Github action macos keychain access

Question

I'm trying to move our iOS CI over to github actions but I'm running into some build issues . These issues (fastlane just hangs when gym runs) seem to arise when using match.

Here's the log that makes me think it's keychain related

WARN [2019-09-26 13:46:14.52]: Could not configure imported keychain item (certificate) to prevent UI permission popup when code signing
Check if you supplied the correct `keychain_password` for keychain: `/Users/runner/Library/Keychains/login.keychain-db`
security: SecKeychainItemSetAccessWithPassword: The user name or passphrase you entered is not correct.

The docs say sudo is passwordless so I assumed the same for keychain. I seem to be wrong but I can't find anything in the docs for it. Any help would be greatly appreciated.

EDIT

Lyndsey Ferguson's comment below is mostly the solution. They're approach of using create_keychain and then match I was able to just specify the keychain and it's password so I was able to avoid import_certificate

EDIT 2

Here's what I'm doing in fastlane to get around this

create_keychain(
        name: "actiontest_keychain",
        password: "meow",
        default_keychain: true,
        unlock: true,
        timeout: 3600,
        lock_when_sleeps: false
    )

    match(
        type: "appstore",
        readonly: is_ci,
        keychain_name: "actiontest_keychain",
        keychain_password: "meow"
    )

Answer 1

Maybe it is a little late, but I think it is worth mentioning that there is a handy fastlane action setup_ci for this purpose:

Description

Setup the keychain and match to work with CI

• Creates a new temporary keychain for use with match
• Switches match to readonly mode to not create new profiles/cert on CI
• Sets up log and test result paths to be easily collectible

Just add this to the top of your Fastfile or within a specific lane if you use CI.

Fastfile lane Example

lane :build_release do
    setup_ci

    sync_code_signing(  
      type: "appstore",
      readonly: is_ci
    )

    build_app
end

Also make sure, your provisioning profiles and certificates within your match storage are up to date and you configured manual signing for release build. Otherwise match will maybe try to sign your app with wrong signing identities which will fail ;)