From 4cc55484368b92a8528cc806384077f74c35a307 Mon Sep 17 00:00:00 2001 From: Sourya Vatsyayan Date: Fri, 30 Oct 2026 10:51:15 +0530 Subject: [PATCH 1/2] ci: notarize macOS builds with an App Store Connect API key Notarization authenticated with an Apple ID + app-specific password. That password stopped being accepted (401 "not allowed for primary authentication"), which failed the v2.0.56 prod deploy. App-specific passwords are revoked whenever the Apple ID's password changes, so switch to a Team API key, which isn't tied to a person's account. Requires the APPLE_API_KEY_BASE64, APPLE_API_KEY_ID and APPLE_API_ISSUER_ID secrets. APPLE_ID, APPLE_TEAM_ID and APPLE_APP_PASSWORD are no longer used. Co-Authored-By: Claude Opus 5.5 AI-Session-Id: 526ae2dd-8c0f-4ca0-b4ca-f1994b0e48e5 AI-Tool: claude-code AI-Model: unknown --- .github/workflows/build-and-deploy.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml index e6014f40..b6e48973 100644 --- a/.github/workflows/build-and-deploy.yml +++ b/.github/workflows/build-and-deploy.yml @@ -139,18 +139,22 @@ jobs: - name: Notarize if: needs.resolve-env.outputs.environment == 'prod' env: - APPLE_ID: ${{ secrets.APPLE_ID }} - APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} - APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }} + APPLE_API_KEY_BASE64: ${{ secrets.APPLE_API_KEY_BASE64 }} + APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} + APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }} run: | BINARY_NAME="${{ needs.resolve-env.outputs.binary_name }}" + # Write App Store Connect API key + KEY_PATH="$RUNNER_TEMP/AuthKey.p8" + echo "$APPLE_API_KEY_BASE64" | base64 --decode > "$KEY_PATH" + # Create zip for notarization ditto -c -k "cmd/deepsource/${BINARY_NAME}" notarize.zip xcrun notarytool submit notarize.zip \ - --apple-id "$APPLE_ID" \ - --team-id "$APPLE_TEAM_ID" \ - --password "$APPLE_APP_PASSWORD" \ + --key "$KEY_PATH" \ + --key-id "$APPLE_API_KEY_ID" \ + --issuer "$APPLE_API_ISSUER_ID" \ --wait - name: Verify signing From 84e5dd8cd83e06eb17a9fbd6bf663ed2a3904bb9 Mon Sep 17 00:00:00 2001 From: Sourya Vatsyayan Date: Fri, 30 Oct 2026 11:00:54 +0530 Subject: [PATCH 2/2] Bump version to 2.0.57 Co-Authored-By: Claude Opus 5.5 AI-Session-Id: 526ae2dd-8c0f-4ca0-b4ca-f1994b0e48e5 AI-Tool: claude-code AI-Model: unknown --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 112f305b..c6f8e3ff 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.0.56 +2.0.57