Re-enable CloudKit signing preflight

[zachyzissou]

Summary

• Restore the OffScript app CloudKit entitlements for iCloud.com.offscript.app instead of shipping the Apple-sign-in/App-Group-only hotfix.
• Add an App Store Connect signing preflight that decodes the active provisioning profile and fails when the CloudKit container is missing.
• Wire the preflight into manual TestFlight uploads, the Xcode Cloud probe workflow, and release docs.

Verification

• Xcode MCP BuildProject: passed
• Xcode MCP RunAllTests: 42/42 passed
• python3 -m py_compile scripts/app_store_connect.py: passed
• scripts/upload_testflight.sh --validate-only: passed
• scripts/app_store_connect.py build-exists --version 2.3.11 --build 43: available
• scripts/app_store_connect.py signing-preflight --cloudkit-container iCloud.com.offscript.app --profile-type IOS_APP_STORE: expected fail; active App Store profile has iCloud-services=['*'] but iCloud-containers=[]

Blocker before merge

Apple Developer portal still needs com.offscript.app iCloud/CloudKit container assignment repaired and the App Store profile regenerated. Current decoded profile evidence: profile 2J87H4LQ25 is ACTIVE but does not include iCloud.com.offscript.app.

[Copilot]

Pull request overview

Restores CloudKit/iCloud entitlements for the OffScript app and adds a release-time signing preflight that validates the active App Store provisioning profile includes the required CloudKit container, wiring that check into local uploads, GitHub Actions probing, and release documentation.

Changes:

• Re-add CloudKit entitlements (iCloud.com.offscript.app + CloudKit) to the shipped app target.
• Introduce scripts/app_store_connect.py signing-preflight to decode ACTIVE provisioning profiles from ASC and validate CloudKit container/service presence.
• Run the preflight during manual TestFlight uploads and from the Xcode Cloud probe workflow; document the repair flow.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
scripts/upload_testflight.sh	Adds CloudKit signing readiness preflight before archiving/uploading.
scripts/app_store_connect.py	Implements signing-preflight command and supporting ASC queries/profile decoding.
docs/TESTFLIGHT.md	Documents new signing preflight and CloudKit signing repair steps.
OffScript/OffScript.entitlements	Restores CloudKit/iCloud entitlements for the app target.
OffScript.xcodeproj/project.pbxproj	Bumps build number to 43 across configurations/targets.
CHANGELOG.md	Records CloudKit entitlement restoration and new release tooling preflight.
.github/workflows/xcode-cloud-probe.yml	Adds signing-preflight workflow option/entrypoint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zachyzissou]

Preflight hardening update:

• Fixed the false-pass path Copilot flagged: signing-preflight now validates every active matching IOS_APP_STORE profile independently. One good profile can no longer mask a bad active profile.
• Removed duplicated hard-coded --cloudkit-container iCloud.com.offscript.app calls from the workflow/docs/upload script and now rely on the default iCloud.<bundle-id> path.
• Updated misleading ASC warning text to name missing ASC_KEY_PATH.
• Resolved Copilot review threads after patching.

Current blocker from live App Store Connect preflight:

Bundle ID: com.offscript.app id=77C8QG75UQ
Capabilities: APPLE_ID_AUTH, APP_GROUPS, ICLOUD, IN_APP_PURCHASE

All active IOS_APP_STORE profiles still have iCloud-services=['*'] but iCloud-containers=[], so the required iCloud.com.offscript.app container is missing from every active profile. Example failing profile IDs include K93X2UR42U, VAQX3P69KM, 6R66QHZTX7, 62772J8G8N, and the rest of the active Store profile set.

Result: this PR is still not safe to merge until the Apple Developer profile state is repaired and scripts/app_store_connect.py signing-preflight --profile-type IOS_APP_STORE returns OK.

[zachyzissou]

Live signing re-check after merging latest main into the PR branch is still blocked.

Command run:

scripts/app_store_connect.py signing-preflight --profile-type IOS_APP_STORE

Current result: CloudKit signing profile is not ready.

Bundle ID: com.offscript.app id=77C8QG75UQ
Required CloudKit container: iCloud.com.offscript.app
Required profile type: IOS_APP_STORE
Capabilities: APPLE_ID_AUTH, APP_GROUPS, ICLOUD, IN_APP_PURCHASE

The active Store profile set now includes 17 profiles. Every active IOS_APP_STORE profile still decodes with iCloud-services=['*'] and iCloud-containers=[], so none includes iCloud.com.offscript.app. Newly observed active IDs since the prior blocker note include CT9Q937SM3 and Q6968NY85Q; the rest of the active set is still missing the container as well.

I also re-ran local script hygiene after syncing the branch:

python3 -m py_compile scripts/app_store_connect.py
git diff --check HEAD~1..HEAD

Both passed. I am not merging this PR until the Apple Developer App ID/profile state is repaired and the signing preflight returns OK.

[zachyzissou]

Codex Reviewer Gate

• Checked: zachyzissou/offscript Re-enable CloudKit signing preflight #38 @ 2026-06-17T04:46:58.477707+00:00
• Action class: review_comment_or_defer
• Changed: no files changed
• Taken: no approval/review mutation (gates not satisfied).
• Deferred: closure-gate emitted for blockers below.
  • blocker: checks_none
  • blocker: merge_state_DIRTY
  • blocker: risk_class_code_or_unknown
  • blocker: self_author_review
  • reason: authenticated as PR author; route to a valid reviewer account or leave a closure-gate comment
• Open: resolve blockers, rerun reviewer loop, then re-check merge surface.