From 2d78421d43217a64c53920e63e9c01c910dea695 Mon Sep 17 00:00:00 2001
From: Jeremy Massel <1123407+jkmassel@users.noreply.github.com>
Date: Wed, 15 Oct 2025 21:14:42 -0600
Subject: [PATCH 01/15] Add xcframework code signing

---
 .buildkite/pipeline.yml | 13 +++++++---
 .buildkite/release.sh   |  4 +++
 Makefile                |  3 +++
 fastlane/Fastfile       | 54 +++++++++++++++++++++++++++++++++++++++--
 4 files changed, 69 insertions(+), 5 deletions(-)

diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 7426dc6a1..1a55bedd0 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -70,11 +70,18 @@ steps:
           make setup-rust
 
           echo "--- :swift: Building xcframework"
-          make xcframework
-          zip -r target/libwordpressFFI.xcframework.zip target/libwordpressFFI.xcframework
+          install_gems
+          bundle exec fastlane set_up_signing
+
+          make xcframework-package
+          make xcframework-package-checksum
+          make xcframework-sign
+
         artifact_paths:
-          - target/libwordpressFFI.xcframework.zip
+          - libwordpressFFI.xcframework.zip
+          - libwordpressFFI.xcframework.zip.checksum.txt
           - native/swift/Sources/wordpress-api-wrapper/*.swift
+        plugins: [$CI_TOOLKIT]
         agents:
           queue: mac
       - label: ":swift: Build Docs"
diff --git a/.buildkite/release.sh b/.buildkite/release.sh
index 3998808d4..c06b26e3a 100755
--- a/.buildkite/release.sh
+++ b/.buildkite/release.sh
@@ -21,9 +21,13 @@ make setup-rust
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
+echo "--- :closed_lock_with_key: Setting up Code Signing"
+bundle exec fastlane set_up_signing
+
 echo "--- :rust: Building XCFramework"
 make xcframework-package
 make xcframework-package-checksum
+make xcframework-sign
 
 release_version="$1"
 echo "--- :rocket: Publish release $release_version"
diff --git a/Makefile b/Makefile
index b3e435f64..913c8574d 100644
--- a/Makefile
+++ b/Makefile
@@ -137,6 +137,9 @@ xcframework-package: xcframework-all
 xcframework-package-checksum:
 	swift package compute-checksum libwordpressFFI.xcframework.zip | tee libwordpressFFI.xcframework.zip.checksum.txt
 
+xcframework-sign:
+	codesign --timestamp -v --sign "Apple Development: Created via API (886NX39KP6)" target/libwordpressFFI.xcframework
+
 docker-image-web:
 	docker build -t wordpress-rs-web -f wp_rs_web/Dockerfile . --progress=plain
 
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index ac7bd7377..6cc7b6a40 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -24,6 +24,21 @@ PROJECT_NAME = 'wordpress-rs'
 # GlotPress configuration
 GLOTPRESS_PROJECT_BASE_URL = 'https://translate.wordpress.com/projects/mobile/wordpress-rs'
 
+# Code Signing
+APPLE_TEAM_ID = 'PZYM8XX95Q'
+APPLE_BUNDLE_IDENTIFIER = 'com.automattic.hostmgr'
+
+ASC_API_KEY_ENV_VARS = %w[
+  APP_STORE_CONNECT_API_KEY_KEY_ID
+  APP_STORE_CONNECT_API_KEY_ISSUER_ID
+  APP_STORE_CONNECT_API_KEY_KEY
+].freeze
+
+CODE_SIGNING_STORAGE_ENV_VARS = %w[
+  MATCH_S3_ACCESS_KEY
+  MATCH_S3_SECRET_ACCESS_KEY
+].freeze
+
 # Supported locales mapping between GlotPress and project locale codes
 # This list combines locales supported in the iOS and Android apps
 SUPPORTED_LOCALES = [
@@ -90,7 +105,7 @@ lane :release do |options|
 
   validate
   update_swift_package
-  publish_github_release
+  publish_release_to_github
   publish_to_s3
 end
 
@@ -124,7 +139,7 @@ lane :update_swift_package do
   File.open(file_path, 'w') { |file| file.puts lines }
 end
 
-lane :publish_github_release do
+lane :publish_release_to_github do
   version = lane_context[LANE_VALUE_VERSION] || UI.user_error!('Missing version lane context')
   github_token = lane_context[LANE_VALUE_GITHUB_TOKEN] || UI.user_error!('Missing github token lane context')
 
@@ -396,6 +411,27 @@ lane :generate_fluent_file_from_po do |file_path:|
   fluent_file_path
 end
 
+desc 'Download the development signing certificates to this machine'
+lane :set_up_signing do |readonly: true|
+  require_env_vars!(*ASC_API_KEY_ENV_VARS, *CODE_SIGNING_STORAGE_ENV_VARS)
+
+  sync_code_signing(
+    platform: 'macos',
+    app_identifier: APPLE_BUNDLE_IDENTIFIER,
+    team_id: APPLE_TEAM_ID,
+    api_key: app_store_connect_api_key,
+    type: 'development',
+    certificate_id: 'Apple Development: Created via API (886NX39KP6)',
+
+    storage_mode: 's3',
+    s3_region: 'us-east-2',
+    s3_bucket: 'a8c-fastlane-match',
+
+    readonly: readonly
+  )
+end
+
+
 # Utils
 
 def xcframework_checksum
@@ -463,3 +499,17 @@ def only_date_headers_changed?(file_path)
 
   changed_lines.all? { |l| l.include?('"POT-Creation-Date:') || l.include?('"PO-Revision-Date:') }
 end
+
+# Use this to ensure all env vars a lane requires are set.
+#
+# The best place to call this is at the start of a lane, to fail early.
+def require_env_vars!(*keys)
+  keys.each { |key| get_required_env!(key) }
+end
+
+# Use this instead of getting values from `ENV` directly. It will throw an error if the requested value is missing.
+def get_required_env!(key)
+  return ENV.fetch(key) if ENV.key?(key)
+
+  UI.user_error!("Environment variable `#{key}` is not set.")
+end

From 125ffca28404d66fd54ebb3e6b6ed41470632bca Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 13:23:35 +1100
Subject: [PATCH 02/15] Remove double blank line

---
 fastlane/Fastfile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 6cc7b6a40..2e7b9984e 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -431,7 +431,6 @@ lane :set_up_signing do |readonly: true|
   )
 end
 
-
 # Utils
 
 def xcframework_checksum

From 85b54edfef59d0d9d82f8d6aaa31b38332163c67 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 18:53:02 +1100
Subject: [PATCH 03/15] Use distribution certificate for XCFramework code
 signing

---
 Makefile          |  4 +++-
 fastlane/Fastfile | 54 +++++++++++++++++++++++++++++++++--------------
 2 files changed, 41 insertions(+), 17 deletions(-)

diff --git a/Makefile b/Makefile
index 913c8574d..215ded22b 100644
--- a/Makefile
+++ b/Makefile
@@ -16,6 +16,8 @@ swift_package_platform_ios = $(call swift_package_platform_version,ios)
 swift_package_platform_watchos = $(call swift_package_platform_version,watchos)
 swift_package_platform_tvos = $(call swift_package_platform_version,tvos)
 
+certificate_name_release = Apple Distribution: Automattic, Inc. (PZYM8XX95Q)
+
 # Required for supporting tvOS and watchOS. We can update the nightly toolchain version if needed.
 rust_nightly_toolchain := nightly-2025-07-29
 
@@ -138,7 +140,7 @@ xcframework-package-checksum:
 	swift package compute-checksum libwordpressFFI.xcframework.zip | tee libwordpressFFI.xcframework.zip.checksum.txt
 
 xcframework-sign:
-	codesign --timestamp -v --sign "Apple Development: Created via API (886NX39KP6)" target/libwordpressFFI.xcframework
+	codesign --timestamp -v --sign "${certificate_name_release}" target/libwordpressFFI.xcframework
 
 docker-image-web:
 	docker build -t wordpress-rs-web -f wp_rs_web/Dockerfile . --progress=plain
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 2e7b9984e..1655d64c6 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -26,7 +26,6 @@ GLOTPRESS_PROJECT_BASE_URL = 'https://translate.wordpress.com/projects/mobile/wo
 
 # Code Signing
 APPLE_TEAM_ID = 'PZYM8XX95Q'
-APPLE_BUNDLE_IDENTIFIER = 'com.automattic.hostmgr'
 
 ASC_API_KEY_ENV_VARS = %w[
   APP_STORE_CONNECT_API_KEY_KEY_ID
@@ -411,24 +410,20 @@ lane :generate_fluent_file_from_po do |file_path:|
   fluent_file_path
 end
 
-desc 'Download the development signing certificates to this machine'
+desc 'Downloads all code signing certificates'
 lane :set_up_signing do |readonly: true|
-  require_env_vars!(*ASC_API_KEY_ENV_VARS, *CODE_SIGNING_STORAGE_ENV_VARS)
-
-  sync_code_signing(
-    platform: 'macos',
-    app_identifier: APPLE_BUNDLE_IDENTIFIER,
-    team_id: APPLE_TEAM_ID,
-    api_key: app_store_connect_api_key,
-    type: 'development',
-    certificate_id: 'Apple Development: Created via API (886NX39KP6)',
+  set_up_signing_development(readonly: readonly)
+  set_up_signing_release(readonly: readonly)
+end
 
-    storage_mode: 's3',
-    s3_region: 'us-east-2',
-    s3_bucket: 'a8c-fastlane-match',
+desc 'Download the development signing certificates to this machine'
+lane :set_up_signing_development do |readonly: true|
+  set_up_certificate_in_keychain(type: 'development', readonly: readonly)
+end
 
-    readonly: readonly
-  )
+desc 'Download the release (distribution) signing certificates to this machine'
+lane :set_up_signing_release do |readonly: true|
+  set_up_certificate_in_keychain(type: 'appstore', readonly: readonly)
 end
 
 # Utils
@@ -512,3 +507,30 @@ def get_required_env!(key)
 
   UI.user_error!("Environment variable `#{key}` is not set.")
 end
+
+def set_up_certificate_in_keychain(type:, readonly:)
+  require_env_vars!(*ASC_API_KEY_ENV_VARS, *CODE_SIGNING_STORAGE_ENV_VARS)
+
+  # This will fetch the certificate and provisioning profile for the given type from remote storage.
+  # It will then set them up in the local keychain, where 'codesign' looks for identities.
+  #
+  # Notice we do not need the provisioning profile because we sign with 'codesign' elsewhere.
+  # However, there is no other way to set up the certificate in the keychain.
+  # Fastlane offers a tool called cert, but it only downloads certificates.
+  sync_code_signing(
+    team_id: APPLE_TEAM_ID,
+    api_key: app_store_connect_api_key,
+    type: type,
+    storage_mode: 's3',
+    s3_region: 'us-east-2',
+    s3_bucket: 'a8c-fastlane-match',
+    readonly: readonly,
+    # We need to provide an app identifier, but remember we only care about the certificate that gets downloaded.
+    # The identifier is used to find a provisioning profile, but we don't care about it.
+    #
+    # Similar rationale for the platform argument,
+    # with the addition that it's required to identify the existing provisioning profile for the given app id.
+    app_identifier: 'com.automattic.hostmgr',
+    platform: 'macos'
+  )
+end

From f11a9e185b554e606df9996d4b8936adce2056f8 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 18:54:56 +1100
Subject: [PATCH 04/15] Address a RuboCop string formatting violation

---
 fastlane/Fastfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 1655d64c6..479ee482e 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -246,7 +246,7 @@ lane :download_translations do |commit_changes: false|
     updated_fluent_files = []
 
     if downloaded_files.empty?
-      UI.message("No .po files were downloaded from GlotPress")
+      UI.message('No .po files were downloaded from GlotPress')
       next
     end
 

From 59885f28274122b84baaa94b1f36d22a96e0c23f Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 19:21:47 +1100
Subject: [PATCH 05/15] Add `setup_ci` call to Fastlane

---
 fastlane/Fastfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 479ee482e..b48091f6c 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -95,6 +95,11 @@ SUPPORTED_LOCALES = [
   { glotpress: 'zh-tw', project: 'zh-TW'  }
 ].freeze
 
+before_all do
+  # Fixes issues with keychain in CI
+  setup_ci
+end
+
 lane :release do |options|
   version = options[:version] || UI.user_error!('version is required')
   lane_context[LANE_VALUE_VERSION] = version

From 171a59b00e6a103c28263d054351548ccdabf852 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 19:34:16 +1100
Subject: [PATCH 06/15] Use `set_up_signing_release` in CI

---
 .buildkite/pipeline.yml | 2 +-
 .buildkite/release.sh   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 1a55bedd0..9fc5d6604 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -71,7 +71,7 @@ steps:
 
           echo "--- :swift: Building xcframework"
           install_gems
-          bundle exec fastlane set_up_signing
+          bundle exec fastlane set_up_signing_release
 
           make xcframework-package
           make xcframework-package-checksum
diff --git a/.buildkite/release.sh b/.buildkite/release.sh
index c06b26e3a..23f711211 100755
--- a/.buildkite/release.sh
+++ b/.buildkite/release.sh
@@ -22,7 +22,7 @@ echo "--- :rubygems: Setting up Gems"
 install_gems
 
 echo "--- :closed_lock_with_key: Setting up Code Signing"
-bundle exec fastlane set_up_signing
+bundle exec fastlane set_up_signing_release
 
 echo "--- :rust: Building XCFramework"
 make xcframework-package

From 0d05c8719cc48946cdab3bffe20a90bc2e19c380 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 19:34:40 +1100
Subject: [PATCH 07/15] Add more CI logs headers

Otherwise, looking at the logs without expanding them would make you
think the build is stuck on sync_code_signing.

See
https://buildkite.com/automattic/wordpress-rs/builds/4084/steps/canvas?sid=019a531b-f04b-4764-9cf7-673e189f3f26
---
 .buildkite/pipeline.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 9fc5d6604..31db1be58 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -69,10 +69,12 @@ steps:
           echo "--- :package: Installing Rust Toolchains"
           make setup-rust
 
-          echo "--- :swift: Building xcframework"
+          echo "--- :ruby: Installing Ruby tools"
           install_gems
+          echo "--- :xcode: Setting up code signing"
           bundle exec fastlane set_up_signing_release
 
+          echo "--- :swift: Building XCFramework"
           make xcframework-package
           make xcframework-package-checksum
           make xcframework-sign

From a007357131800caa1a04f971b69283f42cc5f571 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 20:51:10 +1100
Subject: [PATCH 08/15] Update `download-xcframework.sh` after changing ZIP
 location

---
 .buildkite/download-xcframework.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.buildkite/download-xcframework.sh b/.buildkite/download-xcframework.sh
index e7fb211c3..553514451 100755
--- a/.buildkite/download-xcframework.sh
+++ b/.buildkite/download-xcframework.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 echo "--- :arrow_down: Downloading xcframework"
-buildkite-agent artifact download target/libwordpressFFI.xcframework.zip . --step "xcframework"
+buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
 buildkite-agent artifact download 'native/swift/Sources/wordpress-api-wrapper/*.swift' . --step "xcframework"
-unzip target/libwordpressFFI.xcframework.zip -d .
-rm target/libwordpressFFI.xcframework.zip
+unzip libwordpressFFI.xcframework.zip -d .
+rm libwordpressFFI.xcframework.zip

From 2acadaa74bed532699d56a6f6523570fa54dda56 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 21:21:57 +1100
Subject: [PATCH 09/15] Temporarily also download XCFramework ZIP to target

---
 .buildkite/download-xcframework.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.buildkite/download-xcframework.sh b/.buildkite/download-xcframework.sh
index 553514451..0318278f6 100755
--- a/.buildkite/download-xcframework.sh
+++ b/.buildkite/download-xcframework.sh
@@ -4,6 +4,14 @@ set -euo pipefail
 
 echo "--- :arrow_down: Downloading xcframework"
 buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
+unzip libwordpressFFI.xcframework.zip -d .
+rm libwordpressFFI.xcframework.zip
+
 buildkite-agent artifact download 'native/swift/Sources/wordpress-api-wrapper/*.swift' . --step "xcframework"
+
+# Temporarily also download to target folder because some parts still expect it there
+mkdir -p ./target
+pushd target
+buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
 unzip libwordpressFFI.xcframework.zip -d .
 rm libwordpressFFI.xcframework.zip

From b0f6ab71b33e1e192a8443d8c4fbfd17bf8f0727 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Wed, 5 Nov 2025 21:46:16 +1100
Subject: [PATCH 10/15] Add `popd` following `pushd`

---
 .buildkite/download-xcframework.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.buildkite/download-xcframework.sh b/.buildkite/download-xcframework.sh
index 0318278f6..20298b2cd 100755
--- a/.buildkite/download-xcframework.sh
+++ b/.buildkite/download-xcframework.sh
@@ -15,3 +15,4 @@ pushd target
 buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
 unzip libwordpressFFI.xcframework.zip -d .
 rm libwordpressFFI.xcframework.zip
+popd

From 3408d29b3f61f4c84544cb4441ab182f93b1bebb Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Thu, 6 Nov 2025 14:33:01 +1100
Subject: [PATCH 11/15] Update `Makefile` to package XCFramework in target
 folder

See @crazytonyli's suggestion
https://github.com/Automattic/wordpress-rs/pull/966#discussion_r2496397070
---
 .buildkite/download-xcframework.sh | 13 ++++---------
 Makefile                           |  6 +++---
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/.buildkite/download-xcframework.sh b/.buildkite/download-xcframework.sh
index 20298b2cd..d32207f15 100755
--- a/.buildkite/download-xcframework.sh
+++ b/.buildkite/download-xcframework.sh
@@ -2,17 +2,12 @@
 
 set -euo pipefail
 
-echo "--- :arrow_down: Downloading xcframework"
-buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
-unzip libwordpressFFI.xcframework.zip -d .
-rm libwordpressFFI.xcframework.zip
-
-buildkite-agent artifact download 'native/swift/Sources/wordpress-api-wrapper/*.swift' . --step "xcframework"
-
-# Temporarily also download to target folder because some parts still expect it there
-mkdir -p ./target
+echo "--- :arrow_down: Downloading XCFramework"
 pushd target
 buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
 unzip libwordpressFFI.xcframework.zip -d .
 rm libwordpressFFI.xcframework.zip
 popd
+
+echo "--- :arrow_down: Downloading Native WordPress API Wrapper"
+buildkite-agent artifact download 'native/swift/Sources/wordpress-api-wrapper/*.swift' . --step "xcframework"
diff --git a/Makefile b/Makefile
index 215ded22b..e4c452b0b 100644
--- a/Makefile
+++ b/Makefile
@@ -133,11 +133,11 @@ xcframework: xcframework-all
 endif
 
 xcframework-package: xcframework-all
-	rm -rf libwordpressFFI.xcframework.zip
-	ditto -c -k --sequesterRsrc --keepParent target/libwordpressFFI.xcframework/ libwordpressFFI.xcframework.zip
+	rm -rf target/libwordpressFFI.xcframework.zip
+	ditto -c -k --sequesterRsrc --keepParent target/libwordpressFFI.xcframework/ target/libwordpressFFI.xcframework.zip
 
 xcframework-package-checksum:
-	swift package compute-checksum libwordpressFFI.xcframework.zip | tee libwordpressFFI.xcframework.zip.checksum.txt
+	swift package compute-checksum target/libwordpressFFI.xcframework.zip | tee libwordpressFFI.xcframework.zip.checksum.txt
 
 xcframework-sign:
 	codesign --timestamp -v --sign "${certificate_name_release}" target/libwordpressFFI.xcframework

From 69324fcd397a3c3f0efb503abe95d899bc395a1c Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Thu, 6 Nov 2025 14:59:21 +1100
Subject: [PATCH 12/15] Add required mkdir -p to download script

---
 .buildkite/download-xcframework.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.buildkite/download-xcframework.sh b/.buildkite/download-xcframework.sh
index d32207f15..29b4f28c9 100755
--- a/.buildkite/download-xcframework.sh
+++ b/.buildkite/download-xcframework.sh
@@ -3,6 +3,7 @@
 set -euo pipefail
 
 echo "--- :arrow_down: Downloading XCFramework"
+mkdir -p target
 pushd target
 buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
 unzip libwordpressFFI.xcframework.zip -d .

From 1e634c7a5f7012a6d112990df8b12bb4b894da36 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Thu, 6 Nov 2025 17:50:51 +1100
Subject: [PATCH 13/15] Update XCFramework path to reflect restored `target/`
 dir

---
 .buildkite/pipeline.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 31db1be58..37c4a9b77 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -80,8 +80,8 @@ steps:
           make xcframework-sign
 
         artifact_paths:
-          - libwordpressFFI.xcframework.zip
-          - libwordpressFFI.xcframework.zip.checksum.txt
+          - target/libwordpressFFI.xcframework.zip
+          - target/libwordpressFFI.xcframework.zip.checksum.txt
           - native/swift/Sources/wordpress-api-wrapper/*.swift
         plugins: [$CI_TOOLKIT]
         agents:

From 23acaeae7543dfff79fc6c65b642aae476e3f3f7 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Thu, 6 Nov 2025 18:56:38 +1100
Subject: [PATCH 14/15] Fix download script one last time

---
 .buildkite/download-xcframework.sh | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.buildkite/download-xcframework.sh b/.buildkite/download-xcframework.sh
index 29b4f28c9..44fac63e9 100755
--- a/.buildkite/download-xcframework.sh
+++ b/.buildkite/download-xcframework.sh
@@ -3,12 +3,9 @@
 set -euo pipefail
 
 echo "--- :arrow_down: Downloading XCFramework"
-mkdir -p target
-pushd target
-buildkite-agent artifact download libwordpressFFI.xcframework.zip . --step "xcframework"
-unzip libwordpressFFI.xcframework.zip -d .
-rm libwordpressFFI.xcframework.zip
-popd
+buildkite-agent artifact download target/libwordpressFFI.xcframework.zip . --step "xcframework"
+unzip target/libwordpressFFI.xcframework.zip -d .
+rm target/libwordpressFFI.xcframework.zip
 
 echo "--- :arrow_down: Downloading Native WordPress API Wrapper"
 buildkite-agent artifact download 'native/swift/Sources/wordpress-api-wrapper/*.swift' . --step "xcframework"

From 28b8ffd7e52ec35b86c7a44acf2b31a04a9481b7 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Thu, 6 Nov 2025 20:30:34 +1100
Subject: [PATCH 15/15] Unzip in `./target/` (?)

---
 .buildkite/download-xcframework.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.buildkite/download-xcframework.sh b/.buildkite/download-xcframework.sh
index 44fac63e9..5d60e6c8e 100755
--- a/.buildkite/download-xcframework.sh
+++ b/.buildkite/download-xcframework.sh
@@ -4,7 +4,8 @@ set -euo pipefail
 
 echo "--- :arrow_down: Downloading XCFramework"
 buildkite-agent artifact download target/libwordpressFFI.xcframework.zip . --step "xcframework"
-unzip target/libwordpressFFI.xcframework.zip -d .
+mkdir -p ./target/
+unzip target/libwordpressFFI.xcframework.zip -d ./target/
 rm target/libwordpressFFI.xcframework.zip
 
 echo "--- :arrow_down: Downloading Native WordPress API Wrapper"