fastlane 2.240.0 → 2.241.0

data/fastlane_core/lib/fastlane_core/ui/implementations/shell.rb

@@ -1,6 +1,7 @@
 require_relative '../../helper'
 require_relative '../../globals'
 require_relative '../../env'
+require_relative '../../secrets'
 
 require_relative '../interface'
 
@@ -23,7 +24,7 @@ module FastlaneCore
       end
 
       @log.formatter = proc do |severity, datetime, progname, msg|
-        "#{format_string(datetime, severity)}#{msg}\n"
+        "#{format_string(datetime, severity)}#{Secrets.mask(msg.to_s)}\n"
       end
 
       @log

data/fastlane_core/lib/fastlane_core.rb

@@ -2,6 +2,7 @@ require_relative 'fastlane_core/globals'
 # Ruby monkey-patches - should be before almost all else
 require_relative 'fastlane_core/core_ext/string'
 require_relative 'fastlane_core/core_ext/shellwords'
+require_relative 'fastlane_core/secrets'
 
 require_relative 'fastlane_core/analytics/action_completion_context'
 require_relative 'fastlane_core/analytics/action_launch_context'

data/frameit/lib/frameit/device.rb

@@ -15,7 +15,7 @@ module Frameit
     attr_reader :priority_config_key
 
     def initialize(id, formatted_name, priority, resolutions, density_ppi, default_color, platform = Platform::IOS, deliver_screen_id = nil, priority_config_key = nil)
-      Raise("Priority mustn't be higher than #{REQUIRED_PRIORITY}") if priority > REQUIRED_PRIORITY
+      raise "Priority mustn't be higher than #{REQUIRED_PRIORITY}" if priority > REQUIRED_PRIORITY
       @id = id
       @deliver_screen_id = deliver_screen_id
       @formatted_name = formatted_name

data/frameit/lib/frameit/frame_downloader.rb

@@ -20,6 +20,8 @@ module Frameit
 
       files = JSON.parse(download_file("files.json"))
       files.each_with_index do |current, index|
+        # files.json is downloaded: only accept plain file names, so nothing is written outside templates_path
+        UI.user_error!("Unexpected frame file name '#{current}'") if current.include?("/") || current.include?("\\") || current.start_with?(".")
         content = download_file(current, txt: "#{index + 1} of #{files.count} files")
         File.binwrite(File.join(templates_path, current), content)
       end

data/frameit/lib/frameit/runner.rb

@@ -38,8 +38,9 @@ module Frameit
             if editor.should_skip?
               UI.message("Skipping framing of screenshot #{screenshot.path}.  No title provided in your Framefile.json or title.strings.")
             else
-              Helper.show_loading_indicator("Framing screenshot '#{full_path}'")
-              editor.frame!
+              Helper.with_loading_indicator("Framing screenshot '#{full_path}'") do
+                editor.frame!
+              end
             end
           rescue => ex
             UI.error(ex.to_s)

data/frameit/lib/frameit/screenshot.rb

@@ -48,7 +48,6 @@ module Frameit
     # Device name for a given screen size. Used to use the correct template
     def device_name
       @device.formatted_name
-      # rubocop:enable Require/MissingRequireStatement
     end
 
     def default_color

data/gym/lib/gym/generators/build_command_generator.rb

@@ -34,11 +34,11 @@ module Gym
 
         options = []
         options += project_path_array
-        options << "-sdk '#{config[:sdk]}'" if config[:sdk]
-        options << "-toolchain '#{config[:toolchain]}'" if config[:toolchain]
-        options << "-destination '#{config[:destination]}'" if config[:destination]
+        options << "-sdk #{config[:sdk].shellescape}" if config[:sdk]
+        options << "-toolchain #{config[:toolchain].shellescape}" if config[:toolchain]
+        options << "-destination #{config[:destination].shellescape}" if config[:destination]
         options << "-archivePath #{archive_path.shellescape}" unless config[:skip_archive]
-        options << "-resultBundlePath '#{result_bundle_path}'" if config[:result_bundle]
+        options << "-resultBundlePath #{result_bundle_path.shellescape}" if config[:result_bundle]
         options << "-showBuildTimingSummary" if config[:build_timing_summary]
         if config[:use_system_scm] && !options.include?("-scmProvider system")
           options << "-scmProvider system"

data/gym/lib/gym/generators/package_command_generator_xcode7.rb

@@ -33,10 +33,10 @@ module Gym
         config = Gym.config
 
         options = []
-        options << "-exportOptionsPlist '#{config_path}'"
+        options << "-exportOptionsPlist #{config_path.shellescape}"
         options << "-archivePath #{BuildCommandGenerator.archive_path.shellescape}"
-        options << "-exportPath '#{temporary_output_path}'"
-        options << "-toolchain '#{config[:toolchain]}'" if config[:toolchain]
+        options << "-exportPath #{temporary_output_path.shellescape}"
+        options << "-toolchain #{config[:toolchain].shellescape}" if config[:toolchain]
         options << config[:export_xcargs] if config[:export_xcargs]
         options << config[:xcargs] if config[:xcargs]
 

data/gym/lib/gym/runner.rb

@@ -223,7 +223,7 @@ module Gym
       UI.message("Compressing #{available_dsyms.count} dSYM(s)") unless Gym.config[:silent]
 
       output_path = File.expand_path(File.join(Gym.config[:output_directory], Gym.config[:output_name] + ".app.dSYM.zip"))
-      command = "cd '#{containing_directory}' && zip -r '#{output_path}' *.dSYM"
+      command = "cd #{containing_directory.shellescape} && zip -r #{output_path.shellescape} *.dSYM"
       Helper.backticks(command, print: !Gym.config[:silent])
       puts("") # new line
 

data/internal/README.md

@@ -8,4 +8,4 @@
 
 ------
 
-Internal scripts for Rubocop linting & Rake tasks.
+Internal scripts for Rubocop linting, Rake tasks, and the docs checks and generation the Fastfile runs (`docs/`).

data/match/lib/match/encryption/openssl.rb

@@ -93,8 +93,12 @@ module Match
       def fetch_password!
         password = ENV["MATCH_PASSWORD"]
         unless password
-          item = Security::InternetPassword.find(server: server_name(self.keychain_name))
-          password = item.password if item
+          begin
+            item = Security::InternetPassword.find(server: server_name(self.keychain_name))
+            password = item.password if item
+          rescue Security::Error => ex
+            UI.important("Could not read the local keychain: #{ex.message}")
+          end
         end
 
         unless password

data/match/lib/match/generator.rb

@@ -92,6 +92,7 @@ module Match
         fail_on_name_taken: params[:fail_on_name_taken],
         include_all_certificates: params[:include_all_certificates],
         include_mac_in_profiles: params[:include_mac_in_profiles],
+        offline_profile: params[:offline_profile],
       }
 
       values[:platform] = params[:platform]

data/match/lib/match/options.rb

@@ -160,14 +160,14 @@ module Match
         FastlaneCore::ConfigItem.new(key: :git_basic_authorization,
                                      env_name: "MATCH_GIT_BASIC_AUTHORIZATION",
                                      sensitive: true,
-                                     description: "Use a basic authorization header to access the git repo (e.g.: access via HTTPS, GitHub Actions, etc), usually a string in Base64",
+                                     description: "Use a basic authorization header to access the git repo (e.g.: access via HTTPS, GitHub Actions, etc), usually a string in Base64. Needs git 2.31 or later",
                                      conflicting_options: [:git_bearer_authorization, :git_private_key],
                                      optional: true,
                                      default_value: nil),
         FastlaneCore::ConfigItem.new(key: :git_bearer_authorization,
                                      env_name: "MATCH_GIT_BEARER_AUTHORIZATION",
                                      sensitive: true,
-                                     description: "Use a bearer authorization header to access the git repo (e.g.: access to an Azure DevOps repository), usually a string in Base64",
+                                     description: "Use a bearer authorization header to access the git repo (e.g.: access to an Azure DevOps repository), usually a string in Base64. Needs git 2.31 or later",
                                      conflicting_options: [:git_basic_authorization, :git_private_key],
                                      optional: true,
                                      default_value: nil),
@@ -209,7 +209,8 @@ module Match
         FastlaneCore::ConfigItem.new(key: :s3_access_key,
                                      env_name: "MATCH_S3_ACCESS_KEY",
                                      description: "S3 access key",
-                                     optional: true),
+                                     optional: true,
+                                     sensitive: true),
         FastlaneCore::ConfigItem.new(key: :s3_secret_access_key,
                                      env_name: "MATCH_S3_SECRET_ACCESS_KEY",
                                      description: "S3 secret access key",
@@ -247,11 +248,13 @@ module Match
         FastlaneCore::ConfigItem.new(key: :job_token,
                                       env_name: "CI_JOB_TOKEN",
                                       description: "GitLab CI_JOB_TOKEN",
-                                      optional: true),
+                                      optional: true,
+                                      sensitive: true),
         FastlaneCore::ConfigItem.new(key: :private_token,
                                       env_name: "PRIVATE_TOKEN",
                                       description: "GitLab Access Token",
-                                      optional: true),
+                                      optional: true,
+                                      sensitive: true),
 
         # Keychain
         FastlaneCore::ConfigItem.new(key: :keychain_name,
@@ -374,6 +377,11 @@ module Match
                                      description: "Force encryption to use legacy cbc algorithm for backwards compatibility with older match versions",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :offline_profile,
+                                     env_name: "MATCH_OFFLINE_PROFILE",
+                                     description: "Enable profile with 'Offline Support' (7 day validity). Requires Apple ID login, not supported with App Store Connect API key authentication",
+                                     type: Boolean,
+                                     default_value: false),
 
         # other
         FastlaneCore::ConfigItem.new(key: :verbose,

data/match/lib/match/runner.rb

@@ -24,6 +24,8 @@ module Match
 
     attr_accessor :storage
 
+    attr_accessor :encryption
+
     attr_accessor :cache
 
     # rubocop:disable Metrics/PerceivedComplexity
@@ -45,14 +47,14 @@ module Match
       storage.download
 
       # Init the encryption only after the `storage.download` was called to have the right working directory
-      encryption = Encryption.for_storage_mode(params[:storage_mode], {
+      self.encryption = Encryption.for_storage_mode(params[:storage_mode], {
         git_url: params[:git_url],
         s3_bucket: params[:s3_bucket],
         s3_skip_encryption: params[:s3_skip_encryption],
         working_directory: storage.working_directory,
         force_legacy_encryption: params[:force_legacy_encryption]
       })
-      encryption.decrypt_files if encryption
+      self.encryption.decrypt_files if self.encryption
 
       unless params[:readonly]
         self.spaceship = SpaceshipEnsure.new(params[:username], params[:team_id], params[:team_name], api_token(params))
@@ -117,7 +119,7 @@ module Match
 
       has_file_changes = self.files_to_commit.count > 0 || self.files_to_delete.count > 0
       if has_file_changes && !params[:readonly]
-        encryption.encrypt_files if encryption
+        self.encryption.encrypt_files if self.encryption
         storage.save_changes!(files_to_commit: self.files_to_commit, files_to_delete: self.files_to_delete)
       end
 
@@ -209,6 +211,10 @@ module Match
         self.files_to_commit << cert_path
         self.files_to_commit << private_key_path
 
+        # We pause to upload certs immediatly (or renewals) in case later logic fails, leaving
+        # AppStore with a set of files de-synced from match storage. See fastlane/fastlane#30140
+        save_changes_immediately!(params)
+
         # Reset certificates cache since we have a new cert.
         self.cache.reset_certificates
       else
@@ -255,6 +261,27 @@ module Match
       return File.basename(cert_path).gsub(".cer", "") # Certificate ID
     end
 
+    # Saves all pending file changes to storage right away, keeping the
+    # working directory around so the current run can continue using it
+    def save_changes_immediately!(params)
+      return if params[:readonly]
+      return if self.files_to_commit.empty? && self.files_to_delete.empty?
+
+      self.encryption.encrypt_files if self.encryption
+      begin
+        self.storage.save_changes!(files_to_commit: self.files_to_commit,
+                                   files_to_delete: self.files_to_delete,
+                                   clear_working_directory: false)
+      ensure
+        # Always hand back a decrypted working directory, 2nd upload will hopefully work.
+        self.encryption.decrypt_files if self.encryption
+      end
+
+      # We may have another upload at end (profiles) so reset our cert file(s).
+      self.files_to_commit = []
+      self.files_to_delete = []
+    end
+
     # @return [String] Path to certificate or P12 key
     def select_cert_or_key(paths:, certificate_id: nil)
       return paths.last if certificate_id.to_s.strip.empty?

data/match/lib/match/storage/git_storage.rb

@@ -1,4 +1,5 @@
 require 'fastlane_core/command_executor'
+require 'open3'
 
 require_relative '../module'
 require_relative './interface'
@@ -7,6 +8,9 @@ module Match
   module Storage
     # Store the code signing identities in a git repo
     class GitStorage < Interface
+      DEFAULT_BRANCH = "main"
+      PRIVATE_KEY_ENV = "MATCH_SSH_ADD_PRIVATE_KEY"
+
       # User provided values
       attr_accessor :git_url
       attr_accessor :shallow_clone
@@ -85,11 +89,6 @@ module Match
         self.working_directory = Dir.mktmpdir
 
         command = "git clone #{self.git_url.shellescape} #{self.working_directory.shellescape}"
-        # HTTP headers are supposed to be case-insensitive but
-        # Bitbucket requires `Authorization: Basic` and `Authorization Bearer` to work
-        # https://github.com/fastlane/fastlane/pull/15928
-        command << " -c http.extraheader='Authorization: Basic #{self.git_basic_authorization}'" unless self.git_basic_authorization.nil?
-        command << " -c http.extraheader='Authorization: Bearer #{self.git_bearer_authorization}'" unless self.git_bearer_authorization.nil?
 
         if self.shallow_clone
           command << " --depth 1"
@@ -165,8 +164,10 @@ module Match
       def generate_matchfile_content
         UI.important("Please create a new, private git repository to store the certificates and profiles there")
         url = UI.input("URL of the Git Repo: ")
+        branch = UI.input("Branch of the Git Repo (leave blank to use '#{DEFAULT_BRANCH}'): ").to_s.strip
+        branch = DEFAULT_BRANCH if branch.empty?
 
-        return "git_url(\"#{url}\")"
+        return "git_url(\"#{url}\")\ngit_branch(\"#{branch}\")"
       end
 
       def list_files(file_name: "", file_ext: "")
@@ -178,7 +179,8 @@ module Match
           ssh_add = File.expand_path(self.git_private_key).shellescape.to_s
         else
           UI.message("Private key file does not exist, will continue by using it as a raw key.")
-          ssh_add = "- <<< \"#{self.git_private_key}\""
+          # From the environment (git_env_values), so the key is not on bash's command line
+          ssh_add = "- <<< \"$#{PRIVATE_KEY_ENV}\""
         end
         return "ssh-agent bash -c 'ssh-add #{ssh_add}; #{command}'"
       end
@@ -264,9 +266,43 @@ module Match
       def git_env_values
         env_values = { 'GIT_TERMINAL_PROMPT' => '0' }
         env_values['GIT_SSH_COMMAND'] = non_interactive_git_ssh_command
+        env_values[PRIVATE_KEY_ENV] = self.git_private_key unless self.git_private_key.nil?
+        env_values.merge(authorization_env_values)
+      end
+
+      # Through git's environment (git 2.31+), so the header is neither on the command line nor stored in .git/config
+      def authorization_env_values
+        headers = []
+        # HTTP headers are supposed to be case-insensitive but
+        # Bitbucket requires `Authorization: Basic` and `Authorization Bearer` to work
+        # https://github.com/fastlane/fastlane/pull/15928
+        headers << "Authorization: Basic #{self.git_basic_authorization}" unless self.git_basic_authorization.nil?
+        headers << "Authorization: Bearer #{self.git_bearer_authorization}" unless self.git_bearer_authorization.nil?
+        return {} if headers.empty?
+
+        version = git_version
+        UI.user_error!("git_basic_authorization and git_bearer_authorization need git 2.31 or later, found git #{version}") if version && Gem::Version.new(version) < Gem::Version.new('2.31')
+
+        # Keep pairs the user already passes this way
+        first = ENV['GIT_CONFIG_COUNT'].to_i
+        env_values = { 'GIT_CONFIG_COUNT' => (first + headers.count).to_s }
+        headers.each_with_index do |header, i|
+          env_values["GIT_CONFIG_KEY_#{first + i}"] = 'http.extraheader'
+          env_values["GIT_CONFIG_VALUE_#{first + i}"] = header
+        end
         env_values
       end
 
+      # nil when git cannot be run: cloning reports that
+      def git_version
+        @git_version ||= begin
+          output, status = Open3.capture2('git', '--version')
+          output[/\d+\.\d+(\.\d+)?/] if status.success?
+        rescue Errno::ENOENT
+          nil
+        end
+      end
+
       def non_interactive_git_ssh_command
         ssh_command = ENV['GIT_SSH_COMMAND']
 

data/match/lib/match/storage/gitlab/secure_file.rb

@@ -1,4 +1,5 @@
 require 'open-uri'
+require 'ostruct'
 
 require_relative '../../module'
 
@@ -39,7 +40,7 @@ module Match
 
             create_subfolders(working_directory)
             File.open(destination_file, "wb") do |saved_file|
-              URI.open(url, "rb", { @client.authentication_key => @client.authentication_value }) do |data|
+              url.open("rb", { @client.authentication_key => @client.authentication_value }) do |data|
                 saved_file.write(data.read)
               end
 

data/match/lib/match/storage/interface.rb

@@ -47,11 +47,14 @@ module Match
       # given remote server
       # This method is blocking, meaning it might take multiple
       # seconds or longer to run
-      # @parameter files_to_commit [Array] Array to paths to files
+      # @param files_to_commit [Array] Array to paths to files
       #   that should be committed to the storage provider
-      # @parameter custom_message: [String] Custom change message
-      #           that's optional, is used for commit title
-      def save_changes!(files_to_commit: nil, files_to_delete: nil, custom_message: nil)
+      # @param custom_message: [String] Custom change message
+      #   that's optional, is used for commit title
+      # @param clear_working_directory: [Bool] Pass `false` to keep
+      #   the local working directory after saving, so more
+      #   changes can be made and saved later in the same run
+      def save_changes!(files_to_commit: nil, files_to_delete: nil, custom_message: nil, clear_working_directory: true)
         # Custom init to `[]` in case `nil` is passed
         files_to_commit ||= []
         files_to_delete ||= []
@@ -85,7 +88,7 @@ module Match
           end
         end
       ensure # Always clear working_directory after save
-        self.clear_changes
+        self.clear_changes if clear_working_directory
       end
 
       def upload_files(files_to_upload: [], custom_message: nil)

data/pem/lib/pem/module.rb

@@ -6,10 +6,6 @@ module PEM
     attr_accessor :config
   end
 
-  tmp_dir = Dir.tmpdir
-  TMP_FOLDER = "#{tmp_dir}/fastlane/PEM/"
-  FileUtils.mkdir_p(TMP_FOLDER)
-
   ENV['FASTLANE_TEAM_ID'] ||= ENV["PEM_TEAM_ID"]
   ENV['DELIVER_USER'] ||= ENV["PEM_USERNAME"]
 

data/precheck/lib/precheck/rule_processor.rb

@@ -1,3 +1,4 @@
+require 'ostruct'
 require 'spaceship/tunes/language_item'
 require 'spaceship/tunes/iap_list'
 require 'fastlane/markdown_table_formatter'

data/produce/lib/produce/developer_center.rb

@@ -1,5 +1,7 @@
+require 'ostruct'
 require 'spaceship'
 require_relative 'module'
+require_relative 'service'
 
 module Produce
   class DeveloperCenter
@@ -86,6 +88,8 @@ module Produce
     end
 
     def create_new_app
+      return create_new_app_via_connect_api if using_connect_api?
+
       ENV["CREATED_NEW_APP_ID"] = Time.now.to_i.to_s
       if app_exists?
         UI.success("[DevCenter] App '#{Produce.config[:app_identifier]}' already exists, nothing to do on the Dev Center")
@@ -118,6 +122,31 @@ module Produce
       return true
     end
 
+    # App Store Connect API key path — used instead of Spaceship.login.
+    def create_new_app_via_connect_api
+      config_enabled_services = Produce.config[:enable_services] || Produce.config[:enabled_features]
+
+      existing = Spaceship::ConnectAPI::BundleId.find(app_identifier)
+      if existing
+        UI.success("[DevCenter] App '#{Produce.config[:app_identifier]}' already exists, nothing to do on the Dev Center")
+        return true
+      end
+
+      app_name = Produce.config[:app_name]
+      UI.message("Creating new app '#{app_name}' on the Apple Dev Center")
+
+      connect_api_platform = Spaceship::ConnectAPI::BundleIdPlatform.map(platform)
+      bundle_id = Spaceship::ConnectAPI::BundleId.create(name: app_name, platform: connect_api_platform, identifier: app_identifier)
+
+      UI.crash!("Something went wrong when creating the new app - it's not listed in the apps list") unless bundle_id
+
+      UI.message("Created app #{bundle_id.id}")
+      enable_inline_services(config_enabled_services) if config_enabled_services && !config_enabled_services.empty?
+      UI.success("Finished creating new app '#{app_name}' on the Dev Center")
+
+      return true
+    end
+
     def enable_services
       app_service = Spaceship.app_service
       enabled_clean_options = {}
@@ -161,6 +190,17 @@ module Produce
 
     private
 
+    # Delegates to Service#update instead of duplicating its ~40-capability mapping.
+    # Skips any capability explicitly marked "off" — meaningless on a brand-new app.
+    def enable_inline_services(config_enabled_services)
+      to_enable = config_enabled_services.reject { |_, v| v == SERVICE_OFF }
+      return if to_enable.empty?
+
+      options = OpenStruct.new(to_enable)
+      options.define_singleton_method(:__hash__) { to_enable }
+      Produce::Service.new.update(true, options)
+    end
+
     def platform
       # This was added to support creation of multiple platforms
       # Produce::ItunesConnect can take an array of platforms to create for App Store Connect
@@ -174,9 +214,16 @@ module Produce
       Spaceship.app.find(app_identifier, mac: platform == "osx") != nil
     end
 
+    def using_connect_api?
+      !connect_api_token.nil?
+    end
+
+    def connect_api_token
+      Spaceship::ConnectAPI::Token.from(hash: Produce.config[:api_key], filepath: Produce.config[:api_key_path])
+    end
+
     def login
-      Spaceship.login(Produce.config[:username], nil)
-      Spaceship.select_team
+      Produce.authenticate_connect_api!
     end
   end
 end

data/produce/lib/produce/itunes_connect.rb

@@ -38,7 +38,7 @@ module Produce
         end
 
         # Produce.config[:itc_users]
-        application = Spaceship::ConnectAPI::App.create(
+        Spaceship::ConnectAPI::App.create(
           name: Produce.config[:app_name],
           version_string: Produce.config[:app_version] || "1.0",
           sku: Produce.config[:sku].to_s,

data/produce/lib/produce/module.rb

@@ -1,4 +1,5 @@
 require 'fastlane_core/helper'
+require 'spaceship'
 
 module Produce
   class << self
@@ -11,4 +12,24 @@ module Produce
 
   ENV['FASTLANE_TEAM_ID'] ||= ENV["PRODUCE_TEAM_ID"]
   ENV['DELIVER_USER'] ||= ENV["PRODUCE_USERNAME"]
+
+  # Shared by DeveloperCenter#login and Service#bundle_id. Prefers a configured API key, falls
+  # back to a token already set by another lane (e.g. app_store_connect_api_key), then falls
+  # back to username-based session login.
+  def self.authenticate_connect_api!
+    if (token = Spaceship::ConnectAPI::Token.from(hash: Produce.config[:api_key], filepath: Produce.config[:api_key_path]))
+      UI.message("Authenticating with App Store Connect API Key")
+
+      # `current_team_id:` avoids a live, session-based team_id lookup elsewhere in
+      # ConnectAPI's provisioning client, which has no session to use here.
+      Spaceship::ConnectAPI.client = Spaceship::ConnectAPI::Client.new(token: token, current_team_id: Produce.config[:team_id])
+    elsif !Spaceship::ConnectAPI.token.nil?
+      UI.message("Using existing authorization token for App Store Connect API")
+    else
+      UI.message("Starting login with user '#{Produce.config[:username]}'")
+      Spaceship.login(Produce.config[:username], nil)
+      Spaceship.select_team
+      UI.message("Successfully logged in")
+    end
+  end
 end

data/produce/lib/produce/options.rb

@@ -17,6 +17,23 @@ module Produce
                                      code_gen_sensitive: true,
                                      default_value: user,
                                      default_value_dynamic: true),
+
+        # App Store Connect API
+        FastlaneCore::ConfigItem.new(key: :api_key_path,
+                                     env_names: ["PRODUCE_API_KEY_PATH", "APP_STORE_CONNECT_API_KEY_PATH"],
+                                     description: "Path to your App Store Connect API Key JSON file (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-json-file)",
+                                     optional: true,
+                                     conflicting_options: [:api_key],
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Couldn't find API key JSON file at path '#{value}'") unless File.exist?(value)
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :api_key,
+                                     env_names: ["PRODUCE_API_KEY", "APP_STORE_CONNECT_API_KEY"],
+                                     description: "Your App Store Connect API Key information (https://docs.fastlane.tools/app-store-connect-api/#using-fastlane-api-key-hash-option)",
+                                     type: Hash,
+                                     optional: true,
+                                     sensitive: true,
+                                     conflicting_options: [:api_key_path]),
         FastlaneCore::ConfigItem.new(key: :app_identifier,
                                      env_name: "PRODUCE_APP_IDENTIFIER",
                                      short_option: "-a",

data/produce/lib/produce/service.rb

@@ -88,7 +88,6 @@ module Produce
     end
 
     # rubocop:disable Metrics/PerceivedComplexity
-    # rubocop:disable Require/MissingRequireStatement
     def update(on, options)
       updated = valid_services_for(options).count
 
@@ -420,10 +419,9 @@ module Produce
 
     def bundle_id
       return @bundle_id if @bundle_id
-      UI.message("Starting login with user '#{Produce.config[:username]}'")
-      Spaceship.login(Produce.config[:username], nil)
-      Spaceship.select_team
-      UI.message("Successfully logged in")
+
+      Produce.authenticate_connect_api!
+
       @bundle_id ||= Spaceship::ConnectAPI::BundleId.find(Produce.config[:app_identifier].to_s)
     end
   end

data/produce/lib/produce.rb

@@ -2,5 +2,4 @@ require_relative 'produce/manager'
 require_relative 'produce/options'
 require_relative 'produce/developer_center'
 require_relative 'produce/itunes_connect'
-require_relative 'produce/available_default_languages'
 require_relative 'produce/module'

data/scan/lib/scan/options.rb

@@ -207,6 +207,13 @@ module Scan
                                      conflict_block: proc do |value|
                                        UI.user_error!("You can't use 'thread_sanitizer' and 'address_sanitizer' options in one run")
                                      end),
+        FastlaneCore::ConfigItem.new(key: :collect_test_diagnostics,
+                                     env_name: "SCAN_COLLECT_TEST_DIAGNOSTICS",
+                                     description: "Whether verbose and long-running diagnostics (like sysdiagnoses or log archives) are collected when testing. Valid values are: on-failure or never. If not specified, the value in the test plan is used. Equivalent to -collect-test-diagnostics (Xcode 14 and up)",
+                                     optional: true,
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Invalid collect_test_diagnostics #{value}") unless ['on-failure', 'never'].include?(value)
+                                     end),
 
         # output
         FastlaneCore::ConfigItem.new(key: :open_report,

data/scan/lib/scan/runner.rb

@@ -327,7 +327,7 @@ module Scan
 
     def open_report
       if !Helper.ci? && Scan.cache[:open_html_report_path]
-        `open --hide '#{Scan.cache[:open_html_report_path]}'`
+        system("open", "--hide", Scan.cache[:open_html_report_path])
       end
     end