From b33bc012dcd14f66a952e5a05bb8b0b2d1d09749 Mon Sep 17 00:00:00 2001
From: Riccardo Cipolleschi <cipolleschi@meta.com>
Date: Fri, 7 Mar 2025 04:28:07 -0800
Subject: [PATCH] Add step to sign the XCFramework in CI (#49871)

Summary:
This PR adds a step in CI to sign the xcframework if we have a certificate available
bypass-github-export-checks
## Changelog:
[Internal] - Sign XCFrameworks in CI

Pull Request resolved: https://github.com/facebook/react-native/pull/49871

Test Plan: GHA

Reviewed By: cortinico

Differential Revision: D70734340

Pulled By: cipolleschi

fbshipit-source-id: 244422bdf9a8e0a2075a727a91805f762d4f95c9
---
 .github/workflows/nightly.yml         |  1 +
 .github/workflows/prebuild-ios.yml    | 15 ++++++++++++++-
 .github/workflows/publish-release.yml |  1 +
 .github/workflows/test-all.yml        |  1 +
 4 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index d16d5df6efa..b42951e258a 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -102,6 +102,7 @@ jobs:
 
   prebuild_apple_dependencies:
     uses: ./.github/workflows/prebuild-ios.yml
+    secrets: inherit
 
   build_hermesc_linux:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/prebuild-ios.yml b/.github/workflows/prebuild-ios.yml
index bb352b3c089..a0372306e5b 100644
--- a/.github/workflows/prebuild-ios.yml
+++ b/.github/workflows/prebuild-ios.yml
@@ -3,6 +3,7 @@ name: Prebuild iOS
 on:
   workflow_call: # this directive allow us to call this workflow from other workflows
 
+
 jobs:
   prepare_workspace:
     name: Prepare workspace
@@ -119,6 +120,9 @@ jobs:
       fail-fast: false
       matrix:
         flavor: [Debug, Release]
+    env:
+      REACT_ORG_CODE_SIGNING_P12_CERT: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT }}
+      REACT_ORG_CODE_SIGNING_P12_CERT_PWD: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT_PWD }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -146,9 +150,18 @@ jobs:
           pattern: prebuild-slice-${{ matrix.flavor }}-*
           path: packages/react-native/third-party/.build/Build/Products
           merge-multiple: true
+      - name: Setup Keychain
+        if: ${{ steps.restore-xcframework.outputs.cache-hit != 'true' && env.REACT_ORG_CODE_SIGNING_P12_CERT != '' }}
+        uses: apple-actions/import-codesign-certs@v3 # https://github.com/marketplace/actions/import-code-signing-certificates
+        with:
+          p12-file-base64: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT }}
+          p12-password: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT_PWD }}
       - name: Create XCFramework
-        if: steps.restore-xcframework.outputs.cache-hit != 'true'
+        if: ${{ steps.restore-xcframework.outputs.cache-hit != 'true' && env.REACT_ORG_CODE_SIGNING_P12_CERT == '' }}
         run: node scripts/releases/prepare-ios-prebuilds.js -c
+      - name: Create and Sign XCFramework
+        if: ${{ steps.restore-xcframework.outputs.cache-hit != 'true' && env.REACT_ORG_CODE_SIGNING_P12_CERT != '' }}
+        run: node scripts/releases/prepare-ios-prebuilds.js -c -i "React Org"
       - name: Compress and Rename XCFramework
         if: steps.restore-xcframework.outputs.cache-hit != 'true'
         run: |
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index e3b151e875f..15c7b3ab9e5 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -98,6 +98,7 @@ jobs:
           flavor: ${{ matrix.flavor }}
   prebuild_apple_dependencies:
     uses: ./.github/workflows/prebuild-ios.yml
+    secrets: inherit
 
   build_hermesc_linux:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-all.yml b/.github/workflows/test-all.yml
index 6708e140032..470ea622b4e 100644
--- a/.github/workflows/test-all.yml
+++ b/.github/workflows/test-all.yml
@@ -118,6 +118,7 @@ jobs:
 
   prebuild_apple_dependencies:
     uses: ./.github/workflows/prebuild-ios.yml
+    secrets: inherit
 
   test_ios_rntester_ruby_3_2_0:
     runs-on: macos-13