[apoorvdarshan]

Moves Verceltics' App Store and Google Play release pipeline from store-release v0.2.0 to v0.3.0 (3e580dc136d0ede17e8f4d12e9385fb512d02faf; gh api repos/apoorvdarshan/store-release/git/ref/tags/v0.3.0 returns that commit). The v0.3.0 changelog has Impact release-path, so this PR is validated with dispatches before merging.

Changes in this PR

• ios-release.yml, android-release.yml, store-checks.yml: re-rendered with store-release's own renderer: run.py callers render --platform ios|android|checks --sha 3e580dc136d0ede17e8f4d12e9385fb512d02faf --version 0.3.0 --app-repository apoorvdarshan/verceltics. With the SHA filled in, they are byte-identical to store-release v0.3.0's examples/verceltics/callers/.
  • All ten store-release pins move from @0b298d3e… # v0.2.0 to @3e580dc1… # v0.3.0.
  • The text changes are the iOS caller's docs link (tree/v0.3.0/docs), the marketing_version hint (e.g. 1.2 instead of Fud AI's 7.2), the Android caller's verification comment (it now points at docs/verification.md), and the Store checks comment.
  • Job names, if: conditions, inputs, permissions, concurrency and the explicit secret mapping are unchanged: tests, prepare, build, wait-for-build, app-store-connect, github-release, store-plan (iOS); gates, quality, release, store-plan (Android); checks, store-release (Store checks). No job is named web, android or catalog, so the required checks still come only from ci.yml and CodeQL.
• store/store-release.toml: unchanged. v0.3.0 needs no config edit for this app. The file is still byte-identical to store-release v0.3.0's examples/verceltics/store-release.toml; its header comment still links the v0.2.0 config docs, the same as the example (schema 1 has not changed).
• store/README.md: says v0.3.0 and links the v0.3.0 docs. v0.3.0 moved the shared CI signing identity's renewal steps out of secrets.md, so that link now goes to provenance.md#facts-that-only-concern-the-six-apps.

No switch, variable, secret or ruleset changes. To roll back, revert this PR: the v0.2.0 commit stays valid because tags never move.

What v0.2.0 → v0.3.0 changes for Verceltics

1. How every job gets this repo's files. job-setup now runs a separate step for the lazy blob fetch of each job's sparse checkout. That step passes the job's read-only GITHUB_TOKEN to that one git command as environment config (GIT_CONFIG_*, never .git/config or argv), via fetch-app-files.sh. Verceltics is public, so every job fetches the same files as before (paths --job … is unchanged for this config). The change only matters for private repositories. Every job of both pipelines goes through it.

2. The iOS store plan when the App Store version does not exist yet (the case this app always validates: marketing_version is the next, unapproved version, and IOS_CREATE_VERSION is on). v0.2.0's ported-flow plan said "IOS_CREATE_VERSION would create it" and stopped with CLEAN, without running any later check. v0.3.0 runs every check a tag run makes that needs no App Store version:

   • the catalog check (as on a tag run, Products.storekit and BillingModels.kt);
   • the local files for the enabled switches (ios_metadata.py check --listing and the tag's What's New from RELEASE_NOTES.md);
   • the app's review drafts, with IOS_SUBMIT_REVIEW on.

   It then lists, in a line and a ::notice, what only the created version can show: its state, listing and What's New localizations, its place in the review draft, and the catalog products that go to review with it. For an existing version it now also runs the catalog and local-file checks before the preflight.

3. The flow names. The default flow is now called standard (fud-ai is still accepted). The reusable workflows now test STORE_RELEASE_*_FLOW != 'standard' instead of != 'fud-ai'. For flow = "verceltics" they select exactly the same ported steps as before.

4. Config validation. android.whats_new.version_file is now refused (the verceltics flow used to accept it and ignore it); this config does not set it. ios.build.runner is a new optional key; it is not set, so the build job still runs on xcode-27.

5. Store checks. The new skip-when-the-table-is-missing logic applies to the standard flow only. Verceltics' Store checks still run its ported ios pr-checks and android pr-checks with every switch on.

6. Changes that do not affect this app:

   • run.py init and the templates;
   • docs written for any developer, now tested against the code;
   • no app's identity left outside store_release/flows/;
   • canary --expect;
   • the certifi advisory note. certifi 2026.10.19 already shipped in v0.2.0, so this repository already had it.

Local checks (store-release v0.3.0 checkout, Python 3.13, hash-locked requirements)

• caller check --pr: callers match store-release v0.3.0 (ios-release.yml, android-release.yml, store-checks.yml); the v0.3.0 tag points at 3e580dc136d0ede17e8f4d12e9385fb512d02faf.
• pins check: 10 store-release pins are 3e580dc… # v0.3.0; the v0.3.0 tag points at that commit.
• Also passed:
  • config check --files (17 files checked);
  • yanked check;
  • catalog check (iOS and Android: 7 products each);
  • release-notes --check-headings;
  • ios pr-checks;
  • android pr-checks.

Validation

These are workflow_dispatch runs on this branch: build, sign and verify plus the read-only store plan. Nothing was uploaded and nothing was written to App Store Connect, Google Play or GitHub Releases. The head is 71cd7a8: this PR's commit a96b47c with main (c9dbeb3, a wrangler bump in web/) merged in. Both heads were validated, with the same results.

Run	Head	Result
iOS Release 39517787474, marketing_version=2.1.1	71cd7a8	passed
Android Release 39517791080	71cd7a8	passed
iOS Release 39517437135, marketing_version=2.1.1	a96b47c	passed
Android Release 39517441039	a96b47c	passed

iOS

• prepare: passed.
  • Ran store-release v0.3.0 (3e580dc); its selftest passed (287 tests).
  • caller check --runtime: 6 pins match and the release concurrency queues; the v0.3.0 tag points at the pin. The version is not yanked.
  • scripts/ci/release_gate_tests.sh passed (10 tests).
  • Catalog check: the 7 products match Products.storekit.
  • Validation mode: every store switch resolves off on a dispatch. The next build number is 43.
• build: passed.
  • Archive succeeded; verified com.apoorvdarshan.verceltics 2.1.1 (43), with export compliance NO.
  • The cloud-signed export succeeded, and altool --validate-app reported "No errors validating archive" ("validated 2.1.1 (43) with App Store Connect — nothing uploaded").
  • wait-for-build, app-store-connect and github-release were skipped.

Android

• gates: passed. Its selftest passed (186 tests), caller check --runtime passed and the version is not yanked. It resolved mode=validate, build=true, github_release=false, play_upload=false.
• release: passed.
  • Catalog check: the 7 products match BillingModels.kt.
  • The signed AAB and APK were built; the bundletool 1.18.3 checksum is OK.
  • Verified com.apoorvdarshan.verceltics 1.0 (44), signed by the pinned upload key fe735c7c…61f1ef.
  • "No Play track selected — nothing was uploaded to Google Play". No Sigstore signing, attestation or GitHub Release.

The read-only token fetch

Every job ran job-setup's new "Check out this job's files of the app" step (fetch-app-files.sh, with the job's token masked): prepare, build and store-plan on iOS; gates, release and store-plan on Android. The later steps read the files it fetched: the prepare checks, the catalog checks, the archive, the Gradle build and both plans.

Store plans, with today's repository variables

iOS (the same on both heads):

== the catalog check a tag run's prepare makes (offline): passed
ios: 7 catalog products match Products.storekit
== the local files the enabled switches upload (offline): a tag run would fail here
listing en-US: 8 fields OK
error: What's New needs a ## ios-v2.1.1 section in RELEASE_NOTES.md
== the app's draft review submissions: passed
no draft review submission yet: the tag run creates one when it submits
iOS store plan (verceltics flow):
  a tag run of ios-v2.1.1 would resolve: create_version, upload_build, listing, whats_new, submit, public_release
  App Store version 2.1.1 is missing: IOS_CREATE_VERSION would create it first
  not checked until the tag run creates App Store version 2.1.1: the version's state; its localizations and which listing fields would change; its What's New localizations; the version's place in the review draft; the catalog products that go to review with it (the tag run checks them once it has created the version, before anything is uploaded)
  problem 1: What's New needs a ## ios-v2.1.1 section in RELEASE_NOTES.md
store-plan: 1 PROBLEM(S)

Android (the same on both heads):

Android store plan (verceltics flow):
  a tag run of android-v1.0 would resolve: nothing (every store switch is off)
  Google Play: a tag run would build and release nothing
store-plan: CLEAN

Both plans match the repository variables exactly. IOS_UPLOAD_SCREENSHOTS is false, IOS_UPLOAD_CREATIVE_ASSETS is unset and every ANDROID_* switch is false, so screenshots, creative assets and Play appear nowhere in them.

The iOS problem shows the v0.3.0 fix working; it is not a pipeline defect. RELEASE_NOTES.md has only ## ios-v2.1. With IOS_UPLOAD_WHATS_NEW on, a real ios-v2.1.1 tag run would stop in prepare with exactly this message, before it creates the version or builds anything. For the same version and switches, v0.2.0's plan said store-plan: CLEAN without running the check (39507930078). The problem goes away once the 2.1.1 release adds its ## ios-v2.1.1 notes, which is step 2 of the release procedure in store/README.md. This PR does not add release notes.

🤖 Generated with Claude Code