MetatroncubeSoftwareSolutions/nkbmusic
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Codemagic: pass the iOS certificate key base64-encoded and stop on signing errors

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
metatroncubeswdev 2026-10-31 15:15:32 -04:00
parent b966b6c45e
commit db6abdefd3
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
codemagic.yaml
View File

@ -3,7 +3,7 @@
# Needed in Codemagic (Team settings / app settings): # Needed in Codemagic (Team settings / app settings):
# - Environment variable group "nk_app": SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, MEDIA_BASE_URL # - Environment variable group "nk_app": SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, MEDIA_BASE_URL
# - App Store Connect API key integration "clickstocart-app" (Developer Portal) (iOS) # - App Store Connect API key integration "clickstocart-app" (Developer Portal) (iOS)
# - Variable CERTIFICATE_PRIVATE_KEY (secure) in group "nk_ios_signing" (iOS signing) # - Variable CERTIFICATE_PRIVATE_KEY_BASE64 (secure) in group "nk_ios_signing" (iOS signing)
# - Android keystore uploaded with reference name "nk_upload_keystore" (Android) # - Android keystore uploaded with reference name "nk_upload_keystore" (Android)
# - Variable GCLOUD_SERVICE_ACCOUNT_CREDENTIALS in group "nk_google_play" (Android publishing) # - Variable GCLOUD_SERVICE_ACCOUNT_CREDENTIALS in group "nk_google_play" (Android publishing)
@ -42,7 +42,7 @@ workflows:
environment: environment:
groups: groups:
- nk_app - nk_app
- nk_ios_signing # CERTIFICATE_PRIVATE_KEY (secure) - nk_ios_signing # CERTIFICATE_PRIVATE_KEY_BASE64 (secure)
vars: vars:
BUNDLE_ID: com.metatroncubesolutions.nangaKathai BUNDLE_ID: com.metatroncubesolutions.nangaKathai
flutter: stable flutter: stable
@ -57,9 +57,12 @@ workflows:
- *write_env - *write_env
- *checks - *checks
# Fetches the Apple Distribution certificate and App Store profile through the API key, # Fetches the Apple Distribution certificate and App Store profile through the API key,
# creating them on the first run. CERTIFICATE_PRIVATE_KEY is the certificate's key. # creating them on the first run. The certificate's private key is stored base64-encoded
# on one line, because multi-line values lose their line breaks when pasted into Codemagic.
- name: Set up App Store code signing - name: Set up App Store code signing
script: | script: |
set -e
export CERTIFICATE_PRIVATE_KEY="$(echo "$CERTIFICATE_PRIVATE_KEY_BASE64" | base64 --decode)"
keychain initialize keychain initialize
app-store-connect fetch-signing-files "$BUNDLE_ID" --type IOS_APP_STORE --create app-store-connect fetch-signing-files "$BUNDLE_ID" --type IOS_APP_STORE --create
keychain add-certificates keychain add-certificates

4
docs/app-store-release.md
View File

@ -28,8 +28,8 @@ each store release. Build numbers are set automatically by Codemagic.
- In Codemagic, open Team settings > Team integrations > Developer Portal and add the key with the name **`clickstocart-app`** (already added; it works for every app in the Apple team). - In Codemagic, open Team settings > Team integrations > Developer Portal and add the key with the name **`clickstocart-app`** (already added; it works for every app in the Apple team).
3. **iOS signing (automatic).** The build creates the Apple Distribution certificate and the App 3. **iOS signing (automatic).** The build creates the Apple Distribution certificate and the App
Store profile itself through the API key, so no profiles are made by hand. Store profile itself through the API key, so no profiles are made by hand.
- Create a variable group **`nk_ios_signing`** with `CERTIFICATE_PRIVATE_KEY` (secure). - Create a variable group **`nk_ios_signing`** with `CERTIFICATE_PRIVATE_KEY_BASE64` (secure).
- Its value is the full contents of `C:\Users\manes\nk-keys\ios_distribution_private_key`, including the BEGIN and END lines. - Its value is the one line in `C:\Users\manes\nk-keys\ios_distribution_private_key.base64.txt`.
- The API key needs the **Admin** role, or App Manager with access to Certificates, Identifiers & Profiles. - The API key needs the **Admin** role, or App Manager with access to Certificates, Identifiers & Profiles.
- Apple allows only a few distribution certificates per team. If the limit is reached, revoke an unused one on developer.apple.com. - Apple allows only a few distribution certificates per team. If the limit is reached, revoke an unused one on developer.apple.com.
4. **Android signing.** On the same page, under Android keystores, upload 4. **Android signing.** On the same page, under Android keystores, upload