ios: simplify CI signing keychain setup

This reverts commit a0e410155d.

.gitea/workflows/testflight.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   testflight:
-    runs-on: xcode
+    runs-on: macos-arm64
     defaults:
       run:
         shell: bash
@@ -33,10 +33,17 @@ jobs:
             brew install xcodegen
           fi
 
+      - name: Runner diagnostics
+        run: |
+          set -euo pipefail
+          whoami
+          printf 'HOME=%s\n' "$HOME"
+          security default-keychain -d user || true
+          security list-keychains -d user || true
+
       - name: Upload to TestFlight
         working-directory: ios
         env:
-          HOME: /var/lib/act_runner
           APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}
@@ -47,6 +54,5 @@ jobs:
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
         run: |
-          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
           ruby --version
           bundle exec fastlane ios beta

ios/fastlane/Fastfile

@@ -6,10 +6,6 @@ APP_IDENTIFIER = "net.buzzert.sybil2"
 SCHEME = "Sybil"
 TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
-CI_KEYCHAIN_NAME = "sybil_ci_keychain"
-CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}")
-CI_KEYCHAIN_DB_PATH = "#{CI_KEYCHAIN_PATH}-db"
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -62,26 +58,6 @@ def stamp_marketing_version(version)
   File.write(APP_PROJECT_SPEC, updated)
 end
 
-def ci_keychain_path
-  File.file?(CI_KEYCHAIN_DB_PATH) ? CI_KEYCHAIN_DB_PATH : CI_KEYCHAIN_PATH
-end
-
-def signing_xcargs
-  args = [
-    "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-    "CODE_SIGN_STYLE=Manual",
-    "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-    "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-  ]
-
-  if ci?
-    args << "CODE_SIGN_KEYCHAIN=#{ci_keychain_path.shellescape}"
-    args << "OTHER_CODE_SIGN_FLAGS=#{("--keychain #{ci_keychain_path}").shellescape}"
-  end
-
-  args.join(" ")
-end
-
 platform :ios do
   private_lane :app_store_api_key do
     app_store_connect_api_key(
@@ -92,23 +68,20 @@ platform :ios do
     )
   end
 
-  # CI uses a dedicated throwaway keychain for match. build_app passes this
-  # keychain explicitly so codesign does not depend on the runner's ambient
-  # login/default keychain state.
+  # CI uses a throwaway keychain that is deleted after the lane exits.
   private_lane :prepare_ci_keychain do
-    next unless ci?
+    next nil unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH) || File.file?(CI_KEYCHAIN_PATH)
-    create_keychain(
-      name: CI_KEYCHAIN_NAME,
-      password: CI_KEYCHAIN_PASSWORD,
-      unlock: true,
-      timeout: 3600,
-      add_to_search_list: true
+    run_token = "#{Time.now.to_i}_#{Process.pid}"
+    keychain_name = "fastlane_ci_#{run_token}"
+
+    setup_ci(
+      force: true,
+      keychain_name: keychain_name,
+      timeout: 7_200
     )
 
-    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
-    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
+    keychain_name
   end
 
   private_lane :sync_signing do |options|
@@ -133,7 +106,10 @@ platform :ios do
 
   desc "Build and upload to TestFlight"
   lane :beta do
-    prepare_ci_keychain
+    ci_keychain_name = nil
+
+    begin
+      ci_keychain_name = prepare_ci_keychain
 
       api_key = app_store_api_key
 
@@ -146,12 +122,19 @@ platform :ios do
 
       sync_signing(api_key: api_key, readonly: true)
 
+      sh("security find-identity -v -p codesigning") if ci_keychain_name
+
       build_app(
         project: PROJECT_FILE,
         scheme: SCHEME,
         export_method: "app-store",
         codesigning_identity: "Apple Distribution",
-      xcargs: signing_xcargs,
+        xcargs: [
+          "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
+          "CODE_SIGN_STYLE=Manual",
+          "CODE_SIGN_IDENTITY=Apple\\ Distribution",
+          "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
+        ].join(" "),
         export_options: {
           signingStyle: "manual",
           teamID: TEAM_ID,
@@ -165,5 +148,8 @@ platform :ios do
         api_key: api_key,
         skip_waiting_for_build_processing: true
       )
+    ensure
+      delete_keychain(name: ci_keychain_name) if ci_keychain_name
+    end
   end
 end