Use existing prod profile secret for App Store workflow

[azooz2003-bit]

Summary

• let the iOS App Store workflow use IOS_PROD_PROVISIONING_PROFILE_BASE64 when IOS_APPSTORE_PROVISIONING_PROFILE_BASE64 is absent
• keep the existing profile validation for com.cmuxterm.app, production APNs, and Sign in with Apple

Verification

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ios-app-store.yml"); puts "yaml ok"'\n\nNo app reload: workflow-only change.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Workflow-only secret fallback with the same profile validation; no app or signing logic changes.

Overview
The iOS App Store workflow’s “Install App Store provisioning profile” step now resolves IOS_APPSTORE_PROVISIONING_PROFILE_BASE64 from IOS_APPSTORE_PROVISIONING_PROFILE_BASE64 or, if that secret is missing, from IOS_PROD_PROVISIONING_PROFILE_BASE64.

Decode, install, and plist checks (bundle id com.cmuxterm.app, production APNs, Sign in with Apple) are unchanged—only which secret supplies the profile bytes.

^{Reviewed by Cursor Bugbot for commit 257872c. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

App Store build workflow now falls back to IOS_PROD_PROVISIONING_PROFILE_BASE64 if IOS_APPSTORE_PROVISIONING_PROFILE_BASE64 is missing, preventing failed builds when the App Store secret isn’t set. Existing profile checks for com.cmuxterm.app, production APNs, and Sign in with Apple remain unchanged; CI-only updates with no app code changes.

^{Written for commit c0ee3d8. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Improved the iOS App Store build setup by automatically using the dedicated App Store provisioning profile secret when it’s available, with a fallback to the existing production provisioning profile secret when it isn’t.
  • This helps prevent build/package failures when the preferred provisioning profile value is missing, while still erroring clearly if no provisioning profile is provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cmux	Ready	Preview, Comment	Jul 9, 2026 10:58pm
cmux-staging	Building	Preview, Comment	Jul 9, 2026 10:58pm

[greptile-apps]

Greptile Summary

This PR updates the iOS App Store release workflow. The main changes are:

• Fallback from the App Store provisioning profile secret to the existing production profile secret.
• Keep the provisioning profile decode, install, and entitlement checks in the workflow.
• Add a Swift file-length budget entry for Sources/AppDelegate+AgentChat.swift.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.github/workflows/ios-app-store.yml	Updates the App Store provisioning profile secret expression while leaving the existing profile validation and export-name flow in place.
.github/swift-file-length-budget.tsv	Adds a tracked file-length budget entry for Sources/AppDelegate+AgentChat.swift.

_{Reviews (2): Last reviewed commit: "Use existing prod profile secret for App..." | Re-trigger Greptile}

[coderabbitai]

📝 Walkthrough

Walkthrough

The iOS App Store workflow now uses IOS_PROD_PROVISIONING_PROFILE_BASE64 when IOS_APPSTORE_PROVISIONING_PROFILE_BASE64 is unset or empty.

Changes

iOS provisioning workflow

Layer / File(s)	Summary
Provisioning profile secret fallback .github/workflows/ios-app-store.yml	The workflow falls back from IOS_APPSTORE_PROVISIONING_PROFILE_BASE64 to IOS_PROD_PROVISIONING_PROFILE_BASE64.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 24 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers summary and verification, but it omits the template's Testing, Review Trigger, and Checklist sections.	Add the missing template sections: Testing, Review Trigger, and Checklist, and fill them out with the required details.

✅ Passed checks (24 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Cmux Swift Actor Isolation	✅ Passed	No Swift source changed; the PR only updates workflow YAML and a GitHub TSV, so it cannot introduce Swift actor-isolation regressions.
Cmux Swift Blocking Runtime	✅ Passed	PR changes only a workflow and TSV config; no .swift source was introduced or modified, so the Swift blocking-runtime rule doesn’t apply.
Cmux Browser Automation Off-Main	✅ Passed	Diff only changes a workflow secret fallback and a size-budget TSV; no browser/socket automation code, mainActor routing, or policy tests were touched.
Cmux Expensive Synchronous Load	✅ Passed	No Swift production code changed; the diff only touches a workflow and a Swift file budget TSV, so the expensive sync-load rule is not implicated.
Cmux Cache Substitution Correctness	✅ Passed	Only a workflow YAML and a file-length budget TSV changed; no production Swift/TS/JS cache-substitution path was touched.
Cmux No Hacky Sleeps	✅ Passed	Only a GitHub Actions workflow changed, and the rule explicitly excludes workflow/action YAML; no sleeps or wait logic were introduced.
Cmux Algorithmic Complexity	✅ Passed	Only a workflow YAML and a TSV metadata file changed; no production Swift/TS/JS/shell/runtime code or scalable collection logic was introduced.
Cmux Swift Concurrency	✅ Passed	The diff touches only a workflow YAML and a TSV budget file; no Swift source files changed, so no legacy async pattern regression is introduced.
Cmux Swift @Concurrent	✅ Passed	No Swift files changed; the diff only touches a workflow and a TSV budget file, so the Swift concurrent annotation rule is not applicable.
Cmux Swift File And Package Boundaries	✅ Passed	No production Swift files changed; the diff only updates a workflow and a Swift budget TSV entry, so the boundary rule is not violated.
Cmux Swiftpm Lockfiles	✅ Passed	Only a workflow and a TSV budget file changed; no .gitignore, Package.swift, Xcode project, or Package.resolved files were touched.
Cmux Swift Logging	✅ Passed	No production Swift files changed; the diff only updates workflow/config, so none of the Swift logging rules are implicated.
Cmux User-Facing Error Privacy	✅ Passed	PASS: The diff only changes a workflow secret fallback; it adds no user-facing errors, alerts, or recovery copy, so the privacy rule isn’t violated.
Cmux Full Internationalization	✅ Passed	Workflow-only secret fallback and validation; no user-facing Swift, catalog, web, or markdown text was added or modified.
Cmux Swiftui State Layout	✅ Passed	Diff only changes a workflow and a size-budget TSV; no SwiftUI files or state/layout patterns were introduced.
Cmux Architecture Rethink	✅ Passed	No Swift sources changed; diff only updates the iOS App Store workflow and a TSV budget file, so the Swift architecture rule doesn’t apply.
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	No Swift window code changed; only a workflow and a TSV budget entry were touched, so the auxiliary-window-close-shortcuts rule doesn't apply.
Cmux Source Artifacts	✅ Passed	All changed paths are intentional config/source files: workflow update and checked-in Swift file-length budget; no logs, caches, temp dirs, or other artifacts.
Cmux No Test Or Debug Seam In Production Source	✅ Passed	PR changes only a workflow and a budget TSV; no Swift files under Sources/ were modified, so no production test/debug seam was introduced.
Cmux No Ambient Global State	✅ Passed	PASS: The PR only changes a workflow YAML and a Swift budget TSV; no production Swift code or ambient global state was added.
Title check	✅ Passed	The title clearly matches the main change: adding a fallback to the existing prod profile secret for the App Store workflow.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-ios-appstore-profile-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Profile Name Not Propagated

When the App Store secret is absent and the fallback profile decodes successfully but has a Name different from the upload script default, this step installs that profile but the export step still looks for cmux App Store Distribution. The workflow can fail later during xcodebuild -exportArchive even though the profile passed the new fallback validation.

Rule Used: Flag SwiftPM package, Xcode project, .gitignore, w... (source)