ios: use disposable keychain as ci default

.gitea/workflows/testflight-release.yml

@@ -85,6 +85,7 @@ jobs:
 
           keychain_password="$(uuidgen)"
           keychain_path="${HOME}/Library/Keychains/${SIGNING_KEYCHAIN}.keychain-db"
+          previous_default_keychain="$(security default-keychain -d user | sed 's/[ "]//g' || true)"
           mkdir -p "${HOME}/Library/Keychains" "${HOME}/Library/MobileDevice/Provisioning Profiles" ios/build/secrets
 
           printf '%s' "${APPSTORE_CERTIFICATES_FILE_BASE64}" | base64 --decode > ios/build/secrets/appstore-signing.p12
@@ -95,6 +96,7 @@ jobs:
           security set-keychain-settings -lut 21600 "${keychain_path}"
           security unlock-keychain -p "${keychain_password}" "${keychain_path}"
           security list-keychains -d user -s "${keychain_path}" $(security list-keychains -d user | sed 's/[ "]//g')
+          security default-keychain -d user -s "${keychain_path}"
           security import ios/build/secrets/AppleWWDRCAG3.cer \
             -k "${keychain_path}" \
             -T /usr/bin/codesign \
@@ -111,6 +113,7 @@ jobs:
           {
             echo "SYBIL_SIGNING_KEYCHAIN_PATH=${keychain_path}"
             echo "SYBIL_SIGNING_KEYCHAIN_PASSWORD=${keychain_password}"
+            echo "SYBIL_PREVIOUS_DEFAULT_KEYCHAIN=${previous_default_keychain}"
           } >> "${GITHUB_ENV}"
 
       - name: Build and upload to TestFlight
@@ -129,6 +132,7 @@ jobs:
 
           security unlock-keychain -p "${SYBIL_SIGNING_KEYCHAIN_PASSWORD}" "${SYBIL_SIGNING_KEYCHAIN_PATH}"
           security list-keychains -d user -s "${SYBIL_SIGNING_KEYCHAIN_PATH}" $(security list-keychains -d user | sed 's/[ "]//g')
+          security default-keychain -d user -s "${SYBIL_SIGNING_KEYCHAIN_PATH}"
           security find-identity -v -p codesigning "${SYBIL_SIGNING_KEYCHAIN_PATH}"
 
           SYBIL_VERSION_TAG="${TAG_NAME}" bundle exec fastlane ios beta
@@ -220,4 +224,7 @@ jobs:
       - name: Clean up temporary keychain
         if: always()
         run: |
+          if [[ -n "${SYBIL_PREVIOUS_DEFAULT_KEYCHAIN:-}" ]]; then
+            security default-keychain -d user -s "${SYBIL_PREVIOUS_DEFAULT_KEYCHAIN}" || true
+          fi
           security delete-keychain "${HOME}/Library/Keychains/${SIGNING_KEYCHAIN}.keychain-db" || true