ios: pass match keychain to codesign

ios/fastlane/Fastfile

@@ -8,7 +8,8 @@ TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
 CI_KEYCHAIN_NAME = "sybil_ci_keychain"
 CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
+CI_KEYCHAIN_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}")
+CI_KEYCHAIN_DB_PATH = "#{CI_KEYCHAIN_PATH}-db"
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -61,6 +62,26 @@ def stamp_marketing_version(version)
   File.write(APP_PROJECT_SPEC, updated)
 end
 
+def ci_keychain_path
+  File.file?(CI_KEYCHAIN_DB_PATH) ? CI_KEYCHAIN_DB_PATH : CI_KEYCHAIN_PATH
+end
+
+def signing_xcargs
+  args = [
+    "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
+    "CODE_SIGN_STYLE=Manual",
+    "CODE_SIGN_IDENTITY=Apple\\ Distribution",
+    "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
+  ]
+
+  if ci?
+    args << "CODE_SIGN_KEYCHAIN=#{ci_keychain_path.shellescape}"
+    args << "OTHER_CODE_SIGN_FLAGS=#{("--keychain #{ci_keychain_path}").shellescape}"
+  end
+
+  args.join(" ")
+end
+
 platform :ios do
   private_lane :app_store_api_key do
     app_store_connect_api_key(
@@ -71,13 +92,13 @@ platform :ios do
     )
   end
 
-  # CI has no login keychain, so create a dedicated throwaway one for match to
-  # import the distribution cert into. The runner's launchd job sets
-  # SessionCreate, so add_to_search_list actually makes it visible to xcodebuild.
+  # CI uses a dedicated throwaway keychain for match. build_app passes this
+  # keychain explicitly so codesign does not depend on the runner's ambient
+  # login/default keychain state.
   private_lane :prepare_ci_keychain do
     next unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
+    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH) || File.file?(CI_KEYCHAIN_PATH)
     create_keychain(
       name: CI_KEYCHAIN_NAME,
       password: CI_KEYCHAIN_PASSWORD,
@@ -130,12 +151,7 @@ platform :ios do
       scheme: SCHEME,
       export_method: "app-store",
       codesigning_identity: "Apple Distribution",
-      xcargs: [
-        "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-        "CODE_SIGN_STYLE=Manual",
-        "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-        "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-      ].join(" "),
+      xcargs: signing_xcargs,
       export_options: {
         signingStyle: "manual",
         teamID: TEAM_ID,