Wire codesigning into XCFramework build

Split zip+checksum out of `build_xcframework.sh` into
`package_xcframework.sh` so codesigning can happen on the
unzipped `.xcframework` directory between build and package.

The CI build step now runs:
1. `fastlane set_up_signing_release` — installs certs
2. `make build-resources-xcframework` — builds xcframework
3. `fastlane xcframework_sign` — codesigns xcframework
4. `./package_xcframework.sh` — zips + checksums

---

Generated with the help of Claude Code, https://claude.ai/code

Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Author: mokagio

.buildkite/pipeline.yml

@@ -73,7 +73,10 @@ steps:
       command: |
           buildkite-agent artifact download dist.tar.gz .
           tar -xzf dist.tar.gz
+          bundle exec fastlane set_up_signing_release
           make build-resources-xcframework
+          bundle exec fastlane xcframework_sign
+          ./package_xcframework.sh
       artifact_paths:
           - '*.xcframework.zip'
           - '*.xcframework.zip.checksum.txt'

build_xcframework.sh

@@ -7,8 +7,7 @@
 #   - Package.swift must have `resourcesMode` set to `.local`
 #
 # Output:
-#   - GutenbergKitResources-<git-sha>.xcframework.zip
-#   - GutenbergKitResources-<git-sha>.xcframework.zip.checksum.txt
+#   - build/GutenbergKitResources-<git-sha>.xcframework
 #
 # Adapted from:
 # https://github.com/OpenSwiftUIProject/ProtobufKit/blob/937eae542/Scripts/build_xcframework.sh
@@ -19,12 +18,10 @@ set -euo pipefail
 SCHEME="GutenbergKitResources"
 MINIMUM_IOS_VERSION="17.0"
 BUILD_DIR="$(pwd)/build"
-OUTPUT_DIR="${1:-$(pwd)}"
 DERIVED_DATA_PATH="${BUILD_DIR}/DerivedData"
 
 GIT_SHA="$(git rev-parse HEAD)"
 XCFRAMEWORK_NAME="${SCHEME}-${GIT_SHA}.xcframework"
-ZIP_NAME="${XCFRAMEWORK_NAME}.zip"
 
 link_dylib() {
     local object_file="$1"
@@ -192,16 +189,5 @@ if [ -d "${SIM_DSYMS}" ]; then
     cp -r "${SIM_DSYMS}" "${XCFRAMEWORK_PATH}/ios-arm64_x86_64-simulator/"
 fi
 
-# Create ZIP archive
-echo "--- Creating ZIP archive"
-(cd "${BUILD_DIR}" && zip -r "${ZIP_NAME}" "$(basename "${XCFRAMEWORK_PATH}")" > /dev/null)
-cp "${BUILD_DIR}/${ZIP_NAME}" "${OUTPUT_DIR}/${ZIP_NAME}"
-
-# Compute checksum
-echo "--- Computing checksum"
-CHECKSUM=$(swift package compute-checksum "${OUTPUT_DIR}/${ZIP_NAME}")
-echo "${CHECKSUM}" > "${OUTPUT_DIR}/${ZIP_NAME}.checksum.txt"
-
 echo ""
-echo "XCFramework: ${OUTPUT_DIR}/${ZIP_NAME}"
-echo "Checksum:    ${CHECKSUM}"
+echo "XCFramework: ${XCFRAMEWORK_PATH}"

fastlane/Fastfile

@@ -40,15 +40,11 @@ lane :publish_to_s3 do |options|
 end
 
 lane :xcframework_sign do
-  require_env_vars!(*ASC_API_KEY_ENV_VARS, *CODE_SIGNING_STORAGE_ENV_VARS)
-
-  set_up_signing_release
-
   sh(
     'codesign',
     '--timestamp',
     '-s', 'Apple Distribution',
-    xcframework_file_path.sub('.zip', '')
+    xcframework_dir_path
   )
 end
 
@@ -75,12 +71,17 @@ end
 
 def xcframework_checksum_file_path
   Dir.glob(File.join(PROJECT_ROOT, 'GutenbergKitResources-*.xcframework.zip.checksum.txt')).first \
-    || UI.user_error!('XCFramework checksum file not found. Run build_xcframework.sh first.')
+    || UI.user_error!('XCFramework checksum file not found. Run package_xcframework.sh first.')
+end
+
+def xcframework_dir_path
+  Dir.glob(File.join(PROJECT_ROOT, 'build', 'GutenbergKitResources-*.xcframework')).first \
+    || UI.user_error!('XCFramework not found. Run build_xcframework.sh first.')
 end
 
 def xcframework_file_path
   Dir.glob(File.join(PROJECT_ROOT, 'GutenbergKitResources-*.xcframework.zip')).first \
-    || UI.user_error!('XCFramework zip not found. Run build_xcframework.sh first.')
+    || UI.user_error!('XCFramework zip not found. Run package_xcframework.sh first.')
 end
 
 def required_version!(options)

package_xcframework.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+# Packages an XCFramework into a ZIP archive with a checksum file.
+#
+# Prerequisites:
+#   - A built .xcframework under build/
+#
+# Output:
+#   - GutenbergKitResources-<git-sha>.xcframework.zip
+#   - GutenbergKitResources-<git-sha>.xcframework.zip.checksum.txt
+
+set -euo pipefail
+
+BUILD_DIR="$(pwd)/build"
+OUTPUT_DIR="${1:-$(pwd)}"
+
+XCFRAMEWORK_PATH=$(find "${BUILD_DIR}" -maxdepth 1 -name "*.xcframework" -type d | head -1)
+
+if [ -z "${XCFRAMEWORK_PATH}" ]; then
+    echo "Error: No .xcframework found in ${BUILD_DIR}. Run build_xcframework.sh first." >&2
+    exit 1
+fi
+
+XCFRAMEWORK_NAME=$(basename "${XCFRAMEWORK_PATH}")
+ZIP_NAME="${XCFRAMEWORK_NAME}.zip"
+
+# Create ZIP archive
+echo "--- Creating ZIP archive"
+(cd "${BUILD_DIR}" && zip -r "${ZIP_NAME}" "${XCFRAMEWORK_NAME}" > /dev/null)
+cp "${BUILD_DIR}/${ZIP_NAME}" "${OUTPUT_DIR}/${ZIP_NAME}"
+
+# Compute checksum
+echo "--- Computing checksum"
+CHECKSUM=$(swift package compute-checksum "${OUTPUT_DIR}/${ZIP_NAME}")
+echo "${CHECKSUM}" > "${OUTPUT_DIR}/${ZIP_NAME}.checksum.txt"
+
+echo ""
+echo "XCFramework: ${OUTPUT_DIR}/${ZIP_NAME}"
+echo "Checksum:    ${CHECKSUM}"