fix: sign release XCFrameworks with OneSignal identity, archive unsigned

Archive with CODE_SIGNING_ALLOWED=NO so the build needs no certificate
(fixes the team 99SW8E36CT archive failure), then sign inner + outer
slices with the OneSignal Apple Distribution identity. The framework list
lives in a single XCFRAMEWORKS job env var. Drop the unused Lilomi
dev-cert import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nan-li

.github/workflows/create-release-prs.yml

@@ -44,6 +44,20 @@ jobs:
       BASE_BRANCH: ${{ github.event.inputs.base_branch }}
       RELEASE_BRANCH: ${{ needs.prep.outputs.release_branch }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Single source of truth for the XCFrameworks the Code Sign and Verify steps
+      # operate on (paths relative to iOS_SDK/OneSignalSDK). Keep in sync with the
+      # frameworks built by build_all_frameworks.sh.
+      XCFRAMEWORKS: >-
+        OneSignal_Core/OneSignalCore.xcframework
+        OneSignal_OSCore/OneSignalOSCore.xcframework
+        OneSignal_Outcomes/OneSignalOutcomes.xcframework
+        OneSignal_Extension/OneSignalExtension.xcframework
+        OneSignal_Notifications/OneSignalNotifications.xcframework
+        OneSignal_User/OneSignalUser.xcframework
+        OneSignal_LiveActivities/OneSignalLiveActivities.xcframework
+        OneSignal_Location/OneSignalLocation.xcframework
+        OneSignal_InAppMessages/OneSignalInAppMessages.xcframework
+        OneSignal_XCFramework/OneSignalFramework.xcframework
 
     steps:
       - name: 📋 Display Configuration
@@ -75,21 +89,13 @@ jobs:
         with:
           xcode-version: "15.2"
 
-      - name: Install the Apple distribution certificate and provisioning profile (OneSignal)
+      - name: Install the Apple distribution certificate (OneSignal)
         uses: apple-actions/import-codesign-certs@v2
         with:
           keychain-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
           p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
           p12-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
 
-      - name: Install the Apple distribution certificate and provisioning profile (Lilomi)
-        uses: apple-actions/import-codesign-certs@v2
-        with:
-          create-keychain: false # do not create a new keychain for this value
-          keychain-password: ${{ secrets.CERTIFICATES_P12_PASSWORD }}
-          p12-file-base64: ${{ secrets.DEV_CERTIFICATES_P12 }}
-          p12-password: ${{ secrets.DEV_CERTIFICATES_P12_PASSWORD }}
-
       - name: Update Version in SDK and Podspec Files
         run: |
           cd iOS_SDK/OneSignalSDK
@@ -112,16 +118,20 @@ jobs:
       - name: Code Sign
         run: |
           cd iOS_SDK/OneSignalSDK
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_Core/OneSignalCore.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_Extension/OneSignalExtension.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_InAppMessages/OneSignalInAppMessages.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_Location/OneSignalLocation.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_Notifications/OneSignalNotifications.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_OSCore/OneSignalOSCore.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_Outcomes/OneSignalOutcomes.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_User/OneSignalUser.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_XCFramework/OneSignalFramework.xcframework
-          codesign --timestamp -v --sign "Apple Distribution: OneSignal, Inc. (J3J28YJX9L)" OneSignal_LiveActivities/OneSignalLiveActivities.xcframework
+          set -e
+          IDENTITY="Apple Distribution: OneSignal, Inc. (J3J28YJX9L)"
+          for XCF in $XCFRAMEWORKS; do
+            # Sign inside-out: each slice's .framework binary first, then the
+            # .xcframework wrapper. -f replaces the linker's ad-hoc signature left
+            # by the unsigned archive build, so both inner and outer end up signed
+            # with the official OneSignal Apple Distribution identity.
+            while IFS= read -r FW; do
+              echo "Signing inner framework: $FW"
+              codesign --timestamp -f -v --sign "$IDENTITY" "$FW"
+            done < <(find "$XCF" -type d -name "*.framework")
+            echo "Signing wrapper: $XCF"
+            codesign --timestamp -f -v --sign "$IDENTITY" "$XCF"
+          done
         shell: bash
 
       - name: Commit Build and Push Changes

iOS_SDK/OneSignalSDK/build_all_frameworks.sh

@@ -26,11 +26,17 @@ create_xcframework() {
 
     xcodebuild -list
 
-    xcodebuild archive ONLY_ACTIVE_ARCH=NO -scheme ${BUILD_SCHEME} -destination="generic/platform=iOS Simulator" -archivePath "${SIMULATOR_ARCHIVE_PATH}" -sdk iphonesimulator SKIP_INSTALL=NO BUILD_LIBRARIES_FOR_DISTRIBUTION=YES
+    # Note: code signing is disabled here. These are distribution XCFrameworks
+    # that are signed afterward with the Apple Distribution cert in the workflow's
+    # "Code Sign" step, so the archive itself does not need to be signed. This also
+    # avoids depending on the project's baked-in DEVELOPMENT_TEAM / dev certificate.
+    CODE_SIGN_FLAGS="CODE_SIGN_IDENTITY= CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO"
 
-    xcodebuild archive -scheme ${BUILD_SCHEME} -destination="generic/platform=iOS" -archivePath "${IOS_DEVICE_ARCHIVE_PATH}" -sdk iphoneos SKIP_INSTALL=NO BUILD_LIBRARIES_FOR_DISTRIBUTION=YES
+    xcodebuild archive ONLY_ACTIVE_ARCH=NO -scheme ${BUILD_SCHEME} -destination="generic/platform=iOS Simulator" -archivePath "${SIMULATOR_ARCHIVE_PATH}" -sdk iphonesimulator SKIP_INSTALL=NO BUILD_LIBRARIES_FOR_DISTRIBUTION=YES ${CODE_SIGN_FLAGS}
 
-    xcodebuild archive -scheme ${BUILD_SCHEME} -destination='generic/platform=macOS,variant=Mac Catalyst' -archivePath "${CATALYST_ARCHIVE_PATH}" SKIP_INSTALL=NO BUILD_LIBRARIES_FOR_DISTRIBUTION=YES
+    xcodebuild archive -scheme ${BUILD_SCHEME} -destination="generic/platform=iOS" -archivePath "${IOS_DEVICE_ARCHIVE_PATH}" -sdk iphoneos SKIP_INSTALL=NO BUILD_LIBRARIES_FOR_DISTRIBUTION=YES ${CODE_SIGN_FLAGS}
+
+    xcodebuild archive -scheme ${BUILD_SCHEME} -destination='generic/platform=macOS,variant=Mac Catalyst' -archivePath "${CATALYST_ARCHIVE_PATH}" SKIP_INSTALL=NO BUILD_LIBRARIES_FOR_DISTRIBUTION=YES ${CODE_SIGN_FLAGS}
 
     xcodebuild -create-xcframework -framework ${SIMULATOR_ARCHIVE_PATH}/Products/Library/Frameworks/${FRAMEWORK_NAME}.framework -debug-symbols ${SIMULATOR_ARCHIVE_PATH}/dSYMs/${FRAMEWORK_NAME}.framework.dSYM -framework ${IOS_DEVICE_ARCHIVE_PATH}/Products/Library/Frameworks/${FRAMEWORK_NAME}.framework -debug-symbols ${IOS_DEVICE_ARCHIVE_PATH}/dSYMs/${FRAMEWORK_NAME}.framework.dSYM -framework ${CATALYST_ARCHIVE_PATH}/Products/Library/Frameworks/${FRAMEWORK_NAME}.framework -debug-symbols ${CATALYST_ARCHIVE_PATH}/dSYMs/${FRAMEWORK_NAME}.framework.dSYM -output "${FRAMEWORK_PATH}"
     rm -rf "${SIMULATOR_ARCHIVE_PATH}"