.NET MAUI 10 GitHub Actions CI/CD パイプライン構築ガイド：iOS署名・Android署名・TestFlight・Play Store自動配信（2026年版）

- name: Setup .NET 10 SDK
  uses: actions/setup-dotnet@v4
  with:
    dotnet-version: '10.0.x'

- name: Install .NET MAUI workload
  run: |
    dotnet workload install maui --ignore-failed-sources
    dotnet workload list

- name: Restore NuGet packages
  run: dotnet restore MyApp.sln --locked-mode

# ローカルの Mac / Linux で 1 回だけ実行
base64 -i myapp-release.keystore | pbcopy   # macOS
# 出力を GitHub → Settings → Secrets → Actions に貼り付ける
# キー名の例: ANDROID_KEYSTORE_BASE64

# あわせて次の 3 つも Secrets に登録する
#   ANDROID_KEYSTORE_PASSWORD  … keytool の -storepass
#   ANDROID_KEY_ALIAS          … keytool の -alias
#   ANDROID_KEY_PASSWORD       … keytool の -keypass

- name: Decode Android keystore
  env:
    KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
  run: |
    echo "$KEYSTORE_B64" | base64 --decode > $RUNNER_TEMP/release.keystore
    echo "KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> $GITHUB_ENV

- name: Publish Android AAB
  env:
    KEYSTORE_PWD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
    KEY_ALIAS:    ${{ secrets.ANDROID_KEY_ALIAS }}
    KEY_PWD:      ${{ secrets.ANDROID_KEY_PASSWORD }}
  run: |
    dotnet publish src/MyApp/MyApp.csproj \
      -c Release \
      -f net10.0-android \
      -p:AndroidPackageFormat=aab \
      -p:AndroidKeyStore=true \
      -p:AndroidSigningKeyStore=$KEYSTORE_PATH \
      -p:AndroidSigningStorePass="$KEYSTORE_PWD" \
      -p:AndroidSigningKeyAlias="$KEY_ALIAS" \
      -p:AndroidSigningKeyPass="$KEY_PWD" \
      -p:ApplicationVersion=$GITHUB_RUN_NUMBER \
      -o $RUNNER_TEMP/android-out

# ローカルで 1 回だけ実行（macOS）
gem install fastlane
cd platforms/ios   # Fastfile を置くディレクトリ
fastlane match init          # 対話式で Git リポジトリ URL を設定
fastlane match appstore      # App Store 用証明書と provisioning を生成 → 暗号化 push

- name: Restore iOS signing assets via match
  env:
    MATCH_PASSWORD:      ${{ secrets.MATCH_PASSWORD }}
    MATCH_GIT_URL:       ${{ secrets.MATCH_GIT_URL }}
    MATCH_GIT_BASIC_AUTH: ${{ secrets.MATCH_GIT_BASIC_AUTH }}
  run: |
    cd platforms/ios
    bundle exec fastlane match appstore --readonly

- name: Publish iOS IPA
  env:
    APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
  run: |
    dotnet publish src/MyApp/MyApp.csproj \
      -c Release \
      -f net10.0-ios \
      -p:RuntimeIdentifier=ios-arm64 \
      -p:ArchiveOnBuild=true \
      -p:CodesignKey="Apple Distribution: My Company ($APPLE_TEAM_ID)" \
      -p:CodesignProvision="match AppStore com.mycompany.myapp" \
      -p:ApplicationVersion=$GITHUB_RUN_NUMBER \
      -o $RUNNER_TEMP/ios-out

- name: Upload IPA to TestFlight
  env:
    APP_STORE_CONNECT_API_KEY_ID:       ${{ secrets.ASC_KEY_ID }}
    APP_STORE_CONNECT_API_ISSUER_ID:    ${{ secrets.ASC_ISSUER_ID }}
    APP_STORE_CONNECT_API_KEY_CONTENT:  ${{ secrets.ASC_KEY_P8 }}
  run: |
    bundle exec fastlane pilot upload \
      --api_key_path <(cat << JSON
      {
        "key_id":     "$APP_STORE_CONNECT_API_KEY_ID",
        "issuer_id":  "$APP_STORE_CONNECT_API_ISSUER_ID",
        "key":        "$APP_STORE_CONNECT_API_KEY_CONTENT",
        "in_house":   false
      }
      JSON
      ) \
      --ipa "$RUNNER_TEMP/ios-out/MyApp.ipa" \
      --skip_waiting_for_build_processing true \
      --changelog "Build $GITHUB_RUN_NUMBER from $GITHUB_SHA"

- name: Restore Play service account JSON
  env:
    PLAY_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
  run: |
    echo "$PLAY_JSON" > $RUNNER_TEMP/play-service-account.json
    echo "PLAY_JSON_PATH=$RUNNER_TEMP/play-service-account.json" >> $GITHUB_ENV

- name: Upload AAB to Google Play internal track
  run: |
    bundle exec fastlane supply \
      --package_name "com.mycompany.myapp" \
      --aab "$RUNNER_TEMP/android-out/com.mycompany.myapp-Signed.aab" \
      --track internal \
      --release_status draft \
      --json_key "$PLAY_JSON_PATH" \
      --skip_upload_metadata true \
      --skip_upload_images true \
      --skip_upload_screenshots true

- name: Cache NuGet packages
  uses: actions/cache@v4
  with:
    path: |
      ~/.nuget/packages
      ~/.dotnet/toolResolverCache
    key: nuget-${{ runner.os }}-${{ hashFiles('**/packages.lock.json') }}
    restore-keys: |
      nuget-${{ runner.os }}-

- name: Cache Gradle
  if: runner.os != 'Windows'
  uses: actions/cache@v4
  with:
    path: |
      ~/.gradle/caches
      ~/.gradle/wrapper
    key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*') }}
    restore-keys: |
      gradle-${{ runner.os }}-

name: Release

on:
  push:
    tags: [ 'v*.*.*' ]
  workflow_dispatch:

jobs:
  build-android:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with: { dotnet-version: '10.0.x' }
      - run: dotnet workload install maui-android --ignore-failed-sources
      # ... (Android 署名 → publish → artifact upload)

  build-ios:
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with: { dotnet-version: '10.0.x' }
      - uses: ruby/setup-ruby@v1
        with: { ruby-version: '3.3', bundler-cache: true }
      - run: dotnet workload install maui-ios --ignore-failed-sources
      # ... (match → publish → artifact upload)

  deploy:
    needs: [ build-android, build-ios ]
    runs-on: macos-14
    steps:
      - uses: actions/download-artifact@v4
      # ... (fastlane pilot / fastlane supply)