Skip to content

Commit de023d6

Browse files
committed
Define Apple Developer Program "team ID" via repository variable
The macOS builds generated by the release workflows are notarized. The Apple Developer Program "team ID" associated with the signing certificate is provided to the notarization tool (which refers to it as the "App Store Connect provider"). Previously, this was defined via a GitHub Actions secret. That implies it is secret information. However, the team ID is public information that can be seen by anyone simply by looking at the notarized application (e.g., using macOS's spctl utility), so there is need to use a secret for purposes of protecting the information. The reason a secret was chosen when the notarization system was developed was simply that the only alternative at that time was hardcoding the information in the workflow. Since the workflow is intended to be generally applicable even in 3rd party projects (including forks of Arduino projects), whereas the signing credentials are specific to Arduino, it is better to define them separately from the workflow so that it can be used without modification (though unfortunately some hardcoding of such information ended up being introduced to the workflows at at later time). Since that time, GitHub has introduced the repository variable feature, which is intended to configure repository-specific non-secret information. This is the appropriate mechanism for defining the team ID.
1 parent 6caca78 commit de023d6

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

.github/workflows/publish-go-nightly-task.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ jobs:
180180
env:
181181
AC_USERNAME: ${{ secrets.AC_USERNAME }}
182182
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
183-
AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
183+
AC_PROVIDER: ${{ env.AC_PROVIDER }}
184184
run: |
185185
go tool \
186186
github.com/bearer/gon/cmd/gon "${{ env.GON_CONFIG_PATH }}"

.github/workflows/release-go-task.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ jobs:
180180
env:
181181
AC_USERNAME: ${{ secrets.AC_USERNAME }}
182182
AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
183-
AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
183+
AC_PROVIDER: ${{ env.AC_PROVIDER }}
184184
run: |
185185
go tool \
186186
github.com/bearer/gon/cmd/gon "${{ env.GON_CONFIG_PATH }}"

0 commit comments

Comments
 (0)