ios: pass match keychain to codesign

ios/AGENTS.md

@@ -21,6 +21,12 @@ Instructions for work under `/Users/buzzert/src/sybil-2/ios`.
 - To choose a screenshot path, run `just screenshot path=build/name.png`.
 - The underlying screenshot command is `xcrun simctl io booted screenshot <path>` and requires a booted simulator.
 
+## Release Workflow
+- iOS release tags use the annotated tag namespace `release/ios/vX.Y.Z`; increment from the latest existing `release/ios/v*` tag.
+- Tag message convention is `ios: X.Y.Z`, for example `git tag -a release/ios/v1.13.5 -m "ios: 1.13.5"`.
+- Push the release commit and tag together with `git push origin <branch> release/ios/vX.Y.Z`.
+- Fastlane derives the marketing version from the release tag and stamps `ios/Apps/Sybil/project.yml` during CI, so do not manually bump `MARKETING_VERSION` for normal tagged releases unless explicitly requested.
+
 ## App Structure
 - App target entry: `/Users/buzzert/src/sybil-2/ios/Apps/Sybil/Sources/SybilApp.swift`
 - Shared iOS app code lives in Swift package:

ios/fastlane/Fastfile

@@ -8,7 +8,8 @@ TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
 CI_KEYCHAIN_NAME = "sybil_ci_keychain"
 CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_DB_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}-db")
+CI_KEYCHAIN_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}")
+CI_KEYCHAIN_DB_PATH = "#{CI_KEYCHAIN_PATH}-db"
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -61,6 +62,26 @@ def stamp_marketing_version(version)
   File.write(APP_PROJECT_SPEC, updated)
 end
 
+def ci_keychain_path
+  File.file?(CI_KEYCHAIN_DB_PATH) ? CI_KEYCHAIN_DB_PATH : CI_KEYCHAIN_PATH
+end
+
+def signing_xcargs
+  args = [
+    "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
+    "CODE_SIGN_STYLE=Manual",
+    "CODE_SIGN_IDENTITY=Apple\\ Distribution",
+    "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
+  ]
+
+  if ci?
+    args << "CODE_SIGN_KEYCHAIN=#{ci_keychain_path.shellescape}"
+    args << "OTHER_CODE_SIGN_FLAGS=#{("--keychain #{ci_keychain_path}").shellescape}"
+  end
+
+  args.join(" ")
+end
+
 platform :ios do
   private_lane :app_store_api_key do
     app_store_connect_api_key(
@@ -71,13 +92,13 @@ platform :ios do
     )
   end
 
-  # CI has no login keychain, so create a dedicated throwaway one for match to
-  # import the distribution cert into. The runner's launchd job sets
-  # SessionCreate, so add_to_search_list actually makes it visible to xcodebuild.
+  # CI uses a dedicated throwaway keychain for match. build_app passes this
+  # keychain explicitly so codesign does not depend on the runner's ambient
+  # login/default keychain state.
   private_lane :prepare_ci_keychain do
     next unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH)
+    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH) || File.file?(CI_KEYCHAIN_PATH)
     create_keychain(
       name: CI_KEYCHAIN_NAME,
       password: CI_KEYCHAIN_PASSWORD,
@@ -130,12 +151,7 @@ platform :ios do
       scheme: SCHEME,
       export_method: "app-store",
       codesigning_identity: "Apple Distribution",
-      xcargs: [
-        "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-        "CODE_SIGN_STYLE=Manual",
-        "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-        "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-      ].join(" "),
+      xcargs: signing_xcargs,
       export_options: {
         signingStyle: "manual",
         teamID: TEAM_ID,