01
Pin the code version
After fetching the repository, record the commit hash, initialize submodules, and install dependencies from the lockfile. Do not switch branches during the build.
02
Inject controlled variables
Inject repository tokens, signing parameters, and environment configuration before the task runs. Logs should show only whether a variable exists, never its contents.
03
Run the archive
Specify the workspace or project, scheme, configuration, and archivePath so the command behaves consistently in interactive sessions and pipelines.
04
Check the signing result
Confirm that the archive uses the expected team, certificate, and provisioning profile. If anything does not match, stop the export instead of masking configuration problems with manual changes.
05
Verify and download artifacts
Record the artifact name, size, commit version, and checksum, then download it through a controlled path. Proceed to cleanup only after confirming that the local copy is complete.