From 3a018d91f3838730a76c24a4057cb24c7e35439a Mon Sep 17 00:00:00 2001
From: Makito <i@maki.to>
Date: Sat, 4 Apr 2026 17:14:34 +0900
Subject: [PATCH] chore(ci): add codesign and archive steps for stage-pocket
 iOS build

---
 .github/workflows/release-pocket-ios.yml  | 78 +++++++++++++++++++++--
 apps/stage-pocket/ios/ExportOptions.plist | 17 +++++
 cspell.config.yaml                        |  5 ++
 3 files changed, 96 insertions(+), 4 deletions(-)
 create mode 100644 apps/stage-pocket/ios/ExportOptions.plist

diff --git a/.github/workflows/release-pocket-ios.yml b/.github/workflows/release-pocket-ios.yml
index a359ba187..4d363ff90 100644
--- a/.github/workflows/release-pocket-ios.yml
+++ b/.github/workflows/release-pocket-ios.yml
@@ -33,11 +33,81 @@ jobs:
       - name: Sync assets to iOS
         run: pnpm -F @proj-airi/stage-pocket exec cap sync ios
 
-      - name: Build iOS
+      - name: Install Apple certificate
+        env:
+          CERT_BASE64: ${{ secrets.APPLE_DISTRIBUTION_CERT_BASE64 }}
+          CERT_PASSWORD: ${{ secrets.APPLE_DISTRIBUTION_CERT_PASSWORD }}
         run: |
-          xcodebuild build \
+          CERT_PATH="$RUNNER_TEMP/certificate.p12"
+          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"
+          KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"
+
+          echo "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
+
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security set-keychain-settings -lut 3600 "$KEYCHAIN_PATH"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+          security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$CERT_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/security
+
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db
+
+          echo "KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
+
+      - name: Install provisioning profile
+        env:
+          PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
+        run: |
+          PROFILE_PATH="$RUNNER_TEMP/profile.mobileprovision"
+          echo "$PROFILE_BASE64" | base64 --decode -o "$PROFILE_PATH"
+
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp "$PROFILE_PATH" ~/Library/MobileDevice/Provisioning\ Profiles/
+
+      - name: Archive iOS
+        run: |
+          xcodebuild archive \
             -project apps/stage-pocket/ios/App/App.xcodeproj \
             -scheme App \
             -configuration Release \
-            -destination "generic/platform=iOS Simulator" \
-            CODE_SIGNING_ALLOWED=NO
+            -destination "generic/platform=iOS" \
+            -archivePath "$RUNNER_TEMP/App.xcarchive" \
+            DEVELOPMENT_TEAM=433DLLA855 \
+            CODE_SIGN_STYLE=Manual \
+            CODE_SIGN_IDENTITY="Apple Distribution" \
+            PROVISIONING_PROFILE_SPECIFIER="AIRI CI" \
+            CURRENT_PROJECT_VERSION=${{ github.run_number }}
+
+      - name: Export IPA
+        run: |
+          xcodebuild -exportArchive \
+            -archivePath "$RUNNER_TEMP/App.xcarchive" \
+            -exportPath "$RUNNER_TEMP/output" \
+            -exportOptionsPlist apps/stage-pocket/ios/ExportOptions.plist
+
+      - name: Rename IPA for distribution
+        run: |
+          VERSION="$(sed -n 's/.*MARKETING_VERSION = \(.*\);/\1/p' apps/stage-pocket/ios/App/App.xcodeproj/project.pbxproj | head -1 | tr -d ' ')"
+          IPA_SOURCE="$(find "$RUNNER_TEMP/output" -name '*.ipa' -print -quit)"
+          IPA_NAME="${PRODUCT_NAME}-${VERSION}-ios.ipa"
+
+          mv "$IPA_SOURCE" "$RUNNER_TEMP/output/$IPA_NAME"
+
+          echo "IPA_NAME=$IPA_NAME" >> "$GITHUB_ENV"
+
+      - name: Upload IPA artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.IPA_NAME }}
+          path: ${{ runner.temp }}/output/${{ env.IPA_NAME }}
+          if-no-files-found: error
+
+      - name: Clean up signing
+        if: always()
+        run: |
+          if [ -n "$KEYCHAIN_PATH" ]; then
+            security delete-keychain "$KEYCHAIN_PATH" 2>/dev/null || true
+          fi
+          rm -f ~/Library/MobileDevice/Provisioning\ Profiles/*.mobileprovision
diff --git a/apps/stage-pocket/ios/ExportOptions.plist b/apps/stage-pocket/ios/ExportOptions.plist
new file mode 100644
index 000000000..87dddde8c
--- /dev/null
+++ b/apps/stage-pocket/ios/ExportOptions.plist
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>method</key>
+	<string>app-store-connect</string>
+	<key>teamID</key>
+	<string>433DLLA855</string>
+	<key>signingStyle</key>
+	<string>manual</string>
+	<key>provisioningProfiles</key>
+	<dict>
+		<key>ai.moeru.airi-pocket</key>
+		<string>AIRI CI</string>
+	</dict>
+</dict>
+</plist>
diff --git a/cspell.config.yaml b/cspell.config.yaml
index 8de3d6fc3..5ec23c71c 100644
--- a/cspell.config.yaml
+++ b/cspell.config.yaml
@@ -3,6 +3,7 @@ ignorePaths: []
 dictionaryDefinitions: []
 dictionaries: []
 words:
+  - 433DLLA855
   - acubismmotion
   - Aerisita
   - aihubmix
@@ -46,6 +47,7 @@ words:
   - cjkfonts
   - clippy
   - clustr
+  - codesign
   - collectblock
   - colorjs
   - cometapi
@@ -178,6 +180,7 @@ words:
   - minimizable
   - minisearch
   - mkdist
+  - mobileprovision
   - modelcontextprotocol
   - modnet
   - moeru
@@ -218,6 +221,7 @@ words:
   - otelcol
   - owenthereal
   - oxlint
+  - pbxproj
   - pglite
   - pgvector
   - picklist
@@ -328,6 +332,7 @@ words:
   - worklets
   - xast
   - xastscript
+  - xcarchive
   - xcodeproj
   - Xenova
   - xiaolai