xcode – What’s the right technique to create an iOS ipa on distant machine?

I have been struggling for a couple of week attempting to put in writing a Github motion that builds and uploads an iOS ipa to App Retailer Join.

I appear to be operating into points when attempting create the ipa file itself. I’ve tried quite a few variations of the next workflow yml:

title: Guide Workflow

on:
  workflow_dispatch:
    inputs:
      job:
        description: 'Choose the job to run'
        required: true
        default: 'build_and_upload_to_google_play'
        kind: selection
        choices:
          - build_and_upload_to_app_store_connect

jobs:
  build_and_upload_to_app_store_connect:
    if: ${{ github.occasion.inputs.job == 'build_and_upload_to_app_store_connect' }}
    runs-on: macos-latest

    steps:
      - title: checkout repository
        makes use of: actions/checkout@v3

      - title: Set up the Apple certificates and provisioning profile
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets and techniques.DEVELOPMENT_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets and techniques.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets and techniques.DEVELOPMENT_PROVISIONING_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets and techniques.KEYCHAIN_PASSWORD }}
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificates and provisioning profile from secrets and techniques
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

          # create momentary keychain
          safety create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          safety set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          safety unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificates to keychain
          safety import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          safety list-keychain -d consumer -s $KEYCHAIN_PATH

          # apply provisioning profile
          mkdir -p ~/Library/MobileDevice/Provisioning Profiles
          cp $PP_PATH ~/Library/MobileDevice/Provisioning Profiles          

      - title: construct archive
        run: |
          xcodebuild -workspace ios/Runner.xcworkspace 
          -scheme Runner 
          -archivePath construct/ios/archive/Runner.xcarchive 
          -sdk iphoneos 
          -configuration Debug 
          -destination generic/platform=iOS 
          clear archive        

      - title: export ipa
        env:
          EXPORT_OPTIONS_PLIST: ${{ secrets and techniques.EXPORT_OPTIONS_PLIST }}
        run: |
          EXPORT_OPTS_PATH=$RUNNER_TEMP/ExportOptions.plist
          echo -n "$EXPORT_OPTIONS_PLIST" | base64 --decode -o $EXPORT_OPTS_PATH
          xcodebuild -exportArchive -archivePath $RUNNER_TEMP/Runner.xcarchive -exportOptionsPlist $EXPORT_OPTS_PATH -exportPath $RUNNER_TEMP/construct

It doesn’t matter what I do, I’m all the time seeing some variation of those error messages:

/Customers/runner/work/my-project/my-project/ios/Runner.xcodeproj: error: No Accounts: Add a brand new account in Accounts settings. (in goal 'Runner' from venture 'Runner')
/Customers/runner/work/my-project/my-project/ios/Runner.xcodeproj: error: No profiles for 'com.bundle.identifier' have been discovered: Xcode could not discover any iOS App Improvement provisioning profiles matching 'com.bundle.identifier'. (in goal 'Runner' from venture 'Runner')

I’ve tried variations of “Robotically managed signing” on and off and have the identical outcome both method. When “Robotically managed signing” has been off, I had assigned a Improvement provisioning profile to the debug and profile configs, and a Distribution provisioning profile to the discharge config.

I even have my growth and distribution provisioning profiles signed with two totally different signing certificates.

I’ve additionally tried variations of putting in each provisioning profiles and their related certificates in addition to putting in every provisioning profile and their related certificates individually.

I assume the questions I’ve are:

1. Ought to my venture be utilizing “Robotically managed signing” if I wish to construct/add an ipa in a CI/CD pipeline?
2. If the reply to 1 is “no”, am I right in my assertion that the discharge construct config needs to be signed with the Distribution provisioning profile and the opposite two with the Improvement provisioning profile?
3. Did I make a mistake in signing my Distribution and Improvement provisioning profiles with two distinct signing certificates?
4. What’s the established strategy for constructing an iOS ipa on a distant machine? Is there something I’m doing that’s clearly fallacious?

P.S.:

It is in all probability price mentioning that I’ve tried utilizing fastlane and flutter construct as a substitute of xcodebuild instantly, however have in the end run into the “No Accounts” and “No profiles” errors it doesn’t matter what I’ve tried.