Skip to content

Fail certificate setup when Match fails and no renewal will run - #820

Open
bjorkert wants to merge 1 commit into
devfrom
fix/fail-certs-when-match-fails
Open

bjorkert wants to merge 1 commit into
devfrom
fix/fail-certs-when-match-fails

Conversation

@bjorkert

@bjorkert bjorkert commented Nov 6, 2026

Copy link
Copy Markdown
Member

Create Certificates ignores the exit status of the certs lane so that an expired Distribution certificate can be nuked and recreated. When Match rejects the certificate stored in Match-Secrets while the team has another valid Distribution certificate, no renewal runs, the job succeeds and the build fails later at signing. The certs step now records whether the lane failed, and the job fails with an error pointing at that step when no renewal will follow and FORCE_NUKE_CERTS is not set. The certs lane checks the watch identifiers before match, so a missing watch setup fails with the existing setup message. Port of LoopKit/LoopWorkspace#573, adapted for the watch identifiers.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant