Add publishing guide and secret-stripping scripts

scripts/strip-secrets.sh

@@ -0,0 +1,86 @@
+#!/bin/zsh
+# Strip secrets before publishing to public repo
+# Run ONLY on the 'main' branch
+
+set -e
+cd "$(dirname "$0")/.."
+
+BRANCH=$(git branch --show-current)
+if [ "$BRANCH" != "main" ]; then
+    echo "ERROR: Run this only on 'main' branch (current: $BRANCH)"
+    exit 1
+fi
+
+echo "Stripping secrets for public release..."
+
+# 1. SGConfig — remove keys
+cat > Swiftgram/SGConfig/Sources/File.swift << 'SWIFT'
+import Foundation
+import BuildConfig
+
+public struct SGConfig: Codable {
+    public static let isBetaBuild: Bool = true
+    public var apiUrl: String = "https://api.swiftgram.app"
+    public var webappUrl: String = "https://my.swiftgram.app"
+    public var botUsername: String = "SwiftgramBot"
+    public var publicKey: String?
+    public var iaps: [String] = []
+    public var supportersApiUrl: String? = nil
+    public var supportersAesKey: String? = nil
+    public var supportersHmacKey: String? = nil
+    public var supportersPinnedCertHashes: [String] = []
+    public var demoLoginBackendUrl: String? = nil
+    public var demoLoginPhonePrefix: String? = nil
+}
+
+private func parseSGConfig(_ jsonString: String) -> SGConfig {
+    let jsonData = Data(jsonString.utf8)
+    let decoder = JSONDecoder()
+    decoder.keyDecodingStrategy = .convertFromSnakeCase
+    return (try? decoder.decode(SGConfig.self, from: jsonData)) ?? SGConfig()
+}
+
+private let baseAppBundleId = Bundle.main.bundleIdentifier!
+private let buildConfig = BuildConfig(baseAppBundleId: baseAppBundleId)
+public let SG_CONFIG: SGConfig = parseSGConfig(buildConfig.sgConfig)
+public let SG_API_WEBAPP_URL_PARSED = URL(string: SG_CONFIG.webappUrl)!
+SWIFT
+echo "  Stripped: SGConfig"
+
+# 2. Build configs — replace with templates
+for cfg in build-system/ipa-build-configuration.json build-system/glegram-appstore-configuration.json; do
+    cat > "$cfg" << 'JSON'
+{
+	"bundle_id": "com.example.GLEGram",
+	"api_id": "YOUR_API_ID",
+	"api_hash": "YOUR_API_HASH",
+	"team_id": "YOUR_TEAM_ID",
+	"app_center_id": "0",
+	"is_internal_build": "false",
+	"is_appstore_build": "true",
+	"appstore_id": "0",
+	"app_specific_url_scheme": "tg",
+	"premium_iap_product_id": "",
+	"enable_siri": false,
+	"enable_icloud": false,
+	"sg_config": ""
+}
+JSON
+done
+echo "  Stripped: build configs"
+
+# 3. Real codesigning — empty
+rm -rf build-system/real-codesigning/certs/*.p12 build-system/real-codesigning/certs/*.cer 2>/dev/null
+rm -rf build-system/real-codesigning/profiles/*.mobileprovision 2>/dev/null
+mkdir -p build-system/real-codesigning/certs build-system/real-codesigning/profiles
+echo "# Add your certificates here" > build-system/real-codesigning/certs/README.md
+echo "# Add your provisioning profiles here" > build-system/real-codesigning/profiles/README.md
+echo "  Stripped: codesigning"
+
+# 4. Remove binaries
+rm -f build-input/bazel-* scripts/Telegram 2>/dev/null
+rm -rf build/ 2>/dev/null
+echo "  Stripped: binaries"
+
+echo ""
+echo "Done. Run ./scripts/check-secrets.sh before committing."