From 34ec6956132a239f47ff626c81e708f6ae1ffb80 Mon Sep 17 00:00:00 2001
From: Jacob Cole <tmad4000@gmail.com>
Date: Tue, 25 Aug 2026 21:35:43 -0600
Subject: [PATCH] fix(ci): repair testflight.yml startup failure (secrets ctx
 in step if)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `secrets` context is not available in a step-level `if:`. Referencing it
in the "Write ASC API key (option B)" step made the entire workflow file
unparseable, so GitHub could not evaluate the `on:` triggers and recorded a
0-second startup_failure for EVERY push on EVERY branch — 10+ red runs since
2026-07-28, none of which ever ran a build.

Hoist the option-B secrets to job-level `env` (which IS available in `if:`)
and reference them as shell env vars in the step body. Also collapse the
GITHUB_ENV appends into one redirect (shellcheck SC2129).

Verified with actionlint 1.7.12: file now lints clean (was 1 error).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/testflight.yml | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/testflight.yml b/.github/workflows/testflight.yml
index 93e7cbd..8b12684 100644
--- a/.github/workflows/testflight.yml
+++ b/.github/workflows/testflight.yml
@@ -91,6 +91,14 @@ jobs:
     defaults:
       run:
         working-directory: apps/mobile
+    # The `secrets` context is NOT available in a step-level `if:` — referencing
+    # it there makes the whole file unparseable, so GitHub can't even evaluate
+    # the `on:` triggers and reports a startup_failure for EVERY push. Hoist the
+    # optional (option B) secrets into job-level env, which IS available in `if:`.
+    env:
+      ASC_API_KEY_BASE64: ${{ secrets.EXPO_ASC_API_KEY_BASE64 }}
+      ASC_KEY_ID: ${{ secrets.EXPO_ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.EXPO_ASC_ISSUER_ID }}
 
     steps:
       - name: Checkout
@@ -129,13 +137,15 @@ jobs:
 
       # ── (Option B only) materialize the ASC API key for eas submit ──
       - name: Write ASC API key (option B)
-        if: ${{ secrets.EXPO_ASC_API_KEY_BASE64 != '' }}
+        if: ${{ env.ASC_API_KEY_BASE64 != '' }}
         run: |
           mkdir -p "$RUNNER_TEMP/asc"
-          echo "${{ secrets.EXPO_ASC_API_KEY_BASE64 }}" | base64 --decode > "$RUNNER_TEMP/asc/AuthKey.p8"
-          echo "EXPO_ASC_API_KEY_PATH=$RUNNER_TEMP/asc/AuthKey.p8" >> "$GITHUB_ENV"
-          echo "EXPO_ASC_KEY_ID=${{ secrets.EXPO_ASC_KEY_ID }}" >> "$GITHUB_ENV"
-          echo "EXPO_ASC_ISSUER_ID=${{ secrets.EXPO_ASC_ISSUER_ID }}" >> "$GITHUB_ENV"
+          printf '%s' "$ASC_API_KEY_BASE64" | base64 --decode > "$RUNNER_TEMP/asc/AuthKey.p8"
+          {
+            echo "EXPO_ASC_API_KEY_PATH=$RUNNER_TEMP/asc/AuthKey.p8"
+            echo "EXPO_ASC_KEY_ID=$ASC_KEY_ID"
+            echo "EXPO_ASC_ISSUER_ID=$ASC_ISSUER_ID"
+          } >> "$GITHUB_ENV"
 
       # ── EAS cloud build (production profile from apps/mobile/eas.json) ──
       # --non-interactive: fail instead of prompting (CI must never block).