We are new to Apple iOS development. Our team comprise of few internal developers and few external contractors. We develop using React Native and using a basic Fastlane app for building the apps and pushing them to App Store Connect. At the moment some contractors have access to Appstore connect with 'development' role and all internal developers have access to it. All developers use 'Automatically manage signing' tick box in their Xcode.
When looking at best practices in running a team for app development, we found multiple articles using fastlane match to reduce the complexities in managing certificates and we are wondering whether they are still valid.
For example
- https://codesigning.guide/
- https://medium.com/revelo-tech/setting-up-automatic-ios-release-with-fastlane-and-match-on-ci-cd-server-16c3f1d79bc5
- https://fastlane.tools/
recommends to use match to store development/distribution certificates/profiles in a git repo and share with the team. The main advantage that has been pointed out is the easy administration (and may be security).
eg:
You have to manually renew and download the latest set of provisioning profiles every time you add a new device or a certificate expires. Additionally this requires spending a lot of time when setting up a new machine that will build your app.
Unless there is a security concern, we do not see a big administration hassle so far with 'automatic signing'.
- Are the above concerns not relevant anymore in a world where people predominantly use 'automatic signing?
- Or have we missed something in our setup and doing it all wrong?
- Is it safe to have contractors added to developer account (App Store Connect) and let them access their own developer certificates
