ci: use Ruby 3.1 for TestFlight upload

This reverts commit a0e410155d.

.gitea/workflows/testflight.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   testflight:
-    runs-on: xcode
+    runs-on: macos-arm64
     defaults:
       run:
         shell: bash
@@ -33,10 +33,17 @@ jobs:
             brew install xcodegen
           fi
 
+      - name: Runner diagnostics
+        run: |
+          set -euo pipefail
+          whoami
+          printf 'HOME=%s\n' "$HOME"
+          security default-keychain -d user || true
+          security list-keychains -d user || true
+
       - name: Upload to TestFlight
         working-directory: ios
         env:
-          HOME: /var/lib/act_runner
           APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
           APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
           APP_STORE_CONNECT_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_KEY_CONTENT }}

ios/fastlane/Fastfile

@@ -6,10 +6,6 @@ APP_IDENTIFIER = "net.buzzert.sybil2"
 SCHEME = "Sybil"
 TEAM_ID = "DQQH5H6GBD"
 PROFILE_NAME = "Sybil AppStore CI"
-CI_KEYCHAIN_NAME = "sybil_ci_keychain"
-CI_KEYCHAIN_PASSWORD = "sybil-ci-keychain-password"
-CI_KEYCHAIN_PATH = File.expand_path("~/Library/Keychains/#{CI_KEYCHAIN_NAME}")
-CI_KEYCHAIN_DB_PATH = "#{CI_KEYCHAIN_PATH}-db"
 IOS_ROOT = File.expand_path("..", __dir__)
 PROJECT_FILE = File.join(IOS_ROOT, "Sybil.xcodeproj")
 PROJECT_SPEC = File.join(IOS_ROOT, "project.yml")
@@ -62,26 +58,6 @@ def stamp_marketing_version(version)
   File.write(APP_PROJECT_SPEC, updated)
 end
 
-def ci_keychain_path
-  File.file?(CI_KEYCHAIN_DB_PATH) ? CI_KEYCHAIN_DB_PATH : CI_KEYCHAIN_PATH
-end
-
-def signing_xcargs
-  args = [
-    "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
-    "CODE_SIGN_STYLE=Manual",
-    "CODE_SIGN_IDENTITY=Apple\\ Distribution",
-    "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
-  ]
-
-  if ci?
-    args << "CODE_SIGN_KEYCHAIN=#{ci_keychain_path.shellescape}"
-    args << "OTHER_CODE_SIGN_FLAGS=#{("--keychain #{ci_keychain_path}").shellescape}"
-  end
-
-  args.join(" ")
-end
-
 platform :ios do
   private_lane :app_store_api_key do
     app_store_connect_api_key(
@@ -92,23 +68,20 @@ platform :ios do
     )
   end
 
-  # CI uses a dedicated throwaway keychain for match. build_app passes this
-  # keychain explicitly so codesign does not depend on the runner's ambient
-  # login/default keychain state.
+  # CI uses a throwaway keychain that is deleted after the lane exits.
   private_lane :prepare_ci_keychain do
-    next unless ci?
+    next nil unless ci?
 
-    delete_keychain(name: CI_KEYCHAIN_NAME) if File.file?(CI_KEYCHAIN_DB_PATH) || File.file?(CI_KEYCHAIN_PATH)
-    create_keychain(
-      name: CI_KEYCHAIN_NAME,
-      password: CI_KEYCHAIN_PASSWORD,
-      unlock: true,
-      timeout: 3600,
-      add_to_search_list: true
+    run_token = "#{Time.now.to_i}_#{Process.pid}"
+    keychain_name = "fastlane_ci_#{run_token}"
+
+    setup_ci(
+      force: true,
+      keychain_name: keychain_name,
+      timeout: 7_200
     )
 
-    ENV["MATCH_KEYCHAIN_NAME"] = CI_KEYCHAIN_NAME
-    ENV["MATCH_KEYCHAIN_PASSWORD"] = CI_KEYCHAIN_PASSWORD
+    keychain_name
   end
 
   private_lane :sync_signing do |options|
@@ -133,37 +106,50 @@ platform :ios do
 
   desc "Build and upload to TestFlight"
   lane :beta do
-    prepare_ci_keychain
+    ci_keychain_name = nil
 
-    api_key = app_store_api_key
+    begin
+      ci_keychain_name = prepare_ci_keychain
 
-    version = release_version
-    stamp_marketing_version(version)
-    sh("xcodegen", "--spec", PROJECT_SPEC)
+      api_key = app_store_api_key
 
-    increment_version_number(version_number: version, xcodeproj: PROJECT_FILE)
-    increment_build_number(build_number: build_number, xcodeproj: PROJECT_FILE)
+      version = release_version
+      stamp_marketing_version(version)
+      sh("xcodegen", "--spec", PROJECT_SPEC)
 
-    sync_signing(api_key: api_key, readonly: true)
+      increment_version_number(version_number: version, xcodeproj: PROJECT_FILE)
+      increment_build_number(build_number: build_number, xcodeproj: PROJECT_FILE)
 
-    build_app(
-      project: PROJECT_FILE,
-      scheme: SCHEME,
-      export_method: "app-store",
-      codesigning_identity: "Apple Distribution",
-      xcargs: signing_xcargs,
-      export_options: {
-        signingStyle: "manual",
-        teamID: TEAM_ID,
-        provisioningProfiles: {
-          APP_IDENTIFIER => PROFILE_NAME
+      sync_signing(api_key: api_key, readonly: true)
+
+      sh("security find-identity -v -p codesigning") if ci_keychain_name
+
+      build_app(
+        project: PROJECT_FILE,
+        scheme: SCHEME,
+        export_method: "app-store",
+        codesigning_identity: "Apple Distribution",
+        xcargs: [
+          "DEVELOPMENT_TEAM=#{TEAM_ID.shellescape}",
+          "CODE_SIGN_STYLE=Manual",
+          "CODE_SIGN_IDENTITY=Apple\\ Distribution",
+          "PROVISIONING_PROFILE_SPECIFIER=#{PROFILE_NAME.shellescape}"
+        ].join(" "),
+        export_options: {
+          signingStyle: "manual",
+          teamID: TEAM_ID,
+          provisioningProfiles: {
+            APP_IDENTIFIER => PROFILE_NAME
+          }
         }
-      }
-    )
+      )
 
-    upload_to_testflight(
-      api_key: api_key,
-      skip_waiting_for_build_processing: true
-    )
+      upload_to_testflight(
+        api_key: api_key,
+        skip_waiting_for_build_processing: true
+      )
+    ensure
+      delete_keychain(name: ci_keychain_name) if ci_keychain_name
+    end
   end
 end