fix(ci/macos): 构建后从 WORK 目录 embed 描述文件(xcodebuild 会清 PROF_DIR)

build-macos 失败:flutter build macos 期间 xcodebuild 修剪
~/Library/Developer/Xcode/UserData/Provisioning Profiles,把构建前装进去的
Developer ID 描述文件删掉,构建后 inside-out 重签时从该目录 cp 扑空
(cp: <uuid>.provisionprofile: No such file → exit 1)。改为从 mktemp 的 WORK
目录复制原始 .provisionprofile(xcodebuild 不碰),幂等可靠。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/deploy-client.yml

@@ -109,8 +109,11 @@ jobs:
 
       - name: Compile (macOS System Extension app)
         env:
-          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }}
-          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }}
+          # 左=脚本期望的 env 名(勿改),右=实际密钥名。Apple 证书/公证密钥是
+          # 账号级、跨项目唯一 → 放【全局(用户级)密钥】用通用短名,pangolin/jiu 各自
+          # 在此映射到自己脚本的 env。Developer ID Application 证书=站外分发,一张签所有 app。
+          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.DEVELOPER_ID_P12 }}
+          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.P12_PASSWORD }}
           MACOS_APP_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_APP_PROVISION_PROFILE_BASE64 }}
           MACOS_SYSEXT_PROVISION_PROFILE_BASE64: ${{ secrets.MACOS_SYSEXT_PROVISION_PROFILE_BASE64 }}
           APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
@@ -137,8 +140,10 @@ jobs:
 
       - name: Compile & upload to TestFlight (iOS)
         env:
-          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
-          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
+          # 证书=账号级 →【全局】通用短名(Apple Distribution 证书,签 iOS App Store/TestFlight);
+          # 描述文件=与 bundle id 绑定 →【项目级】pangolin 仓库密钥。
+          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_P12 }}
+          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_PASSWORD }}
           IOS_APP_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_APP_PROVISIONING_PROFILE_BASE64 }}
           IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PACKETTUNNEL_PROVISIONING_PROFILE_BASE64 }}
           APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}

scripts/ci/compile-macos.sh

@@ -223,8 +223,12 @@ PLIST
 
 echo "==> compile-macos: inside-out codesign (sysext -> frameworks -> app)"
 xattr -cr "$APP"
-cp "$SYSEXT_PROFILE" "${SE}/Contents/embedded.provisionprofile"
-cp "$APP_PROFILE" "${APP}/Contents/embedded.provisionprofile"
+# 从 WORK 临时目录复制(不是 PROF_DIR):flutter build macos 期间 xcodebuild 会
+# 修剪 ~/Library/Developer/Xcode/UserData/Provisioning Profiles,把[3/7]构建前
+# 装进去的 profile 清掉,构建后再从那目录 cp 会扑空(No such file → 本步失败)。
+# WORK 是 mktemp 目录、xcodebuild 不碰,里面的原始 .provisionprofile 全程留存。
+cp "${WORK}/sysext.provisionprofile" "${SE}/Contents/embedded.provisionprofile"
+cp "${WORK}/app.provisionprofile" "${APP}/Contents/embedded.provisionprofile"
 
 # sysext first — libbox is linked (not embedded) into the sysext binary
 # itself (see CLAUDE.md), so signing the sysext bundle re-covers its statically