fastlane 2.238.0 → 2.241.0

data/gym/lib/gym/options.rb

@@ -321,6 +321,11 @@ module Gym
                                      description: "Skips resolution of Swift Package Manager dependencies",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :disallow_xcodebuild_settings_lookup,
+                                     env_name: "GYM_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP",
+                                     description: "Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually",
+                                     type: Boolean,
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :disable_package_automatic_updates,
                                      env_name: "GYM_DISABLE_PACKAGE_AUTOMATIC_UPDATES",
                                      description: "Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild",

data/gym/lib/gym/runner.rb

@@ -223,7 +223,7 @@ module Gym
       UI.message("Compressing #{available_dsyms.count} dSYM(s)") unless Gym.config[:silent]
 
       output_path = File.expand_path(File.join(Gym.config[:output_directory], Gym.config[:output_name] + ".app.dSYM.zip"))
-      command = "cd '#{containing_directory}' && zip -r '#{output_path}' *.dSYM"
+      command = "cd #{containing_directory.shellescape} && zip -r #{output_path.shellescape} *.dSYM"
       Helper.backticks(command, print: !Gym.config[:silent])
       puts("") # new line
 

data/internal/README.md

@@ -8,4 +8,4 @@
 
 ------
 
-Internal scripts for Rubocop linting & Rake tasks.
+Internal scripts for Rubocop linting, Rake tasks, and the docs checks and generation the Fastfile runs (`docs/`).

data/match/lib/match/encryption/openssl.rb

@@ -93,8 +93,12 @@ module Match
       def fetch_password!
         password = ENV["MATCH_PASSWORD"]
         unless password
-          item = Security::InternetPassword.find(server: server_name(self.keychain_name))
-          password = item.password if item
+          begin
+            item = Security::InternetPassword.find(server: server_name(self.keychain_name))
+            password = item.password if item
+          rescue Security::Error => ex
+            UI.important("Could not read the local keychain: #{ex.message}")
+          end
         end
 
         unless password

data/match/lib/match/generator.rb

@@ -92,6 +92,7 @@ module Match
         fail_on_name_taken: params[:fail_on_name_taken],
         include_all_certificates: params[:include_all_certificates],
         include_mac_in_profiles: params[:include_mac_in_profiles],
+        offline_profile: params[:offline_profile],
       }
 
       values[:platform] = params[:platform]

data/match/lib/match/nuke.rb

@@ -341,9 +341,9 @@ module Match
     def filter_profiles_and_files_by_selected_certificates
       # Do profile selection logic
       cert_ids = self.certs.map { |cert| cert.id.to_s }
-      self.profiles = self.profiles.reject do |profile|
+      self.profiles = self.profiles.select do |profile|
         profile_cert_ids = profile.certificates.map { |cert| cert.id.to_s }
-        (cert_ids & profile_cert_ids).empty?
+        cert_ids.intersect?(profile_cert_ids)
       end
 
       profile_uuids = self.profiles.map do |profile|

data/match/lib/match/options.rb

@@ -160,14 +160,14 @@ module Match
         FastlaneCore::ConfigItem.new(key: :git_basic_authorization,
                                      env_name: "MATCH_GIT_BASIC_AUTHORIZATION",
                                      sensitive: true,
-                                     description: "Use a basic authorization header to access the git repo (e.g.: access via HTTPS, GitHub Actions, etc), usually a string in Base64",
+                                     description: "Use a basic authorization header to access the git repo (e.g.: access via HTTPS, GitHub Actions, etc), usually a string in Base64. Needs git 2.31 or later",
                                      conflicting_options: [:git_bearer_authorization, :git_private_key],
                                      optional: true,
                                      default_value: nil),
         FastlaneCore::ConfigItem.new(key: :git_bearer_authorization,
                                      env_name: "MATCH_GIT_BEARER_AUTHORIZATION",
                                      sensitive: true,
-                                     description: "Use a bearer authorization header to access the git repo (e.g.: access to an Azure DevOps repository), usually a string in Base64",
+                                     description: "Use a bearer authorization header to access the git repo (e.g.: access to an Azure DevOps repository), usually a string in Base64. Needs git 2.31 or later",
                                      conflicting_options: [:git_basic_authorization, :git_private_key],
                                      optional: true,
                                      default_value: nil),
@@ -209,7 +209,8 @@ module Match
         FastlaneCore::ConfigItem.new(key: :s3_access_key,
                                      env_name: "MATCH_S3_ACCESS_KEY",
                                      description: "S3 access key",
-                                     optional: true),
+                                     optional: true,
+                                     sensitive: true),
         FastlaneCore::ConfigItem.new(key: :s3_secret_access_key,
                                      env_name: "MATCH_S3_SECRET_ACCESS_KEY",
                                      description: "S3 secret access key",
@@ -247,11 +248,13 @@ module Match
         FastlaneCore::ConfigItem.new(key: :job_token,
                                       env_name: "CI_JOB_TOKEN",
                                       description: "GitLab CI_JOB_TOKEN",
-                                      optional: true),
+                                      optional: true,
+                                      sensitive: true),
         FastlaneCore::ConfigItem.new(key: :private_token,
                                       env_name: "PRIVATE_TOKEN",
                                       description: "GitLab Access Token",
-                                      optional: true),
+                                      optional: true,
+                                      sensitive: true),
 
         # Keychain
         FastlaneCore::ConfigItem.new(key: :keychain_name,
@@ -374,6 +377,11 @@ module Match
                                      description: "Force encryption to use legacy cbc algorithm for backwards compatibility with older match versions",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :offline_profile,
+                                     env_name: "MATCH_OFFLINE_PROFILE",
+                                     description: "Enable profile with 'Offline Support' (7 day validity). Requires Apple ID login, not supported with App Store Connect API key authentication",
+                                     type: Boolean,
+                                     default_value: false),
 
         # other
         FastlaneCore::ConfigItem.new(key: :verbose,

data/match/lib/match/runner.rb

@@ -24,6 +24,8 @@ module Match
 
     attr_accessor :storage
 
+    attr_accessor :encryption
+
     attr_accessor :cache
 
     # rubocop:disable Metrics/PerceivedComplexity
@@ -45,14 +47,14 @@ module Match
       storage.download
 
       # Init the encryption only after the `storage.download` was called to have the right working directory
-      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+      self.encryption = Encryption.for_storage_mode(params[:storage_mode], {
         git_url: params[:git_url],
         s3_bucket: params[:s3_bucket],
         s3_skip_encryption: params[:s3_skip_encryption],
         working_directory: storage.working_directory,
         force_legacy_encryption: params[:force_legacy_encryption]
       })
-      encryption.decrypt_files if encryption
+      self.encryption.decrypt_files if self.encryption
 
       unless params[:readonly]
         self.spaceship = SpaceshipEnsure.new(params[:username], params[:team_id], params[:team_name], api_token(params))
@@ -117,7 +119,7 @@ module Match
 
       has_file_changes = self.files_to_commit.count > 0 || self.files_to_delete.count > 0
       if has_file_changes && !params[:readonly]
-        encryption.encrypt_files if encryption
+        self.encryption.encrypt_files if self.encryption
         storage.save_changes!(files_to_commit: self.files_to_commit, files_to_delete: self.files_to_delete)
       end
 
@@ -209,6 +211,10 @@ module Match
         self.files_to_commit << cert_path
         self.files_to_commit << private_key_path
 
+        # We pause to upload certs immediatly (or renewals) in case later logic fails, leaving
+        # AppStore with a set of files de-synced from match storage. See fastlane/fastlane#30140
+        save_changes_immediately!(params)
+
         # Reset certificates cache since we have a new cert.
         self.cache.reset_certificates
       else
@@ -255,6 +261,27 @@ module Match
       return File.basename(cert_path).gsub(".cer", "") # Certificate ID
     end
 
+    # Saves all pending file changes to storage right away, keeping the
+    # working directory around so the current run can continue using it
+    def save_changes_immediately!(params)
+      return if params[:readonly]
+      return if self.files_to_commit.empty? && self.files_to_delete.empty?
+
+      self.encryption.encrypt_files if self.encryption
+      begin
+        self.storage.save_changes!(files_to_commit: self.files_to_commit,
+                                   files_to_delete: self.files_to_delete,
+                                   clear_working_directory: false)
+      ensure
+        # Always hand back a decrypted working directory, 2nd upload will hopefully work.
+        self.encryption.decrypt_files if self.encryption
+      end
+
+      # We may have another upload at end (profiles) so reset our cert file(s).
+      self.files_to_commit = []
+      self.files_to_delete = []
+    end
+
     # @return [String] Path to certificate or P12 key
     def select_cert_or_key(paths:, certificate_id: nil)
       return paths.last if certificate_id.to_s.strip.empty?

data/match/lib/match/storage/git_storage.rb

@@ -1,4 +1,5 @@
 require 'fastlane_core/command_executor'
+require 'open3'
 
 require_relative '../module'
 require_relative './interface'
@@ -7,6 +8,9 @@ module Match
   module Storage
     # Store the code signing identities in a git repo
     class GitStorage < Interface
+      DEFAULT_BRANCH = "main"
+      PRIVATE_KEY_ENV = "MATCH_SSH_ADD_PRIVATE_KEY"
+
       # User provided values
       attr_accessor :git_url
       attr_accessor :shallow_clone
@@ -85,11 +89,6 @@ module Match
         self.working_directory = Dir.mktmpdir
 
         command = "git clone #{self.git_url.shellescape} #{self.working_directory.shellescape}"
-        # HTTP headers are supposed to be case-insensitive but
-        # Bitbucket requires `Authorization: Basic` and `Authorization Bearer` to work
-        # https://github.com/fastlane/fastlane/pull/15928
-        command << " -c http.extraheader='Authorization: Basic #{self.git_basic_authorization}'" unless self.git_basic_authorization.nil?
-        command << " -c http.extraheader='Authorization: Bearer #{self.git_bearer_authorization}'" unless self.git_bearer_authorization.nil?
 
         if self.shallow_clone
           command << " --depth 1"
@@ -117,13 +116,10 @@ module Match
                                             print_command: FastlaneCore::Globals.verbose?)
           end
         rescue
-          UI.error("Error cloning certificates repo, please make sure you have read access to the repository you want to use")
           if self.branch && self.clone_branch_directly
             UI.error("You passed '#{self.branch}' as branch in combination with the `clone_branch_directly` flag. Please remove `clone_branch_directly` flag on the first run for _match_ to create the branch.")
           end
-          UI.error("Run the following command manually to make sure you're properly authenticated:")
-          UI.command(command)
-          UI.user_error!("Error cloning certificates git repo, please make sure you have access to the repository - see instructions above")
+          UI.user_error!("Error cloning certificates repo, please make sure you have read access to the repository you want to use")
         end
 
         add_user_config(self.git_full_name, self.git_user_email)
@@ -168,8 +164,10 @@ module Match
       def generate_matchfile_content
         UI.important("Please create a new, private git repository to store the certificates and profiles there")
         url = UI.input("URL of the Git Repo: ")
+        branch = UI.input("Branch of the Git Repo (leave blank to use '#{DEFAULT_BRANCH}'): ").to_s.strip
+        branch = DEFAULT_BRANCH if branch.empty?
 
-        return "git_url(\"#{url}\")"
+        return "git_url(\"#{url}\")\ngit_branch(\"#{branch}\")"
       end
 
       def list_files(file_name: "", file_ext: "")
@@ -181,7 +179,8 @@ module Match
           ssh_add = File.expand_path(self.git_private_key).shellescape.to_s
         else
           UI.message("Private key file does not exist, will continue by using it as a raw key.")
-          ssh_add = "- <<< \"#{self.git_private_key}\""
+          # From the environment (git_env_values), so the key is not on bash's command line
+          ssh_add = "- <<< \"$#{PRIVATE_KEY_ENV}\""
         end
         return "ssh-agent bash -c 'ssh-add #{ssh_add}; #{command}'"
       end
@@ -267,9 +266,43 @@ module Match
       def git_env_values
         env_values = { 'GIT_TERMINAL_PROMPT' => '0' }
         env_values['GIT_SSH_COMMAND'] = non_interactive_git_ssh_command
+        env_values[PRIVATE_KEY_ENV] = self.git_private_key unless self.git_private_key.nil?
+        env_values.merge(authorization_env_values)
+      end
+
+      # Through git's environment (git 2.31+), so the header is neither on the command line nor stored in .git/config
+      def authorization_env_values
+        headers = []
+        # HTTP headers are supposed to be case-insensitive but
+        # Bitbucket requires `Authorization: Basic` and `Authorization Bearer` to work
+        # https://github.com/fastlane/fastlane/pull/15928
+        headers << "Authorization: Basic #{self.git_basic_authorization}" unless self.git_basic_authorization.nil?
+        headers << "Authorization: Bearer #{self.git_bearer_authorization}" unless self.git_bearer_authorization.nil?
+        return {} if headers.empty?
+
+        version = git_version
+        UI.user_error!("git_basic_authorization and git_bearer_authorization need git 2.31 or later, found git #{version}") if version && Gem::Version.new(version) < Gem::Version.new('2.31')
+
+        # Keep pairs the user already passes this way
+        first = ENV['GIT_CONFIG_COUNT'].to_i
+        env_values = { 'GIT_CONFIG_COUNT' => (first + headers.count).to_s }
+        headers.each_with_index do |header, i|
+          env_values["GIT_CONFIG_KEY_#{first + i}"] = 'http.extraheader'
+          env_values["GIT_CONFIG_VALUE_#{first + i}"] = header
+        end
         env_values
       end
 
+      # nil when git cannot be run: cloning reports that
+      def git_version
+        @git_version ||= begin
+          output, status = Open3.capture2('git', '--version')
+          output[/\d+\.\d+(\.\d+)?/] if status.success?
+        rescue Errno::ENOENT
+          nil
+        end
+      end
+
       def non_interactive_git_ssh_command
         ssh_command = ENV['GIT_SSH_COMMAND']
 

data/match/lib/match/storage/gitlab/secure_file.rb

@@ -1,4 +1,5 @@
 require 'open-uri'
+require 'ostruct'
 
 require_relative '../../module'
 
@@ -39,7 +40,7 @@ module Match
 
             create_subfolders(working_directory)
             File.open(destination_file, "wb") do |saved_file|
-              URI.open(url, "rb", { @client.authentication_key => @client.authentication_value }) do |data|
+              url.open("rb", { @client.authentication_key => @client.authentication_value }) do |data|
                 saved_file.write(data.read)
               end
 

data/match/lib/match/storage/google_cloud_storage.rb

@@ -82,7 +82,12 @@ module Match
         if self.google_cloud_keys_file.to_s.length > 0
           # Extract the Project ID from the `JSON` file
           # so the user doesn't have to provide it manually
-          keys_file_content = JSON.parse(File.read(self.google_cloud_keys_file))
+          begin
+            keys_file_content = JSON.parse(File.read(self.google_cloud_keys_file))
+          rescue JSON::ParserError
+            # Don't dump secret into logs in case a secret (p8) is passed. See fastlane/fastlane#21017
+            UI.user_error!("Provided keys file on path #{File.expand_path(self.google_cloud_keys_file)} is not a valid JSON file")
+          end
           if google_cloud_project_id.to_s.length > 0 && google_cloud_project_id != keys_file_content["project_id"]
             UI.important("The google_cloud_keys_file's project ID ('#{keys_file_content['project_id']}') doesn't match the google_cloud_project_id ('#{google_cloud_project_id}'). This may be the wrong keys file.")
           end

data/match/lib/match/storage/interface.rb

@@ -47,11 +47,14 @@ module Match
       # given remote server
       # This method is blocking, meaning it might take multiple
       # seconds or longer to run
-      # @parameter files_to_commit [Array] Array to paths to files
+      # @param files_to_commit [Array] Array to paths to files
       #   that should be committed to the storage provider
-      # @parameter custom_message: [String] Custom change message
-      #           that's optional, is used for commit title
-      def save_changes!(files_to_commit: nil, files_to_delete: nil, custom_message: nil)
+      # @param custom_message: [String] Custom change message
+      #   that's optional, is used for commit title
+      # @param clear_working_directory: [Bool] Pass `false` to keep
+      #   the local working directory after saving, so more
+      #   changes can be made and saved later in the same run
+      def save_changes!(files_to_commit: nil, files_to_delete: nil, custom_message: nil, clear_working_directory: true)
         # Custom init to `[]` in case `nil` is passed
         files_to_commit ||= []
         files_to_delete ||= []
@@ -85,7 +88,7 @@ module Match
           end
         end
       ensure # Always clear working_directory after save
-        self.clear_changes
+        self.clear_changes if clear_working_directory
       end
 
       def upload_files(files_to_upload: [], custom_message: nil)

data/pem/lib/pem/manager.rb

@@ -20,7 +20,7 @@ module PEM
           remaining_days = (existing_certificate.expires - Time.now) / 60 / 60 / 24
 
           display_platform = ''
-          unless PEM.config[:website_push]
+          unless PEM.config[:website_push] || PEM.config[:voip_push]
             display_platform = "#{PEM.config[:platform]} "
           end
 
@@ -94,6 +94,8 @@ module PEM
       def certificate
         if PEM.config[:website_push]
           Spaceship.certificate.website_push
+        elsif PEM.config[:voip_push]
+          Spaceship.certificate.voip_push
         else
           platform = PEM.config[:platform]
           UI.user_error!('platform parameter is unspecified.') unless platform
@@ -123,6 +125,8 @@ module PEM
           'development'
         elsif PEM.config[:website_push]
           'website'
+        elsif PEM.config[:voip_push]
+          'voip'
         else
           'production'
         end

data/pem/lib/pem/module.rb

@@ -6,10 +6,6 @@ module PEM
     attr_accessor :config
   end
 
-  tmp_dir = Dir.tmpdir
-  TMP_FOLDER = "#{tmp_dir}/fastlane/PEM/"
-  FileUtils.mkdir_p(TMP_FOLDER)
-
   ENV['FASTLANE_TEAM_ID'] ||= ENV["PEM_TEAM_ID"]
   ENV['DELIVER_USER'] ||= ENV["PEM_USERNAME"]
 

data/pem/lib/pem/options.rb

@@ -30,6 +30,12 @@ module PEM
                                      is_string: false,
                                      conflicting_options: [:development],
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :voip_push,
+                                     env_name: "PEM_VOIP_PUSH",
+                                     description: "Create a VoIP Services certificate",
+                                     is_string: false,
+                                     conflicting_options: [:development, :website_push],
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :generate_p12,
                                      env_name: "PEM_GENERATE_P12_FILE",
                                      description: "Generate a p12 file additionally to a PEM file",

data/pilot/lib/pilot/build_manager.rb

@@ -296,6 +296,9 @@ module Pilot
 
       # Handle beta app clip invocations
       update_app_clip_invocations(options: options, build: build)
+
+      # Handle routing app coverage file
+      update_routing_app_coverage(options)
     end
 
     def self.truncate_changelog(changelog)
@@ -679,6 +682,35 @@ module Pilot
         end
       end
     end
+
+    def update_routing_app_coverage(options)
+      # Skip logic entirely if no coverage file passed. So status-quo stays the same.
+      return unless options[:routing_app_coverage_file]
+
+      # We can only attach a coverage file to build upload - so pick the most recent edit.
+      platform = Spaceship::ConnectAPI::Platform.map(fetch_app_platform)
+      version = app.get_edit_app_store_version(platform: platform)
+      unless version
+        UI.important("Skipping upload of routing app coverage file - could not find an editable app store version")
+        return
+      end
+
+      routing_app_coverage =
+        begin
+          version.fetch_routing_app_coverage
+        rescue => error
+          UI.important("Error fetching routing app coverage - #{error.message}")
+          nil
+        end
+
+      if routing_app_coverage
+        UI.message("Removing previous routing app coverage file from App Store Connect")
+        routing_app_coverage.delete!
+      end
+
+      UI.message("Uploading routing app coverage file to App Store Connect")
+      version.upload_routing_app_coverage(path: options[:routing_app_coverage_file])
+    end
   end
   # rubocop:enable Metrics/ClassLength
 end

data/pilot/lib/pilot/options.rb

@@ -201,6 +201,14 @@ module Pilot
                                      optional: true,
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :routing_app_coverage_file,
+                                     env_name: "PILOT_ROUTING_APP_COVERAGE_FILE",
+                                     description: "Path to the routing app coverage file (`.geojson`) that is required for routing apps. It will be uploaded to the editable App Store version of the app",
+                                     optional: true,
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Could not find routing app coverage file at path '#{File.expand_path(value)}'") unless File.exist?(value)
+                                       UI.user_error!("Routing app coverage file must be a .geojson file") unless File.extname(value).casecmp(".geojson").zero?
+                                     end),
 
         # distribution
         FastlaneCore::ConfigItem.new(key: :distribute_only,

data/precheck/lib/precheck/rule_processor.rb

@@ -1,3 +1,4 @@
+require 'ostruct'
 require 'spaceship/tunes/language_item'
 require 'spaceship/tunes/iap_list'
 require 'fastlane/markdown_table_formatter'

data/produce/lib/produce/developer_center.rb

@@ -1,5 +1,7 @@
+require 'ostruct'
 require 'spaceship'
 require_relative 'module'
+require_relative 'service'
 
 module Produce
   class DeveloperCenter
@@ -86,6 +88,8 @@ module Produce
     end
 
     def create_new_app
+      return create_new_app_via_connect_api if using_connect_api?
+
       ENV["CREATED_NEW_APP_ID"] = Time.now.to_i.to_s
       if app_exists?
         UI.success("[DevCenter] App '#{Produce.config[:app_identifier]}' already exists, nothing to do on the Dev Center")
@@ -118,6 +122,31 @@ module Produce
       return true
     end
 
+    # App Store Connect API key path — used instead of Spaceship.login.
+    def create_new_app_via_connect_api
+      config_enabled_services = Produce.config[:enable_services] || Produce.config[:enabled_features]
+
+      existing = Spaceship::ConnectAPI::BundleId.find(app_identifier)
+      if existing
+        UI.success("[DevCenter] App '#{Produce.config[:app_identifier]}' already exists, nothing to do on the Dev Center")
+        return true
+      end
+
+      app_name = Produce.config[:app_name]
+      UI.message("Creating new app '#{app_name}' on the Apple Dev Center")
+
+      connect_api_platform = Spaceship::ConnectAPI::BundleIdPlatform.map(platform)
+      bundle_id = Spaceship::ConnectAPI::BundleId.create(name: app_name, platform: connect_api_platform, identifier: app_identifier)
+
+      UI.crash!("Something went wrong when creating the new app - it's not listed in the apps list") unless bundle_id
+
+      UI.message("Created app #{bundle_id.id}")
+      enable_inline_services(config_enabled_services) if config_enabled_services && !config_enabled_services.empty?
+      UI.success("Finished creating new app '#{app_name}' on the Dev Center")
+
+      return true
+    end
+
     def enable_services
       app_service = Spaceship.app_service
       enabled_clean_options = {}
@@ -161,6 +190,17 @@ module Produce
 
     private
 
+    # Delegates to Service#update instead of duplicating its ~40-capability mapping.
+    # Skips any capability explicitly marked "off" — meaningless on a brand-new app.
+    def enable_inline_services(config_enabled_services)
+      to_enable = config_enabled_services.reject { |_, v| v == SERVICE_OFF }
+      return if to_enable.empty?
+
+      options = OpenStruct.new(to_enable)
+      options.define_singleton_method(:__hash__) { to_enable }
+      Produce::Service.new.update(true, options)
+    end
+
     def platform
       # This was added to support creation of multiple platforms
       # Produce::ItunesConnect can take an array of platforms to create for App Store Connect
@@ -174,9 +214,16 @@ module Produce
       Spaceship.app.find(app_identifier, mac: platform == "osx") != nil
     end
 
+    def using_connect_api?
+      !connect_api_token.nil?
+    end
+
+    def connect_api_token
+      Spaceship::ConnectAPI::Token.from(hash: Produce.config[:api_key], filepath: Produce.config[:api_key_path])
+    end
+
     def login
-      Spaceship.login(Produce.config[:username], nil)
-      Spaceship.select_team
+      Produce.authenticate_connect_api!
     end
   end
 end

data/produce/lib/produce/itunes_connect.rb

@@ -38,7 +38,7 @@ module Produce
         end
 
         # Produce.config[:itc_users]
-        application = Spaceship::ConnectAPI::App.create(
+        Spaceship::ConnectAPI::App.create(
           name: Produce.config[:app_name],
           version_string: Produce.config[:app_version] || "1.0",
           sku: Produce.config[:sku].to_s,

data/produce/lib/produce/module.rb

@@ -1,4 +1,5 @@
 require 'fastlane_core/helper'
+require 'spaceship'
 
 module Produce
   class << self
@@ -11,4 +12,24 @@ module Produce
 
   ENV['FASTLANE_TEAM_ID'] ||= ENV["PRODUCE_TEAM_ID"]
   ENV['DELIVER_USER'] ||= ENV["PRODUCE_USERNAME"]
+
+  # Shared by DeveloperCenter#login and Service#bundle_id. Prefers a configured API key, falls
+  # back to a token already set by another lane (e.g. app_store_connect_api_key), then falls
+  # back to username-based session login.
+  def self.authenticate_connect_api!
+    if (token = Spaceship::ConnectAPI::Token.from(hash: Produce.config[:api_key], filepath: Produce.config[:api_key_path]))
+      UI.message("Authenticating with App Store Connect API Key")
+
+      # `current_team_id:` avoids a live, session-based team_id lookup elsewhere in
+      # ConnectAPI's provisioning client, which has no session to use here.
+      Spaceship::ConnectAPI.client = Spaceship::ConnectAPI::Client.new(token: token, current_team_id: Produce.config[:team_id])
+    elsif !Spaceship::ConnectAPI.token.nil?
+      UI.message("Using existing authorization token for App Store Connect API")
+    else
+      UI.message("Starting login with user '#{Produce.config[:username]}'")
+      Spaceship.login(Produce.config[:username], nil)
+      Spaceship.select_team
+      UI.message("Successfully logged in")
+    end
+  end
 end

data/produce/lib/produce/options.rb

@@ -17,6 +17,23 @@ module Produce
                                      code_gen_sensitive: true,
                                      default_value: user,
                                      default_value_dynamic: true),
+
+        # App Store Connect API
+        FastlaneCore::ConfigItem.new(key: :api_key_path,
+                                     env_names: ["PRODUCE_API_KEY_PATH", "APP_STORE_CONNECT_API_KEY_PATH"],
+                                     description: "Path to your App Store Connect API Key JSON file (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-json-file)",
+                                     optional: true,
+                                     conflicting_options: [:api_key],
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Couldn't find API key JSON file at path '#{value}'") unless File.exist?(value)
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :api_key,
+                                     env_names: ["PRODUCE_API_KEY", "APP_STORE_CONNECT_API_KEY"],
+                                     description: "Your App Store Connect API Key information (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-hash-option)",
+                                     type: Hash,
+                                     optional: true,
+                                     sensitive: true,
+                                     conflicting_options: [:api_key_path]),
         FastlaneCore::ConfigItem.new(key: :app_identifier,
                                      env_name: "PRODUCE_APP_IDENTIFIER",
                                      short_option: "-a",