
-            "is_key_content_base64": true,
-            "duration": 1200,
-            "in_house": false
-          }
-          EOF
-
-      - name: Unlock keychain and run fastlane release
-        run: |
-          echo "whoami: $(whoami)"
-          echo "HOME: $HOME"
-          echo "expanded keychain path: $HOME/Library/Keychains/ci-signing.keychain-db"
-          ls -la "$HOME/Library/Keychains/" || echo "cannot list Keychains dir"
-          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" "$HOME/Library/Keychains/ci-signing.keychain-db"
-          echo "--- keychain info ---"
-          security show-keychain-info "$HOME/Library/Keychains/ci-signing.keychain-db" || true
-          security list-keychains -d user -s "$HOME/Library/Keychains/ci-signing.keychain-db" "$HOME/Library/Keychains/login.keychain-db"
-          security default-keychain -d user -s "$HOME/Library/Keychains/ci-signing.keychain-db"
-          echo "--- current search list ---"
-          security list-keychains
-          echo "--- dump-keychain identity count ---"
-          security dump-keychain "$HOME/Library/Keychains/ci-signing.keychain-db" | grep -c "class.*0x80001000" || true
-          echo "--- find-identity ---"
-          security find-identity -v -p codesigning
-          fastlane release
-
-      - name: Clean up API key
-        if: always()
-        run: rm -f fastlane/apikey.json
-
-  sleep-macos-vm:
-    needs: build-archive-deliver
-    if: always()
-    runs-on: macos-ctl
-    steps:
-      - name: Stop macOS VM container
-        run: docker stop macos

.gitea/workflows/test.yml

@@ -1,43 +1,23 @@
-name: Test (feature branches)
+name: Validation (test + coverage)
 
 on:
-  pull_request:
-    branches:
-      - "feature/*"
+  push:
+    branches-ignore:
+      - develop
+      - release
+      - main
 
 jobs:
-  wake-macos-vm:
-    runs-on: macos-ctl
-    steps:
-      - name: Start macOS VM container
-        run: docker start macos
-
   test:
-    needs: wake-macos-vm
-    runs-on: macos-release
+    runs-on: macos-build
 
     steps:
-      - name: Checkout
+      - name: Checkout repository (workaround - Gitea git-upload-pack bug, see go-gitea/gitea#21819)
         run: |
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_ASKPASS=/bin/false
-          export SSH_ASKPASS=/bin/false
-          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
-          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
-          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
-          git checkout "${{ gitea.sha }}"
+          curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            -o /tmp/repo.tar.gz \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
+          tar -xzf /tmp/repo.tar.gz --strip-components=1 -C "$GITHUB_WORKSPACE"
 
-      - name: Run unit tests
-        run: |
-          xcodebuild test \
-            -project PediFoods.xcodeproj \
-            -scheme "PediFoods" \
-            -destination "platform=iOS Simulator,name=iPhone 16,OS=latest"
-
-  sleep-macos-vm:
-    needs: test
-    if: always()
-    runs-on: macos-ctl
-    steps:
-      - name: Stop macOS VM container
-        run: docker stop macos
+      - name: Run tests with coverage
+        run: fastlane tests