[EPAC-2080]: fix TestFlight build failing on main#606
Merged
riddim-developer-bot[bot] merged 1 commit intoMay 25, 2026
Merged
Conversation
…o AWS Secrets Manager Three release scripts (resolve_build_id.py, wait_for_build_processed.py, attach_build_to_group.py) unconditionally called AWS Secrets Manager for App Store Connect credentials. The production TestFlight workflow provides these via GitHub secrets, not AWS, so the Secrets Manager call fails with exit 255. Add get_asc_credentials() to each script — checks ASC_KEY_ID, ASC_ISSUER_ID, and ASC_PRIVATE_KEY / ASC_KEY_PATH env vars first, matching the pattern already used by submit_beta_app_review.py. Export ASC_KEY_PATH from both the workflow and fetch_asc_secret.sh so downstream steps can locate the .p8 file.
riddim-developer-bot
Bot
added
the
autonomous
riddim-developer-bot
Bot
added
the
autonomous
riddim-developer-bot
Bot
deleted the
symphony/epac-2080-ci-testflight-build-failing-on-main
branch
May 25, 2026 19:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The TestFlight Build workflow on main fails at the "Resolve TestFlight build ID"
step because
resolve_build_id.pyunconditionally calls AWS Secrets Manager forApp Store Connect credentials. The production workflow provides these via GitHub
secrets (written to env vars +
.p8file), not AWS — so theaws secretsmanagercall fails with exit code 255.
The same bug exists in
wait_for_build_processed.pyandattach_build_to_group.py. A fourth script,submit_beta_app_review.py,already had the correct pattern: check env vars first, fall back to AWS.
Failed run: https://github.com/RiddimSoftware/epac/actions/runs/26416412212
What changed
Added
get_asc_credentials()toresolve_build_id.py,wait_for_build_processed.py, andattach_build_to_group.py. The functionchecks
ASC_KEY_ID+ASC_ISSUER_ID+ASC_PRIVATE_KEYenv vars first,then
ASC_KEY_PATH(reads the.p8file), then falls back to AWS SecretsManager. This matches
submit_beta_app_review.py's existing pattern.Exported
ASC_KEY_PATHfrom the "Write App Store Connect credentials" stepin
testflight-build.ymlso downstream steps can locate the.p8filewithout hardcoding the path or calling AWS.
Also exported
ASC_KEY_PATHfromfetch_asc_secret.sh(used by the stagingworkflow) for consistency.
Trade-offs not taken
get_asc_credentials()into a shared module. Four scripts nowhave the same function — a future cleanup can deduplicate, but this fix keeps
the change minimal and scoped to the CI failure.
Test plan
actionlint .github/workflows/testflight-build.yml— passespython3 -m pytest scripts/release/test_wait_for_build_processed.py scripts/release/test_attach_build_to_group.py— 10/10 passSkipped checks
GitHub Actions secrets and the macOS runner. The workflow must validate the
fix by re-running on main after merge.
Resolves EPAC-2080
Reviewer-Boundary: review-only
Estimate was missing from the Linear issue; treated as the standard 8 complexity tier.