ios build fixes

codemagic.yaml

@@ -92,9 +92,13 @@ workflows:
     environment:
       flutter: 3.44.8
       java: 17
-      ios_signing:
-        distribution_type: app_store
-        bundle_identifier: com.troglodyte.timbre
+      # NOTE: intentionally NO `ios_signing` block. That block triggers
+      # Codemagic's *automatic* signing during build initialization, which only
+      # FETCHES existing certs/profiles and fails the build up front ("No
+      # matching profiles found") on a fresh account that has none yet. Instead
+      # we sign fully manually in the scripts below, where we can create the
+      # cert + profile on first run. The `integrations.app_store_connect` above
+      # still injects the ASC API-key env vars the app-store-connect CLI uses.
       vars:
         # The app's numeric Apple ID (App Store Connect → your app → App
         # Information → General → Apple ID). Used to auto-bump the build number
@@ -111,24 +115,27 @@ workflows:
       - *get_deps
       - *analyze
       - *unit_tests
+      - name: Initialize keychain
+        # Manual signing: create the build keychain ourselves (the removed
+        # ios_signing block used to do this automatically).
+        script: keychain initialize
       - name: Fetch signing files
-        # Codemagic's automatic signing (the ios_signing block) only *fetches*
-        # existing certs/profiles — it never creates them. On a fresh account
-        # with no distribution cert or App Store profile yet, that fetch is
-        # empty and `use-profiles` fails with "No matching profiles found".
-        # So we explicitly create-on-miss here: fetch-signing-files --create
-        # mints the Apple Distribution cert + App Store profile via the ASC API
-        # key (the App ID must already be registered), add-certificates loads
-        # the new cert into the build keychain (already initialized by the
-        # ios_signing block), and use-profiles writes export_options.plist.
-        # After the first successful run these resources exist and are simply
-        # reused on subsequent builds.
+        # fetch-signing-files --create mints the Apple Distribution cert + the
+        # App Store provisioning profile via the ASC API key and downloads them.
+        # --create also registers the Bundle ID if it isn't already. On the
+        # first build this creates everything; later builds reuse it.
         script: |
           app-store-connect fetch-signing-files "com.troglodyte.timbre" \
             --type IOS_APP_STORE \
             --create
-          keychain add-certificates
-          xcode-project use-profiles
+      - name: Add certificates to keychain
+        # Load the freshly fetched distribution cert into the build keychain.
+        script: keychain add-certificates
+      - name: Set up code signing
+        # Applies the profile to the Xcode project and writes
+        # ~/export_options.plist (= /Users/builder/export_options.plist) that
+        # the build step reads.
+        script: xcode-project use-profiles
       - name: Build signed IPA
         script: |
           BUILD_NUMBER=$(app-store-connect get-latest-testflight-build-number "$APP_STORE_APPLE_ID" 2>/dev/null || echo 0)