From 0b1785246c50ca4c38c0befd9643cc111d54095e Mon Sep 17 00:00:00 2001 From: Baldri Date: Fri, 3 Jul 2026 09:28:55 +0200 Subject: [PATCH] ci(release): base64-armor Apple API key, key-id/issuer from secrets The raw-PEM secret transport produced 401s at Apple (key material mismatch); base64-encoding the .p8 makes the transport byte-exact. Key ID and issuer move from hardcoded values to secrets so key rotation needs no workflow change. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b4205d6..1b0e4ad 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -206,15 +206,15 @@ jobs: - name: Setup macOS signing & notarization if: runner.os == 'macOS' env: - APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }} + APPLE_API_KEY_P8_B64: ${{ secrets.APPLE_API_KEY_P8_B64 }} run: | - printf '%s' "$APPLE_API_KEY_P8" > "$RUNNER_TEMP/AuthKey.p8" + printf '%s' "$APPLE_API_KEY_P8_B64" | base64 -d > "$RUNNER_TEMP/AuthKey.p8" { echo "CSC_LINK=${{ secrets.CSC_LINK }}" echo "CSC_KEY_PASSWORD=${{ secrets.CSC_KEY_PASSWORD }}" echo "APPLE_API_KEY=$RUNNER_TEMP/AuthKey.p8" - echo "APPLE_API_KEY_ID=CULSWP7496" - echo "APPLE_API_ISSUER=2e60499e-ced7-40e9-9481-3556fdb7ff36" + echo "APPLE_API_KEY_ID=${{ secrets.APPLE_API_KEY_ID }}" + echo "APPLE_API_ISSUER=${{ secrets.APPLE_API_ISSUER }}" } >> "$GITHUB_ENV" - name: Package and publish Electron app