@ahmedsamirelsaka/react-native-local-release 2.0.0-rc.1 → 2.0.0-rc.3

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2.0.0-rc.3
+
+- Fix: Fastlane now materializes Android signing passwords from macOS Keychain when `credentials.provider` is `keychain`.
+  `yarn release:beta` (direct Fastlane) no longer fails with `Missing MYAPP_UPLOAD_STORE_PASSWORD` after a Keychain install.
+- Treat literal empty quotes in `.env` / `keystore.properties` as empty values.
+
+## 2.0.0-rc.2
+
+- Remove maintainer-only `docs/PUBLISHING.md` from the published package and GitHub tree.
+- README / docs scrubbed for public launch (no local paths or token-setup checklists).
+
 ## 2.0.0-rc.1
 
 Security-first rewrite for bare React Native apps (release candidate).
@@ -23,7 +34,7 @@ Security-first rewrite for bare React Native apps (release candidate).
 - CI: SHA-pinned actions, npm provenance publish workflow, Dependabot.
 
 ### Migration
-1. Install `2.0.0-rc.1` from npm (`npm tag next` once published).
+1. Install `2.0.0-rc.3` (or newer) from npm (dist-tag `next`).
 2. Run `rn-local-release migrate --project .` (or reinstall; existing config is merged).
 3. Prefer Keychain credentials: `rn-local-release configure --project .`
 4. Confirm `.gitignore` includes `logs/`, `versions/`, and the marked credential block.

package/README.md

@@ -2,8 +2,8 @@
 
 Security-first local Fastlane release toolkit for **bare** React Native apps (iOS + Android).
 
-Package: `@ahmedsamirelsaka/react-native-local-release`  
-Version: **2.0.0-rc.1** (GitHub Release ready; npm `next` tag after you add `NPM_TOKEN` — see [docs/PUBLISHING.md](./docs/PUBLISHING.md))
+Package: [`@ahmedsamirelsaka/react-native-local-release`](https://www.npmjs.com/package/@ahmedsamirelsaka/react-native-local-release)  
+Version: **2.0.0-rc.3** (npm dist-tag `next`)
 
 ## Supported
 
@@ -22,10 +22,10 @@ Version: **2.0.0-rc.1** (GitHub Release ready; npm `next` tag after you add `NPM
 
 ```bash
 # From your React Native app root
-npx @ahmedsamirelsaka/react-native-local-release@2.0.0-rc.1 install --project .
+npx @ahmedsamirelsaka/react-native-local-release@2.0.0-rc.3 install --project .
 
 # Prefer an exact version in package.json so daily commands do not float:
-# "devDependencies": { "@ahmedsamirelsaka/react-native-local-release": "2.0.0-rc.1" }
+# "devDependencies": { "@ahmedsamirelsaka/react-native-local-release": "2.0.0-rc.3" }
 ```
 
 Useful flags:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahmedsamirelsaka/react-native-local-release",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.0-rc.3",
   "description": "Security-first local Fastlane release toolkit for React Native iOS and Android",
   "type": "module",
   "license": "MIT",

package/template/fastlane/lib/rn_local_release.rb

@@ -122,19 +122,73 @@ def load_keystore_properties
   props
 end
 
+def keychain_service_name
+  "rn-local-release:#{File.basename(repo_root)}"
+end
+
+def keychain_get(account)
+  return nil unless FastlaneCore::Helper.mac?
+
+  out, status = Open3.capture2(
+    "security",
+    "find-generic-password",
+    "-s",
+    keychain_service_name,
+    "-a",
+    account,
+    "-w"
+  )
+  return nil unless status.success?
+
+  value = out.to_s.strip
+  value.empty? ? nil : value
+rescue StandardError
+  nil
+end
+
+# Keychain provider stores passwords in macOS Keychain and intentionally leaves
+# them blank in fastlane/.env + android/keystore.properties. Yarn release:*
+# invokes Fastlane directly, so Fastlane must materialize them itself.
+def materialize_keychain_secrets!
+  return unless config.dig("credentials", "provider").to_s == "keychain"
+  return unless FastlaneCore::Helper.mac?
+
+  {
+    "MYAPP_UPLOAD_STORE_PASSWORD" => keychain_get("MYAPP_UPLOAD_STORE_PASSWORD"),
+    "MYAPP_UPLOAD_KEY_PASSWORD" => keychain_get("MYAPP_UPLOAD_KEY_PASSWORD"),
+    "MYAPP_UPLOAD_KEY_ALIAS" => keychain_get("MYAPP_UPLOAD_KEY_ALIAS"),
+    "ASC_KEY_ID" => keychain_get("ASC_KEY_ID"),
+    "ASC_ISSUER_ID" => keychain_get("ASC_ISSUER_ID")
+  }.each do |key, value|
+    next if value.nil? || value.empty?
+    next unless ENV[key].to_s.strip.empty?
+
+    ENV[key] = value
+  end
+end
+
 def signing_value(name, default: nil)
+  materialize_keychain_secrets!
+
   from_env = ENV[name].to_s.strip
+  # dotenv / Keychain installs may leave literal empty quotes in .env
+  from_env = "" if from_env == '""' || from_env == "''"
   return from_env unless from_env.empty?
 
   from_file = load_keystore_properties[name].to_s.strip
+  from_file = "" if from_file == '""' || from_file == "''"
   return from_file unless from_file.empty?
 
+  from_keychain = keychain_get(name)
+  return from_keychain unless from_keychain.nil? || from_keychain.empty?
+
   return default unless default.nil?
 
   UI.user_error!("Missing #{name}. Set it in fastlane/.env, Keychain, or android/keystore.properties.")
 end
 
 def apply_android_signing_env!
+  materialize_keychain_secrets!
   {
     "MYAPP_UPLOAD_STORE_FILE" => signing_value("MYAPP_UPLOAD_STORE_FILE", default: "keystore.jks"),
     "MYAPP_UPLOAD_STORE_PASSWORD" => signing_value("MYAPP_UPLOAD_STORE_PASSWORD"),

package/docs/PUBLISHING.md

@@ -1,128 +0,0 @@
-# Publishing to npm (`@ahmedsamirelsaka/react-native-local-release`)
-
-CI and GitHub Releases already work. npm publish fails with **`ENEEDAUTH`** until **you** add registry credentials. This cannot be done by the CI bot alone.
-
-Choose **Path A** (fastest) or **Path B** (OIDC, no long-lived token).
-
----
-
-## Path A — Automation token (recommended for first publish)
-
-### 1. Create / sign in to npm
-
-1. Open https://www.npmjs.com/signup (or https://www.npmjs.com/login).
-2. Prefer username **`ahmedsamirelsaka`** so the scope `@ahmedsamirelsaka` matches the package name.  
-   If you already use another username, either:
-   - change `package.json` `"name"` to `@YOUR_NPM_USER/react-native-local-release`, or
-   - create an npm **Organization** named `ahmedsamirelsaka` and add yourself as owner.
-
-### 2. Enable 2FA (required for publishing)
-
-npm → **Account** → **Access Tokens** / Security → enable 2FA (auth-and-writes or auth-only + granular tokens).
-
-### 3. Create an Automation token
-
-1. https://www.npmjs.com/settings/~/tokens  
-   (or Organization → Access Tokens if publishing under an org)
-2. **Generate New Token** → **Granular Access Token** (preferred) or classic **Automation**.
-3. Settings that work:
-   - **Type:** Automation (classic) **or** Granular with permission **Read and write** on packages
-   - **Packages:** allow `@ahmedsamirelsaka/react-native-local-release` (or entire `@ahmedsamirelsaka` scope)
-   - **Organizations:** your org if applicable
-4. Copy the token once (`npm_…`). Store it in a password manager.
-
-### 4. Add the token to GitHub
-
-**Option 1 — Environment secret (matches the workflow):**
-
-1. https://github.com/AhmedSamirElsaka/react-native-local-release/settings/environments  
-2. Open environment **`npm-publish`** (already created).  
-3. **Environment secrets** → **Add secret**  
-   - Name: `NPM_TOKEN`  
-   - Value: paste the npm token  
-
-**Option 2 — Repository secret:**
-
-1. https://github.com/AhmedSamirElsaka/react-native-local-release/settings/secrets/actions  
-2. **New repository secret** → `NPM_TOKEN` → paste token  
-
-> The workflow reads `${{ secrets.NPM_TOKEN }}`. Environment secrets are visible only to jobs that use `environment: npm-publish` (this one does).
-
-### 5. Re-run publish
-
-Either:
-
-- Actions → failed **Publish npm + GitHub Release assets** run → **Re-run failed jobs**
-
-Or from a terminal:
-
-```bash
-cd /Users/ahmedsamir/work/react-native-local-release
-git push origin :refs/tags/v2.0.0-rc.1
-git tag -f -a v2.0.0-rc.1 -m "2.0.0-rc.1"
-git push origin v2.0.0-rc.1
-```
-
-### 6. Verify
-
-```bash
-npm view @ahmedsamirelsaka/react-native-local-release version --tag next
-npx @ahmedsamirelsaka/react-native-local-release@next --help
-```
-
-RC is published under dist-tag **`next`** (not `latest`) until you cut a stable `2.0.0`.
-
----
-
-## Path B — Trusted Publishing (OIDC, no `NPM_TOKEN`)
-
-Best after the package exists once, or if npm allows first-time trusted publish for your account.
-
-1. Publish **once** with Path A (creates the package), **or** follow npm’s current “Trusted Publisher” UI for new packages.
-2. Open the package on npm → **Settings** → **Trusted Publisher** / **Provenance**:
-   - **Repository:** `AhmedSamirElsaka/react-native-local-release`
-   - **Workflow:** `publish.yml` (file under `.github/workflows/publish.yml`)
-   - **Environment:** `npm-publish`
-3. Remove `NPM_TOKEN` later if you want OIDC-only.
-4. Re-run the tag workflow. Job already has `permissions.id-token: write`.
-
-Docs: https://docs.npmjs.com/trusted-publishers
-
----
-
-## Optional: publish once from your laptop
-
-```bash
-cd /Users/ahmedsamir/work/react-native-local-release
-npm login          # or: npm login --auth-type=web
-npm whoami
-npm test
-npm publish --access public --tag next --provenance
-```
-
-Use the same version already in `package.json` (`2.0.0-rc.1`). Do **not** re-publish the same version if CI already succeeded.
-
----
-
-## Checklist
-
-| Step | Status |
-|------|--------|
-| CI green on `main` | Done by repo |
-| GitHub Release `v2.0.0-rc.1` + tarball | Done |
-| npm account + `@ahmedsamirelsaka` scope | **You** |
-| `NPM_TOKEN` on `npm-publish` env (or Trusted Publisher) | **You** |
-| Re-run publish workflow | **You** |
-| `npm view …@next` works | Confirm |
-
----
-
-## After it works
-
-Consumers:
-
-```bash
-npx @ahmedsamirelsaka/react-native-local-release@next install --project .
-# or pin exactly:
-npm i -D @ahmedsamirelsaka/react-native-local-release@2.0.0-rc.1
-```