[mirzemehdi]

This workflow has never run on any generated app. It required a secret nobody can produce without a Mac — so shipping iOS effectively meant buying one. Three separate problems:

1. Signing required a hand-exported .p12

IOS_APP_CERTIFICATE_P12_BASE64 can only be exported from a Mac keychain — the exact thing this workflow exists to avoid. Replaced with fastlane match, which creates the certificate on the runner from the App Store Connect API key.

The encrypted certificates are committed to a match-certificates branch of the same repository, so the built-in GITHUB_TOKEN reaches them: no second repo and no personal access token. The git URL and auth are derived from the Actions context rather than stored as secrets.

Xcode automatic signing is deliberately not used: it mints a new distribution certificate per run and Apple caps those at three per account. It works three times, then fails permanently.

2. local.properties was wrong in both directions

It wrote three keys — two of which (REVENUECAT_ANDROID_API_KEY, REVENUECAT_IOS_API_KEY) no longer exist; the build reads SUBSCRIPTION_PROVIDER_*. Meanwhile 14 keys the build does read were missing (Firebase ×3, OpenAI, Replicate, AdMob ×7, subscription provider ×2).

This never failed a build, because every getRequiredProperty() declares a defaultValue. It shipped green binaries carrying "" and "testValue" — dead sign-in, no analytics, broken paywall. Silent, and the worst failure mode available.

Rather than replace one hardcoded list with another, the step now derives the key list from MobileApp/local.properties.example and pulls each value out of toJSON(secrets). Adding a key means editing that one file and setting a repo secret of the same name — the workflow never needs touching again. Keys with no secret are written empty and reported as a build annotation, rather than failing the release: a placeholder only breaks the feature that uses it, and a half-configured app still needs to reach TestFlight.

3. Signing config contradicted itself

Archive used CODE_SIGN_STYLE=Manual with a hardcoded profile UUID; export declared signingStyle: automatic. Plus a duplicated -destination flag.

Also

• Builds through the project's own Fastfile rather than a parallel xcodebuild invocation, so a local release and a CI release run the same lane.
• Adds workflow_dispatch (on-demand) alongside the existing tag trigger.
• Uploads the .ipa as an artifact, so a failed upload doesn't cost another 20-minute rebuild.
• Keeps the GitHub release step, now tag-only.

Secrets required after this change

APPSTORE_KEY_ID, APPSTORE_ISSUER_ID, APPSTORE_PRIVATE_KEY, MATCH_PASSWORD, GRADLE_CACHE_ENCRYPTION_KEY, plus one per build key in the local.properties step.

Gone: IOS_APP_CERTIFICATE_P12_BASE64, IOS_APP_CERTIFICATE_P12_PASSWORD, IOS_APP_DEVELOPMENT_PROVISION_UUID, APPSTORE_TEAM_ID.

Not yet proven

No live run against a real Apple account. Two unknowns, both pre-existing: whether xcodebuild resolves the iosApp scheme with no shared scheme committed, and whether the ASC API key's role permits certificate creation.

If this repo is public, the encrypted certificates on the branch are public too — useless without MATCH_PASSWORD, but worth a deliberate decision.