2026 short-cycle iOS signing: Fastlane Match, encrypted Git on per-day cloud Mac runners, read-only HTTPS, and multi-job certificate conflicts

Short-cycle iOS teams rent cloud Mac runners by the day to burst through TestFlight builds without buying metal. Signing is where that model collides with reality: ephemeral disks, parallel jobs, and a secrets store that must stay offline from app code. Fastlane Match remains the pragmatic default because it encodes certificates and provisioning profiles as encrypted blobs in Git, then hydrates the keychain on each runner. The failure modes are predictable—stale profiles, passphrase drift, two jobs mutating the same repo branch—but the fixes are boring engineering once you separate read from write and pin concurrency.

Match + encrypted Git: what actually lands on the runner

Match expects a dedicated repository (often private) holding encrypted .p12 and mobileprovision files, plus metadata. The passphrase is not in Git; inject it from your CI secret manager as an environment variable. On a per-day cloud Mac, treat the checkout directory as disposable: clone fresh, run match in read-only mode for archive lanes, and only enable readonly: false on a guarded admin job that renews certs. That single policy removes most "CI flipped my repo" incidents.

Branching and access control

Use a default branch per environment (for example master or main for production signing material) and restrict merge rights. CI read tokens should be repository-scoped with contents read only. Human admins keep a separate credential path for regeneration. If you mix ad-hoc and App Store profiles in one repo, namespace directories clearly so Match types do not overwrite each other during parallel runs.

Read-only HTTPS clones on cloud Mac runners

HTTPS with a fine-scoped personal access token or deploy key mapped to HTTPS is easier to audit than long-lived SSH keys copied onto rented machines. Set GIT_TERMINAL_PROMPT=0 so hung auth fails fast, and prefer shallow clones for the Match repo to reduce minutes billed on short sessions. If your provider recycles IPs, watch for rate limits from the Git host; backoff belongs in the pipeline wrapper, not in Match itself.

export GIT_TERMINAL_PROMPT=0
export MATCH_READONLY=true   # archive / test lanes
# Optional: raise low-speed timeout for large LFS blobs
export GIT_HTTP_LOW_SPEED_LIMIT=1000
export GIT_HTTP_LOW_SPEED_TIME=120

Multi-job certificate conflict decision matrix

Two concurrent jobs that both call Match with write access, or that target the same app_identifier with conflicting type settings, can race on Git pushes or keychain installs. Use the matrix below before scaling parallelism. For runner pool sizing and when to add a second macOS pipeline versus offloading work, see 2026 short-cycle sprints: add a second macOS CI pipeline or split jobs onto Linux agents? Queue cost, secret isolation — decision matrix and FAQ; for elastic versus always-on Mac capacity, see 2026 short-cycle CI peaks: self-hosted GitHub Actions macOS runners — elastic cloud Mac pool or always-on nodes?.

Executable checklist FAQ

Run this list on every new cloud Mac image or runner label before enabling production signing.

• Preflight — Xcode major matches your DEVELOPMENT_TEAM settings; Apple Intermediate certificates present.
• Secrets — MATCH_PASSWORD, App Store Connect API key, and Git HTTPS token scoped to the Match repo only.
• Network — Outbound 443 to Apple and your Git host allowed; non-interactive mode (CI=1 so Fastlane skips prompts where supported).
• Concurrency — Default pipeline sets MATCH_READONLY; only the renewal workflow clears it.
• Post-job — Keychain reset or logout script on shared pools; artifacts uploaded, temp directories removed.

FAQ snippets

"Codesign wants to access keychain" — unlock with a throwaway keychain file in $TMPDIR for CI, not the login keychain. Profile expired mid-sprint — run a single renewal lane, bump profiles, commit to Match repo, then fan out readonly jobs. Two apps, one bundle ID typo — fails at upload, not compile; add a pre-archive gym metadata check.