From cd5ea02b661876f142fed328887d554ca20d8ba6 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Wed, 3 Jun 2026 12:23:49 +0200
Subject: [PATCH 01/15] fix: debugging workflow

check the size of the file after it is decoded.
---
 .github/workflows/build-release-ios.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index b30342a..dbf6399 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -57,6 +57,14 @@ jobs:
           mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
           cp "$PROVISIONING_PROFILE_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
 
+      - name: Debug provisioning profile
+        run: |
+          PROFILE_PATH="$RUNNER_TEMP/$PROVISIONING_PROFILE_FILE"
+          INSTALLED="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
+          echo "Temp file size: $(wc -c < "$PROFILE_PATH") bytes"
+          echo "Installed file size: $(wc -c < "$INSTALLED") bytes"
+          file "$INSTALLED"
+
       - name: Extract UUID from provisioning profile
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"

From 111fdc2685c7f511a6c920639cfe21ecfd581354 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Wed, 3 Jun 2026 12:30:51 +0200
Subject: [PATCH 02/15] change extract uuid step to not use security cms.

---
 .github/workflows/build-release-ios.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index dbf6399..00b610a 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -68,8 +68,9 @@ jobs:
       - name: Extract UUID from provisioning profile
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
-          UUID=$(security cms -D -i "$PROFILE" | /usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin)
+          UUID=$(grep -aEo '[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}' "$PROFILE" | head -1)
           echo "UUID=$UUID" >> $GITHUB_ENV
+          echo "Extracted UUID: $UUID"
 
       - name: Generate ExportOptions.plist
         working-directory: apps/storybook

From 87526aa9883170dd8ba282032a275c9ded4a6040 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Wed, 3 Jun 2026 12:38:09 +0200
Subject: [PATCH 03/15] add buildnumber to app.json

---
 apps/storybook/app.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/storybook/app.json b/apps/storybook/app.json
index 7a7ebca..f78e29a 100644
--- a/apps/storybook/app.json
+++ b/apps/storybook/app.json
@@ -10,7 +10,8 @@
         "newArchEnabled": false,
         "ios": {
             "supportsTablet": true,
-            "bundleIdentifier": "com.equinor.eds.mobile"
+            "bundleIdentifier": "com.equinor.eds.mobile",
+            "buildNumber": "1"
         },
         "android": {
             "adaptiveIcon": {

From 3929a22cb3eb871b18d1852aa6e8e580b2eb9bfe Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Wed, 3 Jun 2026 12:50:29 +0200
Subject: [PATCH 04/15] update uuid grep to be case-sensitive

---
 .github/workflows/build-release-ios.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 00b610a..1eb20dc 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -68,7 +68,7 @@ jobs:
       - name: Extract UUID from provisioning profile
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
-          UUID=$(grep -aEo '[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}' "$PROFILE" | head -1)
+          UUID=$(grep -aEo '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' "$PROFILE" | head -1)
           echo "UUID=$UUID" >> $GITHUB_ENV
           echo "Extracted UUID: $UUID"
 

From f03fd97a9a864ca35d69ecfee3b59c97eb8e03a8 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Wed, 3 Jun 2026 13:14:17 +0200
Subject: [PATCH 05/15] remove debug step.

---
 .github/workflows/build-release-ios.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 1eb20dc..b8021d2 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -57,14 +57,6 @@ jobs:
           mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
           cp "$PROVISIONING_PROFILE_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
 
-      - name: Debug provisioning profile
-        run: |
-          PROFILE_PATH="$RUNNER_TEMP/$PROVISIONING_PROFILE_FILE"
-          INSTALLED="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
-          echo "Temp file size: $(wc -c < "$PROFILE_PATH") bytes"
-          echo "Installed file size: $(wc -c < "$INSTALLED") bytes"
-          file "$INSTALLED"
-
       - name: Extract UUID from provisioning profile
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"

From d17c07759cf04317092294630533db6186a03293 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Wed, 3 Jun 2026 13:17:23 +0200
Subject: [PATCH 06/15] update storybook script to be easier to run

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index acefb77..20fddc8 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
     "build:components": "turbo run build --filter @equinor/eds-mobile-components",
     "build:storybook": "turbo run build --filter @equinor/mobile-storybook",
     "dev": "turbo run dev",
-    "dev:storybook": "turbo run dev --filter @equinor/mobile-storybook",
+    "storybook": "turbo run dev --filter @equinor/mobile-storybook",
     "dev:components": "turbo run dev --filter @equinor/eds-mobile-components",
     "lint": "turbo run lint",
     "lint:components": "turbo run lint --filter @equinor/eds-mobile-components",

From 71093c198f1d8b5471129217f3b7d155e9787b4e Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Wed, 3 Jun 2026 15:04:56 +0200
Subject: [PATCH 07/15] no exempt encryption

---
 apps/storybook/app.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/storybook/app.json b/apps/storybook/app.json
index f78e29a..2b69fe8 100644
--- a/apps/storybook/app.json
+++ b/apps/storybook/app.json
@@ -11,7 +11,10 @@
         "ios": {
             "supportsTablet": true,
             "bundleIdentifier": "com.equinor.eds.mobile",
-            "buildNumber": "1"
+            "buildNumber": "1",
+            "infoPlist": {
+                "ITSAppUsesNonExemptEncryption": false
+            }
         },
         "android": {
             "adaptiveIcon": {

From e500ae96efaba8cd2a2a0c3cae55687b0c946a25 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Thu, 4 Jun 2026 10:19:14 +0200
Subject: [PATCH 08/15] fix(ci): add UUID guard and update storybook script
 references

Adds an empty-value guard after UUID extraction to surface misconfigured
secrets or silent base64 decode failures immediately rather than letting
an empty value propagate silently through PlistBuddy and xcodebuild.

Updates 8 doc references from pnpm dev:storybook to pnpm storybook to
match the earlier script rename.
---
 .github/workflows/build-release-ios.yml | 1 +
 CLAUDE.md                               | 2 +-
 README.md                               | 4 ++--
 apps/storybook/CLAUDE.md                | 2 +-
 apps/storybook/README.md                | 6 +++---
 packages/components/CLAUDE.md           | 2 +-
 6 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index b8021d2..7b1f67d 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -61,6 +61,7 @@ jobs:
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
           UUID=$(grep -aEo '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' "$PROFILE" | head -1)
+          if [ -z "$UUID" ]; then echo "::error::Failed to extract UUID from provisioning profile"; exit 1; fi
           echo "UUID=$UUID" >> $GITHUB_ENV
           echo "Extracted UUID: $UUID"
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 7c94dbd..34c6f5f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,7 +27,7 @@ pnpm build:components
 pnpm dev:components
 
 # Run storybook app for iOS (requires prior build)
-pnpm dev:storybook
+pnpm storybook
 
 # Run storybook for specific platform
 cd apps/storybook
diff --git a/README.md b/README.md
index 2457855..d05e138 100644
--- a/README.md
+++ b/README.md
@@ -149,7 +149,7 @@ pnpm build
 | --------------------- | --------------------------------------- |
 | `pnpm install`        | Install all dependencies                |
 | `pnpm build`          | Build all packages                      |
-| `pnpm dev:storybook`  | Run the storybook app                   |
+| `pnpm storybook`  | Run the storybook app                   |
 | `pnpm dev:components` | Watch mode for component library        |
 | `pnpm lint`           | Run ESLint                              |
 | `pnpm format`         | Format code with Prettier               |
@@ -176,7 +176,7 @@ design-system-mobile/
 pnpm build
 
 # Start the storybook app
-pnpm dev:storybook
+pnpm storybook
 
 # For iOS, install pods (first time only)
 cd apps/storybook/ios && pod install
diff --git a/apps/storybook/CLAUDE.md b/apps/storybook/CLAUDE.md
index 6252a50..5b5a394 100644
--- a/apps/storybook/CLAUDE.md
+++ b/apps/storybook/CLAUDE.md
@@ -15,7 +15,7 @@ From the monorepo root:
 pnpm build
 
 # Run the storybook app
-pnpm dev:storybook
+pnpm storybook
 
 # Or from this directory
 pnpm ios       # Run on iOS simulator
diff --git a/apps/storybook/README.md b/apps/storybook/README.md
index 422658b..88dba50 100644
--- a/apps/storybook/README.md
+++ b/apps/storybook/README.md
@@ -28,7 +28,7 @@ This is an [Expo](https://expo.dev) project using [file-based routing](https://d
 3. Run the storybook app:
 
     ```bash
-    pnpm dev:storybook
+    pnpm storybook
     ```
 
 4. Press `i` to open in iOS Simulator or `a` for Android Emulator.
@@ -47,7 +47,7 @@ Use Expo's development build to run on a physical device:
 
 ```bash
 # iOS
-pnpm dev:storybook -- --device
+pnpm storybook -- --device
 
 # Or scan the QR code with the Expo Go app (limited functionality)
 ```
@@ -99,7 +99,7 @@ pod install
 Clear the cache and restart:
 
 ```bash
-pnpm dev:storybook -- --clear
+pnpm storybook -- --clear
 ```
 
 ## Learn more
diff --git a/packages/components/CLAUDE.md b/packages/components/CLAUDE.md
index 48c6549..61ea35b 100644
--- a/packages/components/CLAUDE.md
+++ b/packages/components/CLAUDE.md
@@ -165,7 +165,7 @@ export default function App() {
 
 1. Make changes in `src/`
 2. Run `pnpm dev` for watch mode (auto-rebuilds)
-3. Test changes in storybook app: `cd ../../ && pnpm dev:storybook`
+3. Test changes in storybook app: `cd ../../ && pnpm storybook`
 4. **Always use tokens** (`theme.colors`, `theme.spacing`, `theme.typography`) for new work
 5. All components must support both light/dark mode and comfortable/spacious density
 

From 7cf86586674d979e82a62f4c7604b760f6ca56f5 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Fri, 5 Jun 2026 14:42:57 +0200
Subject: [PATCH 09/15] fix(ci): revert UUID extraction to security cms -D with
 file guard

Replaces the grep workaround with the structured security cms -D approach.
The original failure (Cannot parse a NULL or zero-length data) was caused by
an empty provisioning profile file, not a security cms limitation. A -s file
size guard now surfaces that failure immediately with a clear error message.

Also reverts dev:storybook script rename to preserve the verb:scope convention
used throughout the repo, and updates docs accordingly.
---
 .github/workflows/build-release-ios.yml | 3 ++-
 CLAUDE.md                               | 2 +-
 README.md                               | 4 ++--
 apps/storybook/CLAUDE.md                | 2 +-
 apps/storybook/README.md                | 6 +++---
 package.json                            | 2 +-
 packages/components/CLAUDE.md           | 2 +-
 7 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 7b1f67d..5ba3bc9 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -60,7 +60,8 @@ jobs:
       - name: Extract UUID from provisioning profile
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
-          UUID=$(grep -aEo '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' "$PROFILE" | head -1)
+          if [ ! -s "$PROFILE" ]; then echo "::error::Provisioning profile is missing or empty at $PROFILE"; exit 1; fi
+          UUID=$(security cms -D -i "$PROFILE" | /usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin)
           if [ -z "$UUID" ]; then echo "::error::Failed to extract UUID from provisioning profile"; exit 1; fi
           echo "UUID=$UUID" >> $GITHUB_ENV
           echo "Extracted UUID: $UUID"
diff --git a/CLAUDE.md b/CLAUDE.md
index 34c6f5f..7c94dbd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,7 +27,7 @@ pnpm build:components
 pnpm dev:components
 
 # Run storybook app for iOS (requires prior build)
-pnpm storybook
+pnpm dev:storybook
 
 # Run storybook for specific platform
 cd apps/storybook
diff --git a/README.md b/README.md
index d05e138..2457855 100644
--- a/README.md
+++ b/README.md
@@ -149,7 +149,7 @@ pnpm build
 | --------------------- | --------------------------------------- |
 | `pnpm install`        | Install all dependencies                |
 | `pnpm build`          | Build all packages                      |
-| `pnpm storybook`  | Run the storybook app                   |
+| `pnpm dev:storybook`  | Run the storybook app                   |
 | `pnpm dev:components` | Watch mode for component library        |
 | `pnpm lint`           | Run ESLint                              |
 | `pnpm format`         | Format code with Prettier               |
@@ -176,7 +176,7 @@ design-system-mobile/
 pnpm build
 
 # Start the storybook app
-pnpm storybook
+pnpm dev:storybook
 
 # For iOS, install pods (first time only)
 cd apps/storybook/ios && pod install
diff --git a/apps/storybook/CLAUDE.md b/apps/storybook/CLAUDE.md
index 5b5a394..6252a50 100644
--- a/apps/storybook/CLAUDE.md
+++ b/apps/storybook/CLAUDE.md
@@ -15,7 +15,7 @@ From the monorepo root:
 pnpm build
 
 # Run the storybook app
-pnpm storybook
+pnpm dev:storybook
 
 # Or from this directory
 pnpm ios       # Run on iOS simulator
diff --git a/apps/storybook/README.md b/apps/storybook/README.md
index 88dba50..422658b 100644
--- a/apps/storybook/README.md
+++ b/apps/storybook/README.md
@@ -28,7 +28,7 @@ This is an [Expo](https://expo.dev) project using [file-based routing](https://d
 3. Run the storybook app:
 
     ```bash
-    pnpm storybook
+    pnpm dev:storybook
     ```
 
 4. Press `i` to open in iOS Simulator or `a` for Android Emulator.
@@ -47,7 +47,7 @@ Use Expo's development build to run on a physical device:
 
 ```bash
 # iOS
-pnpm storybook -- --device
+pnpm dev:storybook -- --device
 
 # Or scan the QR code with the Expo Go app (limited functionality)
 ```
@@ -99,7 +99,7 @@ pod install
 Clear the cache and restart:
 
 ```bash
-pnpm storybook -- --clear
+pnpm dev:storybook -- --clear
 ```
 
 ## Learn more
diff --git a/package.json b/package.json
index 20fddc8..acefb77 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
     "build:components": "turbo run build --filter @equinor/eds-mobile-components",
     "build:storybook": "turbo run build --filter @equinor/mobile-storybook",
     "dev": "turbo run dev",
-    "storybook": "turbo run dev --filter @equinor/mobile-storybook",
+    "dev:storybook": "turbo run dev --filter @equinor/mobile-storybook",
     "dev:components": "turbo run dev --filter @equinor/eds-mobile-components",
     "lint": "turbo run lint",
     "lint:components": "turbo run lint --filter @equinor/eds-mobile-components",
diff --git a/packages/components/CLAUDE.md b/packages/components/CLAUDE.md
index 61ea35b..48c6549 100644
--- a/packages/components/CLAUDE.md
+++ b/packages/components/CLAUDE.md
@@ -165,7 +165,7 @@ export default function App() {
 
 1. Make changes in `src/`
 2. Run `pnpm dev` for watch mode (auto-rebuilds)
-3. Test changes in storybook app: `cd ../../ && pnpm storybook`
+3. Test changes in storybook app: `cd ../../ && pnpm dev:storybook`
 4. **Always use tokens** (`theme.colors`, `theme.spacing`, `theme.typography`) for new work
 5. All components must support both light/dark mode and comfortable/spacious density
 

From b297396d846f28343ce2680504593b603006b4da Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Fri, 5 Jun 2026 14:49:50 +0200
Subject: [PATCH 10/15] fix(ci): use openssl smime to decode provisioning
 profile on macos-26

security cms -D fails on macos-26 runners because they lack the Apple root
certificate needed to verify the CMS signature. openssl smime with -noverify
performs the same structured DER decode without requiring the signing cert,
giving a keyed UUID extraction that works on the current runner image.
---
 .github/workflows/build-release-ios.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 5ba3bc9..4fc5b8a 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -61,7 +61,7 @@ jobs:
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
           if [ ! -s "$PROFILE" ]; then echo "::error::Provisioning profile is missing or empty at $PROFILE"; exit 1; fi
-          UUID=$(security cms -D -i "$PROFILE" | /usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin)
+          UUID=$(openssl smime -inform DER -verify -noverify -in "$PROFILE" 2>/dev/null | /usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin)
           if [ -z "$UUID" ]; then echo "::error::Failed to extract UUID from provisioning profile"; exit 1; fi
           echo "UUID=$UUID" >> $GITHUB_ENV
           echo "Extracted UUID: $UUID"

From 25d155b43f2f2ad82be1c455dd2636b1b77d0ebb Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Fri, 5 Jun 2026 14:53:20 +0200
Subject: [PATCH 11/15] fix(ci): extract provisioning profile UUID via Python
 plistlib
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both security cms -D and openssl smime fail on macos-26 — the former needs
Apple root certs in the keychain, the latter is incompatible with the runner's
LibreSSL. Python's plistlib reads the UUID by key name from the embedded XML
plist, requiring no external tools or certificates.
---
 .github/workflows/build-release-ios.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 4fc5b8a..4f509ed 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -61,7 +61,13 @@ jobs:
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
           if [ ! -s "$PROFILE" ]; then echo "::error::Provisioning profile is missing or empty at $PROFILE"; exit 1; fi
-          UUID=$(openssl smime -inform DER -verify -noverify -in "$PROFILE" 2>/dev/null | /usr/libexec/PlistBuddy -c "Print :UUID" /dev/stdin)
+          UUID=$(python3 -c "
+import plistlib
+with open('$PROFILE', 'rb') as f:
+    data = f.read()
+start = data.find(b'<?xml')
+print(plistlib.loads(data[start:])['UUID'])
+")
           if [ -z "$UUID" ]; then echo "::error::Failed to extract UUID from provisioning profile"; exit 1; fi
           echo "UUID=$UUID" >> $GITHUB_ENV
           echo "Extracted UUID: $UUID"

From e730d4bd5ca8be2402e941ed641bcc246f6df3b1 Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Fri, 5 Jun 2026 14:54:32 +0200
Subject: [PATCH 12/15] fix(ci): guard against missing plist in provisioning
 profile

---
 .github/workflows/build-release-ios.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 4f509ed..79c3b5b 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -62,10 +62,13 @@ jobs:
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
           if [ ! -s "$PROFILE" ]; then echo "::error::Provisioning profile is missing or empty at $PROFILE"; exit 1; fi
           UUID=$(python3 -c "
-import plistlib
+import plistlib, sys
 with open('$PROFILE', 'rb') as f:
     data = f.read()
 start = data.find(b'<?xml')
+if start == -1:
+    print('::error::No plist found in provisioning profile', file=sys.stderr)
+    sys.exit(1)
 print(plistlib.loads(data[start:])['UUID'])
 ")
           if [ -z "$UUID" ]; then echo "::error::Failed to extract UUID from provisioning profile"; exit 1; fi

From f90bdef188e7802c7106343758915cd241b123bc Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Fri, 5 Jun 2026 14:58:26 +0200
Subject: [PATCH 13/15] =?UTF-8?q?fix(ci):=20revert=20UUID=20extraction=20t?=
 =?UTF-8?q?o=20grep=20=E2=80=94=20security=20cms=20and=20openssl=20incompa?=
 =?UTF-8?q?tible=20with=20macos-26?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release-ios.yml | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 79c3b5b..219f5d0 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -61,16 +61,7 @@ jobs:
         run: |
           PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
           if [ ! -s "$PROFILE" ]; then echo "::error::Provisioning profile is missing or empty at $PROFILE"; exit 1; fi
-          UUID=$(python3 -c "
-import plistlib, sys
-with open('$PROFILE', 'rb') as f:
-    data = f.read()
-start = data.find(b'<?xml')
-if start == -1:
-    print('::error::No plist found in provisioning profile', file=sys.stderr)
-    sys.exit(1)
-print(plistlib.loads(data[start:])['UUID'])
-")
+          UUID=$(grep -aEo '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' "$PROFILE" | head -1)
           if [ -z "$UUID" ]; then echo "::error::Failed to extract UUID from provisioning profile"; exit 1; fi
           echo "UUID=$UUID" >> $GITHUB_ENV
           echo "Extracted UUID: $UUID"

From fa62b7c84fcf81cd37db613f7f931e3edd257d3b Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Fri, 5 Jun 2026 15:07:49 +0200
Subject: [PATCH 14/15] fix(ci): replace UUID extraction with provisioning
 profile name variable

xcodebuild accepts a profile name in ExportOptions.plist, so extracting the
UUID from the binary mobileprovision file is unnecessary. The profile name is
stored as APPLE_PROVISIONING_PROFILE_NAME in repository variables, removing
the macos-26 runner incompatibility entirely.
---
 .github/workflows/build-release-ios.yml | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 219f5d0..929b85e 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -57,22 +57,13 @@ jobs:
           mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
           cp "$PROVISIONING_PROFILE_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
 
-      - name: Extract UUID from provisioning profile
-        run: |
-          PROFILE="$HOME/Library/MobileDevice/Provisioning Profiles/build_pp.mobileprovision"
-          if [ ! -s "$PROFILE" ]; then echo "::error::Provisioning profile is missing or empty at $PROFILE"; exit 1; fi
-          UUID=$(grep -aEo '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' "$PROFILE" | head -1)
-          if [ -z "$UUID" ]; then echo "::error::Failed to extract UUID from provisioning profile"; exit 1; fi
-          echo "UUID=$UUID" >> $GITHUB_ENV
-          echo "Extracted UUID: $UUID"
-
       - name: Generate ExportOptions.plist
         working-directory: apps/storybook
         run: |
           FILE=ExportOptions.plist
           /usr/libexec/PlistBuddy -c "add :method string app-store" $FILE
           /usr/libexec/PlistBuddy -c "add :provisioningProfiles dict" $FILE
-          /usr/libexec/PlistBuddy -c "add :provisioningProfiles:${{ vars.APPLE_BUNDLE_IDENTIFIER }} string ${{ env.UUID }}" $FILE
+          /usr/libexec/PlistBuddy -c "add :provisioningProfiles:${{ vars.APPLE_BUNDLE_IDENTIFIER }} string ${{ vars.APPLE_PROVISIONING_PROFILE_NAME }}" $FILE
           /usr/libexec/PlistBuddy -c "add :signingStyle string manual" $FILE
           /usr/libexec/PlistBuddy -c "add :teamId string ${{ vars.APPLE_TEAM_ID }}" $FILE
           cat $FILE

From d6c83fa3dd203ce4bc16d16f98ae965b39ecec2d Mon Sep 17 00:00:00 2001
From: Chibuzor Nwemambu <75029767+Chibuzor-Nwemambu@users.noreply.github.com>
Date: Fri, 5 Jun 2026 15:12:50 +0200
Subject: [PATCH 15/15] fix(ci): use PROVISIONING_PROFILE_SPECIFIER with
 profile name in xcodebuild archive

---
 .github/workflows/build-release-ios.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-release-ios.yml b/.github/workflows/build-release-ios.yml
index 929b85e..91e1a68 100644
--- a/.github/workflows/build-release-ios.yml
+++ b/.github/workflows/build-release-ios.yml
@@ -102,7 +102,7 @@ jobs:
             -archivePath build/EDSMobile.xcarchive \
             CODE_SIGN_STYLE="Manual" \
             CODE_SIGN_IDENTITY="${{ vars.APPLE_CODE_SIGN_IDENTITY }}" \
-            PROVISIONING_PROFILE="${{ env.UUID }}"
+            PROVISIONING_PROFILE_SPECIFIER="${{ vars.APPLE_PROVISIONING_PROFILE_NAME }}"
 
       - name: Export IPA
         working-directory: apps/storybook