.github/workflows/build-and-release.yml

@@ -304,9 +304,46 @@ jobs:
           path: ${{ matrix.artifact_paths }}
           if-no-files-found: error
 
+  remote_contract:
+    name: Test - remote provider contract
+    runs-on: ubuntu-22.04
+    needs:
+      - build
+    # Test-stage quality gate: runs between build and release.
+    # continue-on-error keeps it skippable so a failure never blocks release.
+    continue-on-error: true
+    if: ${{ github.event_name != 'push' && github.event_name != 'pull_request' }}
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v7
+
+      - name: Load Vault secrets
+        id: vault
+        uses: hashicorp/vault-action@v4
+        with:
+          url: ${{ env.VAULT_ADDR }}
+          method: jwt
+          role: github-actions-xworkmate-app
+          jwtGithubAudience: vault
+          ignoreNotFound: true
+          secrets: |
+            kv/data/github-actions/xworkmate-app REVIEW_ACCOUNT_LOGIN_PASSWORD | REVIEW_ACCOUNT_LOGIN_PASSWORD
+
+      - name: Export remote contract secrets
+        run: echo "REVIEW_ACCOUNT_LOGIN_PASSWORD=${{ steps.vault.outputs.REVIEW_ACCOUNT_LOGIN_PASSWORD }}" >> "$GITHUB_ENV"
+
+      - name: Verify accounts to bridge provider contract
+        shell: bash
+        env:
+          REVIEW_ACCOUNT_BASE_URL: ${{ vars.REVIEW_ACCOUNT_BASE_URL }}
+          REVIEW_ACCOUNT_LOGIN_NAME: ${{ vars.REVIEW_ACCOUNT_LOGIN_NAME }}
+        run: bash ./scripts/ci/verify_remote_provider_contract.sh
 
   release:
-    if: ${{ needs.prepare.outputs.should_release == 'true' && needs.prepare.result == 'success' && needs.build.result == 'success' }}
+    # always() so release waits for the remote_contract gate to finish but is
+    # never blocked by it being skipped (e.g. push events) or failing.
+    # build/prepare must still genuinely succeed.
+    if: ${{ always() && needs.prepare.outputs.should_release == 'true' && needs.prepare.result == 'success' && needs.build.result == 'success' }}
     strategy:
       fail-fast: false
       matrix:
@@ -329,6 +366,7 @@ jobs:
     needs:
       - prepare
       - build
+      - remote_contract
     steps:
       - name: Checkout source
         uses: actions/checkout@v7

scripts/ensure-framework-dsyms.sh

@@ -1,9 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Generate dSYMs that App Store validation expects for embedded frameworks.
-# Some prebuilt dependencies, including WebRTC, do not ship a dSYM even though
-# their Mach-O binaries contain UUIDs that App Store Connect requires.
+# Generate the dSYM that App Store validation expects for the vendored
+# objective_c native-asset framework after Xcode/CocoaPods embed it.
 if [[ "${CONFIGURATION:-}" != "Release" && "${CONFIGURATION:-}" != "Profile" ]]; then
   exit 0
 fi
@@ -23,22 +22,6 @@ fi
 
 mkdir -p "${DWARF_DSYM_FOLDER_PATH}"
 
-dsym_matches_binary() {
-  local binary_path="$1"
-  local dsym_path="$2"
-  local binary_uuids dsym_uuids uuid
-
-  [[ -d "${dsym_path}" ]] || return 1
-
-  binary_uuids="$(xcrun dwarfdump --uuid "${binary_path}" 2>/dev/null || true)"
-  dsym_uuids="$(xcrun dwarfdump --uuid "${dsym_path}" 2>/dev/null || true)"
-  [[ -n "${binary_uuids}" && -n "${dsym_uuids}" ]] || return 1
-
-  while read -r uuid; do
-    [[ -z "${uuid}" ]] || grep -Fq "${uuid}" <<<"${dsym_uuids}" || return 1
-  done < <(awk '/^UUID:/ { print $2 }' <<<"${binary_uuids}")
-}
-
 for framework_path in "${frameworks_dir}"/*.framework; do
   [[ -d "${framework_path}" ]] || continue
 
@@ -46,8 +29,10 @@ for framework_path in "${frameworks_dir}"/*.framework; do
   binary_path="${framework_path}/${framework_name}"
   [[ -f "${binary_path}" ]] || continue
 
+  [[ "${framework_name}" == "objective_c" ]] || continue
+
   dsym_path="${DWARF_DSYM_FOLDER_PATH}/${framework_name}.framework.dSYM"
-  if dsym_matches_binary "${binary_path}" "${dsym_path}"; then
+  if [[ -d "${dsym_path}" ]]; then
     continue
   fi
 
@@ -55,10 +40,17 @@ for framework_path in "${frameworks_dir}"/*.framework; do
     continue
   fi
 
-  echo "Generating missing or mismatched dSYM for ${framework_name}.framework"
-  rm -rf "${dsym_path}"
+  echo "Generating missing dSYM for ${framework_name}.framework"
   if ! xcrun dsymutil "${binary_path}" -o "${dsym_path}" >/dev/null 2>&1; then
     echo "warning: Failed to generate dSYM for ${framework_name}.framework" >&2
     rm -rf "${dsym_path}" || true
   fi
 done
+
+# Workaround for App Store Connect bug where it expects the DWARF file for App.framework to be named "A"
+# because the binary is located at App.framework/Versions/A/App.
+app_dwarf_dir="${DWARF_DSYM_FOLDER_PATH}/App.framework.dSYM/Contents/Resources/DWARF"
+if [[ -d "${app_dwarf_dir}" && -f "${app_dwarf_dir}/App" && ! -f "${app_dwarf_dir}/A" ]]; then
+  echo "Applying workaround: Copying App DWARF file to A for App Store Connect validation"
+  cp "${app_dwarf_dir}/App" "${app_dwarf_dir}/A"
+fi