ci: restore Ruby PATH export for fastlane step

act_runner does not carry setup-ruby's PATH changes into later steps,
so without this the step runs the toolcache default Ruby (3.3.11) and
bundler cannot find the gems installed for 3.1.7.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/testflight.yml

@@ -9,15 +9,10 @@ on:
 jobs:
   testflight:
     runs-on: macos-arm64
-    defaults:
-      run:
-        shell: bash
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
@@ -27,19 +22,7 @@ jobs:
           working-directory: ios
 
       - name: Install XcodeGen
-        run: |
-          set -euo pipefail
-          if ! command -v xcodegen >/dev/null 2>&1; then
-            brew install xcodegen
-          fi
-
-      - name: Runner diagnostics
-        run: |
-          set -euo pipefail
-          whoami
-          printf 'HOME=%s\n' "$HOME"
-          security default-keychain -d user || true
-          security list-keychains -d user || true
+        run: command -v xcodegen >/dev/null 2>&1 || brew install xcodegen
 
       - name: Upload to TestFlight
         working-directory: ios
@@ -53,6 +36,9 @@ jobs:
           SYBIL_BUILD_NUMBER: ${{ github.run_number }}
           FASTLANE_SKIP_UPDATE_CHECK: "1"
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: "120"
+        # act_runner does not propagate setup-ruby's PATH changes into later
+        # steps, so put the selected Ruby back on PATH or `bundle` resolves to
+        # the toolcache default and misses the gems installed above.
         run: |
-          ruby --version
+          export PATH="/Users/runner/hostedtoolcache/Ruby/3.1.7/arm64/bin:${PATH}"
           bundle exec fastlane ios beta

ios/fastlane/Fastfile

@@ -6,6 +6,9 @@ APP_IDENTIFIER = "net.buzzert.sybil2"
 SCHEME = "Sybil"
 TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
+CI_KEYCHAIN_NAME = "sybil_ci_keychain"
+CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
+CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -68,20 +71,33 @@ platform :ios do
     )
   end
 
-  # CI uses a throwaway keychain that is deleted after the lane exits.
+  # CI signs headlessly, so match needs a fresh unlocked keychain to import
+  # into. codesign resolves identities through the user keychain *search list*
+  # (first match wins; the --keychain flag does not restrict the lookup), and
+  # other projects' keychains on this runner hold the same identity but are
+  # usually locked — so ours must come first. delete_keychain in the beta
+  # lane's ensure removes both the keychain and its search-list entry, which
+  # also keeps our (later locked) copy from shadowing those other projects.
   private_lane :prepare_ci_keychain do
-    next nil unless ci?
+    next unless ci?
 
-    run_token = "#{Time.now.to_i}_#{Process.pid}"
-    keychain_name = "fastlane_ci_#{run_token}"
-
-    setup_ci(
-      force: true,
-      keychain_name: keychain_name,
-      timeout: 7_200
+    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
+    create_keychain(
+      name: CI_KEYCHAIN_NAME,
+      password: CI_KEYCHAIN_PASSWORD,
+      unlock: true,
+      timeout: 3600,
+      add_to_search_list: false
     )
 
-    keychain_name
+    others = sh("security list-keychains -d user", log: false)
+      .scan(/"([^"]+)"/)
+      .flatten
+      .reject { |path| path.include?(CI_KEYCHAIN_NAME) }
+    sh("security list-keychains -d user -s #{([CI_KEYCHAIN_DB_PATH] + others).shelljoin}")
+
+    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
+    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
   end
 
   private_lane :sync_signing do |options|
@@ -106,10 +122,7 @@ platform :ios do
 
   desc "Build and upload to TestFlight"
   lane :beta do
-    ci_keychain_name = nil
-
-    begin
-      ci_keychain_name = prepare_ci_keychain
+    prepare_ci_keychain
 
     api_key = app_store_api_key
 
@@ -122,13 +135,10 @@ platform :ios do
 
     sync_signing(api_key: api_key, readonly: true)
 
-      sh("security find-identity -v -p codesigning") if ci_keychain_name
-
     build_app(
       project: PROJECT_FILE,
       scheme: SCHEME,
       export_method: "app-store",
-        codesigning_identity: "Apple Distribution",
       xcargs: [
         "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
         "CODE_SIGN_STYLE=Manual",
@@ -149,7 +159,6 @@ platform :ios do
       skip_waiting_for_build_processing: true
     )
   ensure
-      delete_keychain(name: ci_keychain_name) if ci_keychain_name
-    end
+    delete_keychain(name: CI_KEYCHAIN_NAME) if ci? && File.file?(CI_KEYCHAIN_DB_PATH)
   end
 end