[eas-cli] Add `--refresh-distribution-certificate` for non-intractive builds by sswrk · Pull Request #3739 · expo/eas-cli

sswrk · 2026-05-18T13:03:22Z

Why

When there's no valid distribution certificate associated with an app, and a non-interactive development build is run (e.g. invoked by CI or by a workflow job), even without the freeze-credentials flag, the distribution certificate is not validated or refreshed, which may fail the internal build and require doing manual eas build to create a new certificate. See the Linear issue: https://linear.app/expo/issue/ENG-21330/make-it-possible-to-refresh-a-distribution-certificate-in-non

How

Added an opt-in distribution certificate refresh to non-interactive builds with flag --refresh-distribution-certificate.

When the flag is present, we hit www GQL API to get the ASC API key (the submission key), and we distribution certificate validation or set-up if needed. packages/eas-cli/src/credentials/ios/actions/SetUpDistributionCertificate.ts is where this logic happens.

The flag mustn't be present when --freeze-credentials is present, these are conflicting flags.

I'm leaning towards an opt-in flag instead of extending the default behavior because of the extra credentials configuration requirements and side effects of the distribution certificate refresh logic.

Test Plan

Added unit tests.

Manual verification:

Did easd build --platform ios --profile development --non-interactive --refresh-distribution-certificate in the following scenarios, verified it works:
- current certificate is valid
- current certificate is invalid
Did easd build --platform ios --profile development --non-interactive --refresh-distribution-certificate --refresh-ad-hoc-provisioning-profile, verified the ASC API key got resolved just once.

linear · 2026-05-18T13:03:25Z

ENG-21330

sswrk · 2026-05-18T13:03:37Z

[eas-cli] Add --refresh-distribution-certificate for non-intractive builds #3739 👈 (View in Graphite)
[eas-cli] Add --refresh-ad-hoc-provisioning-profile for non-interactive builds #3716 : 1 other dependent PR (#3717 )
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

codecov · 2026-05-18T13:20:07Z

Codecov Report

❌ Patch coverage is 86.27451% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.00%. Comparing base (d4b4bf6) to head (6436e27).

Files with missing lines	Patch %	Lines
packages/eas-cli/src/commands/build/index.ts	0.00%	2 Missing and 3 partials ⚠️
packages/eas-cli/src/build/createContext.ts	0.00%	1 Missing ⚠️
...tials/ios/actions/SetUpAdhocProvisioningProfile.ts	66.67%	1 Missing ⚠️

Additional details and impacted files

@@                                                  Coverage Diff                                                  @@
##           szymonswierk/eng-7041-allow-including-all-eas-registered-devices-automatically-in    #3739      +/-   ##
=====================================================================================================================
+ Coverage                                                                              56.88%   57.00%   +0.12%     
=====================================================================================================================
  Files                                                                                    904      904              
  Lines                                                                                  39177    39217      +40     
  Branches                                                                                8202     8215      +13     
=====================================================================================================================
+ Hits                                                                                   22283    22352      +69     
+ Misses                                                                                 15422    15395      -27     
+ Partials                                                                                1472     1470       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-05-18T13:25:02Z

Subscribed to pull request

File Patterns	Mentions
*/	@douglowder
packages/eas-cli/src/commands/build/**	@sjchmiela
packages/eas-cli/src/build/**	@sjchmiela

Generated by CodeMention

quinlanj

lgtm. I'm surprised this was a feature people asked for because the number of dist certs apple lets you have in your account is very low (2-3 max)

quinlanj · 2026-05-21T09:58:15Z

+        return currentCertificate;
+      }
+
+      Log.warn('Current distribution certificate is invalid. Creating a new one...');


move this log.warn to when we actually create a new cert, since it's possible we could reuse

Suggested change

Log.warn('Current distribution certificate is invalid. Creating a new one...');

quinlanj · 2026-05-21T09:58:32Z

+        Log.log(`Reusing distribution certificate with serial number ${cert.serialNumber}`);
+        return cert;
+      }
+      return await this.createNewDistCertAsync(ctx);


Suggested change

return await this.createNewDistCertAsync(ctx);

Log.warn('Current distribution certificate is invalid. Creating a new one...');

return await this.createNewDistCertAsync(ctx);

…uilds

github-actions · 2026-05-21T11:37:57Z

✅ Thank you for adding the changelog entry!

sjchmiela · 2026-05-22T15:07:06Z

+      throw new Error(
+        'No App Store Connect API Key found for distribution certificate refresh. In non-interactive mode, provide one via:\n' +
+          '  - Environment variables: EXPO_ASC_API_KEY_PATH, EXPO_ASC_KEY_ID, EXPO_ASC_ISSUER_ID\n' +
+          '  - EAS credentials service: configure an App Store Connect API Key for submissions on this app'


ugh it's still weird to me we're saying to use key for submissions to generate certificates

sjchmiela · 2026-05-22T15:07:44Z

+      if (await this.isCurrentCertificateValidAsync(ctx, currentCertificate)) {
+        assert(currentCertificate, 'currentCertificate is defined here');


Suggested change

if (await this.isCurrentCertificateValidAsync(ctx, currentCertificate)) {

assert(currentCertificate, 'currentCertificate is defined here');

if (currentCertificate && await this.isCurrentCertificateValidAsync(ctx, currentCertificate)) {

this makes more sense to me?

sjchmiela · 2026-05-22T15:09:06Z

+        Log.log(`Reusing distribution certificate with serial number ${cert.serialNumber}`);
+        return cert;
+      }
+      return await this.createNewDistCertAsync(ctx);


how likely is that we're going to hit

eas-cli/packages/eas-cli/src/credentials/ios/actions/DistributionCertificateUtils.ts

Lines 219 to 223 in 62ab329

if (ctx.nonInteractive) {

throw new Error(

"Start the CLI without the '--non-interactive' flag to revoke existing certificates."

);

}

often? can we do something about it?

sswrk mentioned this pull request May 18, 2026

[eas-cli] Add --refresh-ad-hoc-provisioning-profile for non-interactive builds #3716

Merged

sswrk mentioned this pull request May 18, 2026

[eas-build-job] Add refreshAdHocProvisioningProfile to iOS job #3717

Merged

sswrk changed the title ~~[eas-cli] Add --refresh-distribution-certificate for non-intractive builds~~ [eas-cli] Add --refresh-distribution-certificate for non-intractive builds May 18, 2026

sswrk marked this pull request as ready for review May 18, 2026 13:24

sswrk requested review from quinlanj and sjchmiela May 18, 2026 13:27

sswrk force-pushed the szymonswierk/eng-21330-make-it-possible-to-refresh-a-distribution-certificate-in branch from 763d237 to 1e21106 Compare May 20, 2026 11:43

sswrk force-pushed the szymonswierk/eng-7041-allow-including-all-eas-registered-devices-automatically-in branch 2 times, most recently from 701b7d7 to 4c939d9 Compare May 20, 2026 11:57

sswrk force-pushed the szymonswierk/eng-21330-make-it-possible-to-refresh-a-distribution-certificate-in branch 2 times, most recently from 354509c to e1e9a7e Compare May 20, 2026 12:01

quinlanj approved these changes May 21, 2026

View reviewed changes

sswrk added 2 commits May 21, 2026 13:32

[eas-cli] Add --refresh-distribution-certificate for non-intractive b…

0def5f5

…uilds

changelog entry

6436e27

sswrk force-pushed the szymonswierk/eng-7041-allow-including-all-eas-registered-devices-automatically-in branch from d20291d to d4b4bf6 Compare May 21, 2026 11:37

sswrk force-pushed the szymonswierk/eng-21330-make-it-possible-to-refresh-a-distribution-certificate-in branch from e1e9a7e to 6436e27 Compare May 21, 2026 11:37

sswrk changed the base branch from szymonswierk/eng-7041-allow-including-all-eas-registered-devices-automatically-in to graphite-base/3739 May 21, 2026 12:04

This was referenced May 21, 2026

[build-tools] Pass refresh ad-hoc provisioning profile through build:internal #3770

Merged

[eas-cli] Wire refresh ad-hoc profile through build:internal and prepareJob #3769

Merged

sjchmiela approved these changes May 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[eas-cli] Add `--refresh-distribution-certificate` for non-intractive builds#3739

[eas-cli] Add `--refresh-distribution-certificate` for non-intractive builds#3739
sswrk wants to merge 2 commits into
graphite-base/3739from
szymonswierk/eng-21330-make-it-possible-to-refresh-a-distribution-certificate-in

sswrk commented May 18, 2026 •

edited

Loading

Uh oh!

linear Bot commented May 18, 2026

Uh oh!

sswrk commented May 18, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 18, 2026

Uh oh!

quinlanj left a comment

Uh oh!

quinlanj May 21, 2026

Uh oh!

quinlanj May 21, 2026

Uh oh!

github-actions Bot commented May 21, 2026

Uh oh!

sjchmiela May 22, 2026

Uh oh!

sjchmiela May 22, 2026

Uh oh!

sjchmiela May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	return await this.createNewDistCertAsync(ctx);
	Log.warn('Current distribution certificate is invalid. Creating a new one...');
	return await this.createNewDistCertAsync(ctx);

		if (await this.isCurrentCertificateValidAsync(ctx, currentCertificate)) {
		assert(currentCertificate, 'currentCertificate is defined here');

	if (await this.isCurrentCertificateValidAsync(ctx, currentCertificate)) {
	assert(currentCertificate, 'currentCertificate is defined here');
	if (currentCertificate && await this.isCurrentCertificateValidAsync(ctx, currentCertificate)) {

	if (ctx.nonInteractive) {
	throw new Error(
	"Start the CLI without the '--non-interactive' flag to revoke existing certificates."
	);
	}

Conversation

sswrk commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

How

Test Plan

Uh oh!

linear Bot commented May 18, 2026

Uh oh!

sswrk commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented May 18, 2026

Uh oh!

quinlanj left a comment

Choose a reason for hiding this comment

Uh oh!

quinlanj May 21, 2026

Choose a reason for hiding this comment

Uh oh!

quinlanj May 21, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 21, 2026

Uh oh!

sjchmiela May 22, 2026

Choose a reason for hiding this comment

Uh oh!

sjchmiela May 22, 2026

Choose a reason for hiding this comment

Uh oh!

sjchmiela May 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sswrk commented May 18, 2026 •

edited

Loading

sswrk commented May 18, 2026 •

edited

Loading

codecov Bot commented May 18, 2026 •

edited

Loading