iOS code signing in GitLab CI/CD

The HexSign GitLab CI/CD component adds a ready-made hexsign-fetch job to your pipeline with a single include: block. It installs the hexsign binary, verifies its SHA-256 against the release's signed checksums.txt, and downloads the certificate and provisioning profile you've stored in HexSign into a short-lived job artifact. A downstream job picks them up and runs xcodebuild, with no secrets in the repository.

What you need

• A service credential with hexsign-api/read scope, provisioned under Settings → CLI Tokens in the HexSign dashboard. The secret is shown exactly once.
• HEXSIGN_CLIENT_ID and HEXSIGN_CLIENT_SECRET configured as masked, protected CI/CD variables under Settings → CI/CD → Variables.
• The certificate and profile IDs you sign with (or a team id and bundle id if you fetch by filter).

Add the fetch component

# .gitlab-ci.yml
include:
  - component: $CI_SERVER_FQDN/hexsign/hexsign-gitlab-component/fetch@~latest
    inputs:
      certificate_id: $HEXSIGN_CERT_ID
      profile_id:     $HEXSIGN_PROFILE_ID
      output_dir:     build/sign

stages:
  - signing
  - build

xcodebuild:
  stage: build
  needs: [hexsign-fetch]
  dependencies: [hexsign-fetch]
  script:
    - security import build/sign/*.p12 -P "$(cat build/sign/*.password)"
    - xcodebuild -scheme MyApp archive

The hexsign-fetch job runs in the .pre stage by default, so it completes before any named stage, and dependencies: pulls the artifact directory into your build job. To survive rotation, swap the IDs for certificate_type + team_id and bundle_id filters so the pipeline never changes when an artefact is regenerated. The fetched .p12 lives in a job artifact, so keep artifact_expire_in short.