Google Play and App Store publishing as two Gitea actions

play uploads an Android App Bundle to a track or moves a release between
tracks; apple uploads an iOS build for TestFlight and submits a version for
review. Each is one Python file over the store's own API, with openssl for
the signed tokens.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KizzWs2WQPWN2qgE7G6r8B

apple/action.yml

@@ -0,0 +1,57 @@
+name: App Store
+description: Uploads a signed iOS .ipa to App Store Connect for TestFlight, and sends a version for App Store review
+inputs:
+  issuer-id:
+    description: The issuer id of the team's App Store Connect API keys, from a secret
+    required: true
+  key-id:
+    description: The id of the API key, from a secret
+    required: true
+  private-key:
+    description: The text of the API key's .p8 file, from a secret
+    required: true
+  bundle-id:
+    description: The app's bundle identifier, for example software.arasaka.meweb
+    required: true
+  ipa:
+    description: The signed .ipa to upload; its version and build number are read from it
+    required: false
+  notes:
+    description: A folder of <locale>.txt files, such as en-US.txt and it.txt; what to test on TestFlight, and what is new when submitting
+    required: false
+  groups:
+    description: TestFlight groups to give the uploaded build to, by name, separated by commas or lines
+    required: false
+  submit:
+    description: true sends the build for App Store review, creating or reusing the version
+    default: "false"
+  version:
+    description: The version to submit when no ipa is given, for example 1.4.0
+    required: false
+  build:
+    description: The build number to submit when no ipa is given; the newest processed build of version when empty
+    required: false
+  release:
+    description: after-approval puts the version on sale as soon as Apple approves it; manual waits for you
+    default: after-approval
+  phased:
+    description: true releases the update to automatic updaters over seven days
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: python3 "$GITHUB_ACTION_PATH/apple.py"
+      env:
+        ASC_ISSUER_ID: ${{ inputs.issuer-id }}
+        ASC_KEY_ID: ${{ inputs.key-id }}
+        ASC_PRIVATE_KEY: ${{ inputs.private-key }}
+        APPLE_BUNDLE_ID: ${{ inputs.bundle-id }}
+        APPLE_IPA: ${{ inputs.ipa }}
+        APPLE_NOTES: ${{ inputs.notes }}
+        APPLE_GROUPS: ${{ inputs.groups }}
+        APPLE_SUBMIT: ${{ inputs.submit }}
+        APPLE_VERSION: ${{ inputs.version }}
+        APPLE_BUILD: ${{ inputs.build }}
+        APPLE_RELEASE: ${{ inputs.release }}
+        APPLE_PHASED: ${{ inputs.phased }}