fix(ci): give the TestFlight build Apple auth so a new target can get a profile

The share extension is a second build target with its own bundle identifier,
and a new target needs its own provisioning profile. The workflow wrote the
App Store Connect key only for the submit step, so the build step had no Apple
authentication: EAS fell back to an interactive login and failed with
"Failed to set up credentials" before it could create the profile.

The key and issuer ids are read from eas.json rather than repeated here, so
the build and submit steps cannot disagree about which key they mean.

Author: AnkushMalaker

.github/workflows/ios-testflight.yml

@@ -54,9 +54,23 @@ jobs:
           printf '%s\n' "$ASC_API_KEY_P8" > asc-api-key.p8
           chmod 600 asc-api-key.p8
           openssl pkey -in asc-api-key.p8 -noout -check
+          # Read the key/issuer ids from eas.json rather than repeating them, so the
+          # build and submit steps can never disagree about which key they mean.
+          node -e '
+            const ios = require("./eas.json").submit.testflight.ios;
+            const out = require("fs");
+            out.appendFileSync(process.env.GITHUB_ENV,
+              `EXPO_ASC_KEY_ID=${ios.ascApiKeyId}\nEXPO_ASC_ISSUER_ID=${ios.ascApiKeyIssuerId}\n`);
+          '
 
       - name: Build and submit to TestFlight
         if: inputs.build_id == ''
+        # The ASC key is exported for the *build*, not just the submit step: a new
+        # target (the share extension) needs its own provisioning profile, and
+        # without Apple auth EAS falls back to an interactive login and fails
+        # non-interactive builds with "Failed to set up credentials".
+        env:
+          EXPO_ASC_API_KEY_PATH: ${{ github.workspace }}/app/asc-api-key.p8
         run: eas build --platform ios --profile testflight --auto-submit --non-interactive
 
       - name: Submit existing build to TestFlight