Native iOS port: ARM64 bootstrap, IPA pipeline, and zero-to-complete roadmap

.github/workflows/ios-native-signed.yml

@@ -0,0 +1,201 @@
+name: iOS Native Signed IPA
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-signed-ios:
+    runs-on: macos-latest
+    timeout-minutes: 35
+
+    steps:
+      - name: Checkout source and submodules
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+          fetch-depth: 1
+
+      - name: Verify no retail Portal data is committed under native project
+        shell: bash
+        run: |
+          set -euo pipefail
+          if find ios-native -type f \( \
+            -iname '*.vpk' -o -iname '*.bsp' -o -iname '*.vtf' -o -iname '*.vmt' -o \
+            -iname '*.vcs' -o -iname '*.wav' -o -iname '*.mp3' -o -iname '*.mdl' \
+          \) -print -quit | grep -q .; then
+            echo 'Retail/game asset file detected under ios-native/. Refusing signed package.' >&2
+            exit 1
+          fi
+
+      - name: Validate signing configuration
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+          IOS_TEAM_ID: ${{ vars.IOS_TEAM_ID }}
+          IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID }}
+        run: |
+          set -euo pipefail
+          for value in BUILD_CERTIFICATE_BASE64 BUILD_PROVISION_PROFILE_BASE64 P12_PASSWORD KEYCHAIN_PASSWORD IOS_TEAM_ID IOS_BUNDLE_ID; do
+            if [ -z "${!value:-}" ]; then
+              echo "Missing required secret/variable: $value" >&2
+              exit 1
+            fi
+          done
+
+      - name: Install Apple certificate and provisioning profile
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        shell: bash
+        run: |
+          set -euxo pipefail
+          CERTIFICATE_PATH="$RUNNER_TEMP/build_certificate.p12"
+          PP_PATH="$RUNNER_TEMP/build_pp.mobileprovision"
+          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
+
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o "$CERTIFICATE_PATH"
+          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o "$PP_PATH"
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security import "$CERTIFICATE_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychain -d user -s "$KEYCHAIN_PATH"
+
+          security cms -D -i "$PP_PATH" > "$RUNNER_TEMP/profile.plist"
+          PROFILE_UUID="$(/usr/libexec/PlistBuddy -c 'Print :UUID' "$RUNNER_TEMP/profile.plist")"
+          PROFILE_NAME="$(/usr/libexec/PlistBuddy -c 'Print :Name' "$RUNNER_TEMP/profile.plist")"
+          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
+          cp "$PP_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/$PROFILE_UUID.mobileprovision"
+
+          echo "PROFILE_UUID=$PROFILE_UUID" >> "$GITHUB_ENV"
+          echo "PROFILE_NAME=$PROFILE_NAME" >> "$GITHUB_ENV"
+          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
+
+      - name: Configure signed Xcode project
+        env:
+          IOS_BUNDLE_ID: ${{ vars.IOS_BUNDLE_ID }}
+        run: |
+          set -euxo pipefail
+          cmake -S ios-native -B build/ios -G Xcode \
+            -DCMAKE_SYSTEM_NAME=iOS \
+            -DCMAKE_OSX_SYSROOT=iphoneos \
+            -DCMAKE_OSX_ARCHITECTURES=arm64 \
+            -DCMAKE_OSX_DEPLOYMENT_TARGET=15.0 \
+            -DRENDER360_DEPLOYMENT_TARGET=15.0 \
+            -DRENDER360_BUNDLE_ID="$IOS_BUNDLE_ID" \
+            -DRENDER360_BUILD_IDENTIFIER="${GITHUB_SHA}" \
+            -DRENDER360_BUILD_NUMBER="${GITHUB_RUN_NUMBER}"
+
+      - name: Build signed arm64 app
+        env:
+          IOS_TEAM_ID: ${{ vars.IOS_TEAM_ID }}
+          IOS_SIGNING_IDENTITY: ${{ vars.IOS_SIGNING_IDENTITY }}
+        shell: bash
+        run: |
+          set -euxo pipefail
+          SIGNING_IDENTITY="${IOS_SIGNING_IDENTITY:-Apple Development}"
+          xcodebuild \
+            -project build/ios/Render360PortalIOS.xcodeproj \
+            -scheme Render360Portal \
+            -configuration Release \
+            -sdk iphoneos \
+            -destination 'generic/platform=iOS' \
+            -derivedDataPath build/DerivedData \
+            CODE_SIGN_STYLE=Manual \
+            DEVELOPMENT_TEAM="$IOS_TEAM_ID" \
+            CODE_SIGN_IDENTITY="$SIGNING_IDENTITY" \
+            PROVISIONING_PROFILE="$PROFILE_UUID" \
+            ONLY_ACTIVE_ARCH=NO \
+            ARCHS=arm64 \
+            build
+
+      - name: Verify signature and package IPA
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          resolve_app_path() {
+            local candidate
+            for candidate in \
+              build/ios/Release-iphoneos/Render360Portal.app \
+              build/DerivedData/Build/Products/Release-iphoneos/Render360Portal.app; do
+              if [ -d "$candidate" ]; then
+                printf '%s\n' "$candidate"
+                return 0
+              fi
+            done
+            find build -type d -path '*/Release-iphoneos/Render360Portal.app' -print -quit 2>/dev/null || true
+          }
+
+          APP_PATH="$(resolve_app_path)"
+          if [ -z "$APP_PATH" ] || [ ! -d "$APP_PATH" ]; then
+            echo 'Render360 Portal: could not locate the signed iPhoneOS .app bundle.' >&2
+            find build -maxdepth 6 -type d -name '*.app' -print 2>/dev/null || true
+            exit 1
+          fi
+
+          EXECUTABLE="$APP_PATH/Render360Portal"
+          test -f "$EXECUTABLE"
+          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+          codesign -d --entitlements :- "$APP_PATH" || true
+          test "$(lipo -archs "$EXECUTABLE")" = 'arm64'
+
+          python3 - "$APP_PATH/Info.plist" "${{ vars.IOS_BUNDLE_ID }}" <<'PY'
+          import plistlib
+          import sys
+
+          with open(sys.argv[1], 'rb') as handle:
+              info = plistlib.load(handle)
+          assert info.get('CFBundleIdentifier') == sys.argv[2]
+          assert info.get('CFBundleExecutable') == 'Render360Portal'
+          assert info.get('UIDeviceFamily') == [1]
+          assert info.get('CFBundleSupportedPlatforms') == ['iPhoneOS']
+          assert info.get('MinimumOSVersion') == '15.0'
+          assert info.get('UISupportedInterfaceOrientations') == [
+              'UIInterfaceOrientationLandscapeLeft',
+              'UIInterfaceOrientationLandscapeRight',
+          ]
+          print('Validated signed N0 bundle metadata')
+          PY
+
+          rm -rf build/ipa-signed
+          mkdir -p build/ipa-signed/Payload
+          ditto "$APP_PATH" build/ipa-signed/Payload/Render360Portal.app
+          (cd build/ipa-signed && /usr/bin/zip -qry ../Render360-Portal-iOS-signed.ipa Payload)
+          IPA=build/Render360-Portal-iOS-signed.ipa
+          test -s "$IPA"
+          /usr/bin/unzip -Z1 "$IPA" > build/signed-ipa-contents.txt
+          grep -qx 'Payload/Render360Portal.app/Render360Portal' build/signed-ipa-contents.txt
+          if grep -Eiq '\.(vpk|bsp|vtf|vmt|vcs|wav|mp3|mdl)$' build/signed-ipa-contents.txt; then
+            echo 'Retail/game asset extension detected inside signed IPA.' >&2
+            exit 1
+          fi
+          ls -lh "$IPA"
+
+      - name: Upload signed IPA
+        uses: actions/upload-artifact@v4
+        with:
+          name: Render360-Portal-iOS-signed-${{ github.run_number }}
+          path: build/Render360-Portal-iOS-signed.ipa
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Clean up signing material
+        if: ${{ always() }}
+        shell: bash
+        run: |
+          if [ -n "${KEYCHAIN_PATH:-}" ] && [ -f "$KEYCHAIN_PATH" ]; then
+            security delete-keychain "$KEYCHAIN_PATH" || true
+          fi
+          if [ -n "${PROFILE_UUID:-}" ]; then
+            rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/$PROFILE_UUID.mobileprovision" || true
+          fi

.github/workflows/ios-native.yml

@@ -0,0 +1,135 @@
+name: iOS Native Bootstrap IPA
+on:
+  push:
+    branches: [render360/ios-native]
+    paths:
+      - 'ios-native/**'
+      - 'tier0/**'
+      - 'tier1/**'
+      - 'mathlib/**'
+      - 'common/**'
+      - 'public/**'
+      - '.github/workflows/ios-native.yml'
+      - 'docs/IOS_NATIVE_**'
+  workflow_dispatch:
+permissions: { contents: read }
+jobs:
+  build-ios-native:
+    runs-on: macos-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout source and submodules
+        uses: actions/checkout@v6
+        with: { submodules: recursive, fetch-depth: 1 }
+      - name: Print toolchain
+        run: |
+          set -euxo pipefail
+          xcodebuild -version; cmake --version; clang --version
+      - name: Verify native source boundaries
+        shell: bash
+        run: |
+          set -euo pipefail
+          if find ios-native -type f \( -iname '*.vpk' -o -iname '*.bsp' -o -iname '*.vtf' -o -iname '*.vmt' -o -iname '*.vcs' -o -iname '*.wav' -o -iname '*.mp3' -o -iname '*.mdl' \) -print -quit | grep -q .; then echo 'Retail game asset detected.' >&2; exit 1; fi
+          if grep -RInE '__EMSCRIPTEN__|MEMFS|WORKERFS|SharedArrayBuffer|PROXY_TO_PTHREAD|OffscreenCanvas' ios-native/Sources ios-native/SourceCompat ios-native/CMakeLists.txt ios-native/cmake; then echo 'Browser runtime dependency entered native target.' >&2; exit 1; fi
+          grep -q 'add_library(r360_tier0 STATIC' ios-native/cmake/SourceFoundation.cmake
+          grep -q 'add_library(r360_tier1 STATIC' ios-native/cmake/SourceFoundation.cmake
+          grep -q 'add_library(r360_mathlib STATIC' ios-native/cmake/SourceFoundation.cmake
+      - name: Configure Xcode arm64 iPhone project
+        run: |
+          set -euxo pipefail
+          cmake -S ios-native -B build/ios -G Xcode -DCMAKE_SYSTEM_NAME=iOS -DCMAKE_OSX_SYSROOT=iphoneos -DCMAKE_OSX_ARCHITECTURES=arm64 -DCMAKE_OSX_DEPLOYMENT_TARGET=15.0 -DRENDER360_DEPLOYMENT_TARGET=15.0 -DRENDER360_BUNDLE_ID=com.render360.portal -DRENDER360_BUILD_IDENTIFIER="${GITHUB_SHA}" -DRENDER360_BUILD_NUMBER="${GITHUB_RUN_NUMBER}"
+      - name: Verify pinned SDL2 and generated iPhoneOS settings
+        shell: bash
+        run: |
+          set -euo pipefail
+          grep -Fx 'version=2.32.10' build/ios/render360-sdl2-version.txt
+          grep -Fx 'commit=5d249570393f7a37e037abf22cd6012a4cc56a71' build/ios/render360-sdl2-version.txt
+          grep -Fx 'sha256=5f5993c530f084535c65a6879e9b26ad441169b3e25d789d83287040a9ca5165' build/ios/render360-sdl2-version.txt
+          xcodebuild -project build/ios/Render360PortalIOS.xcodeproj -scheme Render360Portal -configuration Release -sdk iphoneos -destination 'generic/platform=iOS' -showBuildSettings | tee build/xcode-build-settings.txt
+          grep -Eq '^[[:space:]]*ARCHS = arm64$' build/xcode-build-settings.txt
+          grep -Eq '^[[:space:]]*IPHONEOS_DEPLOYMENT_TARGET = 15\.0$' build/xcode-build-settings.txt
+          grep -Eq '^[[:space:]]*PRODUCT_BUNDLE_IDENTIFIER = com\.render360\.portal$' build/xcode-build-settings.txt
+          grep -Eq '^[[:space:]]*SUPPORTED_PLATFORMS = iphoneos$' build/xcode-build-settings.txt
+          grep -Eq '^[[:space:]]*TARGETED_DEVICE_FAMILY = 1$' build/xcode-build-settings.txt
+          grep -Eq '^[[:space:]]*SUPPORTS_MAC_DESIGNED_FOR_IPHONE_IPAD = NO$' build/xcode-build-settings.txt
+          grep -Eq '^[[:space:]]*SUPPORTS_XR_DESIGNED_FOR_IPHONE_IPAD = NO$' build/xcode-build-settings.txt
+      - name: Build N2 Source foundation in dependency order
+        shell: bash
+        run: |
+          set -euxo pipefail
+          for target in r360_tier0 r360_tier1 r360_mathlib; do
+            echo "=== building ${target} ==="
+            xcodebuild -project build/ios/Render360PortalIOS.xcodeproj -target "${target}" -configuration Release -sdk iphoneos -destination 'generic/platform=iOS' CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO ONLY_ACTIVE_ARCH=NO ARCHS=arm64 build
+          done
+      - name: Verify N2 static ARM64 products
+        shell: bash
+        run: |
+          set -euxo pipefail
+          : > build/foundation-libraries.txt
+          for stem in tier0_ios tier1_ios mathlib_ios; do
+            lib="$(find build/ios -type f -name "lib${stem}.a" -print -quit)"
+            test -n "$lib"
+            archs="$(lipo -archs "$lib")"
+            test "$archs" = arm64
+            echo "${stem}=${lib} arch=${archs}" | tee -a build/foundation-libraries.txt
+          done
+          if grep -Eq '(^|[[:space:]])(i386|x86_64)([[:space:]]|$)' build/foundation-libraries.txt; then exit 1; fi
+      - name: Build unsigned arm64 N2 app
+        run: |
+          set -euxo pipefail
+          xcodebuild -project build/ios/Render360PortalIOS.xcodeproj -scheme Render360Portal -configuration Release -sdk iphoneos -destination 'generic/platform=iOS' -derivedDataPath build/DerivedData CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO ONLY_ACTIVE_ARCH=NO ARCHS=arm64 build
+      - name: Verify N2 bundle and package unsigned IPA
+        shell: bash
+        run: |
+          set -euxo pipefail
+          APP_PATH=build/ios/Release-iphoneos/Render360Portal.app
+          if [ ! -d "$APP_PATH" ]; then APP_PATH=build/DerivedData/Build/Products/Release-iphoneos/Render360Portal.app; fi
+          test -f "$APP_PATH/Render360Portal"
+          lipo -archs "$APP_PATH/Render360Portal" | tee build/architecture.txt
+          test "$(cat build/architecture.txt)" = arm64
+          nm "$APP_PATH/Render360Portal" | grep -q '_SDL_Init'
+          python3 - "$APP_PATH/Info.plist" <<'PY'
+          import plistlib,sys
+          with open(sys.argv[1],'rb') as f: info=plistlib.load(f)
+          assert info.get('CFBundleIdentifier')=='com.render360.portal'
+          assert info.get('CFBundleExecutable')=='Render360Portal'
+          assert info.get('UIRequiresFullScreen') is True
+          assert info.get('UIFileSharingEnabled') is True
+          assert info.get('LSSupportsOpeningDocumentsInPlace') is True
+          assert info.get('UISupportedInterfaceOrientations')==['UIInterfaceOrientationLandscapeLeft','UIInterfaceOrientationLandscapeRight']
+          assert info.get('UIRequiredDeviceCapabilities')==['arm64']
+          assert info.get('UIDeviceFamily')==[1]
+          assert info.get('CFBundleSupportedPlatforms')==['iPhoneOS']
+          assert info.get('MinimumOSVersion')=='15.0'
+          assert not any(k.startswith('NS') and k.endswith('UsageDescription') for k in info)
+          PY
+          rm -rf build/ipa; mkdir -p build/ipa/Payload; ditto "$APP_PATH" build/ipa/Payload/Render360Portal.app
+          cat > build/ipa/BUILD_INFO.txt <<INFO
+          Render360 Portal native iOS N2 Source foundation
+          commit=${GITHUB_SHA}
+          sdl=2.32.10
+          sdl_commit=5d249570393f7a37e037abf22cd6012a4cc56a71
+          source_foundation=tier0,tier1,mathlib
+          sdk=iphoneos
+          deployment=15.0
+          arch=arm64
+          signing=unsigned
+          retail_assets=bundled:no
+          INFO
+          (cd build/ipa && /usr/bin/zip -qry ../Render360-Portal-iOS-unsigned.ipa Payload BUILD_INFO.txt)
+          /usr/bin/unzip -Z1 build/Render360-Portal-iOS-unsigned.ipa | tee build/ipa-contents.txt
+          grep -qx 'Payload/Render360Portal.app/Render360Portal' build/ipa-contents.txt
+          if grep -Eiq '\.(vpk|bsp|vtf|vmt|vcs|wav|mp3|mdl)$' build/ipa-contents.txt; then exit 1; fi
+      - name: Upload unsigned IPA
+        uses: actions/upload-artifact@v4
+        with:
+          name: Render360-Portal-iOS-unsigned-${{ github.run_number }}
+          path: |
+            build/Render360-Portal-iOS-unsigned.ipa
+            build/architecture.txt
+            build/foundation-libraries.txt
+            build/xcode-build-settings.txt
+            build/ipa-contents.txt
+            build/ios/render360-sdl2-version.txt
+          if-no-files-found: error
+          retention-days: 30