Keep release archive signing automatic

Author: offyotto

.github/workflows/release.yml

@@ -120,6 +120,7 @@ jobs:
 
       - name: Build release archive
         env:
+          ARCHIVE_CODE_SIGN_STYLE: Automatic
           ARCHIVE_CODE_SIGN_IDENTITY: Apple Development
           ARCHIVE_PROVISIONING_PROFILE_SPECIFIER: ${{ env.ARCHIVE_PROVISIONING_PROFILE_SPECIFIER }}
           RELEASE_PROVISIONING_PROFILE_SPECIFIER: ${{ env.RELEASE_PROVISIONING_PROFILE_SPECIFIER }}

RELEASING.md

@@ -72,7 +72,7 @@ Signed archive + zip:
 ./scripts/release/build_release.sh
 ```
 
-`build_release.sh` now archives with automatic signing against the WeatherKit-enabled development profile installed on the machine, pins the archive profile name from `ARCHIVE_PROVISIONING_PROFILE_SPECIFIER`, then performs a `developer-id` export so the release artifact keeps the WeatherKit entitlement while still shipping as a Developer ID app.
+`build_release.sh` archives with automatic signing against the WeatherKit-enabled development profile installed on the machine, then performs a `developer-id` export so the release artifact keeps the WeatherKit entitlement while still shipping as a Developer ID app. For local/manual release experiments, `ARCHIVE_CODE_SIGN_STYLE=Manual` can be combined with `ARCHIVE_PROVISIONING_PROFILE_SPECIFIER`, but the GitHub workflow intentionally keeps archive signing automatic so the app and helper targets can resolve their own signing requirements.
 
 The repository's `Release` configuration now uses the WeatherKit entitlement. The direct-download path therefore depends on both provisioning profile secrets listed above: the development profile for the archive phase and the direct-distribution profile for the export phase.
 

docs/releases/v15.2.1.md

@@ -12,7 +12,7 @@ This release ships the new **Rescue** dashboard page for advanced Apple Silicon
 - Adds copyable `usbcfwflasher` diagnosis and recovery templates for explicit technician use
 - Adds NVMe SMART health parsing when `smartctl` is installed, including percentage used, data written, unsafe shutdowns, and media/data errors
 - Adds parser coverage for recovered UG400/RID2-style controller states and SMART output
-- Pins the archive provisioning profile during automated release builds so Xcode uses the intended signing profile
+- Tightens release signing configuration while keeping archive signing automatic for the app/helper target pair
 
 ## Safety Note
 

scripts/release/build_release.sh

@@ -9,6 +9,7 @@ APP_PATH="${EXPORT_DIR}/Core-Monitor.app"
 ZIP_PATH="${ZIP_PATH:-${BUILD_DIR}/Core-Monitor.app.zip}"
 DERIVED_DATA_PATH="${DERIVED_DATA_PATH:-${ROOT_DIR}/build/DerivedData/release}"
 DEVELOPMENT_TEAM="${DEVELOPMENT_TEAM:-6VDP675K4L}"
+ARCHIVE_CODE_SIGN_STYLE="${ARCHIVE_CODE_SIGN_STYLE:-Automatic}"
 ARCHIVE_CODE_SIGN_IDENTITY="${ARCHIVE_CODE_SIGN_IDENTITY:-Apple Development}"
 ARCHIVE_PROVISIONING_PROFILE_SPECIFIER="${ARCHIVE_PROVISIONING_PROFILE_SPECIFIER:-}"
 RELEASE_CODE_SIGN_IDENTITY="${RELEASE_CODE_SIGN_IDENTITY:-Developer ID Application}"
@@ -21,11 +22,11 @@ mkdir -p "${EXPORT_DIR}"
 mkdir -p "${DERIVED_DATA_PATH}"
 
 archive_signing_args=(
-  CODE_SIGN_STYLE=Automatic
+  CODE_SIGN_STYLE="${ARCHIVE_CODE_SIGN_STYLE}"
   CODE_SIGN_IDENTITY="${ARCHIVE_CODE_SIGN_IDENTITY}"
 )
 
-if [[ -n "${ARCHIVE_PROVISIONING_PROFILE_SPECIFIER}" ]]; then
+if [[ "${ARCHIVE_CODE_SIGN_STYLE}" == "Manual" && -n "${ARCHIVE_PROVISIONING_PROFILE_SPECIFIER}" ]]; then
   archive_signing_args+=(
     PROVISIONING_PROFILE_SPECIFIER="${ARCHIVE_PROVISIONING_PROFILE_SPECIFIER}"
   )