[ci] Move CI to native Mac mini runner, drop Bitrise

- Remove bitrise.yml (no longer used, replaced by Gitea Actions on
  a native macos-build:host runner - Docker VM-based macos-ctl/
  macos-release runners are dead per earlier session)
- test.yml: push-triggered on any branch except develop/release/main,
  runs fastlane tests (coverage) instead of raw xcodebuild
- beta.yml: PR-to-develop triggered, builds + uploads to TestFlight;
  drops the dead wake/sleep-macos-vm jobs, uses the archive-API
  checkout workaround (see go-gitea/gitea#21819), points at the real
  ci-build.keychain-db instead of the old ci-signing.keychain-db name
- release.yml removed: release/main run nothing automated per the
  agreed branch flow, promotion is manual
- Fastfile: add a tests lane (coverage) so the workflow just calls
  fastlane, matching LC Wallet's convention

.gitea/workflows/beta.yml

@@ -1,37 +1,24 @@
-name: Beta (TestFlight)
+name: Beta (TestFlight, on PR to develop)
 
 on:
-  push:
+  pull_request:
     branches:
       - develop
 
 jobs:
-  wake-macos-vm:
-    runs-on: macos-ctl
-    steps:
-      - name: Start macOS VM container
-        run: docker start macos
-
   build-and-upload:
-    needs: wake-macos-vm
-    runs-on: macos-release
+    runs-on: macos-build
 
     env:
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
-      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
-      BUILD_NUMBER: ${{ gitea.run_number }}
+      BUILD_NUMBER: ${{ github.run_number }}
 
     steps:
-      - name: Checkout
+      - name: Checkout repository (workaround - Gitea git-upload-pack bug, see go-gitea/gitea#21819)
         run: |
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_ASKPASS=/bin/false
-          export SSH_ASKPASS=/bin/false
-          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
-          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
-          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
-          git checkout "${{ gitea.sha }}"
+          curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            -o /tmp/repo.tar.gz \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
+          tar -xzf /tmp/repo.tar.gz --strip-components=1 -C "$GITHUB_WORKSPACE"
 
       - name: Write App Store Connect API key
         run: |
@@ -48,20 +35,11 @@ jobs:
 
       - name: Unlock keychain and run fastlane beta
         run: |
-          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-signing.keychain-db
-          security list-keychains -d user -s ~/Library/Keychains/ci-signing.keychain-db ~/Library/Keychains/login.keychain-db
-          security default-keychain -d user -s ~/Library/Keychains/ci-signing.keychain-db
+          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/ci-build.keychain-db
+          security list-keychains -d user -s ~/Library/Keychains/ci-build.keychain-db ~/Library/Keychains/login.keychain-db
           security find-identity -v -p codesigning
           fastlane beta
 
       - name: Clean up API key
         if: always()
         run: rm -f fastlane/apikey.json
-
-  sleep-macos-vm:
-    needs: build-and-upload
-    if: always()
-    runs-on: macos-ctl
-    steps:
-      - name: Stop macOS VM container
-        run: docker stop macos

.gitea/workflows/release.yml

@@ -1,85 +0,0 @@
-name: Release (App Store Connect)
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  wake-macos-vm:
-    runs-on: macos-ctl
-    steps:
-      - name: Start macOS VM container
-        run: docker start macos
-
-  build-archive-deliver:
-    needs: wake-macos-vm
-    runs-on: macos-release
-
-    env:
-      APPLE_ID: ${{ secrets.APPLE_ID }}
-      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
-      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
-      BUILD_NUMBER: ${{ gitea.run_number }}
-
-    steps:
-      - name: Checkout
-        run: |
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_ASKPASS=/bin/false
-          export SSH_ASKPASS=/bin/false
-          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
-          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
-          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
-          git checkout "${{ gitea.sha }}"
-
-      - name: Verify ASC secrets
-        run: |
-          if [ -z "${{ secrets.ASC_KEY_ID }}" ]; then
-            echo "ERROR: ASC_KEY_ID is empty"
-            exit 1
-          fi
-
-      - name: Write App Store Connect API key
-        run: |
-          cat > fastlane/apikey.json <<EOF
-          {
-            "key_id": "${{ secrets.ASC_KEY_ID }}",
-            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
-            "key": "${{ secrets.ASC_KEY_CONTENT }}",
-            "is_key_content_base64": true,
-            "duration": 1200,
-            "in_house": false
-          }
-          EOF
-
-      - name: Unlock keychain and run fastlane release
-        run: |
-          echo "whoami: $(whoami)"
-          echo "HOME: $HOME"
-          echo "expanded keychain path: $HOME/Library/Keychains/ci-signing.keychain-db"
-          ls -la "$HOME/Library/Keychains/" || echo "cannot list Keychains dir"
-          security unlock-keychain -p "${{ secrets.CI_KEYCHAIN_PASSWORD }}" "$HOME/Library/Keychains/ci-signing.keychain-db"
-          echo "--- keychain info ---"
-          security show-keychain-info "$HOME/Library/Keychains/ci-signing.keychain-db" || true
-          security list-keychains -d user -s "$HOME/Library/Keychains/ci-signing.keychain-db" "$HOME/Library/Keychains/login.keychain-db"
-          security default-keychain -d user -s "$HOME/Library/Keychains/ci-signing.keychain-db"
-          echo "--- current search list ---"
-          security list-keychains
-          echo "--- dump-keychain identity count ---"
-          security dump-keychain "$HOME/Library/Keychains/ci-signing.keychain-db" | grep -c "class.*0x80001000" || true
-          echo "--- find-identity ---"
-          security find-identity -v -p codesigning
-          fastlane release
-
-      - name: Clean up API key
-        if: always()
-        run: rm -f fastlane/apikey.json
-
-  sleep-macos-vm:
-    needs: build-archive-deliver
-    if: always()
-    runs-on: macos-ctl
-    steps:
-      - name: Stop macOS VM container
-        run: docker stop macos

.gitea/workflows/test.yml

@@ -1,43 +1,23 @@
-name: Test (feature branches)
+name: Validation (test + coverage)
 
 on:
-  pull_request:
-    branches:
-      - "feature/*"
+  push:
+    branches-ignore:
+      - develop
+      - release
+      - main
 
 jobs:
-  wake-macos-vm:
-    runs-on: macos-ctl
-    steps:
-      - name: Start macOS VM container
-        run: docker start macos
-
   test:
-    needs: wake-macos-vm
-    runs-on: macos-release
+    runs-on: macos-build
 
     steps:
-      - name: Checkout
+      - name: Checkout repository (workaround - Gitea git-upload-pack bug, see go-gitea/gitea#21819)
         run: |
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_ASKPASS=/bin/false
-          export SSH_ASKPASS=/bin/false
-          REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
-          AUTH_URL="$(echo "$REPO_URL" | sed "s#https://#https://x-access-token:${{ gitea.token }}@#")"
-          git -c credential.helper= -c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30 clone "$AUTH_URL" .
-          git checkout "${{ gitea.sha }}"
+          curl -sSfL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            -o /tmp/repo.tar.gz \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
+          tar -xzf /tmp/repo.tar.gz --strip-components=1 -C "$GITHUB_WORKSPACE"
 
-      - name: Run unit tests
-        run: |
-          xcodebuild test \
-            -project PediFoods.xcodeproj \
-            -scheme "PediFoods" \
-            -destination "platform=iOS Simulator,name=iPhone 16,OS=latest"
-
-  sleep-macos-vm:
-    needs: test
-    if: always()
-    runs-on: macos-ctl
-    steps:
-      - name: Stop macOS VM container
-        run: docker stop macos
+      - name: Run tests with coverage
+        run: fastlane tests

bitrise.yml

@@ -1,172 +0,0 @@
-format_version: '26'
-default_step_lib_source: https://github.com/bitrise-io/bitrise-steplib.git
-project_type: ios
-
-meta:
-  bitrise.io:
-    stack: osx-xcode-26.0.x
-    machine_type_id: g2-m1.8core
-
-app:
-  envs:
-    - TEST_SHARD_COUNT: 2
-    - BITRISE_PROJECT_PATH: PediFoods.xcodeproj
-      opts:
-        is_expand: false
-    - BITRISE_SCHEME: PediFoods
-      opts:
-        is_expand: false
-    - BITRISE_DISTRIBUTION_METHOD: app-store
-      opts:
-        is_expand: false
-    - APPLE_ID: developer@loverde.com.br
-    # MANUAL (Bitrise Secrets tab — never commit these):
-    #   ASC_KEY_ID        → App Store Connect API Key ID
-    #   ASC_ISSUER_ID     → App Store Connect Issuer ID
-    #   ASC_KEY_CONTENT   → .p8 file content base64-encoded
-    #   ITC_TEAM_ID       → iTunes Connect Team ID (numeric)
-
-# ─── PIPELINES ────────────────────────────────────────────────────────────────
-pipelines:
-  run_tests:
-    workflows:
-      build_for_testing: {}
-      test_without_building:
-        depends_on:
-          - build_for_testing
-        parallel: "$TEST_SHARD_COUNT"
-
-# ─── WORKFLOWS ────────────────────────────────────────────────────────────────
-workflows:
-
-  # ── Parallel test pipeline: step 1 — build only ───────────────────────────
-  build_for_testing:
-    description: Build app for testing (no run) — used by run_tests pipeline
-    steps:
-      - git-clone@8: {}
-      - xcode-build-for-test@3:
-          inputs:
-            - project_path: $BITRISE_PROJECT_PATH
-            - scheme: $BITRISE_SCHEME
-            - simulator_device: iPhone 16
-            - simulator_os_version: latest
-            - output_tool: xcpretty
-      - deploy-to-bitrise-io@2:
-          inputs:
-            - pipeline_intermediate_files: "$BITRISE_TEST_BUNDLE_ZIP_PATH:BITRISE_TEST_BUNDLE_ZIP_PATH"
-
-  # ── Parallel test pipeline: step 2 — run shards ───────────────────────────
-  test_without_building:
-    description: Run test shards in parallel — depends on build_for_testing
-    steps:
-      - pull-intermediate-files@1:
-          inputs:
-            - artifact_sources: build_for_testing
-      - xcode-test-without-building@0:
-          inputs:
-            - xctestrun: $BITRISE_TEST_BUNDLE_ZIP_PATH
-            - destination: platform=iOS Simulator,name=iPhone 16,OS=latest
-            - test_shard_index: $BITRISE_IO_PARALLEL_INDEX
-            - total_number_of_shards: $TEST_SHARD_COUNT
-            - generate_code_coverage_files: "yes"
-
-  # ── Metadata push (no build) ───────────────────────────────────────────────
-  metadata:
-    description: Push App Store metadata and screenshots for all languages
-    steps:
-      - git-clone@8: {}
-      - fastlane@3:
-          inputs:
-            - lane: metadata
-            - work_dir: $BITRISE_SOURCE_DIR
-
-  # ── Simple single-machine test (non-parallel) ──────────────────────────────
-  test:
-    description: Run unit tests (single machine, for PR checks)
-    steps:
-      - git-clone@8: {}
-      - xcode-test@5:
-          inputs:
-            - project_path: $BITRISE_PROJECT_PATH
-            - scheme: $BITRISE_SCHEME
-            - simulator_device: iPhone 16
-            - simulator_os_version: latest
-            - should_build_before_test: "yes"
-            - generate_code_coverage_files: "yes"
-
-  # ── Beta → TestFlight ──────────────────────────────────────────────────────
-  beta:
-    description: Build, sign, and upload to TestFlight
-    steps:
-      - git-clone@8: {}
-      - script@1:
-          title: Set build number
-          inputs:
-            - content: |
-                cd $BITRISE_SOURCE_DIR
-                agvtool new-version -all $BITRISE_BUILD_NUMBER
-      - xcode-archive@5:
-          inputs:
-            - project_path: $BITRISE_PROJECT_PATH
-            - scheme: $BITRISE_SCHEME
-            - distribution_method: $BITRISE_DISTRIBUTION_METHOD
-            - automatic_code_signing: api-key
-            - register_test_devices: "no"
-            - platform: iOS
-      - deploy-to-itunesconnect-deliver@2:
-          inputs:
-            - itunescon_user: $APPLE_ID
-            - api_key_path: ""
-            - api_issuer: $ASC_ISSUER_ID
-            - submit_for_review: "no"
-            - skip_metadata: "yes"
-            - skip_screenshots: "yes"
-
-  # ── Full release → App Store ───────────────────────────────────────────────
-  release:
-    description: Build, sign, push metadata+screenshots, upload binary to App Store
-    envs:
-      - ASC_KEY_ID: $ASC_KEY_ID
-      - ASC_ISSUER_ID: $ASC_ISSUER_ID
-      - ASC_KEY_CONTENT: $ASC_KEY_CONTENT
-      - ITC_TEAM_ID: $ITC_TEAM_ID
-    steps:
-      - git-clone@8: {}
-      - script@1:
-          title: Verify ASC secrets
-          inputs:
-            - content: |
-                if [ -z "$ASC_KEY_ID" ]; then
-                  echo "ERROR: ASC_KEY_ID is empty"
-                  exit 1
-                fi
-                echo "ASC_KEY_ID is set (length: ${#ASC_KEY_ID})"
-                echo "ASC_ISSUER_ID is set (length: ${#ASC_ISSUER_ID})"
-                echo "ASC_KEY_CONTENT is set (length: ${#ASC_KEY_CONTENT})"
-      - script@1:
-          title: Set build number
-          inputs:
-            - content: |
-                cd $BITRISE_SOURCE_DIR
-                agvtool new-version -all $BITRISE_BUILD_NUMBER
-      - xcode-archive@5:
-          inputs:
-            - project_path: $BITRISE_PROJECT_PATH
-            - scheme: $BITRISE_SCHEME
-            - distribution_method: $BITRISE_DISTRIBUTION_METHOD
-            - automatic_code_signing: api-key
-            - platform: iOS
-      - fastlane@3:
-          inputs:
-            - lane: release
-            - work_dir: $BITRISE_SOURCE_DIR
-      - deploy-to-bitrise-io@2: {}
-
-# ─── TRIGGER MAP ──────────────────────────────────────────────────────────────
-trigger_map:
-  - push_branch: develop
-    workflow: beta
-  - push_branch: main
-    workflow: release
-  - pull_request_source_branch: feature/*
-    workflow: test

fastlane/Fastfile

@@ -3,6 +3,15 @@
 
 default_platform(:ios)
 
+lane :tests do
+  run_tests(
+    scheme: "PediFoods",
+    project: "PediFoods.xcodeproj",
+    clean: true,
+    code_coverage: true
+  )
+end
+
 lane :assemble do |options|
   # Manual signing (team/identity/profile) for the "PediFoods" target is
   # baked directly into PediFoods.xcodeproj's own project settings - not
@@ -15,7 +24,7 @@ lane :assemble do |options|
   build_app(
     scheme: "PediFoods",
     sdk: "iphoneos",
-    export_method: ENV["BITRISE_DISTRIBUTION_METHOD"] || "app-store",
+    export_method: "app-store",
     xcconfig: "fastlane/AppStore.xcconfig",
     xcargs: xcargs,
     derived_data_path: ".build/DerivedData",