From 8a68710ae58b0e815bd3a30c3073f366f4369ec1 Mon Sep 17 00:00:00 2001 From: YuYu1015 Date: Tue, 18 Aug 2026 16:33:04 +0800 Subject: [PATCH] ci(release): stop waiting for TestFlight with an expired token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The upload succeeded and the step failed anyway. `apple-actions/upload-testflight-build@v5` signs one App Store Connect JWT with a 600-second life — `n=600` in its bundled dist/index.js, with no re-signing anywhere in it — and then polls for the build to become visible on a schedule that sleeps 60 + 120 + 240 + 300 = 720 seconds before giving up. The token is guaranteed to die first, so any build Apple takes more than a few minutes to process reports 401 NOT_AUTHORIZED with the binary already delivered. Build 426000342 is on TestFlight; the run is red. The wait is only there so the action can write metadata afterwards, and this step asks for none: it sets neither release-notes nor uses-non-exempt-encryption, and Info.plist already declares ITSAppUsesNonExemptEncryption. What is given up is being told when Apple rejects a binary during processing. That signal was already gone — the step failed on the expired token whether processing passed or not, so the red said nothing about the build either way. --- .github/workflows/release.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 82d8ab74f..922f48334 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -296,6 +296,20 @@ jobs: issuer-id: ${{ secrets.APPSTORE_ISSUER_ID }} api-key-id: ${{ secrets.APPSTORE_API_KEY_ID }} api-private-key: ${{ secrets.APPSTORE_API_PRIVATE_KEY }} + # The upload finishes; the wait after it cannot. The action signs one + # App Store Connect JWT with a 600-second life (`n=600` in its bundled + # dist/index.js) and never re-signs it, while its own poll schedule + # sleeps 60 + 120 + 240 + 300 = 720 seconds before giving up. Any build + # that takes longer than the token lives reports + # `401 NOT_AUTHORIZED` — after the binary is already on TestFlight. + # + # Nothing here needs the wait: it exists so the action can write + # metadata afterwards, and this step sets neither `release-notes` nor + # `uses-non-exempt-encryption` — Info.plist already declares + # ITSAppUsesNonExemptEncryption. What is given up is being told when + # Apple rejects a binary during processing, which this step never told + # us anyway: it failed on the token whether processing passed or not. + wait-for-processing: 'false' # An Admin credential for the whole App Store Connect account. The runner # is ephemeral, but removing it costs one line.