Repository navigation
ci: notarize macOS builds with an App Store Connect API key - #297
Open
sourya-deepsource wants to merge 2 commits into
Open
sourya-deepsource wants to merge 2 commits into
sourya-deepsource wants to merge 2 commits into
Conversation
Notarization authenticated with an Apple ID + app-specific password. That password stopped being accepted (401 "not allowed for primary authentication"), which failed the v2.0.56 prod deploy. App-specific passwords are revoked whenever the Apple ID's password changes, so switch to a Team API key, which isn't tied to a person's account. Requires the APPLE_API_KEY_BASE64, APPLE_API_KEY_ID and APPLE_API_ISSUER_ID secrets. APPLE_ID, APPLE_TEAM_ID and APPLE_APP_PASSWORD are no longer used. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> AI-Session-Id: 526ae2dd-8c0f-4ca0-b4ca-f1994b0e48e5 AI-Tool: claude-code AI-Model: unknown
 |
|
Overall Grade |
Security Reliability Complexity Hygiene Coverage  |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Go |  |
Oct 30, 2026 5:31a.m. | Review ↗ |
| Secrets | |
Oct 30, 2026 5:31a.m. | Review ↗ |
| Code coverage | |
Oct 30, 2026 5:31a.m. | Review ↗ |
Code Coverage Summary
| Language | Line Coverage (Overall) |
|---|---|
| Aggregate | 25.4% |
| Go | 25.4% [✓ above threshold] |
➟ Additional coverage metrics may have been reported. See full coverage report ↗
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> AI-Session-Id: 526ae2dd-8c0f-4ca0-b4ca-f1994b0e48e5 AI-Tool: claude-code AI-Model: unknown
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v2.0.56 prod deploy failed at Notarize (run):
Notarization used an Apple ID + app-specific password. The secrets haven't changed since 2026-01-28 and worked through v2.0.55 (2026-04-03), so Apple has since stopped accepting the password. Apple revokes app-specific passwords whenever the Apple ID's password changes. This switches
notarytoolto an App Store Connect Team API key, which isn't tied to a person's account.Merge only after these repo secrets exist (otherwise the next prod deploy fails at the same step):
APPLE_API_KEY_BASE64: base64 of the.p8keyAPPLE_API_KEY_IDAPPLE_API_ISSUER_IDAlso bumps
VERSIONto 2.0.57: v2.0.56 is tagged on the commit before this change and was never published. After merging,just deploy-prodfrommasterships 2.0.57 with the new step.After 2.0.57 notarizes,
APPLE_ID,APPLE_TEAM_IDandAPPLE_APP_PASSWORDcan be deleted; nothing else uses them.Dev tags skip this step and are unaffected. Flags were checked against local
notarytool; the step itself can only be exercised by a prod tag.🤖 Generated with Claude Code