ci: refactor TestFlight deploy to workflow_dispatch with manual inputs

- replace release/* push trigger with workflow_dispatch (branch + release_notes)
- restore GoogleService-Info.plist from GOOGLE_SERVICE_INFO_PLIST_B64 secret
- extract provisioning profile name into PROVISIONING_PROFILE_SPECIFIER env
- harden keychain password (openssl rand) and pin profile filename
- expose RELEASE_NOTES to fastlane env (consumed in follow-up Fastfile PR)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kangddong

.github/workflows/deploy_testflight.yml

@@ -1,9 +1,16 @@
 name: Deploy TestFlight
 
 on:
-  push:
-    branches:
-      - "release/*" # develop -> release/* merge triggers TestFlight
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "빌드할 브랜치 이름"
+        required: true
+        default: "develop"
+      release_notes:
+        description: "테스트 노트 (선택)"
+        required: false
+        default: ""
 
 jobs:
   beta:
@@ -12,6 +19,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.branch }}
 
       - name: Setup Xcode
         uses: maxim-lobanov/setup-xcode@v1
@@ -27,36 +36,56 @@ jobs:
           ruby-version: "3.2"
           bundler-cache: true
 
+      - name: Prepare xcconfig
+        run: |
+          mkdir -p Projects/App/Resources
+          printf "BASE_URL = ${{ vars.BASE_URL }}\nKAKAO_NATIVE_APP_KEY = ${{ secrets.KAKAO_NATIVE_APP_KEY }}\n" \
+            > Projects/App/Resources/Common.xcconfig
+
+      - name: Restore GoogleService-Info.plist
+        env:
+          GOOGLE_SERVICE_INFO_PLIST_B64: ${{ secrets.GOOGLE_SERVICE_INFO_PLIST_B64 }}
+        run: |
+          set -euo pipefail
+          test -n "$GOOGLE_SERVICE_INFO_PLIST_B64"
+          mkdir -p Projects/App/Resources
+          printf '%s' "$GOOGLE_SERVICE_INFO_PLIST_B64" | base64 --decode \
+            > Projects/App/Resources/GoogleService-Info.plist || \
+          printf '%s' "$GOOGLE_SERVICE_INFO_PLIST_B64" | base64 -D \
+            > Projects/App/Resources/GoogleService-Info.plist
+
       - name: Install certificate and provisioning profile
         env:
           CERTIFICATE_P12: ${{ secrets.CERTIFICATE_P12 }}
           CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
           PROVISIONING_PROFILE: ${{ secrets.PROVISIONING_PROFILE }}
         run: |
+          set -euo pipefail
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
-          KEYCHAIN_PASSWORD=temp-keychain-password
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 20)
           security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
 
-          echo "$CERTIFICATE_P12" | base64 --decode > $RUNNER_TEMP/certificate.p12
-          security import "$RUNNER_TEMP/certificate.p12" \
-            -k "$KEYCHAIN_PATH" \
-            -P "$CERTIFICATE_PASSWORD" \
-            -A -t cert -f pkcs12
+          P12_PATH=$RUNNER_TEMP/certificate.p12
+          printf '%s' "$CERTIFICATE_P12" | base64 --decode > "$P12_PATH" || \
+          printf '%s' "$CERTIFICATE_P12" | base64 -D > "$P12_PATH"
+          security import "$P12_PATH" -P "$CERTIFICATE_PASSWORD" -A \
+            -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
           security list-keychain -d user -s "$KEYCHAIN_PATH"
 
-          PP_PATH=$RUNNER_TEMP/profile.mobileprovision
-          echo "$PROVISIONING_PROFILE" | base64 --decode > "$PP_PATH"
-          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
-          UUID=$(security cms -D -i "$PP_PATH" | plutil -extract UUID raw -)
-          cp "$PP_PATH" ~/Library/MobileDevice/Provisioning\ Profiles/"$UUID".mobileprovision
+          PP_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
+          mkdir -p "$PP_DIR"
+          printf '%s' "$PROVISIONING_PROFILE" | base64 --decode \
+            > "$PP_DIR/distribution.mobileprovision" || \
+          printf '%s' "$PROVISIONING_PROFILE" | base64 -D \
+            > "$PP_DIR/distribution.mobileprovision"
 
-      - name: Prepare xcconfig
+      - name: Extract provisioning profile name
         run: |
-          mkdir -p Projects/App/Resources
-          printf "BASE_URL = ${{ vars.BASE_URL }}\nKAKAO_NATIVE_APP_KEY = ${{ secrets.KAKAO_NATIVE_APP_KEY }}\n" \
-            > Projects/App/Resources/Common.xcconfig
+          PP_PATH="$HOME/Library/MobileDevice/Provisioning Profiles/distribution.mobileprovision"
+          PROFILE_NAME=$(security cms -D -i "$PP_PATH" | plutil -extract Name raw -)
+          echo "PROVISIONING_PROFILE_SPECIFIER=$PROFILE_NAME" >> $GITHUB_ENV
 
       - name: Install Tuist dependencies
         run: tuist install
@@ -65,9 +94,11 @@ jobs:
         run: tuist generate --no-open
 
       - name: Deploy to TestFlight
-        run: bundle exec fastlane beta
         env:
           ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
           ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
           ASC_KEY_CONTENT: ${{ secrets.ASC_KEY_CONTENT }}
           DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          PROVISIONING_PROFILE_SPECIFIER: ${{ env.PROVISIONING_PROFILE_SPECIFIER }}
+          RELEASE_NOTES: ${{ github.event.inputs.release_notes }}
+        run: bundle exec fastlane beta