[iradkot]

Base LoopKit/LoopWorkspace:dev at 1a1c7538fdeb0bbb1171998d0bd0dd15fff91ce8.

Issue LoopKit/Loop#2661.

Summary

An expired certificate in Match-Secrets can fail Fastlane Match while unrelated valid certificates make the team-wide renewal check pass. Keep the original Match step outcome so the certificate job can report the failure before the archive starts.

Fastlane Match prepares the signing assets
  → existing portal renewal check runs
  → Match failed and neither renewal path will run
    → annotate the certificate job and stop the build

The error points to the original Match output. The change uses GitHub Actions' outcome, which records the exit status before continue-on-error is applied. The existing portal-driven and explicitly forced renewal paths keep their current behavior.

Evidence

• Before: With a simulated Match failure and new_certificate_needed: false, the upstream shell step exited 0.
• After: The same case exits 1 with an error annotation about preparing the signing certificate and profiles from Match-Secrets.
• Seven local cases passed, covering valid signing assets, portal renewal enabled and disabled, forced renewal, missing portal status, and both settings of automatic renewal in the original failure case. The harness ran the workflow's actual Bash step with simulated inputs. Live Apple signing was outside this test.
• git diff --check and actionlint passed. Actionlint 1.7.12 does not recognize the existing xcode-27 label, which is listed in GitHub's runner documentation. I excluded that diagnostic only.

Merge impact

The change is reversible and limited to the GitHub Actions certificate preflight. It changes no certificate selection or revocation logic.

Codex drafted the workflow change from the observed failure in the linked issue and ran the local checks. The workflow conventions and renewal paths received a separate AI-assisted review.

[ps2]

LGTM!