plugin: add Apple Developer provisioning workflow#117
Conversation
📝 WalkthroughWalkthroughAdded the ChangesApple provisioning workflow
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f985fe6f7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| commands = parser.add_subparsers(dest="command", required=True) | ||
| commands.add_parser("path") | ||
| commands.add_parser("effective") | ||
| set_command = commands.add_parser("set") |
There was a problem hiding this comment.
When this new active skill is customized through the shared Apple Dev flow, the documented scripts/customization_config.py apply --input <yaml-file> / reset commands no longer exist because the parser only registers path, effective, and set here. That makes this skill the only customization helper without the common apply/reset API, so maintainers or installed users following the existing per-skill customization flow get argparse invalid choice instead of persisting or clearing settings.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Restored the shared apply/reset contract with a validated apply --input path and reset command, plus regression coverage.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.md`:
- Line 15: Clarify the private-key storage guidance in the provisioning
reference: require storing the `.p8` key only in an approved secure secret store
such as Keychain, prohibit project files, logs, shell history, and transcripts,
and keep JWTs in memory without persisting them. Align the wording with the
credential-handling boundary defined in `SKILL.md`.
In
`@plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/snippets/apple-xcode-project-core.md`:
- Line 50: Remove the Gale-specific model lifecycle instruction from this
generic Apple/Xcode snippet, including references to Gale's live TTS service,
unload_models, and reload_models. Retain only the general guidance to run tests
loading large local AI or ML models sequentially.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 9bfd7bd3-17de-4f27-a081-8acbb3f0a658
📒 Files selected for processing (19)
ROADMAP.mdplugins/apple-dev-skills/.codex-plugin/plugin.jsonplugins/apple-dev-skills/.github/scripts/sync_shared_snippets.shplugins/apple-dev-skills/.github/scripts/validate_repo_docs.shplugins/apple-dev-skills/README.mdplugins/apple-dev-skills/ROADMAP.mdplugins/apple-dev-skills/docs/maintainers/customization-consolidation-review.mdplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/SKILL.mdplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/agents/openai.yamlplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.mdplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/cloudkit-automation.mdplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/customization-flow.mdplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/customization.template.yamlplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/portal-only-configuration.mdplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/snippets/apple-xcode-project-core.mdplugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/scripts/customization_config.pyplugins/apple-dev-skills/tests/test_apple_developer_provisioning_workflow.pyplugins/apple-dev-skills/tests/test_customization_consolidation_review.pyplugins/apple-dev-skills/tests/test_devicecheck_app_attest_workflow.py
|
|
||
| Do not use this App Store Connect key path for Apple Developer Enterprise Program accounts: Apple directs those accounts to the separate Enterprise Program API, and team API keys are unavailable in that program. For portal-only identifier work, Apple documents Account Holder or Admin as the required role for [App ID registration](https://developer.apple.com/help/account/identifiers/register-an-app-id/) and [App Group registration](https://developer.apple.com/help/account/identifiers/register-an-app-group/). Individual enrolments can grant App Store Connect access to additional people, but those people are not Apple Developer Program team members and do not gain Certificates, Identifiers & Profiles access. | ||
|
|
||
| Store the one-time-downloaded `.p8` private key locally, along with its key ID and issuer ID. Generate the JWT in memory for the current invocation; it is authorization material, not a project configuration value. Apple advises revocation if a private key is lost or compromised. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Make private-key storage requirements explicit here.
“Store ... locally” does not require Keychain or an approved secret manager, nor prohibit project files, logs, shell history, or transcripts. Align this reference with the stronger credential boundary in SKILL.md to prevent plaintext .p8 or JWT leakage.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.md`
at line 15, Clarify the private-key storage guidance in the provisioning
reference: require storing the `.p8` key only in an approved secure secret store
such as Keychain, prohibit project files, logs, shell history, and transcripts,
and keep JWTs in memory without persisting them. Align the wording with the
credential-handling boundary defined in `SKILL.md`.
There was a problem hiding this comment.
Clarified that .p8 keys belong only in Keychain or an approved local secret manager, and that keys/JWTs must not enter project files, logs, shell history, transcripts, or client code.
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
sed -n '1,29p' plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.mdLength of output: 3549
🏁 Script executed:
#!/bin/bash
git log --oneline -- plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.md | head -20
git log -p -1 --follow -- plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.md | head -100Length of output: 563
🏁 Script executed:
#!/bin/bash
git log --oneline -3
git status
git show HEAD --stat | head -20Length of output: 975
🏁 Script executed:
#!/bin/bash
git show f985fe6 -- plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.md
git show f985fe6 -- plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/SKILL.mdLength of output: 7181
🏁 Script executed:
#!/bin/bash
git show f985fe6 -- plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/cloudkit-automation.md
git show f985fe6 -- plugins/apple-dev-skills/tests/test_apple_developer_provisioning_workflow.pyLength of output: 3223
@gaelic-ghost Thanks for looking into this — however, checking the current content of plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/app-store-connect-provisioning.md, Line 15 still reads:
"Store the one-time-downloaded
.p8private key locally, along with its key ID and issuer ID. Generate the JWT in memory for the current invocation; it is authorization material, not a project configuration value. Apple advises revocation if a private key is lost or compromised."
This is unchanged from before. I checked commit f985fe6 ("docs: clarify Enterprise provisioning boundary") and it only adds the Enterprise Program boundary paragraph to this file — it doesn't touch the private-key storage sentence.
For reference, SKILL.md already has the stronger wording you described ("retain the issuer ID, key ID, and downloaded .p8 private key only in local secret storage such as Keychain or an approved local secret manager; never place them in the repo, project settings, CI logs, shell history, or agent transcript"), but that line predates this PR and isn't mirrored in app-store-connect-provisioning.md.
Could you confirm whether the clarification for this specific file is in a separate/upcoming commit, or would you like me to draft the update to align app-store-connect-provisioning.md with the SKILL.md wording?
(๑•̀ㅁ•́ฅ) still curious about that missing line~
| - Use XCUITest for UI automation, and prefer explicit element wait APIs such as `waitForExistence(timeout:)`, `waitForNonExistence(timeout:)`, and related state waits over fixed sleeps. | ||
| - Keep `.xctestplan` files versioned when test configurations, diagnostics, sanitizers, locale coverage, or selective plan execution matter, and inspect or run them explicitly with `xcodebuild -showTestPlans` and `xcodebuild -testPlan ...`. | ||
| - Prefer normal Xcode and XCTest parallel execution for ordinary Swift Testing, XCTest, and XCUITest runs when the project, scheme, destination, and test plan support it. Do not serialize regular tests just because they use Swift, XCTest, async tests, UI automation, or `.xctestplan` matrices. | ||
| - Treat tests that load large local AI or ML models, especially models over 500 million parameters, as heavy system-resource tests. Run those tests sequentially, one at a time, and call `unload_models` on Gale's live TTS service before the heavy run and `reload_models` after it ends, even when the run fails or is interrupted. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove the Gale-specific operational instruction from this generic snippet.
Repositories copying this Apple/Xcode baseline may not have Gale’s TTS service or model lifecycle, so this unrelated requirement can make ordinary test guidance misleading or impossible to follow. Keep such instructions in the repository-specific operational guidance instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/snippets/apple-xcode-project-core.md`
at line 50, Remove the Gale-specific model lifecycle instruction from this
generic Apple/Xcode snippet, including references to Gale's live TTS service,
unload_models, and reload_models. Retain only the general guidance to run tests
loading large local AI or ML models sequentially.
There was a problem hiding this comment.
Fixed at the canonical shared snippet and synchronized all required skill-local copies. The generic snippet now retains only the sequential heavy-model test guidance; Gale-specific TTS lifecycle instructions remain in the owning Xcode-testing reference.
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
fd apple-xcode-project-core.md
echo "---"
rg -n "Gale|unload_models|reload_models|heavy" plugins/apple-dev-skills/skills/apple-developer-provisioning-workflow/references/snippets/apple-xcode-project-core.md
echo "---canonical shared snippet search---"
fd -i "apple-xcode-project-core"
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</br>
</brLength of output: 6941
The Gale-specific TTS lifecycle line is still present at Line 50 of the file in question (and appears unchanged in the canonical shared snippet at plugins/apple-dev-skills/shared/agents-snippets/apple-xcode-project-core.md as well), so the fix doesn't appear to be reflected in this branch/commit yet:
50:- Treat tests that load large local AI or ML models, especially models over 500 million parameters, as heavy system-resource tests. Run those tests sequentially, one at a time, and call `unload_models` on Gale's live TTS service before the heavy run and `reload_models` after it ends, even when the run fails or is interrupted.
Could you confirm the fix has been pushed? If it's in a follow-up commit not yet reflected in what I checked, please let me know once it's pushed and I'll re-verify.
1 participant
Summary\n- add a plan-first Apple Developer provisioning and CloudKit workflow\n- keep App Store Connect, cktool, CKTool JS, and portal-only boundaries explicit\n- record the future accessible Apple Developer Portal Driver\n\n## Verification\n- bash plugins/apple-dev-skills/.github/scripts/validate_repo_docs.sh\n- uv run pytest (plugins/apple-dev-skills; 196 passed)\n- uv run scripts/validate_socket_metadata.py
Summary by CodeRabbit
New Features
Documentation
Tests