From 862f2c037ec3c7685f0cebb49cd54c2f5a980825 Mon Sep 17 00:00:00 2001
From: hellolio <helloliaojun@outlook.com>
Date: Mon, 12 Oct 2026 23:09:57 +0900
Subject: [PATCH 1/2] =?UTF-8?q?ci:=20=E8=AF=81=E4=B9=A6=E5=AF=BC=E5=85=A5?=
 =?UTF-8?q?=E5=90=8E=E6=A0=A1=E9=AA=8C=20keychain=20=E5=AD=98=E5=9C=A8?=
 =?UTF-8?q?=E5=8F=AF=E7=AD=BE=E5=90=8D=E8=BA=AB=E4=BB=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

p12 只带证书没带私钥时,set-key-partition-list 只报隐晦的
SecItemCopyMatching;改为导入后立即 find-identity 计数,为 0 时
给出明确的导出/重签指引
---
 .github/workflows/build.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0c5e216..7804a29 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,6 +54,13 @@ jobs:
           security set-keychain-settings -lut 21600 "$KC_PATH"
           security unlock-keychain -p "$KC_PASS" "$KC_PATH"
           security import "$CERT_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KC_PATH"
+          # 校验私钥真的进来了:p12 只导出证书没带私钥时(常见坑)这里为 0,
+          # 否则后续 set-key-partition-list 只报隐晦的 SecItemCopyMatching
+          COUNT="$(security find-identity -v -p codesigning "$KC_PATH" | awk '/valid identities found/ {print $1}')"
+          if [ "${COUNT:-0}" -eq 0 ]; then
+            echo "::error::keychain 里没有可签名的身份——导出的 p12 大概率没带私钥。请在钥匙串访问「我的证书」里展开证书条目确认有「专用密钥」,连私钥一起导出 .p12 后更新 secret;若私钥不可导出(Xcode 生成于其它机器),在 Xcode → Accounts → Manage Certificates 新建证书后重新导出"
+            exit 1
+          fi
           security set-key-partition-list -S apple-tool:,apple: -k "$KC_PASS" "$KC_PATH"
           security list-keychain -d user -s "$KC_PATH" login.keychain
           echo "CS_IDENTITY=Apple Development" >> "$GITHUB_ENV"

From 9d7b9dd636b6425c8d0d3d4ff70c3fcac58ae4c3 Mon Sep 17 00:00:00 2001
From: hellolio <helloliaojun@outlook.com>
Date: Mon, 12 Oct 2026 23:31:15 +0900
Subject: [PATCH 2/2] update create_release_tag.sh

---
 create_release_tag.sh | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/create_release_tag.sh b/create_release_tag.sh
index d7260ba..3db49b1 100644
--- a/create_release_tag.sh
+++ b/create_release_tag.sh
@@ -1,6 +1,40 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# 记录原始分支和工作区状态
+ORIGINAL_BRANCH=$(git branch --show-current)
+STASH_CREATED=false
+
+# 保存未提交的修改（包括未跟踪文件）
+if [[ -n "$(git status --porcelain)" ]]; then
+    git stash push --include-untracked -m "temporary-release-stash"
+    STASH_CREATED=true
+fi
+
+# 无论发布成功与否，都恢复原始分支和工作区
+cleanup() {
+    local exit_code=$?
+
+    trap - EXIT
+
+    if [[ -n "$ORIGINAL_BRANCH" ]]; then
+        git switch "$ORIGINAL_BRANCH" || {
+            echo "错误：无法恢复原始分支 $ORIGINAL_BRANCH" >&2
+            exit 1
+        }
+    fi
+
+    if [[ "$STASH_CREATED" == true ]]; then
+        git stash pop || {
+            echo "错误：无法自动恢复工作区修改，请手动执行 git stash list" >&2
+            exit 1
+        }
+    fi
+
+    exit "$exit_code"
+}
+trap cleanup EXIT
+
 # 切换到 main 分支并更新
 git switch main
 git pull --ff-only origin main