Restore Sparkle notarization credentials from Fleet-OPS Infisical

.github/workflows/ios-ship-contract.yml

@@ -14,6 +14,8 @@ on:
       - '.github/workflows/ios-ship*.yml'
       - 'ios/CodeCapsCompanion/project.yml'
       - 'scripts/ios-*'
+      - 'scripts/infisical-fetch*.mjs'
+      - 'scripts/stage-asc-key*'
       - 'scripts/ios-fleet/**'
       - 'scripts/test-ios-stage-asc-key.sh'
   push:
@@ -22,6 +24,8 @@ on:
       - '.github/workflows/ios-ship*.yml'
       - 'ios/CodeCapsCompanion/project.yml'
       - 'scripts/ios-*'
+      - 'scripts/infisical-fetch*.mjs'
+      - 'scripts/stage-asc-key*'
       - 'scripts/ios-fleet/**'
       - 'scripts/test-ios-stage-asc-key.sh'
   workflow_dispatch:
@@ -42,6 +46,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Pin the auto-ship wiring
         run: |
-          node --test scripts/ios-ship-workflow.test.mjs
+          node --test scripts/ios-ship-workflow.test.mjs scripts/stage-asc-key.node-test.mjs scripts/infisical-fetch-expand.node-test.mjs scripts/ios-enable-apns.test.mjs
           bash scripts/ios-fleet/test-asc-credentials.sh
           node --test scripts/ios-fleet/test-asc-credentials.mjs

.github/workflows/ios-ship.yml

@@ -22,8 +22,10 @@ name: iOS TestFlight ship (GitHub-hosted macOS)
 #     Usage-Monitor read it.  The same-named repository secrets are a stale
 #     copy that App Store Connect answers with HTTP 401 (CC-163), so they are
 #     deliberately not read here and there is no fallback to them.
-#   * The multiline key never enters GITHUB_ENV: scripts/ios-stage-asc-key.sh
-#     writes it to a mode-600 file and only the path crosses steps.
+#   * The multiline key never enters the step environment.
+#     The tooling and scripts/stage-asc-key.mjs run in one step, so the key
+#     goes from the fleet's reader straight into a mode-600 file, and only
+#     that file's path and the two identifiers cross a step boundary.
 #   * IOS_DIST_P12_BASE64 / IOS_DIST_P12_PASSWORD (Apple Distribution identity)
 #     stay repository secrets.
 #   * SENTRY_DSN and SENTRY_AUTH_TOKEN are best-effort: an inert Sentry beats a
@@ -74,6 +76,8 @@ on:
       - '.github/workflows/ios-ship.yml'
       - '.github/actions/infisical-secrets/**'
       - 'scripts/infisical-fetch.mjs'
+      - 'scripts/install-release-secrets-tooling.sh'
+      - 'scripts/stage-asc-key*'
       - 'scripts/ios-fleet/**'
       - '!scripts/ios-fleet/test-*.sh'
       - 'scripts/ios-ship-testflight.sh'
@@ -212,87 +216,43 @@ jobs:
       # ASC key from Fleet-OPS prod /asc.  ASC_KEY_ID and ASC_ISSUER_ID are
       # single-line and go to GITHUB_ENV; the multiline private key is staged
       # to a mode-600 file and only ASC_KEY_PATH is exported.
-      - name: Load ASC credentials (Fleet-OPS prod /asc)
+      #
+      # The tooling and the staging script run in ONE step on purpose.  The
+      # tooling installs the Infisical CLI and the fleet's reader onto the
+      # runner, mints the access token they use, and runs the staging script
+      # in the same process tree, so the token never touches a file.  The
+      # staging script is what resolves the three ASC values, and it writes
+      # the private key to a mode-600 file: the key is never an environment
+      # variable of a step, and only that file's path and the two identifiers
+      # cross a step boundary.
+      #
+      # The staging script runs even when the install fails, because it is
+      # what removes any key-bearing entry from the job's environment file,
+      # and the step reports the status of the command that actually failed.
+      - name: Load and stage the ASC credentials (Fleet-OPS prod /asc)
         env:
-          ASC_INFISICAL_PROJECT_ID: 8dae6d03-8f12-48b2-adf3-e5c1b881c8c5
-          INFISICAL_UNIVERSAL_AUTH_CLIENT_ID: ${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID }}
-          INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET: ${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET }}
-          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
-          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
+          INFISICAL_PROJECT_ID: ${{ secrets.INFISICAL_FLEET_OPS_PROJECT_ID }}
+          INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID || secrets.INFISICAL_CLIENT_ID }}
+          INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET || secrets.INFISICAL_CLIENT_SECRET }}
         run: |
           set +o xtrace
           set -euo pipefail
-          export INFISICAL_DISABLE_UPDATE_CHECK=true
-
-          if ! command -v infisical >/dev/null 2>&1; then
-            NONINTERACTIVE=1 HOMEBREW_NO_AUTO_UPDATE=1 brew install infisical/get-cli/infisical
-          fi
-          command -v infisical >/dev/null 2>&1 || {
-            echo "::error::Infisical CLI is not installed."
-            exit 1
-          }
-
-          CLIENT_ID="${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID}"
-          CLIENT_SECRET="${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET}"
-          if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
-            CLIENT_ID="${INFISICAL_CLIENT_ID}"
-            CLIENT_SECRET="${INFISICAL_CLIENT_SECRET}"
-          fi
-          if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then
-            echo "::error::Missing Infisical machine identity.  Set INFISICAL_UNIVERSAL_AUTH_CLIENT_ID/SECRET (fallback INFISICAL_CLIENT_ID/SECRET) on the org or repo."
-            exit 1
-          fi
-
-          TOKEN="$(
-            env -u INFISICAL_CLIENT_ID -u INFISICAL_CLIENT_SECRET -u INFISICAL_TOKEN \
-              INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$CLIENT_ID" \
-              INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$CLIENT_SECRET" \
-              infisical login --method=universal-auth --silent --plain --telemetry=false 2>/dev/null || true
-          )"
-          if [ -z "$TOKEN" ]; then
-            echo "::error::Infisical universal-auth login failed."
-            exit 1
-          fi
-          if [[ "$TOKEN" == *$'\n'* || "$TOKEN" == *$'\r'* ]]; then
-            echo '::error::Infisical returned a multiline token.' >&2
-            exit 1
-          fi
-          printf '::add-mask::%s\n' "${TOKEN//'%'/'%25'}"
+          bash scripts/install-release-secrets-tooling.sh
 
+      - name: Check the ASC credentials arrived
+        run: |
+          set +o xtrace
+          set -euo pipefail
           for name in ASC_KEY_ID ASC_ISSUER_ID; do
-            val="$(
-              INFISICAL_TOKEN="$TOKEN" infisical secrets get "$name" \
-                --plain --silent --telemetry=false --expand=false \
-                --projectId="$ASC_INFISICAL_PROJECT_ID" --env=prod --path=/asc \
-                2>/dev/null || true
-            )"
-            if [ -z "$val" ]; then
-              echo "::error::Missing $name in Fleet-OPS prod /asc; verify the CI identity has read access to project ${ASC_INFISICAL_PROJECT_ID} path /asc." >&2
+            if [ -z "${!name:-}" ]; then
+              echo "::error::Missing $name in Fleet-OPS prod /asc; verify the CI identity has read access to Fleet-OPS prod /asc." >&2
               exit 1
             fi
-            if [[ "$val" == *$'\n'* || "$val" == *$'\r'* ]]; then
-              echo "::error::Signing field $name must be single-line; correct Infisical formatting." >&2
-              exit 1
-            fi
-            printf '::add-mask::%s\n' "${val//'%'/'%25'}"
-            printf '%s=%s\n' "$name" "$val" >> "$GITHUB_ENV"
           done
-
-          # Keep the multiline PEM out of GITHUB_ENV and every later step
-          # environment.  Only its mode-600 file path crosses the step boundary.
-          key_material="$(
-            INFISICAL_TOKEN="$TOKEN" infisical secrets get ASC_KEY_P8 \
-              --plain --silent --telemetry=false --expand=false \
-              --projectId="$ASC_INFISICAL_PROJECT_ID" --env=prod --path=/asc \
-              2>/dev/null || true
-          )"
-          if [ -z "$key_material" ]; then
-            echo "::error::Missing ASC key material in Fleet-OPS prod /asc; verify the CI identity has read access to project ${ASC_INFISICAL_PROJECT_ID} path /asc." >&2
+          if [ -z "${ASC_KEY_PATH:-}" ] || [ ! -s "${ASC_KEY_PATH:-}" ]; then
+            echo '::error::Missing ASC key material in Fleet-OPS prod /asc; verify the CI identity has read access to Fleet-OPS prod /asc.' >&2
             exit 1
           fi
-          printf '%s\n' "$key_material" | bash "$GITHUB_WORKSPACE/scripts/ios-stage-asc-key.sh"
-          unset key_material TOKEN CLIENT_ID CLIENT_SECRET val
-
       - name: Import signing identity
         env:
           IOS_DIST_P12_BASE64: ${{ secrets.IOS_DIST_P12_BASE64 }}