build(client/ios): add a release build for the Capacitor app

[ohnorobo]

What

Adds a production release path for the Capacitor iOS app, step 2 of the Capacitor migration plan. It is stacked on #2867, which adds the release mode of the shared web bundle.

npm run action client/capacitor/build ios -- --buildMode=release --versionName=<version>

runs xcodebuild archive on ios/App/App.xcodeproj with the Release configuration and leaves the archive at output/client/ios/Outline.xcarchive.

Nothing in outline-release changes yet, so releases keep using Cordova. macOS is not part of this PR.

Differences from the Cordova release build

• The version and build number are passed to xcodebuild as MARKETING_VERSION and CURRENT_PROJECT_VERSION instead of being substituted into generated plists. This versions the VpnExtension too, which the Cordova build leaves at 1.0 (1).
• The archive has a fixed path under output/, like every other platform's artifacts. The Cordova build archives into Xcode's Archives folder, which the release scripts search by timestamp.
• DEVELOPMENT_TEAM is required in the environment. The Capacitor app target has no team of its own, where the Cordova project hardcodes one, so the action fails up front without it rather than at signing time.

Verified

Locally, with Xcode 26.2:

• An unsigned archive built with the same xcodebuild arguments plus CODE_SIGNING_ALLOWED=NO succeeds. In it, the app and the VpnExtension both carry the requested version and build number, the web bundle is the production build with the DSN in environment.json, and the dSYMs for the app and the extension are present.
• The action fails with a clear message when DEVELOPMENT_TEAM is not set.
• The debug build through the refactored action still succeeds.

Full release build (1.21.6)

Built as a real release through the outline-release scripts (OutlineFoundation/outline-release#17, build client ios) from this PR's head 4dde5a4. 1.21.6 is a dummy version not intended for publishing, and the publish step (App Store submission) has not been tested.

• The action produced a signed archive (version 1.21.6, build 497604) with the team's signing identity, and it exported and uploaded to App Store Connect: TestFlight build. It went to internal TestFlight only; I did not add it to the external tester group.
• The dSYMs went to Sentry, and the build is tagged client_ios/v1.21.6-rc.1.

Caveat

The Capacitor app's deployment target is iOS 16.6. The Cordova app's is 15.5, so devices on iOS 15.5 to 16.5 would stop getting updates.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds iOS release build signing and archive creation.

The PR appears safe to merge, with no new actionable findings.

What we checked:

• Release numbers stay together: main passes its build number to both steps, so crossing an hour boundary does not split their release identity.

Summary

Adds a signed Capacitor iOS release archive at output/client/ios/Outline.xcarchive.

• Capacitor iOS release builds now create signed archives.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[iOS release command] --> B[Check development team]
  B --> C[Build production web bundle]
  C --> D[Sync iOS and build Go framework]
  D --> E[Archive app and VPN extension]
  E --> F[output/client/ios/Outline.xcarchive]

Loading

_{Reviews (2) · Last reviewed commit: "build(client/ios): archive the release t..." · Reviewed by Greptile}