/

CI/CD Integration

Shield integrates into any CI/CD pipeline. This guide covers the recommended xcarchive workflow and examples for common CI systems.

The recommended CI/CD pattern is: archive → protect xcarchive → export IPA. This lets Xcode handle code signing during the export step.

Bash
# 1. Build the archive
xcodebuild archive \
  -scheme MyApp \
  -archivePath build/MyApp.xcarchive

# 2. Protect the archive (no signing — Xcode signs on export)
shield-ios protect build/MyApp.xcarchive \
  -o build/MyApp.xcarchive \
  --config shield-ios.json \
  --no-sign

# 3. Export to IPA (Xcode handles signing)
xcodebuild -exportArchive \
  -archivePath build/MyApp.xcarchive \
  -exportOptionsPlist ExportOptions.plist \
  -exportPath build/output

Store your project token as a CI secret and pass it via environment variable or include it in your shield-ios.json:

Bash
export SHIELD_PROJECT_TOKEN="bh_your-project-token"

GitHub Actions

YAML
name: Build and Protect iOS App

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Shield iOS
        run: brew install bytehide/tap/shield-ios

      - name: Build archive
        run: |
          xcodebuild archive \
            -scheme MyApp \
            -archivePath build/MyApp.xcarchive

      - name: Protect archive
        run: |
          shield-ios protect build/MyApp.xcarchive \
            -o build/MyApp.xcarchive \
            --config shield-ios.json \
            --no-sign

      - name: Export IPA
        run: |
          xcodebuild -exportArchive \
            -archivePath build/MyApp.xcarchive \
            -exportOptionsPlist ExportOptions.plist \
            -exportPath build/output

      - name: Upload IPA
        uses: actions/upload-artifact@v4
        with:
          name: protected-ipa
          path: build/output/*.ipa

Store your token securely

Add SHIELD_PROJECT_TOKEN as a repository secret in GitHub: Settings > Secrets and variables > Actions > New repository secret. Or include the token in your shield-ios.json committed to the repo (tokens identify your project but do not grant code access).

GitLab CI

YAML
protect_ios:
  stage: protect
  tags: [macos]
  script:
    - brew install bytehide/tap/shield-ios
    - xcodebuild archive -scheme MyApp -archivePath build/MyApp.xcarchive
    - shield-ios protect build/MyApp.xcarchive -o build/MyApp.xcarchive --config shield-ios.json --no-sign
    - xcodebuild -exportArchive -archivePath build/MyApp.xcarchive -exportOptionsPlist ExportOptions.plist -exportPath build/output
  artifacts:
    paths:
      - build/output/*.ipa

Fastlane

Use the official Fastlane plugin for the cleanest integration:

Bash
fastlane add_plugin shield_ios
Ruby
platform :ios do
  lane :release do
    build_app(
      scheme: "MyApp",
      archive_path: "build/MyApp.xcarchive",
      skip_package_ipa: true
    )

    shield_ios(
      archive_path: "build/MyApp.xcarchive",
      config: "shield-ios.json"
    )

    build_app(
      archive_path: "build/MyApp.xcarchive",
      skip_build_archive: true
    )

    upload_to_app_store
  end
end

See Fastlane Plugin for full documentation including parameters, environment variables, and CI examples.

Bitrise

Add a Script step after your Xcode Archive step:

Bash
#!/bin/bash
brew install bytehide/tap/shield-ios
shield-ios protect "$BITRISE_XCARCHIVE_PATH" \
    -o "$BITRISE_XCARCHIVE_PATH" \
    --config shield-ios.json \
    --no-sign

Next Steps

Automatic Setup

One-command installation and configuration

Xcode Integration

Post-archive action setup

Configuration Reference

Full configuration options

Previous
Xcode Integration
Next
Configuration Reference