fix: scope provisioning profile to main app target only in pbxproj

Author: datlechin

scripts/build-release.sh

@@ -336,13 +336,18 @@ build_for_arch() {
     SPM_CACHE_DIR="${HOME}/.spm-cache"
     mkdir -p "$SPM_CACHE_DIR"
 
-    # Detect provisioning profile UUID for iCloud entitlements
-    local PROFILE_SPECIFIER=""
+    # Inject provisioning profile UUID into pbxproj for the main app target only.
+    # Command-line PROVISIONING_PROFILE_SPECIFIER applies to ALL targets (plugins,
+    # SPM packages) which breaks them. Instead, replace the empty specifier in
+    # the main app target's build settings directly.
     PROFILE_PATH=$(find ~/Library/MobileDevice/Provisioning\ Profiles -name "*.provisionprofile" -print -quit 2>/dev/null)
     if [ -n "${PROFILE_PATH:-}" ]; then
-        PROFILE_SPECIFIER=$(/usr/libexec/PlistBuddy -c "Print UUID" /dev/stdin <<< "$(security cms -D -i "$PROFILE_PATH" 2>/dev/null)" || true)
-        if [ -n "$PROFILE_SPECIFIER" ]; then
-            echo "📋 Using provisioning profile: $PROFILE_SPECIFIER"
+        PROFILE_UUID=$(/usr/libexec/PlistBuddy -c "Print UUID" /dev/stdin <<< "$(security cms -D -i "$PROFILE_PATH" 2>/dev/null)" || true)
+        if [ -n "${PROFILE_UUID:-}" ]; then
+            echo "📋 Injecting provisioning profile into pbxproj: $PROFILE_UUID"
+            # The main app target has PROVISIONING_PROFILE_SPECIFIER = "";
+            # Other targets don't have this key at all, so this is safe.
+            sed -i '' "s/PROVISIONING_PROFILE_SPECIFIER = \"\";/PROVISIONING_PROFILE_SPECIFIER = \"$PROFILE_UUID\";/g" "$PROJECT/project.pbxproj"
         fi
     fi
 
@@ -357,7 +362,6 @@ build_for_arch() {
         CODE_SIGN_IDENTITY="$SIGN_IDENTITY" \
         CODE_SIGN_STYLE=Manual \
         DEVELOPMENT_TEAM="$TEAM_ID" \
-        ${PROFILE_SPECIFIER:+PROVISIONING_PROFILE_SPECIFIER="$PROFILE_SPECIFIER"} \
         ${ANALYTICS_HMAC_SECRET:+ANALYTICS_HMAC_SECRET="$ANALYTICS_HMAC_SECRET"} \
         -skipPackagePluginValidation \
         -clonedSourcePackagesDirPath "$SPM_CACHE_DIR" \