I'm trying to set up an Azure DevOps pipeline to build a macOS app. I think I have all the necessary steps in place, and it runs as far as I expect it to for now.
However, I now have reached the step where, in order to sign the product, the build machine device must be included in our provisioning profiles, which means we have to add its UUID to the list of devices in Apple Developer.
Image may be NSFW.
Clik here to view.
How do I get this pipeline to use this profile? I imagine a solution might involve one of these:
- There's a way to find the UUIDs of every Mac which might run the pipeline
- There's a way to restrict that pipeline to always use the same Mac with the same UUID
- There's a way to specify/spoof the UUID of the build machine
- There's an API or something to register the build machine with Apple Developer at build time
- Azure DevOps has a special way to circumvent this part of the build process while still allowing signing
- Apple has some special way I don't know about to allow an arbitrary build machine to sign without knowing its UUID beforehand
I've looked around for all these and can't find definitive info for any of them. Does anyone know the best practice for signing an Xcode project pipeline in Azure DevOps using a specific set of provisioning profiles?
Our certs and profiles are stored in Azure's "Secure files" section:
Image may be NSFW.
Clik here to view.
And referenced in the pipeline's build steps:
