GitHub 操作 IOS xcode QA/Staging 以及证书和配置文件的问题

Question

我正在使用 xcode 11.3 的 IOS 的 GitHub 操作。我能够构建、导出存档并推送到开发环境的应用程序中心。但是，我在暂存/QA 环境中遇到错误。

如果我提供与暂存/QA 中的开发环境相同的证书和配置文件，我在导出存档时会收到错误（构建成功）：-

#Export Archives
##[error]Process completed with exit code 70.
Run xcodebuild -exportArchive -archivePath abc.xcarchive -exportPath abc.ipa -exportOptionsPlist ./abc/ExportOptions.plist          
2020-04-16 15:57:11.154 xcodebuild[7404:37990] [MT] IDEDistribution: -[IDEDistributionLogging _createLoggingBundleAtPath:]: Created bundle at path '/var/folders/24/8k48jl6d249_n_qfxwsl6xvm0000gn/T/abcStaging_2020-04-16_15-57-11.153.xcdistributionlogs'.
error: exportArchive: No profiles for 'com.abc.Staging' were found
** EXPORT FAILED **

Error Domain=IDEProfileLocatorErrorDomain Code=1 "No profiles for 'com.abc.Staging' were found" UserInfo={IDEDistributionIssueSeverity=3, NSLocalizedDescription=No profiles for 'com.abc.Staging' were found, NSLocalizedRecoverySuggestion=Xcode couldn't find any iOS Ad Hoc provisioning profiles matching 'com.abc.Staging'. Automatic signing is disabled and unable to generate a profile. To enable automatic signing, pass -allowProvisioningUpdates to xcodebuild.}

如果我在苹果开发者帐户中创建新证书（苹果发行版）和配置文件（临时发行版）。导出文件并转换文件，然后在 GitHub 操作中上传 .p12.gpg 和 mobileprovision.gpg，我在构建时遇到错误：-

#Build archives
##[error]Process completed with exit code 65.
Run xcodebuild archive -workspace abc.xcworkspace -scheme abcStaging -archivePath abc.xcarchive
User defaults from command line:
    IDEArchivePathOverride = /Users/runner/runners/2.169.0/work/abcappIOS-v1.0/abcappIOS-v1.0/abc.xcarchive

note: Using new build system
note: Planning build
note: Constructing build description
error: No profiles for 'com.abc.Staging' were found: Xcode couldn't find any iOS App Development provisioning profiles matching 'com.abc.Staging'. Automatic signing is disabled and unable to generate a profile. To enable automatic signing, pass -allowProvisioningUpdates to xcodebuild. (in target 'abc' from project 'abc')

** ARCHIVE FAILED **

##[error]Process completed with exit code 65.

我已在导出存档中提供 -allowProvisioningUpdates 作为参数，但错误仍然存​​在

以下是来自github actions的代码

name: Deploy iOS to App Center

on:
  push:
    branches: [ staging ]
  pull_request:
    branches: [ staging ]

jobs:
  build:
    runs-on: macOS-latest
    steps:
      - uses: actions/checkout@v1

      - name: Install gpg
        run: brew install gnupg

      - name: Switch XCode Version
        run: sudo xcode-select -s /Applications/Xcode_11.3.app

      - name: Setup provisioning profile
        run: |
          chmod +x ./.github/secrets/secrets.sh
          ./.github/secrets/secrets.sh
        env:
          IOS_PROFILE_KEY: ${{ secrets.ios_profile_key }}

      - name: Install Cocoapods
        run: gem install cocoapods

      - name: Install pod dependencies
        run: |
          pod install
        shell: bash

      - name: Build archive
        run: |
          xcodebuild archive -workspace abc.xcworkspace -scheme abcStaging -archivePath abc.xcarchive

      - name: Export Archive
        run: |
          xcodebuild -exportArchive -archivePath abc.xcarchive -exportPath abc.ipa -exportOptionsPlist ./abc/ExportOptions.plist -allowProvisioningUpdates          

下面是shell脚本

#!/bin/sh
gpg --quiet --batch --yes --decrypt --passphrase="xxxx" --output ./.github/secrets/xxxxx-xxxx-xxxx-xxxx-xxxxxxxx.mobileprovision ./.github/secrets/xxxxx-xxxx-xxxx-xxxx-xxxxxxxx.mobileprovision.gpg

gpg --quiet --batch --yes --decrypt --passphrase="xxxx" --output ./.github/secrets/abc_Certificates.p12 ./.github/secrets/abc_Certificates.p12.gpg

mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles

cp ./.github/secrets/xxxxx-xxxx-xxxx-xxxx-xxxxxxxx.mobileprovision ~/Library/MobileDevice/Provisioning\ Profiles/xxxxx-xxxx-xxxx-xxxx-xxxxxxxx.mobileprovision

security create-keychain -p "" build.keychain
security import ./.github/secrets/abc_Certificates.p12 -t agg -k ~/Library/Keychains/build.keychain -P "xxxx" -A

security list-keychains -s ~/Library/Keychains/build.keychain
security default-keychain -s ~/Library/Keychains/build.keychain
security unlock-keychain -p "" ~/Library/Keychains/build.keychain
security set-keychain-settings -lut 1500 ~/Library/Keychains/build.keychain

security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" ~/Library/Keychains/build.keychain

如何创建证书、用于登台（非开发或非生产环境）的配置文件？请告知，我如何解决上述的分期/质量保证问题？

谢谢

Answer 1

我遇到了同样的错误并且能够找到解决方案。有很多事情可能会出错，所以我将添加几点可以帮助您纠正问题：

1. 开发人员与分发配置文件：您需要不同的开发人员和分发配置文件来进行存档+导出+部署。xcodebuild 会自动选择正确的，但您必须为此创建 2 个不同的配置文件 + 2 个不同的证书。必须针对每个环境（QA、Staging、Prod 等）完成此过程。

总而言之，对于每个环境，都会有 2 个配置文件和 2 个证书（证书可以重复使用，但配置文件不能重复使用，因为它们取决于您拥有多少个不同的捆绑包）。

error: No profiles for 'com.abc.Staging' were found: Xcode couldn't find any iOS App Development provisioning profiles matching 'com.abc.Staging'

上面的错误表明您从未为 com.abc.Staging 创建配置文件，或者至少没有将其下载+添加到正确的位置。

您可以在 Apple 开发者控制台 -> 证书、标识符和配置文件 -> 配置文件中创建它们

确保您还设置了临时（或其他）环境的标识符：com.app.staging 等。

2. 在 XCode 中添加开发配置文件，并确保直接使用 XCode 构建时证书有效。然后在本地尝试您的脚本，然后将它们推送到 Github Actions。

3. 有时，Apple Developer 中的配置文件可能会失效（可能您在 XCode 中撤销或删除了证书等）。这种情况在我身上发生过几次，所以一定要检查一切是否有效。

4. 解密后按 UUID 保存配置文件。我不确定这有多重要，但我还是继续使用了它。

代码在这里：

for PROVISION in `ls ./*.mobileprovision`
do
  UUID=`/usr/libexec/PlistBuddy -c 'Print :UUID' /dev/stdin <<< $(security cms -D -i ./$PROVISION)`
  cp "./$PROVISION" "$HOME/Library/MobileDevice/Provisioning Profiles/$UUID.mobileprovision"
done

推理+示例代码来自这篇文章：https://medium.com/@karaiskc/archive-and-export-ios-app-with-github-actions-b44f676e4bf9

CICD 过程对我来说相当疲惫，但主要的挑战是理解证书、配置文件和钥匙串访问之间的关系，以及它们如何工作。