ci: add profile metadata debug output to diagnose provisioning mismatch

.gitea/workflows/ios-release.yaml

@@ -6,8 +6,8 @@ on:
       - "ios-v*"
 
 concurrency:
-  group: ${{ gitea.workflow }}-${{ gitea.ref }}
-  cancel-in-progress: true
+  group: ios-macos-runner
+  cancel-in-progress: false
 
 jobs:
   # ── archive & release to TestFlight ──────────────────────────────────────
@@ -57,8 +57,9 @@ jobs:
         run: |
           PP_PATH=$RUNNER_TEMP/profile.mobileprovision
           echo "$PROFILE_BASE64" | base64 --decode > $PP_PATH
+          UUID=$(security cms -D -i "$PP_PATH" | plutil -extract UUID raw -)
           mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
-          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/
+          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles/$UUID.mobileprovision
 
       - name: Write App Store Connect API key
         env:
@@ -79,7 +80,22 @@ jobs:
       - name: Archive
         env:
           USER: runner
-        run: just ios-archive
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          PROFILE_UUID=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract UUID raw -)
+          PROFILE_NAME=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract Name raw -)
+          PROFILE_BUNDLE=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract Entitlements.application-identifier raw - 2>/dev/null || echo "n/a")
+          PROFILE_TEAM=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract TeamIdentifier.0 raw -)
+          PROFILE_EXPIRY=$(security cms -D -i $RUNNER_TEMP/profile.mobileprovision | plutil -extract ExpirationDate raw -)
+          echo "DEBUG: PROFILE_UUID=$PROFILE_UUID"
+          echo "DEBUG: PROFILE_NAME=$PROFILE_NAME"
+          echo "DEBUG: PROFILE_BUNDLE=$PROFILE_BUNDLE"
+          echo "DEBUG: PROFILE_TEAM=$PROFILE_TEAM"
+          echo "DEBUG: PROFILE_EXPIRY=$PROFILE_EXPIRY"
+          echo "DEBUG: APPLE_TEAM_ID=$APPLE_TEAM_ID"
+          echo "DEBUG: profiles dir listing:"
+          ls ~/Library/MobileDevice/Provisioning\ Profiles/
+          just ios-archive "$APPLE_TEAM_ID" "$PROFILE_UUID"
 
       - name: Export IPA
         run: just ios-export

.gitea/workflows/ios.yaml

@@ -17,7 +17,7 @@ on:
       - ".gitea/workflows/ios-release.yaml"
 
 concurrency:
-  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  group: ios-macos-runner
   cancel-in-progress: true
 
 jobs:

ios/LibNovel/project.yml

@@ -49,6 +49,12 @@ targets:
         TARGETED_DEVICE_FAMILY: "1,2"   # iPhone + iPad
         GENERATE_INFOPLIST_FILE: NO
         INFOPLIST_FILE: LibNovel/Resources/Info.plist
+      configs:
+        Release:
+          CODE_SIGN_STYLE: Manual
+          CODE_SIGN_IDENTITY: "iPhone Distribution"
+          DEVELOPMENT_TEAM: GHZXC6FVMU
+          PROVISIONING_PROFILE: $(PROFILE_UUID)
 
   LibNovelTests:
     type: bundle.unit-test

justfile

@@ -130,13 +130,18 @@ ios-test: ios-gen ios-resolve
 # Archive a signed Release build (requires valid signing identity in keychain).
 # Output: {{runner_temp}}/LibNovel.xcarchive
 # Typically called from CI after importing certificate + provisioning profile.
-ios-archive: ios-gen ios-resolve
+# Usage: just ios-archive <team-id> <profile-uuid>
+ios-archive team_id profile_uuid: ios-gen ios-resolve
     cd {{ios_dir}} && xcodebuild archive \
         -project {{ios_scheme}}.xcodeproj \
         -scheme {{ios_scheme}} \
         -configuration Release \
+        -destination 'generic/platform=iOS' \
         -clonedSourcePackagesDirPath {{ios_spm}} \
-        -archivePath {{runner_temp}}/LibNovel.xcarchive
+        -archivePath {{runner_temp}}/LibNovel.xcarchive \
+        CODE_SIGN_STYLE=Manual \
+        DEVELOPMENT_TEAM="{{team_id}}" \
+        PROVISIONING_PROFILE="{{profile_uuid}}"
 
 # Export an IPA from the archive produced by ios-archive.
 # Requires ios/LibNovel/ExportOptions.plist.