From e6195d1e984a133aaa202609661169f1a7a87fec Mon Sep 17 00:00:00 2001
From: jwinterm <johnwmurphy@gmail.com>
Date: Mon, 1 Jun 2026 18:30:34 -0400
Subject: [PATCH] iOS TestFlight: override signing in Release.xcconfig for CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The committed project.pbxproj Release config uses CODE_SIGN_STYLE =
Automatic + CODE_SIGN_IDENTITY = "Apple Development" — both set up for
local Xcode-signed-into-an-Apple-ID development workflow. CI has only
the Distribution cert + provisioning profile we install into a temp
keychain, no Apple ID session, so Automatic signing fails at archive
time.

Append manual-signing overrides to ios/Flutter/Release.xcconfig in CI
(xcconfig values take precedence over pbxproj defaults, so this
overrides without modifying the committed project file):
  CODE_SIGN_IDENTITY = Apple Distribution
  CODE_SIGN_STYLE = Manual
  DEVELOPMENT_TEAM = ${APPLE_TEAM_ID}
  PROVISIONING_PROFILE_SPECIFIER = ${PROFILE_NAME}

PROFILE_NAME is parsed earlier from the .mobileprovision Name field.
APPLE_TEAM_ID comes from the existing Gitea secret. Local Debug/Profile
builds remain on Automatic signing — unchanged.
---
 .github/workflows/build-ios-testflight.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml
index 51228754e..0133b924b 100644
--- a/.github/workflows/build-ios-testflight.yml
+++ b/.github/workflows/build-ios-testflight.yml
@@ -284,6 +284,28 @@ jobs:
           cd ios
           pod install --repo-update
 
+      # ---- Override signing in Release.xcconfig for the archive step ------
+      # The committed project.pbxproj Release config uses Automatic signing
+      # + "Apple Development" identity (set up for local dev with Xcode
+      # signed into an Apple ID). CI can't do Automatic signing — it has
+      # only the cert + provisioning profile we installed in the temp
+      # keychain. Append manual-signing overrides to Release.xcconfig;
+      # xcconfig values take precedence over pbxproj defaults.
+      - name: Override signing settings for archive
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          set -x
+          cat >> ios/Flutter/Release.xcconfig <<XCFG
+
+          // CI-only signing overrides (appended at build time, not committed).
+          CODE_SIGN_IDENTITY = Apple Distribution
+          CODE_SIGN_STYLE = Manual
+          DEVELOPMENT_TEAM = ${APPLE_TEAM_ID}
+          PROVISIONING_PROFILE_SPECIFIER = ${PROFILE_NAME}
+          XCFG
+          tail -8 ios/Flutter/Release.xcconfig
+
       # ---- Generate ExportOptions.plist + build IPA -----------------------
       - name: Write ExportOptions.plist
         env: