ci(ios): add reusable codesigning action

Author: fadi-george

.github/actions/setup-ios-codesigning/action.yml

@@ -0,0 +1,56 @@
+name: 'Setup iOS Codesigning'
+description: 'Import an Apple Development/Distribution signing certificate and download a provisioning profile via the App Store Connect API. Call once per bundle id; the cert import is automatically skipped on repeat calls within the same job.'
+
+inputs:
+  p12-base64:
+    description: 'Base64-encoded .p12 signing certificate'
+    required: true
+  p12-password:
+    description: 'Password used when exporting the .p12'
+    required: true
+  asc-key-id:
+    description: 'App Store Connect API Key ID'
+    required: true
+  asc-issuer-id:
+    description: 'App Store Connect API Issuer ID'
+    required: true
+  asc-private-key-base64:
+    description: 'Base64-encoded App Store Connect API private key (.p8)'
+    required: true
+  bundle-id:
+    description: 'Bundle identifier of the target whose provisioning profile should be downloaded'
+    required: true
+  profile-type:
+    description: 'Provisioning profile type to download (IOS_APP_DEVELOPMENT, IOS_APP_ADHOC, IOS_APP_STORE)'
+    required: false
+    default: 'IOS_APP_DEVELOPMENT'
+
+runs:
+  using: composite
+  steps:
+    - name: Check for existing signing keychain
+      id: keychain-check
+      shell: bash
+      run: |
+        if security list-keychains -d user | grep -qi signing_temp; then
+          echo "exists=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "exists=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Import signing certificate
+      if: steps.keychain-check.outputs.exists != 'true'
+      uses: apple-actions/import-codesign-certs@v3
+      with:
+        p12-file-base64: ${{ inputs.p12-base64 }}
+        p12-password: ${{ inputs.p12-password }}
+        keychain-password: ci-keychain
+
+    - name: Download provisioning profile
+      uses: apple-actions/download-provisioning-profiles@v3
+      with:
+        bundle-id: ${{ inputs.bundle-id }}
+        profile-type: ${{ inputs.profile-type }}
+        issuer-id: ${{ inputs.asc-issuer-id }}
+        api-key-id: ${{ inputs.asc-key-id }}
+        api-private-key: ${{ inputs.asc-private-key-base64 }}