xcode – What’s the appropriate solution to create an iOS ipa on distant machine?

I have been struggling for a couple of week attempting to put in writing a Github motion that builds and uploads an iOS ipa to App Retailer Join.

I appear to be working into points when attempting create the ipa file itself. I’ve tried quite a few variations of the next workflow yml:

title: Handbook Workflow

on:
  workflow_dispatch:
    inputs:
      job:
        description: 'Choose the job to run'
        required: true
        default: 'build_and_upload_to_google_play'
        kind: selection
        choices:
          - build_and_upload_to_app_store_connect

jobs:
  build_and_upload_to_app_store_connect:
    if: ${{ github.occasion.inputs.job == 'build_and_upload_to_app_store_connect' }}
    runs-on: macos-latest

    steps:
      - title: checkout repository
        makes use of: actions/checkout@v3

      - title: Set up the Apple certificates and provisioning profile
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets and techniques.DEVELOPMENT_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets and techniques.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets and techniques.DEVELOPMENT_PROVISIONING_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets and techniques.KEYCHAIN_PASSWORD }}
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificates and provisioning profile from secrets and techniques
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

          # create non permanent keychain
          safety create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          safety set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          safety unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificates to keychain
          safety import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          safety list-keychain -d person -s $KEYCHAIN_PATH

          # apply provisioning profile
          mkdir -p ~/Library/MobileDevice/Provisioning Profiles
          cp $PP_PATH ~/Library/MobileDevice/Provisioning Profiles          

      - title: construct archive
        run: |
          xcodebuild -workspace ios/Runner.xcworkspace 
          -scheme Runner 
          -archivePath construct/ios/archive/Runner.xcarchive 
          -sdk iphoneos 
          -configuration Debug 
          -destination generic/platform=iOS 
          clear archive        

      - title: export ipa
        env:
          EXPORT_OPTIONS_PLIST: ${{ secrets and techniques.EXPORT_OPTIONS_PLIST }}
        run: |
          EXPORT_OPTS_PATH=$RUNNER_TEMP/ExportOptions.plist
          echo -n "$EXPORT_OPTIONS_PLIST" | base64 --decode -o $EXPORT_OPTS_PATH
          xcodebuild -exportArchive -archivePath $RUNNER_TEMP/Runner.xcarchive -exportOptionsPlist $EXPORT_OPTS_PATH -exportPath $RUNNER_TEMP/construct

It doesn’t matter what I do, I’m at all times seeing some variation of those error messages:

/Customers/runner/work/my-project/my-project/ios/Runner.xcodeproj: error: No Accounts: Add a brand new account in Accounts settings. (in goal 'Runner' from undertaking 'Runner')
/Customers/runner/work/my-project/my-project/ios/Runner.xcodeproj: error: No profiles for 'com.bundle.identifier' have been discovered: Xcode could not discover any iOS App Improvement provisioning profiles matching 'com.bundle.identifier'. (in goal 'Runner' from undertaking 'Runner')

I’ve tried variations of “Robotically managed signing” on and off and have the identical end result both means. When “Robotically managed signing” has been off, I had assigned a Improvement provisioning profile to the debug and profile configs, and a Distribution provisioning profile to the discharge config.

I even have my improvement and distribution provisioning profiles signed with two totally different signing certificates.

I’ve additionally tried variations of putting in each provisioning profiles and their related certificates in addition to putting in every provisioning profile and their related certificates individually.

I assume the questions I’ve are:

1. Ought to my undertaking be utilizing “Robotically managed signing” if I wish to construct/add an ipa in a CI/CD pipeline?
2. If the reply to 1 is “no”, am I appropriate in my assertion that the discharge construct config ought to be signed with the Distribution provisioning profile and the opposite two with the Improvement provisioning profile?
3. Did I make a mistake in signing my Distribution and Improvement provisioning profiles with two distinct signing certificates?
4. What’s the established strategy for constructing an iOS ipa on a distant machine? Is there something I’m doing that’s clearly flawed?

P.S.:

It is in all probability value mentioning that I’ve tried utilizing fastlane and flutter construct as a substitute of xcodebuild instantly, however have in the end run into the “No Accounts” and “No profiles” errors it doesn’t matter what I’ve tried.