Debug iOS code signing failure in CI that works locally

WHAT THIS TESTS: This question tests whether you understand the full iOS code signing stack beyond clicking fix issues in Xcode. It specifically probes your ability to reason about environment differences between an interactive developer Mac and an ephemeral CI runner. The interviewer wants to see that you know how provisioning profiles, certificates, keychains, entitlements, and xcodebuild flags interact, and that you can debug cryptic signing errors without guessing.

A GOOD ANSWER COVERS: A senior answer should walk through a systematic checklist in order. First, compare the archive command and exportOptions.plist between local and CI because method and signingStyle keys control whether Xcode uses manual or automatic signing. Second, inspect the CI keychain state: ensure the temporary keychain is created, the certificate and provisioning profile are imported, the keychain is unlocked, and access control is set to allow codesign. Third, verify provisioning profile validity and bundle ID matches, including checking that the profile UUID referenced in the project matches what is installed on the runner. Fourth, confirm runner environment parity: macOS version, Xcode version, Flutter version, and CocoaPods state can all alter archive behavior. Fifth, check entitlements and capabilities differences between debug and release schemes because CI often archives release while developers build debug. Sixth, review the full xcodebuild log for specific error codes rather than the vague summary.

COMMON WRONG ANSWERS: A major red flag is suggesting you will open Xcode on the CI runner and click fix issues. Another is blaming Apple and saying it works on my machine without proposing environment diffs. Candidates who suggest disabling code signing or using ad-hoc distribution to bypass the problem show they do not understand production release requirements. Similarly, ignoring the keychain lifecycle on CI and assuming the login keychain is sufficient reveals a gap in automation experience.

LIKELY FOLLOW-UPS: The interviewer may ask how you would secure certificates and profiles in the CI pipeline, which should lead to answers about encrypted repository secrets, match from fastlane, or cloud key management. They might also ask how you would reproduce the CI environment locally, which should involve using the same xcodebuild command, a clean keychain, and the same exportOptions.plist. Another follow-up is how to handle signing when the team has multiple apps or extensions with different provisioning profiles.

ONE CONCRETE EXAMPLE: Imagine a Flutter app that archives locally with automatic signing using a personal team but fails on GitHub Actions with error errSecInternalComponent. The systematic fix would be: create a dedicated keychain in the workflow, import the distribution certificate and App Store provisioning profile, unlock the keychain and set partition IDs, switch the project to manual signing with a specific provisioning profile specifier, ensure the exportOptions.plist uses method app-store and signingStyle manual, and pin the Xcode version to match the local machine. After these steps the archive succeeds and the IPA exports correctly.