fix: swap CI entitlements during build to bypass iCloud provisioning requirement

Author: datlechin

TablePro/TablePro.ci.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.app-sandbox</key>
+	<false/>
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+</dict>
+</plist>

scripts/build-release.sh

@@ -336,6 +336,16 @@ build_for_arch() {
     SPM_CACHE_DIR="${HOME}/.spm-cache"
     mkdir -p "$SPM_CACHE_DIR"
 
+    # Use CI entitlements (without iCloud) during build to avoid provisioning
+    # profile requirement. The app is re-signed with real entitlements after build.
+    local ci_entitlements="TablePro/TablePro.ci.entitlements"
+    local real_entitlements="TablePro/TablePro.entitlements"
+    if [ -f "$ci_entitlements" ]; then
+        echo "📋 Using CI entitlements (iCloud stripped for build)..."
+        cp "$real_entitlements" "$real_entitlements.bak"
+        cp "$ci_entitlements" "$real_entitlements"
+    fi
+
     # Build with xcodebuild
     echo "Running xcodebuild..."
     if ! xcodebuild \
@@ -345,6 +355,7 @@ build_for_arch() {
         -arch "$arch" \
         ONLY_ACTIVE_ARCH=YES \
         CODE_SIGN_IDENTITY="$SIGN_IDENTITY" \
+        CODE_SIGN_STYLE=Manual \
         DEVELOPMENT_TEAM="$TEAM_ID" \
         ${ANALYTICS_HMAC_SECRET:+ANALYTICS_HMAC_SECRET="$ANALYTICS_HMAC_SECRET"} \
         -skipPackagePluginValidation \
@@ -356,6 +367,11 @@ build_for_arch() {
     fi
     echo "✅ Build succeeded for $arch"
 
+    # Restore real entitlements
+    if [ -f "$real_entitlements.bak" ]; then
+        mv "$real_entitlements.bak" "$real_entitlements"
+    fi
+
     # Get binary path with validation
     DERIVED_DATA=$(echo "$build_settings" | grep -m 1 "BUILD_DIR" | awk '{print $3}')
 
@@ -501,8 +517,8 @@ build_for_arch() {
         done
     fi
 
-    # Sign the app bundle last
-    codesign -fs "$SIGN_IDENTITY" --force --options runtime --timestamp "$BUILD_DIR/$OUTPUT_NAME"
+    # Sign the app bundle last (with real entitlements including iCloud)
+    codesign -fs "$SIGN_IDENTITY" --force --options runtime --timestamp --entitlements "$real_entitlements" "$BUILD_DIR/$OUTPUT_NAME"
     echo "✅ Code signing complete"
 
     # Verify signature