From 1ffc69469b384bb48d9ae2ceefa722b8d61a6249 Mon Sep 17 00:00:00 2001 From: sravan Date: Fri, 17 Jul 2026 15:47:28 +0530 Subject: [PATCH] ci(ios): pass a fixed CERTIFICATE_PRIVATE_KEY so the distribution cert is reusable fetch-signing-files --create alone mints a throwaway distribution certificate whose private key dies with the build VM; the next build then finds a cert it has no key for and fails 'Cannot save Signing Certificates without certificate private key'. Supplying our own fixed private key (secure var in the ios_signing group) makes the cert reproducible and reusable across builds. Co-Authored-By: Claude Opus 4.8 --- codemagic.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/codemagic.yaml b/codemagic.yaml index 45111b5..7db3390 100644 --- a/codemagic.yaml +++ b/codemagic.yaml @@ -23,6 +23,8 @@ workflows: # a brand-new app it fails init with "No matching profiles found …". Instead the "Set up code # signing" script below runs `fetch-signing-files … --create`, which creates the distribution # certificate + profile on first run, then `xcode-project use-profiles` wires them into the project. + groups: + - ios_signing # ← Codemagic variable group holding CERTIFICATE_PRIVATE_KEY (secure). See below. vars: BUNDLE_ID: "com.bizgaze.connect" XCODE_WORKSPACE: "mobile/ios/App/App.xcworkspace" @@ -55,9 +57,17 @@ workflows: # cert to the keychain. NOTE: `xcode-project use-profiles` is intentionally NOT here — it must # run AFTER `pod install` generates the workspace, otherwise it fails to wire the profile into # the App target and the archive dies with "App requires a provisioning profile". + # + # --certificate-key is REQUIRED for reusable signing: without it, --create makes a throwaway + # distribution cert whose private key dies with the build machine, so the next build finds a + # cert it has no key for ("Cannot save Signing Certificates without certificate private key"). + # By passing our own fixed private key (CERTIFICATE_PRIVATE_KEY, a secure var in the + # `ios_signing` group), the cert is created once from that key and reused by every build. keychain initialize app-store-connect fetch-signing-files "$BUNDLE_ID" \ - --type IOS_APP_STORE --create + --type IOS_APP_STORE \ + --certificate-key="@env:CERTIFICATE_PRIVATE_KEY" \ + --create keychain add-certificates - name: Install CocoaPods