[macos-runner] Add Gitea Actions workflows for self-hosted macOS CI

Replaces bitrise.yml with equivalent test/beta/release pipelines running
on the self-hosted macos-release runner (act_runner inside a dockur/macos
VM). Each workflow wakes the VM over SSH before the job and stops it
after, since the VM can't be left running 24/7 without starving the
VPS's other services.

.gitea/workflows/beta.yml

@@ -0,0 +1,79 @@
+name: Beta (TestFlight)
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  wake-macos-vm:
+    runs-on: docker
+    container:
+      image: alpine:3.20
+    steps:
+      - name: Install ssh client
+        run: apk add --no-cache openssh-client
+      - name: Start macOS VM container
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
+            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} start
+
+  build-and-upload:
+    needs: wake-macos-vm
+    runs-on: macos-release
+
+    env:
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
+      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set build number
+        run: |
+          cd Darwin
+          agvtool new-version -all ${{ gitea.run_number }}
+
+      - name: Write App Store Connect API key
+        run: |
+          cat > Darwin/fastlane/apikey.json <<EOF
+          {
+            "key_id": "${{ secrets.ASC_KEY_ID }}",
+            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
+            "key": "${{ secrets.ASC_KEY_CONTENT }}",
+            "is_key_content_base64": true,
+            "duration": 1200,
+            "in_house": false
+          }
+          EOF
+
+      - name: fastlane beta
+        run: |
+          cd Darwin
+          fastlane beta
+
+      - name: Clean up API key
+        if: always()
+        run: rm -f Darwin/fastlane/apikey.json
+
+  sleep-macos-vm:
+    needs: build-and-upload
+    if: always()
+    runs-on: docker
+    container:
+      image: alpine:3.20
+    steps:
+      - name: Install ssh client
+        run: apk add --no-cache openssh-client
+      - name: Stop macOS VM container
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
+            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} stop

.gitea/workflows/release.yml

@@ -0,0 +1,86 @@
+name: Release (App Store Connect)
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  wake-macos-vm:
+    runs-on: docker
+    container:
+      image: alpine:3.20
+    steps:
+      - name: Install ssh client
+        run: apk add --no-cache openssh-client
+      - name: Start macOS VM container
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
+            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} start
+
+  build-archive-deliver:
+    needs: wake-macos-vm
+    runs-on: macos-release
+
+    env:
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      ITC_TEAM_ID: ${{ secrets.ITC_TEAM_ID }}
+      DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Verify ASC secrets
+        run: |
+          if [ -z "${{ secrets.ASC_KEY_ID }}" ]; then
+            echo "ERROR: ASC_KEY_ID is empty"
+            exit 1
+          fi
+
+      - name: Set build number
+        run: |
+          cd Darwin
+          agvtool new-version -all ${{ gitea.run_number }}
+
+      - name: Write App Store Connect API key
+        run: |
+          cat > Darwin/fastlane/apikey.json <<EOF
+          {
+            "key_id": "${{ secrets.ASC_KEY_ID }}",
+            "issuer_id": "${{ secrets.ASC_ISSUER_ID }}",
+            "key": "${{ secrets.ASC_KEY_CONTENT }}",
+            "is_key_content_base64": true,
+            "duration": 1200,
+            "in_house": false
+          }
+          EOF
+
+      - name: fastlane release
+        run: |
+          cd Darwin
+          fastlane release
+
+      - name: Clean up API key
+        if: always()
+        run: rm -f Darwin/fastlane/apikey.json
+
+  sleep-macos-vm:
+    needs: build-archive-deliver
+    if: always()
+    runs-on: docker
+    container:
+      image: alpine:3.20
+    steps:
+      - name: Install ssh client
+        run: apk add --no-cache openssh-client
+      - name: Stop macOS VM container
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
+            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} stop

.gitea/workflows/test.yml

@@ -0,0 +1,54 @@
+name: Test (feature branches)
+
+on:
+  pull_request:
+    branches:
+      - "feature/*"
+
+jobs:
+  wake-macos-vm:
+    runs-on: docker
+    container:
+      image: alpine:3.20
+    steps:
+      - name: Install ssh client
+        run: apk add --no-cache openssh-client
+      - name: Start macOS VM container
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
+            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} start
+
+  test:
+    needs: wake-macos-vm
+    runs-on: macos-release
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run unit tests
+        run: |
+          xcodebuild test \
+            -project Darwin/PediFoods.xcodeproj \
+            -scheme "PediFoods App" \
+            -destination "platform=iOS Simulator,name=iPhone 16,OS=latest"
+
+  sleep-macos-vm:
+    needs: test
+    if: always()
+    runs-on: docker
+    container:
+      image: alpine:3.20
+    steps:
+      - name: Install ssh client
+        run: apk add --no-cache openssh-client
+      - name: Stop macOS VM container
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
+            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} stop