Dashboard › spotlight › build.yml has two separate Apple signin…

build.yml has two separate Apple signing jobs with different env var names

Category: gotcha
Confidence: 0.90
ID: 019f84cd-45e4-7ce9-8988-19566312aa08
Project ID: ec1699be-a430-4fc6-879b-c437a47171b4
Cross-project: No
Recalled in other projects: 0
Source session: 1R1ErNtmYLcORkv9V
Created: 2026-07-21 13:11:13
Updated: 2026-07-21 13:11:13

Content

.github/workflows/build.yml's Linux build job (fossilize/rcodesign signing) exports APPLE_API_KEY_ISSUER_ID, APPLE_API_KEY_ID, APPLE_API_KEY_P8_PATH, APPLE_API_KEY_PATH — distinct from the electron-mac job's 'Setup Apple API Key for Notarization' step, which exports APPLE_API_ISSUER, APPLE_API_KEY_ID, APPLE_API_KEY=/tmp/apple_key.pem for electron-builder's internal notarization (macPackager.js/MacTargetHelper.js). Trap: seeing 'APPLE_API_KEY_ISSUER_ID' vs 'APPLE_API_ISSUER' looks like a naming mismatch/bug because both jobs ultimately sign parts of the same release. Fix: they're unrelated — separate jobs, separate signing tools (rcodesign for Linux-built fossilize binaries vs electron-builder/@electron/notarize for the mac Electron app bundle) — don't conflate them when debugging notarization failures.

Move to: