[maxonary]

Chime has a manual TestFlight release path but no repository CI. This draft adds checks for relevant PR changes and an explicitly disabled-by-default internal TestFlight job for validated, app-changing main commits. It is independent of the dot bridge in #21 and includes no app-client changes.

Behavior

• Every PR and main push gets pipeline tests, workflow lint and a stable Validated commit gate. Gateway code runs Node 22 typechecking/unit tests; app changes run Watch Swift checks, unsigned iPhone + Watch simulator builds, and an unsigned Release archive that verifies the embedded Watch/widgets and matching versions.
• Complete git-diff path classification skips app uploads for gateway-only, docs-only, test-only and pipeline-only changes.
• The upload job depends on successful applicable checks from the same run and exact commit. It accepts only main pushes in this repository, uses a protected internal-testflight environment, serializes uploads, and rechecks current main before archive and upload.
• Native Xcode signing/export uses an existing P12, three existing distribution profiles and an App Store Connect API key. Ephemeral keychain/profile cleanup, exact team/bundle/certificate checks, no automatic provisioning, no PR artifact reuse, and only contents: read GitHub permission.
• One reserved build-number namespace (offset + run_number).run_attempt.0 across all three targets; retry attempts get distinct builds. Xcode build-number management is disabled during export.
• testFlightInternalTestingOnly=true prevents external TestFlight/App Store distribution. No gateway deployment, tester invitations or App Store submission.

Activation stays a separate operator decision

The release job cannot run until TESTFLIGHT_UPLOAD_ENABLED=true is explicitly set and the protected environment, branch restrictions/reviewers, build offset and Apple environment secrets are configured. Missing configuration fails closed. No credentials, environment permissions, live uploads, provisioning changes or deployments were created/performed in this task.

See setup, security boundaries and operations. The workflow uses GitHub's official Xcode 27 preview image, pinned to the Xcode 27.0 app path; image availability remains an external dependency. Preserve the documented build-number namespace when mixing manual and CI releases.

Validation

Hosted CI run 37006320923 passed on final commit eb6308dca0e74fd6f9ac09a95a93499c39e61a5e: pipeline tests/lint, gateway tests, iPhone/Watch checks and the validation gate are green. Internal TestFlight was skipped as intended.

• 9 pipeline unit tests passed (filters/large diffs, build allocation, signing maps/profile validation, archive contents, stale SHA and trigger/secret guards).
• actionlint 1.7.7 passed; shell syntax and git diff --check passed.
• Gateway npm run typecheck and 67 unit tests passed on clean main-based code.
• Local Xcode 27.0: scripts/check-watch.sh, iPhone simulator build, Watch simulator build, unsigned Release archive all passed; archive verifies iPhone + embedded Watch + widgets with matching versions.
• Xcode accepted the release script's temporary XML project and 1012.2.0 build override with signing disabled.
• Real signing/API permissions/upload/Apple processing/internal-group distribution remain unverified until separately authorized setup. No real TestFlight build was uploaded.