fix: unset empty App Store Connect API key issuer ID

.github/actions/ios-fastlane-beta/beta.sh

@@ -1,6 +1,12 @@
 #!/bin/bash
 set -e
 
+# Individual keys have no issuer ID, but an omitted secret arrives as "", which
+# is truthy in Ruby — fastlane would sign iss: "" instead of sub: "user".
+if [ -z "${APP_STORE_CONNECT_API_KEY_ISSUER_ID//[[:space:]]/}" ]; then
+  unset APP_STORE_CONNECT_API_KEY_ISSUER_ID
+fi
+
 # Change to iOS root for bundle install
 if [ -n "$IOS_ROOT_PATH" ]; then
   echo "Installing gems from: $IOS_ROOT_PATH"

.github/actions/ios-fastlane-beta/test/test_beta.bats

@@ -27,3 +27,21 @@ SCRIPT="$BATS_TEST_DIRNAME/../beta.sh"
   [ "$status" -eq 0 ]
   grep -q "^exec fastlane beta build_number:42 version_number:1.2.0$" "$BUNDLE_LOG"
 }
+
+@test "empty issuer ID — unset so fastlane treats the key as individual" {
+  APP_STORE_CONNECT_API_KEY_ISSUER_ID="" run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  ! grep -q "^APP_STORE_CONNECT_API_KEY_ISSUER_ID=" "$ENV_LOG"
+}
+
+@test "whitespace-only issuer ID — unset" {
+  APP_STORE_CONNECT_API_KEY_ISSUER_ID="  " run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  ! grep -q "^APP_STORE_CONNECT_API_KEY_ISSUER_ID=" "$ENV_LOG"
+}
+
+@test "issuer ID set — passed through to fastlane" {
+  APP_STORE_CONNECT_API_KEY_ISSUER_ID="abc-123" run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  grep -q "^APP_STORE_CONNECT_API_KEY_ISSUER_ID=abc-123$" "$ENV_LOG"
+}

.github/actions/ios-fastlane-beta/test/test_helper.bash

@@ -9,19 +9,21 @@ exit 0
 MOCK
   chmod +x "$MOCK_DIR/gem"
 
-  # Mock bundle command — capture the full invocation
+  # Mock bundle command — capture the full invocation and the env fastlane sees
   BUNDLE_LOG="$(mktemp)"
-  export BUNDLE_LOG
+  ENV_LOG="$(mktemp)"
+  export BUNDLE_LOG ENV_LOG
   cat > "$MOCK_DIR/bundle" <<MOCK
 #!/bin/bash
 if [ "\$1" = "exec" ]; then
   echo "\$@" >> "$BUNDLE_LOG"
+  env > "$ENV_LOG"
 fi
 exit 0
 MOCK
   chmod +x "$MOCK_DIR/bundle"
 }
 
 teardown() {
-  rm -rf "$MOCK_DIR" "$BUNDLE_LOG"
+  rm -rf "$MOCK_DIR" "$BUNDLE_LOG" "$ENV_LOG"
 }

.github/actions/ios-fastlane-release/release.sh

@@ -1,6 +1,12 @@
 #!/bin/bash
 set -e
 
+# Individual keys have no issuer ID, but an omitted secret arrives as "", which
+# is truthy in Ruby — fastlane would sign iss: "" instead of sub: "user".
+if [ -z "${APP_STORE_CONNECT_API_KEY_ISSUER_ID//[[:space:]]/}" ]; then
+  unset APP_STORE_CONNECT_API_KEY_ISSUER_ID
+fi
+
 # Change to iOS root for bundle install
 if [ -n "$IOS_ROOT_PATH" ]; then
   echo "Installing gems from: $IOS_ROOT_PATH"

.github/actions/ios-fastlane-release/test/test_release.bats

@@ -15,21 +15,23 @@ exit 0
 MOCK
   chmod +x "$MOCK_DIR/gem"
 
-  # Mock bundle command — capture the full invocation
+  # Mock bundle command — capture the full invocation and the env fastlane sees
   BUNDLE_LOG="$(mktemp)"
-  export BUNDLE_LOG
+  ENV_LOG="$(mktemp)"
+  export BUNDLE_LOG ENV_LOG
   cat > "$MOCK_DIR/bundle" <<MOCK
 #!/bin/bash
 if [ "\$1" = "exec" ]; then
   echo "\$@" >> "$BUNDLE_LOG"
+  env > "$ENV_LOG"
 fi
 exit 0
 MOCK
   chmod +x "$MOCK_DIR/bundle"
 }
 
 teardown() {
-  rm -rf "$MOCK_DIR" "$BUNDLE_LOG"
+  rm -rf "$MOCK_DIR" "$BUNDLE_LOG" "$ENV_LOG"
 }
 
 @test "no overrides — runs fastlane release without args" {
@@ -55,3 +57,21 @@ teardown() {
   [ "$status" -eq 0 ]
   grep -q "^exec fastlane release build_number:42 version_number:1.2.0$" "$BUNDLE_LOG"
 }
+
+@test "empty issuer ID — unset so fastlane treats the key as individual" {
+  APP_STORE_CONNECT_API_KEY_ISSUER_ID="" run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  ! grep -q "^APP_STORE_CONNECT_API_KEY_ISSUER_ID=" "$ENV_LOG"
+}
+
+@test "whitespace-only issuer ID — unset" {
+  APP_STORE_CONNECT_API_KEY_ISSUER_ID="  " run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  ! grep -q "^APP_STORE_CONNECT_API_KEY_ISSUER_ID=" "$ENV_LOG"
+}
+
+@test "issuer ID set — passed through to fastlane" {
+  APP_STORE_CONNECT_API_KEY_ISSUER_ID="abc-123" run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  grep -q "^APP_STORE_CONNECT_API_KEY_ISSUER_ID=abc-123$" "$ENV_LOG"
+}