What are the main ways to run iOS CI/CD (Xcode Cloud, GitHub Actions, Fastlane, others), and what do they all call underneath?

Every option ends in the same command-line tools, so learn those first. xcodebuild builds and tests (build-for-testing, test-without-building), and releases use two steps: xcodebuild archive -archivePath … produces an .xcarchive, then xcodebuild -exportArchive -archivePath … -exportOptionsPlist ExportOptions.plist -exportPath … produces the signed .ipa for the chosen method (app-store, ad hoc, development). Signing can be automated with an App Store Connect API key (-allowProvisioningUpdates with -authenticationKeyPath, -authenticationKeyID and -authenticationKeyIssuerID), which avoids storing an Apple ID password; the check below confirms those options exist. Mac apps are notarised with xcrun notarytool (store-credentials, submit, history), and uploads to App Store Connect go through Xcode’s upload step, the App Store Connect API or Transporter (check Apple’s current guidance on older command-line upload tools).

The tools differ in how much they wrap that. Xcode Cloud is Apple’s hosted CI: workflows defined in Xcode and App Store Connect, signing managed by Apple’s cloud, direct TestFlight integration, simple to start with and less flexible for unusual steps. GitHub Actions (or GitLab, Bitrise, Jenkins, CircleCI) give you a general runner: hosted macOS machines or your own, full control over steps and caching, and you handle signing and secrets yourself. Fastlane is a Ruby toolbox that scripts the repetitive parts as lanes: gym (build and export), scan (test), match (certificates and profiles in an encrypted repository), pilot (TestFlight), deliver (metadata and submission) and it runs inside any CI. Choose by control and cost: start with the simplest that handles your signing and TestFlight upload, keep the logic in versioned scripts rather than in the CI provider’s UI so you can run a release locally, and pin the Xcode version so builds do not change when the runner image does.