EAS iOS build omits valid widget extension provisioning profile from Fastlane mapping

[anasyd]

Build/Submit details page URL

https://expo.dev/accounts/ilmm/projects/ilmm-ai/builds/f1386802-6fa3-43b6-9d4e-1f995b494962

Summary

An existing React Native project with a WidgetKit extension builds successfully with local iOS credentials but fails on EAS cloud builds. EAS has valid remote credentials for both the main app and widget, but the cloud build passes Fastlane a provisioning-profile mapping for only the main app target.

Managed or bare?

bare

Environment

npx expo-env-info

  expo-env-info 2.1.0 environment info:
    System:
      OS: macOS 26.4.1
      Shell: 5.9 - /bin/zsh
    Binaries:
      Node: 22.22.0 - /Users/anas/.nvm/versions/node/v22.22.0/bin/node
      Yarn: 1.22.22 - /Users/anas/.nvm/versions/node/v22.22.0/bin/yarn
      npm: 10.9.4 - /Users/anas/.nvm/versions/node/v22.22.0/bin/npm
      Watchman: 2025.10.27.00 - /usr/local/bin/watchman
    Managers:
      CocoaPods: 1.16.2 - /Users/anas/.rbenv/shims/pod
    SDKs:
      iOS SDK:
        Platforms: DriverKit 25.5, iOS 26.5, macOS 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5
      Android SDK:
        API Levels: 34, 35, 36
        Build Tools: 35.0.0, 36.0.0
    IDEs:
      Android Studio: 2025.1 AI-251.26094.121.2513.14007798
      Xcode: 26.5/17F42 - /usr/bin/xcodebuild
    npmPackages:
      babel-preset-expo: ~57.0.10 => 57.0.11 
      expo: ~57.0.21 => 57.0.21 
      react: 19.2.3 => 19.2.3 
      react-dom: 19.2.3 => 19.2.3 
      react-native: ^0.86.3 => 0.86.3 
    npmGlobalPackages:
      eas-cli: 24.0.0
    Expo Workflow: bare

npx expo-doctor

19/21 checks passed. 2 checks failed. Possible issues detected:
Use the --verbose flag to see more details about passed checks.

✖ Check for app config fields that may not be synced in a non-CNG project
This project contains native project folders but also has native configuration properties in app.json, indicating it is configuredto use Prebuild. When the android/ios folders are present, EAS Build will not sync the following properties: scheme, userInterfaceStyle, ios, android, plugins. 


✖ Validate packages against React Native Directory package metadata
The following issues were found when validating your dependencies against React Native Directory:
  Untested on New Architecture: @nozbe/watermelondb
  Unmaintained: @notifee/react-native, @react-native-community/blur, @react-native-voice/voice
  No metadata available: @react-native-vector-icons/common, react-native-pcm-player-lite, @nozbe/simdjson
Advice:
Use libraries that are actively maintained and support the New Architecture. Find alternative libraries with https://reactnative.directory.
Add packages to expo.doctor.reactNativeDirectoryCheck.exclude in package.json to selectively skip validations, if the warning is not relevant.
Update React Native Directory to include metadata for unknown packages. Alternatively, set expo.doctor.reactNativeDirectoryCheck.listUnknownPackages in package.json to false to skip warnings about packages with no metadata, if the warning is not relevant.

2 checks failed, indicating possible issues with the project.

Additional environment details:

EAS CLI: 24.0.0
Expo SDK: 57
React Native: 0.86.3
Xcode build image: 26.5
macOS build environment: EAS cloud

Error output

The build fails during the Run fastlane step with:

Detected provisioning profile mapping:
{:\"com.ilmmai.ilmm\"=>\"259a6624-0583-44ca-92d6-0ae6516ef541\"}

No profiles for 'com.ilmmai.ilmm.ILMMWidget' were found: Xcode couldn't find
any iOS App Development provisioning profiles matching
'com.ilmmai.ilmm.ILMMWidget'. Automatic signing is disabled and unable to
generate a profile. To enable automatic signing, pass
-allowProvisioningUpdates to xcodebuild.

(in target 'ILMMWidgetExtension' from project 'ilmm')

The mapping contains the main app profile but omits the widget profile. The expected additional entry is:

\"com.ilmmai.ilmm.ILMMWidget\" => \"77548484-10a4-401a-86f2-76fce84c4d2a\"

The build also reports that it is using remote iOS credentials and that the main app credentials are ready. The widget provisioning profile is present and active in the EAS dashboard, but it is not passed to Fastlane/Xcode.

Reproducible demo or steps to reproduce from a blank project

This is an existing bare React Native project, so there is no blank-project reproduction yet.

1. Create an iOS project with these targets:

   • Main target: ilmm
   • Main bundle ID: com.ilmmai.ilmm
   • Widget target: ILMMWidgetExtension
   • Widget bundle ID: com.ilmmai.ilmm.ILMMWidget

2. Configure the widget with this entitlement:

{
  "com.apple.security.application-groups": [
    "group.com.ilmmai.ilmm"
  ]
}

3. Configure valid App Store distribution credentials in EAS for both bundle IDs.

4. Run:

eas build --platform ios --profile ios-production --auto-submit --non-interactive

5. EAS reports the main app credentials as ready, but Fastlane's provisioning-profile mapping contains only com.ilmmai.ilmm.

6. Xcode fails while archiving ILMMWidgetExtension because no profile is assigned to the widget target.

The same project succeeds with local credentials because credentials.json explicitly maps ILMMWidgetExtension to its provisioning profile.

Credentials and targets

Both App Store distribution profiles are present and valid in EAS:

Main bundle ID: com.ilmmai.ilmm
Main profile UUID: 259a6624-0583-44ca-92d6-0ae6516ef541

Widget target: ILMMWidgetExtension
Widget bundle ID: com.ilmmai.ilmm.ILMMWidget
Widget profile UUID: 77548484-10a4-401a-86f2-76fce84c4d2a

Could you investigate why the EAS cloud build sees the valid remote widget credentials but does not include the widget bundle identifier in Fastlane's provisioning-profile mapping?

[LizunovSergey]

I looked at where that Fastlane mapping is built, and I think this one has to be routed to the EAS backend rather than fixed in eas-cli — posting the trace so it can be checked quickly.

The mapping is assembled in packages/build-tools/src/ios/credentials/manager.ts:

const targets = Object.keys(buildCredentials);
const targetProvisioningProfiles: TargetProvisioningProfiles = {};
for (const target of targets) {
  const provisioningProfile = await this.prepareTargetCredentials(target, buildCredentials[target]);
  this.provisioningProfiles.push(provisioningProfile);
  targetProvisioningProfiles[target] = provisioningProfile.data;
}

buildCredentials is ctx.job.secrets.buildCredentials — the job payload the worker receives. The loop is unconditional over Object.keys, and both consumers (ios/fastfile.ts and ios/gymfile.ts) iterate the whole record the same way, so nothing on this side filters targets or prefers the application target. getApplicationTargetProvisioningProfile() sorts by bundle id and takes the first, but it only picks the one profile used for the signing identity; it does not narrow the mapping.

So if Fastlane saw only the main app target, that target set was already the only one in buildCredentials when the job reached the worker. That is decided before any code in this repository runs.

Two things that would confirm it from your side, if you are able to share them privately with Expo:

1. The build's Prepare credentials log lines — the manager logs one Preparing credentials for target ... per key in that record, so the log shows exactly how many targets the job carried.
2. Whether the widget target appears under eas credentials for the same profile and platform, with a bundle id matching the extension's.

If the widget target is present in eas credentials but absent from those log lines, the gap is in what the server puts into the job, and this issue wants a maintainer from the EAS build side rather than a CLI change.

[anasyd]

Thanks for tracing this.

The affected build is:
https://expo.dev/accounts/ilmm/projects/ilmm-ai/builds/f1386802-6fa3-43b6-9d4e-1f995b494962

1. The downloaded build log does not include the earlier Preparing credentials for target ... lines, so I cannot verify the full buildCredentials key set from that artifact. It is the Xcode/Fastlane log only.

2. Yes. The widget target is present under the EAS iOS App Store credentials for the same project/profile, with the matching bundle identifier com.ilmmai.ilmm.ILMMWidget and profile UUID 77548484-10a4-401a-86f2-76fce84c4d2a.

The Fastlane output contains only:

{"com.ilmmai.ilmm"=>"259a6624-0583-44ca-92d6-0ae6516ef541"}

It does not contain the expected widget entry:

{"com.ilmmai.ilmm.ILMMWidget"=>"77548484-10a4-401a-86f2-76fce84c4d2a"}

The widget bundle identifier is registered in Apple Developer and its App Store provisioning profile is uploaded and valid in EAS. The build succeeds with local multi-target credentials but fails with remote EAS credentials.

The build log does not include the earlier Preparing credentials for target ... lines, but it does confirm the mapping received by Fastlane:

Detected provisioning profile mapping: {:\"com.ilmmai.ilmm\"=>\"259a6624-0583-44ca-92d6-0ae6516ef541\"}

The Gym export summary likewise contains only:

export_options.provisioningProfiles.com.ilmmai.ilmm | 259a6624-0583-44ca-92d6-0ae6516ef541

There is no com.ilmmai.ilmm.ILMMWidget entry. The same log then reports:

No profiles for 'com.ilmmai.ilmm.ILMMWidget' were found

Could you inspect the EAS worker's earlier Prepare credentials logs for this build? The widget profile is present and valid in EAS, but it is not reaching the Fastlane mapping.