Skip to content

Fail certificate setup when Match fails and no renewal will run #820

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marionbarker merged 2 commits into from
Nov 12, 2026
Merged

Fail certificate setup when Match fails and no renewal will run #820

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a2f2cca
Fail certificate setup when Match fails and no renewal will run
bjorkert Nov 6, 2026
be9ba2b
Point the certificate error at deleting Match-Secrets
bjorkert Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion .github/workflows/create_certs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,9 +47,15 @@ jobs:

# Create or update Distribution certificate and provisioning profiles
- name: Check and create or update Distribution certificate and profiles if needed
id: certs
run: |
echo "Running Fastlane certs lane..."
bundle exec fastlane certs || true # ignore and continue on errors without annotating an exit code
# Continue on errors without annotating an exit code; set_output fails the job if no renewal follows
if bundle exec fastlane certs; then
echo "certs_failed=false" >> $GITHUB_OUTPUT
else
echo "certs_failed=true" >> $GITHUB_OUTPUT
fi

- name: Check Distribution certificate and launch Nuke certificates if needed
run: bundle exec fastlane check_and_renew_certificates
Expand Down Expand Up @@ -88,6 +94,12 @@ jobs:
echo "::warning::‼️ Nuking of certificates was forced because the repository variable FORCE_NUKE_CERTS is set to 'true'."
fi

# Fail if the certificate setup failed and no renewal will replace it
if [ "${{ steps.certs.outputs.certs_failed }}" = "true" ] && [ "$CERT_STATUS" != "true" ] && [ "$FORCE_NUKE_CERTS" != "true" ]; then
echo "::error::❌ Fastlane Match could not use the Distribution certificate in your Match-Secrets repository, and automated renewal will not run because another valid certificate exists. Delete https://github.com/${{ github.repository_owner }}/Match-Secrets and run action again: https://loopkit.github.io/loopdocs/browser/bb-errors/#delete-match-secrets"
exit 1
fi

# Nuke Certs if needed, and if the repository variable ENABLE_NUKE_CERTS is set to 'true', or if FORCE_NUKE_CERTS is set to 'true', which will always force certs to be nuked
nuke_certs:
name: Nuke certificates
Expand Down
4 changes: 3 additions & 1 deletion fastlane/Fastfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,9 @@ platform :ios do
issuer_id: "#{FASTLANE_ISSUER_ID}",
key_content: "#{FASTLANE_KEY}"
)


ensure_watch_identifiers_exist

match(
type: "appstore",
force: false,
Expand Down