Add step to sign the XCFramework in CI (#49871)

Summary:
This PR adds a step in CI to sign the xcframework if we have a certificate available
bypass-github-export-checks
## Changelog:
[Internal] - Sign XCFrameworks in CI

Pull Request resolved: https://github.com/facebook/react-native/pull/49871

Test Plan: GHA

Reviewed By: cortinico

Differential Revision: D70734340

Pulled By: cipolleschi

fbshipit-source-id: 244422bdf9a8e0a2075a727a91805f762d4f95c9

.github/workflows/nightly.yml

@@ -102,6 +102,7 @@ jobs:
 
   prebuild_apple_dependencies:
     uses: ./.github/workflows/prebuild-ios.yml
+    secrets: inherit
 
   build_hermesc_linux:
     runs-on: ubuntu-latest

.github/workflows/prebuild-ios.yml

@@ -3,6 +3,7 @@ name: Prebuild iOS
 on:
   workflow_call: # this directive allow us to call this workflow from other workflows
 
+
 jobs:
   prepare_workspace:
     name: Prepare workspace
@@ -119,6 +120,9 @@ jobs:
       fail-fast: false
       matrix:
         flavor: [Debug, Release]
+    env:
+      REACT_ORG_CODE_SIGNING_P12_CERT: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT }}
+      REACT_ORG_CODE_SIGNING_P12_CERT_PWD: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT_PWD }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -146,9 +150,18 @@ jobs:
           pattern: prebuild-slice-${{ matrix.flavor }}-*
           path: packages/react-native/third-party/.build/Build/Products
           merge-multiple: true
+      - name: Setup Keychain
+        if: ${{ steps.restore-xcframework.outputs.cache-hit != 'true' && env.REACT_ORG_CODE_SIGNING_P12_CERT != '' }}
+        uses: apple-actions/import-codesign-certs@v3 # https://github.com/marketplace/actions/import-code-signing-certificates
+        with:
+          p12-file-base64: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT }}
+          p12-password: ${{ secrets.REACT_ORG_CODE_SIGNING_P12_CERT_PWD }}
       - name: Create XCFramework
-        if: steps.restore-xcframework.outputs.cache-hit != 'true'
+        if: ${{ steps.restore-xcframework.outputs.cache-hit != 'true' && env.REACT_ORG_CODE_SIGNING_P12_CERT == '' }}
         run: node scripts/releases/prepare-ios-prebuilds.js -c
+      - name: Create and Sign XCFramework
+        if: ${{ steps.restore-xcframework.outputs.cache-hit != 'true' && env.REACT_ORG_CODE_SIGNING_P12_CERT != '' }}
+        run: node scripts/releases/prepare-ios-prebuilds.js -c -i "React Org"
       - name: Compress and Rename XCFramework
         if: steps.restore-xcframework.outputs.cache-hit != 'true'
         run: |

.github/workflows/publish-release.yml

@@ -98,6 +98,7 @@ jobs:
           flavor: ${{ matrix.flavor }}
   prebuild_apple_dependencies:
     uses: ./.github/workflows/prebuild-ios.yml
+    secrets: inherit
 
   build_hermesc_linux:
     runs-on: ubuntu-latest

.github/workflows/test-all.yml

@@ -118,6 +118,7 @@ jobs:
 
   prebuild_apple_dependencies:
     uses: ./.github/workflows/prebuild-ios.yml
+    secrets: inherit
 
   test_ios_rntester_ruby_3_2_0:
     runs-on: macos-13