github-featured / momenbasel--puremac

发布

0 发布 29 Git 标签

RSS 订阅源
  • v2.2.0 d9db708067
    比较

    ci: switch notarization to App Store Connect API key

    frostbyte_neo 发布于 2026-05-14 22:27:21 +00:00

    Drops the legacy --apple-id + app-specific-password flow in favor of the
    modern --key + --key-id + --issuer notarytool path:

    • No app-specific password rotation
    • Scoped to one team via the issuer UUID (less blast radius)
    • The .p8 file is short-lived in CI ($RUNNER_TEMP, chmod 600, rm in cleanup)
    • Aligns with the local AC_NOTARY keychain profile already stored on dev

    Three secrets replace the previous APPLE_ID + APPLE_APP_PASSWORD pair:
    APP_STORE_CONNECT_KEY_ID (10-char)
    APP_STORE_CONNECT_ISSUER_ID (UUID)
    APP_STORE_CONNECT_PRIVATE_KEY (full .p8 contents)

    scripts/release-local.sh now takes an optional notary profile name
    (defaults to AC_NOTARY) and uses --keychain-profile so it inherits the
    locally stored credential rather than requiring env vars.

    scripts/SECRETS.md rewritten end-to-end: one-shot p12 extraction recipe
    that filters out non-Developer-ID identities (so a leaked p12 cannot be
    used to sign with Apple Distribution / Apple Development), and a
    ready-to-paste gh CLI block for all six secrets.

    下载附件