Make iOS release signing deterministic

scripts/configure-ios-signing.js

@@ -0,0 +1,20 @@
+// @ts-check
+const fs = require("fs");
+const path = require("path");
+const xcode = require("xcode");
+const { configureReleaseSigning } = require("../plugins/withAppStoreSigning");
+
+const projectPath = process.argv[2];
+if (!projectPath) {
+  throw new Error(
+    "Usage: node scripts/configure-ios-signing.js <project.pbxproj>",
+  );
+}
+
+const resolvedPath = path.resolve(projectPath);
+const project = xcode.project(resolvedPath);
+project.parseSync();
+configureReleaseSigning(project);
+fs.writeFileSync(resolvedPath, project.writeSync());
+
+console.log("Configured manual App Store signing for iOS release targets.");

scripts/ios-release.sh

@@ -185,6 +185,10 @@ prepare_native_project() {
     fi
   )
 
+  if [[ -f "$ROOT/$PROJECT/project.pbxproj" ]]; then
+    node "$ROOT/scripts/configure-ios-signing.js" "$ROOT/$PROJECT/project.pbxproj"
+  fi
+
   resolve_xcode_workspace
 }
 
@@ -241,7 +245,6 @@ archive_app() {
     -archivePath "$ARCHIVE_PATH" \
     -destination "generic/platform=iOS" \
     -allowProvisioningUpdates \
-    CODE_SIGN_STYLE=Automatic \
     DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
     "${API_AUTH_ARGS[@]}" \
     archive