[DNM] Add no-policy identity fallback for certs without Code Signing EKU

Author: Kyle-Ye

.github/actions/codesign-xcframework/action.yml

@@ -78,11 +78,15 @@ runs:
         SIGNING_IDENTITY: ${{ inputs.signing-identity }}
         XCFRAMEWORK_PATHS: ${{ inputs.xcframework-paths }}
       run: |
-        # Try trusted identities first, fall back to all (including untrusted self-signed)
+        # Try: trusted codesigning → all codesigning → any identity (no policy)
         SIGNING_HASH=$(security find-identity -v -p codesigning 2>/dev/null | grep "$SIGNING_IDENTITY" | head -1 | awk '{print $2}')
         if [ -z "$SIGNING_HASH" ]; then
             SIGNING_HASH=$(security find-identity -p codesigning 2>/dev/null | grep "$SIGNING_IDENTITY" | head -1 | awk '{print $2}')
         fi
+        if [ -z "$SIGNING_HASH" ]; then
+            # Last resort: find any identity regardless of policy (works for certs without Code Signing EKU)
+            SIGNING_HASH=$(security find-identity 2>/dev/null | grep "$SIGNING_IDENTITY" | head -1 | awk '{print $2}')
+        fi
         if [ -z "$SIGNING_HASH" ]; then
             echo "::error::Signing identity '$SIGNING_IDENTITY' not found"
             exit 1