[jaywedgeworth22]

Fixes log exposure of the App Store Connect signing key by masking secrets before they are persisted to GITHUB_ENV.

• In ios-ship.yml, masks every line of the raw PEM individually — a single multiline add-mask only covers the first line — and computes the base64 APPLE_API_KEY_P8_BASE64 value into key_b64 and masks it before writing it to GITHUB_ENV, since GitHub prints later steps' env blocks in the public log. Clears key_b64 from memory after use.
• In ios-appstore-gm.yml, changes Infisical secret masking from a single add-mask per value to per-line masking.
• Extends test-ios-stage-asc-key.sh to enforce mask-before-write ordering for the base64 key, verify each PEM line and the base64 form are carried via ::add-mask::, and fail if key material appears outside a mask carrier.

[jaywedgeworth22]

@kody start-review

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

⚠️ 3 Kody Rule(s) were not evaluated

These rules declare that they need repository context beyond this diff, and the review could not retrieve it, so they were not judged on this pull request:

• Verify the import graph before applying import 'server-only'
• Configuration Helpers Must Be Side-Effect Free
• Keep Numeric Representations Consistent Across Related Data Sources

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​