Use ASC API key env vars - #3951
Merged
mokagio merged 5 commits intoJul 6, 2026
Merged
Conversation
Read App Store Connect credentials through fastlane's built-in environment variable support instead of the JSON key previously materialized by `.configure`. This aligns Studio with the recent AutoProxxy, wpiOS, and WooCommerce iOS migrations, and removes obsolete encrypted secret files from the repo. Readonly certificate fetches continue to use match's S3 storage without App Store Connect access; notarization now reads the standard `APP_STORE_CONNECT_API_KEY_*` trio from the agent environment. --- Generated with the help of Codex, https://chatgpt.com/codex Co-Authored-By: Codex GPT-5 <noreply@openai.com>
…-json-for-asc-api-key-in
Comment on lines
66
to
70
| sync_code_signing( | ||
| platform: 'macos', | ||
| app_identifier: APPLE_BUNDLE_IDENTIFIER, | ||
| team_id: APPLE_TEAM_ID, | ||
| type: 'developer_id', |
Contributor
There was a problem hiding this comment.
I think this makes sense? 🤔
Contributor
Author
There was a problem hiding this comment.
At first, I thought that no, this was overly cautious because the lane hardcodes readonly: true so the API key will not be used.
But, thinking about it, maybe it makes sense to future proof so that if we ever want to pass readonly: false, the code already knows how to handle the API key correctly.
Comment on lines
79
to
83
| Dir[File.join(BUILDS_FOLDER, '**', 'Studio.app')].each do |path| | ||
| notarize( | ||
| package: path, | ||
| api_key_path: APPLE_API_KEY_PATH, | ||
| api_key: app_store_connect_api_key, | ||
| print_log: true |
mokagio
enabled auto-merge (squash)
July 6, 2026 05:11
…-json-for-asc-api-key-in
Collaborator
📊 Performance Test ResultsComparing 70c2a60 vs trunk app-size
site-editor
site-startup
Results are median values from multiple test runs. Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff) |
mokagio
deleted the
ainfra-228-use-env-var-instead-of-encrypted-json-for-asc-api-key-in
branch
July 6, 2026 05:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issues
How AI was used in this PR
Codex applied the same App Store Connect credential migration pattern used in recent WordPress iOS, and WooCommerce iOS changes.
Proposed Changes
APP_STORE_CONNECT_API_KEY_*environment variables. Better because removes an encrypted file from the repo.Testing Instructions
The macOS builds succeed in CI:
Pre-merge Checklist