ci(ios): import one stored distribution certificate instead of minting one per run

.github/workflows/native-release.yml

@@ -151,17 +151,24 @@ jobs:
           ASC_KEY_P8_B64: ${{ secrets.ASC_KEY_P8_B64 }}
         run: printf '%s' "$ASC_KEY_P8_B64" | base64 -d > "$RUNNER_TEMP/AuthKey.p8"
 
+      - name: Distribution certificate
+        env:
+          APPLE_DIST_CERT_P12_B64: ${{ secrets.APPLE_DIST_CERT_P12_B64 }}
+        run: printf '%s' "$APPLE_DIST_CERT_P12_B64" | base64 -d > "$RUNNER_TEMP/dist.p12"
+
       # Signs for distribution and uploads to TestFlight. Automatic signing cannot
       # run on a device-less CI runner (it signs for development and then needs a
       # development profile, which needs a registered device), so client/fastlane/Fastfile
-      # signs manually: it creates or reuses the distribution certificate and the App
-      # Store profile through the API key, so neither has to be stored as a secret.
+      # imports the stored distribution certificate and creates the App Store profile
+      # through the API key.
       - name: Build and upload to TestFlight
         working-directory: client
         env:
           ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
           ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
           ASC_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
+          CERT_P12_PATH: ${{ runner.temp }}/dist.p12
+          CERT_P12_PASSWORD: ${{ secrets.APPLE_DIST_CERT_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           MARKETING_VERSION: ${{ steps.version.outputs.version }}
           CURRENT_PROJECT_VERSION: ${{ steps.version.outputs.build }}
@@ -169,6 +176,6 @@ jobs:
           FASTLANE_HIDE_CHANGELOG: '1'
         run: fastlane ios beta
 
-      - name: Remove the API key
+      - name: Remove secrets
         if: always()
-        run: rm -f "$RUNNER_TEMP/AuthKey.p8"
+        run: rm -f "$RUNNER_TEMP/AuthKey.p8" "$RUNNER_TEMP/dist.p12"

client/fastlane/Fastfile

@@ -43,10 +43,14 @@ platform :ios do
     )
     keychain_path = File.expand_path("~/Library/Keychains/#{keychain_name}-db")
 
-    # Distribution certificate into the keychain, and an App Store profile that trusts it.
-    get_certificates(
-      api_key: key,
-      development: false,
+    # Import the one distribution certificate from its stored .p12, rather than
+    # minting a new one each run — Apple caps distribution certificates at two, so
+    # a fresh one per build would quickly hit the limit. The matching App Store
+    # profile is created (or reused) through the API key.
+    import_certificate(
+      certificate_path: ENV.fetch("CERT_P12_PATH"),
+      certificate_password: ENV.fetch("CERT_P12_PASSWORD"),
+      keychain_name: keychain_name,
       keychain_path: keychain_path,
       keychain_password: keychain_password,
     )