.gitea/scripts/ios_ci_signing.rb

@@ -6,6 +6,11 @@
 require "xcodeproj"
 
 TEAM = "Q3JLTAG9PV"
+# Pinned by SHA-1, not by the "Apple Distribution" name: a runner that also
+# holds other same-named distribution certs (e.g. a dev Mac's login keychain)
+# would otherwise let Xcode pick one the profiles don't include. Update this
+# (and ios/ExportOptions.plist) when the certificate is renewed.
+CERT_SHA1 = "2527806871D806E8E27221B15CA8A1938CF216F2"
 PROFILES = {
   "Runner" => "NooProfile",
   "ShareExtension" => "NooShareSheetProfile",
@@ -18,8 +23,8 @@ PROFILES.each do |target_name, profile|
     settings = config.build_settings
     settings["CODE_SIGN_STYLE"] = "Manual"
     settings["DEVELOPMENT_TEAM"] = TEAM
-    settings["CODE_SIGN_IDENTITY"] = "Apple Distribution"
-    settings["CODE_SIGN_IDENTITY[sdk=iphoneos*]"] = "Apple Distribution"
+    settings["CODE_SIGN_IDENTITY"] = CERT_SHA1
+    settings["CODE_SIGN_IDENTITY[sdk=iphoneos*]"] = CERT_SHA1
     settings["PROVISIONING_PROFILE_SPECIFIER"] = profile
   end
 end

.gitea/workflows/ios.yml

@@ -61,6 +61,9 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
           security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
           rm -f "${{ runner.temp }}/dist.p12"
+          # Must list 2527806871D8... (the cert the profiles embed); if it
+          # doesn't, IOS_DIST_CERT_P12_BASE64 holds the wrong certificate.
+          security find-identity -v -p codesigning "$KEYCHAIN"
 
           PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
           mkdir -p "$PROFILES_DIR"

ios/ExportOptions.plist

@@ -9,7 +9,7 @@
 	<key>signingStyle</key>
 	<string>manual</string>
 	<key>signingCertificate</key>
-	<string>Apple Distribution</string>
+	<string>2527806871D806E8E27221B15CA8A1938CF216F2</string>
 	<key>provisioningProfiles</key>
 	<dict>
 		<key>dev.ayushya.noo</key>