From a2f2cca9da9e716a8ee5557f0ae1f5c0538b1183 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonas=20Bj=C3=B6rkert?= Date: Fri, 6 Nov 2026 19:30:12 +0100 Subject: [PATCH 1/2] Fail certificate setup when Match fails and no renewal will run --- .github/workflows/create_certs.yml | 14 +++++++++++++- fastlane/Fastfile | 4 +++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/create_certs.yml b/.github/workflows/create_certs.yml index 2f8bde21b..2d4a9d485 100644 --- a/.github/workflows/create_certs.yml +++ b/.github/workflows/create_certs.yml @@ -47,9 +47,15 @@ jobs: # Create or update Distribution certificate and provisioning profiles - name: Check and create or update Distribution certificate and profiles if needed + id: certs run: | echo "Running Fastlane certs lane..." - bundle exec fastlane certs || true # ignore and continue on errors without annotating an exit code + # Continue on errors without annotating an exit code; set_output fails the job if no renewal follows + if bundle exec fastlane certs; then + echo "certs_failed=false" >> $GITHUB_OUTPUT + else + echo "certs_failed=true" >> $GITHUB_OUTPUT + fi - name: Check Distribution certificate and launch Nuke certificates if needed run: bundle exec fastlane check_and_renew_certificates @@ -88,6 +94,12 @@ jobs: echo "::warning::‼️ Nuking of certificates was forced because the repository variable FORCE_NUKE_CERTS is set to 'true'." fi + # Fail if the certificate setup failed and no renewal will replace it + if [ "${{ steps.certs.outputs.certs_failed }}" = "true" ] && [ "$CERT_STATUS" != "true" ] && [ "$FORCE_NUKE_CERTS" != "true" ]; then + echo "::error::❌ Certificate setup failed and automated renewal will not run, because the Apple Developer account has a valid Distribution certificate. See the Fastlane error in the 'Check and create or update Distribution certificate and profiles if needed' step." + exit 1 + fi + # Nuke Certs if needed, and if the repository variable ENABLE_NUKE_CERTS is set to 'true', or if FORCE_NUKE_CERTS is set to 'true', which will always force certs to be nuked nuke_certs: name: Nuke certificates diff --git a/fastlane/Fastfile b/fastlane/Fastfile index 8bf9986ce..254fa0782 100644 --- a/fastlane/Fastfile +++ b/fastlane/Fastfile @@ -247,7 +247,9 @@ platform :ios do issuer_id: "#{FASTLANE_ISSUER_ID}", key_content: "#{FASTLANE_KEY}" ) - + + ensure_watch_identifiers_exist + match( type: "appstore", force: false, From be9ba2b0235b90b6afb5b31ba42202b5f5441a7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jonas=20Bj=C3=B6rkert?= Date: Thu, 12 Nov 2026 10:09:06 +0100 Subject: [PATCH 2/2] Point the certificate error at deleting Match-Secrets --- .github/workflows/create_certs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/create_certs.yml b/.github/workflows/create_certs.yml index 2d4a9d485..090cec230 100644 --- a/.github/workflows/create_certs.yml +++ b/.github/workflows/create_certs.yml @@ -96,7 +96,7 @@ jobs: # Fail if the certificate setup failed and no renewal will replace it if [ "${{ steps.certs.outputs.certs_failed }}" = "true" ] && [ "$CERT_STATUS" != "true" ] && [ "$FORCE_NUKE_CERTS" != "true" ]; then - echo "::error::❌ Certificate setup failed and automated renewal will not run, because the Apple Developer account has a valid Distribution certificate. See the Fastlane error in the 'Check and create or update Distribution certificate and profiles if needed' step." + echo "::error::❌ Fastlane Match could not use the Distribution certificate in your Match-Secrets repository, and automated renewal will not run because another valid certificate exists. Delete https://github.com/${{ github.repository_owner }}/Match-Secrets and run action again: https://loopkit.github.io/loopdocs/browser/bb-errors/#delete-match-secrets" exit 1 fi