From e57ee3d4469e24e1cbb7e5fd6b7c61921805b191 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Thu, 22 Oct 2026 03:05:51 +0200
Subject: [PATCH] ci: sign the ios simulator build ad hoc so the keychain has
 its entitlements

---
 .github/workflows/e2e-ios.yml | 15 ++++++++++++++-
 scripts/e2e/boot-sim.sh       | 22 ----------------------
 2 files changed, 14 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/e2e-ios.yml b/.github/workflows/e2e-ios.yml
index 0f7c57c9..715cc5f5 100644
--- a/.github/workflows/e2e-ios.yml
+++ b/.github/workflows/e2e-ios.yml
@@ -102,6 +102,8 @@ jobs:
         run: npx expo prebuild --platform ios --clean
 
       - name: Build for the simulator
+        env:
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
           WORKSPACE=$(ls -d ios/*.xcworkspace | head -1)
           SCHEME=$(basename "$WORKSPACE" .xcworkspace)
@@ -117,12 +119,23 @@ jobs:
             -destination 'generic/platform=iOS Simulator' \
             -derivedDataPath build \
             ARCHS=arm64 \
-            CODE_SIGNING_ALLOWED=NO \
+            CODE_SIGN_STYLE=Manual \
+            CODE_SIGN_IDENTITY=- \
+            DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
+            PROVISIONING_PROFILE_SPECIFIER= \
             > e2e-build/xcodebuild.log 2>&1; then
             grep -E "error:|fatal error" e2e-build/xcodebuild.log | head -n 50 || true
             tail -n 80 e2e-build/xcodebuild.log
             exit 1
           fi
+          # Signed ad hoc ("Sign to Run Locally"): no certificate needed, and
+          # Xcode embeds the simulator entitlements the keychain needs. An
+          # unsigned build has none, and every expo-secure-store call fails
+          # with "A required entitlement isn't present".
+          APP_PATH=build/Build/Products/Release-iphonesimulator/BulwarkMobile.app
+          echo "Simulated entitlements:"
+          xcrun otool -X -s __TEXT __entitlements "$APP_PATH/BulwarkMobile" | head -20 || true
+          codesign -d --entitlements - "$APP_PATH" 2>&1 | head -20 || true
           # Packed as a tar: artifacts drop the executable bit, which would
           # leave a reused app unable to launch.
           tar -C build/Build/Products/Release-iphonesimulator -czf "$RUNNER_TEMP/simulator-app.tar.gz" BulwarkMobile.app
diff --git a/scripts/e2e/boot-sim.sh b/scripts/e2e/boot-sim.sh
index b2a98c6c..a96f12ac 100644
--- a/scripts/e2e/boot-sim.sh
+++ b/scripts/e2e/boot-sim.sh
@@ -43,28 +43,6 @@ xcrun simctl spawn "$UDID" defaults write $PREFS KeyboardShowPredictionBar -bool
 xcrun simctl spawn "$UDID" defaults write com.apple.WebUI AutoFillPasswords -bool false || true
 
 xcrun simctl ui "$UDID" appearance "$APPEARANCE"
-# The app is built without signing (no certificate on the runner), so it
-# carries no entitlements and every keychain call (expo-secure-store, which
-# holds the credentials) fails with "A required entitlement isn't present".
-# Sign it ad hoc with the keychain entitlement, as Xcode's "Sign to Run
-# Locally" does for simulator builds.
-ENT="$RUNNER_TEMP/simulator.entitlements"
-cat > "$ENT" <<'PLIST'
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>application-identifier</key>
-  <string>8ZANF9LQ39.org.bulwarkmail.mobile</string>
-  <key>keychain-access-groups</key>
-  <array>
-    <string>8ZANF9LQ39.org.bulwarkmail.mobile</string>
-  </array>
-</dict>
-</plist>
-PLIST
-codesign --force --sign - --entitlements "$ENT" --timestamp=none "$APP"
-codesign -d --entitlements - "$APP" 2>/dev/null | grep -c keychain-access-groups
 xcrun simctl install "$UDID" "$APP"
 # A photo for the compose flow's attachment.
 xcrun simctl addmedia "$UDID" "$(dirname "$0")/../../assets/icon.png" || true