【iOS/Xcode】Fastlane matchで証明書(Certificates)等の自動管理

$ bundle exec fastlane init

What would you like to use fastlane for?
1. 📸  Automate screenshots
2. 👩‍✈️  Automate beta distribution to TestFlight
3. 🚀  Automate App Store distribution
4. 🛠  Manual setup - manually setup your project to automate your tasks

$ bundle exec fastlane match init

fastlane match supports multiple storage modes, please select the one you want to use:
1. git
2. google_cloud
3. s3
4. gitlab_secure_files

Please create a new, private git repository to store the certificates and profiles there
URL of the Git Repo:[リポジトリのURL]

Matchfile
git_url("https://github.com/USERNAME/certificates.git")

storage_mode("git")

type("development")

$ bundle exec fastlane match development

// match用のパスフレーズを入力
Passphrase for Match storage:**********

$ fastlane match development --readonly

.env
MATCH_PASSWORD=パスフレーズ

FastFile
# 開発用プロビジョニングプロファイルを取得する
desc "Fetch development provisioning profiles and certificates for code signing"
lane :fetch_dev_signing do
  # プロビジョニングプロファイルの取得 
  match(
    # development or appstore or adhoc
    type: "development"
  )
end

Verifying that the certificate and profile are still valid on the Dev Portal...
Available session is not valid anymore. Continuing with normal login.
Two-factor Authentication (6 digits code) is enabled for account 'XXXXXXX@gmail.com'
More information about Two-factor Authentication: https://support.apple.com/en-us/HT204915

Please enter the 6 digit code:

.env
TEAM_ID=XXXXXXXXXX
KEY_ID=XXXXXXXXXX
ISSUER_ID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX
KEY_FILE_PATH=AuthKey_XXXXXXXXXX.p8 # AuthKey_XXXXXXXXXX.p8ファイルへのパス
# ↑ このパスはfastlaneディレクトリから見た位置を指定する

# 開発用プロビジョニングプロファイルを取得する
desc "Fetch development provisioning profiles and certificates for code signing"
lane :fetch_dev_signing do
  # 認証(JWTの生成)
  api_key = app_store_connect_api_key(
    key_id: ENV['KEY_ID'],
    issuer_id: ENV['ISSUER_ID'],
    key_filepath: ENV['KEY_FILE_PATH']
  )
  # プロビジョニングプロファイルの取得 
  match(
    api_key: api_key,
    # development or appstore or adhoc
    type: "development"
  )
end

# 管理者用：新しいデバイス追加後の再生成を許可
desc "Sync and regenerate development profiles with new devices (admin use)"
lane :sync_dev_signing_admin do
  api_key = app_store_connect_api_key(
    key_id: ENV['KEY_ID'],
    issuer_id: ENV['ISSUER_ID'],
    key_filepath: ENV['KEY_FILE_PATH']
  )

  match(
    api_key: api_key,
    type: "development",
    # 新しいデバイスがある場合に自動で再生成
    force_for_new_devices: true 
  )
end

# 開発者が既存の証明書・プロビジョニングを取得する専用
desc "Fetch development provisioning profiles (read-only mode) for local use"
lane :fetch_dev_signing_readonly do
  api_key = app_store_connect_api_key(
    key_id: ENV['KEY_ID'],
    issuer_id: ENV['ISSUER_ID'],
    key_filepath: ENV['KEY_FILE_PATH']
  )

  match(
    api_key: api_key,
    type: "development",
    # Apple Developer Portal に書き込まない
    readonly: true 
  )
end

$ fastlane match change_password

$ fastlane match nuke development

// 〜〜〜〜〜〜〜〜+---------------------------------------------------------------+
|               Certificates that can be revoked                |
+--------+--------------+------------+-------------+------------+
| Option | Name         | ID         | Type        | Expires    |
+--------+--------------+------------+-------------+------------+
| 1      | Apple        | XXXXXXXXXX | Certificate | 2026-05-14 |
|        | Development  |            |             |            |
|        | : XXXXXXXXXX |            |             |            |
|        | XXXXXXXXXX   |            |             |            |
| 2      | Apple        | XXXXXXXXXX | Certificate | 2026-06-28 |
|        | Development  |            |             |            |
|        | : XXXXXXXXXX |            |             |            |
|        | XXXXXXXXXX   |            |             |            |
+--------+--------------+------------+-------------+------------+

// デフォルトでは、リストされているすべての証明書とプロファイルが削除されます。
By default, all listed certificates and profiles will be nuked
// 特定の証明書とそれに関連付けられたプロファイルのみを削除しますか？(y/n)
Do you want to only nuke specific certificates and their associated
profiles? (y/n)