Fix IPA CI: empty EXTRA_FLAGS under set -u and core check curl

Avoid unbound array expansion on macOS bash and make the EverywhereCore
freshness job resilient so it cannot fail the IPA build.

Author: decoder-dev

.github/workflows/build-ipa.yml

@@ -123,6 +123,7 @@ jobs:
     name: Check EverywhereCore / Xray freshness
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    continue-on-error: true
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -136,7 +137,8 @@ jobs:
           echo "Latest EverywhereCore: $LATEST"
           XRAY=$(curl -fsSL https://proxy.golang.org/github.com/xtls/xray-core/@latest)
           echo "Latest Xray (Go proxy): $XRAY"
-          CORE_MOD=$(curl -fsSL "https://raw.githubusercontent.com/NodePassProject/EverywhereCore/v${LATEST}/go/go.mod" | awk '/xray-core/{print; exit}')
+          curl -fsSL "https://raw.githubusercontent.com/NodePassProject/EverywhereCore/v${LATEST}/go/go.mod" -o /tmp/everywherecore.go.mod
+          CORE_MOD=$(awk '/xray-core/{print; exit}' /tmp/everywherecore.go.mod)
           echo "Xray in latest EverywhereCore: $CORE_MOD"
           if [[ "$LATEST" > "$PIN" ]]; then
             echo "::warning::EverywhereCore floor $PIN is behind latest $LATEST — bump Scripts/wire_project.rb"

Scripts/ci_export_ipa.sh

@@ -12,7 +12,6 @@
 #   IPA_DIR         path (default ./build/ipa)
 #   EXPORT_OPTIONS  plist path (default Config/ExportOptions-ad-hoc.plist)
 #   DEVELOPMENT_TEAM optional Apple Team ID override
-#   PRODUCT_BUNDLE_IDENTIFIER optional override for app id
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -27,40 +26,30 @@ EXPORT_OPTIONS="${EXPORT_OPTIONS:-$ROOT/Config/ExportOptions-ad-hoc.plist}"
 
 mkdir -p "$(dirname "$ARCHIVE_PATH")" "$IPA_DIR" "$DERIVED_DATA"
 
-EXTRA_FLAGS=()
-if [[ -n "${DEVELOPMENT_TEAM:-}" ]]; then
-  EXTRA_FLAGS+=(DEVELOPMENT_TEAM="$DEVELOPMENT_TEAM")
-fi
-# Do not pass a global PRODUCT_BUNDLE_IDENTIFIER — it would clobber the NE target.
-# Change bundle IDs in the Xcode project (or a CI pbxproj patch) when rebranding.
-
 echo "→ wire SwiftPM deps"
 ./build.sh
 
+COMMON=(
+  -project DecoderSec.xcodeproj
+  -scheme DecoderSec
+  -configuration "$CONFIGURATION"
+  -destination 'generic/platform=iOS'
+  -archivePath "$ARCHIVE_PATH"
+  -derivedDataPath "$DERIVED_DATA"
+)
+if [[ -n "${DEVELOPMENT_TEAM:-}" ]]; then
+  COMMON+=(DEVELOPMENT_TEAM="$DEVELOPMENT_TEAM")
+fi
+
 echo "→ archive ($CONFIGURATION, signing=$SIGNING)"
 if [[ "$SIGNING" == "unsigned" ]]; then
-  xcodebuild \
-    -project DecoderSec.xcodeproj \
-    -scheme DecoderSec \
-    -configuration "$CONFIGURATION" \
-    -destination 'generic/platform=iOS' \
-    -archivePath "$ARCHIVE_PATH" \
-    -derivedDataPath "$DERIVED_DATA" \
+  xcodebuild "${COMMON[@]}" \
     CODE_SIGNING_ALLOWED=NO \
     CODE_SIGNING_REQUIRED=NO \
     CODE_SIGN_IDENTITY="" \
-    "${EXTRA_FLAGS[@]}" \
     archive
 else
-  xcodebuild \
-    -project DecoderSec.xcodeproj \
-    -scheme DecoderSec \
-    -configuration "$CONFIGURATION" \
-    -destination 'generic/platform=iOS' \
-    -archivePath "$ARCHIVE_PATH" \
-    -derivedDataPath "$DERIVED_DATA" \
-    "${EXTRA_FLAGS[@]}" \
-    archive
+  xcodebuild "${COMMON[@]}" archive
 
   echo "→ export IPA via $EXPORT_OPTIONS"
   xcodebuild \