fix(ci): repair testflight.yml startup failure (secrets context in step if)

[tmad4000]

Problem

Every push to every branch since 2026-07-28 produced a red, 0-second failed run of TestFlight (EAS cloud build + submit). None of them ever ran a build — they were startup failures.

Root cause is one line:

- name: Write ASC API key (option B)
  if: ${{ secrets.EXPO_ASC_API_KEY_BASE64 != '' }}

The secrets context is not available in a step-level if:. That makes the whole workflow file unparseable, so GitHub cannot even evaluate the on: block — which is why a workflow gated on push: tags: ['v*'] was firing on ordinary branch pushes.

.github/workflows/testflight.yml:132:17: context "secrets" is not allowed here.
available contexts are "env", "github", "inputs", "job", "matrix", "needs",
"runner", "steps", "strategy", "vars".

Fix

Hoist the optional option-B secrets into job-level env, which is available in a step if:, and reference them as ordinary shell variables in the step body. Also collapses the three GITHUB_ENV appends into one redirect (shellcheck SC2129).

Verification

actionlint 1.7.12 — 1 error before, clean after:

$ actionlint
$ echo $?
0

Not addressed here

The workflow still cannot produce a build until setup is finished — the repo has no Actions secrets configured at all, so EXPO_TOKEN is missing, and apps/mobile/eas.json sets credentialsSource: "local" for the production profile (signing assets that only exist on the M3 machine). Tracked separately.

🤖 Generated with Claude Code