Fix build number for release.yml flow

.github/workflows/release.yml

@@ -21,11 +21,61 @@ jobs:
           TAG="${GITHUB_REF_NAME}"
           echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
 
+  fetch-build-number:
+    name: Fetch build number from App Store Connect
+    needs: prepare
+    runs-on: ubuntu-latest
+    outputs:
+      build-number: ${{ steps.asc.outputs.build-number }}
+    steps:
+      - name: Get latest build and increment
+        id: asc
+        env:
+          ISSUER_ID:          ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+          KEY_ID:             ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
+          PRIVATE_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}
+          APP_ID:             ${{ secrets.APP_STORE_APP_ID_IOS }}
+          VERSION:            ${{ needs.prepare.outputs.version }}
+        run: |
+          pip install cryptography --quiet
+
+          echo "$PRIVATE_KEY_BASE64" | base64 --decode > /tmp/AuthKey.p8
+          trap 'rm -f /tmp/AuthKey.p8' EXIT
+
+          JWT=$(python3 -c "import base64,json,time,os;from cryptography.hazmat.primitives import hashes,serialization;from cryptography.hazmat.primitives.asymmetric import ec;from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature;key=serialization.load_pem_private_key(open('/tmp/AuthKey.p8','rb').read(),password=None);b64url=lambda d:base64.urlsafe_b64encode(d if isinstance(d,bytes) else d.encode()).rstrip(b'=').decode();now=int(time.time());h=b64url(json.dumps({'alg':'ES256','kid':os.environ['KEY_ID'],'typ':'JWT'},separators=(',',':')));p=b64url(json.dumps({'iss':os.environ['ISSUER_ID'],'exp':now+1200,'aud':'appstoreconnect-v1'},separators=(',',':')));msg=f'{h}.{p}'.encode();sig_der=key.sign(msg,ec.ECDSA(hashes.SHA256()));r,s=decode_dss_signature(sig_der);sig=b64url(r.to_bytes(32,'big')+s.to_bytes(32,'big'));print(f'{h}.{p}.{sig}')")
+
+          HTTP_STATUS=$(curl -sg \
+            -o /tmp/asc_response.json \
+            -w "%{http_code}" \
+            "https://api.appstoreconnect.apple.com/v1/builds?filter[app]=$APP_ID&filter[preReleaseVersion.version]=$VERSION&sort=-uploadedDate&limit=1" \
+            -H "Authorization: Bearer $JWT")
+
+          RESPONSE=$(cat /tmp/asc_response.json)
+          echo "HTTP status: $HTTP_STATUS"
+
+          if [ "$HTTP_STATUS" != "200" ]; then
+            echo "API error:" && echo "$RESPONSE" | jq . || echo "$RESPONSE"
+            exit 1
+          fi
+
+          LATEST=$(echo "$RESPONSE" | jq -r 'if (.data | length) > 0 and (.data[0].attributes.version != null) then .data[0].attributes.version else "none" end')
+          echo "Latest build: $LATEST"
+
+          if [ "$LATEST" = "none" ]; then
+            NEXT="1"
+          else
+            NEXT=$(python3 -c "v='$LATEST'; print(int(v)+1) if v.isdigit() else '1'")
+          fi
+
+          echo "Next build number: $NEXT"
+          echo "build-number=$NEXT" >> "$GITHUB_OUTPUT"
+
   build:
     name: Build and Upload Release
-    needs: prepare
+    needs: [prepare, fetch-build-number]
     uses: ./.github/workflows/build-upload.yml
     with:
       ref: ${{ github.ref }}
       version: ${{ needs.prepare.outputs.version }}
+      build-number: ${{ needs.fetch-build-number.outputs.build-number }}
     secrets: inherit