ios: simplify CI signing keychain setup

.gitea/workflows/testflight.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   testflight:
-    runs-on: xcode
+    runs-on: macos-arm64
     defaults:
       run:
         shell: bash
@@ -33,10 +33,17 @@ jobs:
             brew install xcodegen
           fi
 
+      - name: Runner diagnostics
+        run: |
+          set -euo pipefail
+          whoami
+          printf 'HOME=%s\n' "$HOME"
+          security default-keychain -d user || true
+          security list-keychains -d user || true
+
       - name: Upload to TestFlight
         working-directory: ios
         env:
-          HOME: /var/lib/act_runner
           APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
@@ -47,6 +54,5 @@ jobs:
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
         run: |
-          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
           ruby --version
           bundle exec fastlane ios beta

ios/fastlane/Fastfile

@@ -6,9 +6,6 @@ APP_IDENTIFIER = "net.buzzert.sybil2"
 SCHEME = "Sybil"
 TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
-CI_KEYCHAIN_NAME = "sybil_ci_keychain"
-CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -71,23 +68,20 @@ platform :ios do
     )
   end
 
-  # CI has no login keychain, so create a dedicated throwaway one for match to
-  # import the distribution cert into. The runner's launchd job sets
-  # SessionCreate, so add_to_search_list actually makes it visible to xcodebuild.
+  # CI uses a throwaway keychain that is deleted after the lane exits.
   private_lane :prepare_ci_keychain do
-    next unless ci?
+    next nil unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
-    create_keychain(
-      name: CI_KEYCHAIN_NAME,
-      password: CI_KEYCHAIN_PASSWORD,
-      unlock: true,
-      timeout: 3600,
-      add_to_search_list: true
+    run_token = "#{Time.now.to_i}_#{Process.pid}"
+    keychain_name = "fastlane_ci_#{run_token}"
+
+    setup_ci(
+      force: true,
+      keychain_name: keychain_name,
+      timeout: 7_200
     )
 
-    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
-    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
+    keychain_name
   end
 
   private_lane :sync_signing do |options|
@@ -112,7 +106,10 @@ platform :ios do
 
   desc "Build and upload to TestFlight"
   lane :beta do
-    prepare_ci_keychain
+    ci_keychain_name = nil
+
+    begin
+      ci_keychain_name = prepare_ci_keychain
 
       api_key = app_store_api_key
 
@@ -125,6 +122,8 @@ platform :ios do
 
       sync_signing(api_key: api_key, readonly: true)
 
+      sh("security find-identity -v -p codesigning") if ci_keychain_name
+
       build_app(
         project: PROJECT_FILE,
         scheme: SCHEME,
@@ -149,5 +148,8 @@ platform :ios do
         api_key: api_key,
         skip_waiting_for_build_processing: true
       )
+    ensure
+      delete_keychain(name: ci_keychain_name) if ci_keychain_name
+    end
   end
 end