diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 0ce1b23..5793fe1 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -207,10 +207,20 @@ jobs: # (Config/Punktfunk-macOS.entitlements) — mandatory for the Mac App Store. continue-on-error: true run: | - # Separate archive from the Developer ID one above: App Store needs a profile-signed - # archive (manual signing), not the unsigned-then-codesign DMG path. Same App-Manager - # ASC-key constraint as iOS/tvOS — MANUAL signing, NOT -allowProvisioningUpdates - # (cloud signing the key can't do). Quit Xcode so it can't prune the dropped profile. + # Separate archive from the Developer ID one above: App Store needs a signed, entitled + # archive that -exportArchive can re-sign for distribution, not the unsigned-then-codesign + # DMG path. Archive with AUTOMATIC signing (development). Why not a manually-specified + # profile (as this step used to do): the in-app license screens added a SwiftPM resource + # bundle (PunktfunkKit_PunktfunkKit), and a resource bundle is a product type that cannot + # carry a provisioning profile — a global PROVISIONING_PROFILE_SPECIFIER (here) or an + # sdk-scoped one (iOS/tvOS) lands on it and fails the archive ("does not support + # provisioning profiles"). Automatic signing assigns a profile only to the app and leaves + # the resource bundle (and the macOS-host macro plugins) alone, and bakes the sandbox + # entitlements in. No -allowProvisioningUpdates → it stays OFFLINE and never cloud-signs + # (the App-Manager ASC key can't), so the runner must have a macOS *development* profile + # for io.unom.punktfunk installed. DISTRIBUTION signing happens in the export step below + # (manual, via the plist). Quit Xcode so it can't prune the manually-installed App Store + # distribution profile that export needs. osascript -e 'tell application "Xcode" to quit' >/dev/null 2>&1 || true pkill -x Xcode 2>/dev/null || true PROFILE="Punktfunk macOS App Store Distribution" @@ -218,11 +228,10 @@ jobs: -project "$PROJECT" -scheme Punktfunk \ -destination 'generic/platform=macOS' \ -archivePath "$RUNNER_TEMP/Punktfunk-macos-appstore.xcarchive" \ + -skipMacroValidation -skipPackagePluginValidation \ MARKETING_VERSION="$VERSION" CURRENT_PROJECT_VERSION="$BUILD_NUM" \ - CODE_SIGN_STYLE=Manual \ - CODE_SIGN_IDENTITY="Apple Distribution" \ - DEVELOPMENT_TEAM="$TEAM_ID" \ - PROVISIONING_PROFILE_SPECIFIER="$PROFILE" + CODE_SIGN_STYLE=Automatic \ + DEVELOPMENT_TEAM="$TEAM_ID" cat > "$RUNNER_TEMP/export-macos-appstore.plist" < @@ -252,35 +261,27 @@ jobs: # Best-effort until the App Store Connect app record for io.unom.punktfunk exists. continue-on-error: true run: | - # MANUAL App Store signing: the local (valid) Apple Distribution identity + the App - # Store provisioning profile. NOT -allowProvisioningUpdates — with an App-Manager-role - # ASC key that forces Xcode's CLOUD-managed signing, which the role can't do ("Cloud - # signing permission error"). The profile must be installed on the runner under - # ~/Library/Developer/Xcode/UserData/Provisioning Profiles/ (install it once with - # Xcode.app quit, or it prunes the manually-dropped distribution profile). - # A running Xcode.app prunes unrecognized profiles from that dir — quit it so the App - # Store profile survives this build; headless xcodebuild doesn't need the GUI app. + # Archive with AUTOMATIC signing (development) — see the macOS App Store step for the full + # rationale. The SwiftPM resource bundle (PunktfunkKit_PunktfunkKit, added with the in-app + # license screens) builds for iphoneos, so even the sdk-scoped PROVISIONING_PROFILE_SPECIFIER + # this step used to set matched it and failed the archive ("does not support provisioning + # profiles"). Automatic signing profiles only the app and leaves the resource bundle (and + # the macOS-host macro plugins) alone. No -allowProvisioningUpdates → OFFLINE, never + # cloud-signs (the App-Manager ASC key can't), so the runner needs an iOS *development* + # profile for io.unom.punktfunk installed. DISTRIBUTION signing is the export step below + # (manual, via the plist). A running Xcode.app prunes unrecognized profiles — quit it so the + # manually-installed App Store distribution profile survives for export. osascript -e 'tell application "Xcode" to quit' >/dev/null 2>&1 || true pkill -x Xcode 2>/dev/null || true PROFILE="Punktfunk iOS App Store Distribution" - # Scope signing to the iOS device SDK via an xcconfig — see the tvOS step below for the - # full rationale. A global (CLI) profile specifier would also be forced onto the shared - # macOS-host SwiftPM macro plugins, which reject it and fail the archive; [sdk=iphoneos*] - # in an xcconfig lands it on the app/framework slices only. - SIGN_XCCONFIG="$RUNNER_TEMP/sign-ios.xcconfig" - cat > "$SIGN_XCCONFIG" < "$RUNNER_TEMP/export-appstore.plist" < @@ -312,33 +313,24 @@ jobs: # on the runner (xcodebuild -downloadPlatform tvOS). continue-on-error: true run: | - # Same manual App Store signing as iOS (the App-Manager ASC key can't cloud-sign). + # Archive with AUTOMATIC signing (development) — see the macOS App Store step. The SwiftPM + # resource bundle (PunktfunkKit_PunktfunkKit) builds for appletvos and rejected the + # sdk-scoped profile this step used to set; Automatic signing profiles only the app and + # leaves the resource bundle + the macOS-host macro plugins (OnceMacro/SwizzlingMacro/ + # AssociationMacro) alone. No -allowProvisioningUpdates → OFFLINE, never cloud-signs (the + # App-Manager ASC key can't), so the runner needs a tvOS *development* profile for + # io.unom.punktfunk installed. DISTRIBUTION signing is the export step below (manual, plist). osascript -e 'tell application "Xcode" to quit' >/dev/null 2>&1 || true pkill -x Xcode 2>/dev/null || true PROFILE="Punktfunk tvOS App Store Distribution" - # Scope signing to the tvOS device SDK via an xcconfig. A global (CLI) profile specifier - # hits EVERY target, including the shared SwiftPM macro plugins (OnceMacro/SwizzlingMacro/ - # AssociationMacro) which build for the macOS host and reject a provisioning profile - # (" does not support provisioning profiles"), failing the archive. Conditionals - # work only in an xcconfig (xcodebuild mis-parses a CLI "SETTING[sdk=..]=val"), and a - # command-line -xcconfig outranks target settings, so [sdk=appletvos*] puts the profile on - # the app/framework slices only — the macosx-host macros get nothing. (The macOS archive - # above is immune: its host-SDK macros are CODE_SIGNING_ALLOWED=NO, so a global specifier - # is ignored there.) - SIGN_XCCONFIG="$RUNNER_TEMP/sign-tvos.xcconfig" - cat > "$SIGN_XCCONFIG" < "$RUNNER_TEMP/export-tvos.plist" <