iOS release builds can't sign the widget and notification-service targets

[GSTJ]

v1.5.0-rc1 is the first tag since the widgets target landed in #83, and its iOS build died before compiling anything:

Setting up credentials for target PegadaWidgets (app.pegada.widgets)
- Linking bundle identifier app.pegada.widgets
✔ Bundle identifier registered app.pegada.widgets
- Syncing capabilities
✔ Synced capabilities: No updates
Skipping capability identifier syncing because the current Apple authentication
session is not using Cookies (username/password).
Distribution Certificate is not validated for non-interactive builds.
Failed to set up credentials.
Credentials are not set up. Run this command again in interactive mode.

Run: https://github.com/GSTJ/pegada/actions/runs/30227811313

This is the case release-mobile.yml's own CREDENTIALS comment predicted. EAS has a valid profile for app.pegada and reused it fine (Updated provisioning profile (J3NGLA7345)), but the extension targets have no stored credentials, and non-interactive mode won't mint them. The last green native build was 2026-07-08, before either extension existed, so nothing has exercised this path until now.

Two extensions need it, and the build only got as far as the first:

• app.pegada.widgets (WidgetKit, feat: home-screen widgets with matches waiting for a reply (WidgetKit + Glance) #83), needs the App Group capability
• app.pegada.notificationservice (chat push NSE, feat: reply to chat messages straight from the notification #75), needs Communication Notifications

Either fix works:

1. One interactive eas credentials run per target to mint and store the profiles. Quickest, but has to be redone by hand whenever a target is added.
2. An App Store Connect API key wired in as EXPO_ASC_API_KEY_PATH / EXPO_ASC_KEY_ID / EXPO_ASC_ISSUER_ID, which lets EAS generate profiles non-interactively from then on. More setup once, then this class of failure stops happening.

I'd go with option 2, since adding a target is going to keep happening and option 1 breaks every time.

Both need App Store Connect access, so this one's on me. Android built separately and isn't affected. The OTA path is unaffected too, so JS-only changes keep shipping normally; what's blocked is any new binary, which is what 1.5.0 needs to reach users at all (runtimeVersion follows appVersion, and there's no 1.5.0 build in the stores).

[GSTJ]

Android finished green on the same run and uploaded an 81 MB .aab, so this is iOS-only. The Gradle build had no trouble with either extension; Android doesn't need per-target provisioning the way iOS does.

That means v1.5.0-rc1 has a shippable Android artifact and no iOS one.

[GSTJ]

I'd hold off on option 2, I don't think it fixes this.

rc1 was already authenticated with an ASC API key. The log says so a few lines above the failure:

Setting up credentials for target Pegada (app.pegada)
Distribution Certificate is not validated for non-interactive builds.
Using App Store Connect API Key from EAS credentials service.

The widget target never reached the profile step. SetUpProvisioningProfile.runAsync calls SetUpDistributionCertificate first, and its non-interactive branch (eas-cli 21.3.0) throws whenever the target has no certificate assigned:

async runNonInteractiveAsync(_ctx, currentCertificate) {
  Log.warn('Distribution Certificate is not validated for non-interactive builds.');
  if (!currentCertificate) {
    throw new MissingCredentialsNonInteractiveError();
  }
  return currentCertificate;
}

currentCertificate is looked up by that target's own bundle id, so 6ZL5FHSFHB sitting on the account doesn't count. The InsufficientAuthenticationNonInteractiveError the workflow comment predicted, which an ASC key does solve, gets thrown later and we never reach it.

An ASC key also can't link the App Group on its own. syncCapabilityIdentifiersForEntitlementsAsync returns early on token auth, which is the "Skipping capability identifier syncing" line in the rc1 log, and app.pegada.widgets needs group.app.pegada on its App ID. Only the Apple ID cookie session does that.

My read is option 1, twice, and again for each future target. #109 covers the details. It also fixes ios.appleTeamId, which was never set and had prebuild writing DevelopmentTeam = undefined into both extension targets, and makes the build step name the target it's missing credentials for.

[GSTJ]

#109 is on main. Leaving this open, the credentials still block the build.

When you have App Store Connect open:

1. gh secret set EXPO_APPLE_TEAM_ID -R GSTJ/pegada with the team id under Membership. The build only warns until it exists.
2. eas credentials -p ios from apps/mobile, production profile, once for PegadaWidgets and once for PegadaNotificationService. Apple ID sign-in, reuse cert 6ZL5FHSFHB, let EAS mint each profile.
3. Re-run the workflow on v1.5.0-rc1.

I skipped re-running it now because it would fail at the same line and burn a macOS runner.