jackson

Great breakdown, this matches my experience almost exactly, just with a different piece of CI. I went with GitHub Actions (macos-latest runners) + Fastlane instead of EAS, mainly to avoid the build queue times and to keep the signing config in a repo I own rather than tied to an Expo account. Fastlane match handles certs/profiles headlessly, similar idea to what EAS does for you, just self-hosted. Packaged it into a pipeline called Macless (macless.dev) since getting the Fastlane match setup right the first time was the fiddly part. The certificate objection is the right one to lead with, it's the thing that scares people off before they even try.

Useful breakdown of the P12/provisioning profile pieces. Worth mentioning for anyone who'd rather not pay for a separate Windows tool: GitHub Actions gives free macOS build minutes on public repos, so you can run the actual xcodebuild archive/export/upload steps there instead. No Mac needed and no tool subscription, though it's a scripted GitHub Actions workflow instead of a GUI. Built mine into a packaged template at macless.dev if that tradeoff sounds better for your setup.