key-store/key.store

Fork 0

lately macOS: fix the two build-breakers found in pre-flight review #32

Merged

founder merged 1 commit from lately-macos-preflight-fixes into main

2026-08-16 05:51:30 +00:00

founder commented

2026-08-16 05:51:23 +00:00

Owner

Pre-flight review (rules_apple 4.5.3 source-checked) of the gated lately_macos_release target found two hard failures before compile: an --embed_label that cannot match apple_release_version's build_label_pattern, and $(AppIdentifierPrefix) in the entitlements of a no-profile build. Also fixes the macOS push entitlement key (com.apple.developer.aps-environment, which is what the synced Developer ID profile grants), matches SwiftPM's macOS 15 floor, and removes the dead write_lately_macos_plist.

🤖 Generated with Claude Code

Pre-flight review (rules_apple 4.5.3 source-checked) of the gated `lately_macos_release` target found two hard failures before compile: an `--embed_label` that cannot match `apple_release_version`'s `build_label_pattern`, and `$(AppIdentifierPrefix)` in the entitlements of a no-profile build. Also fixes the macOS push entitlement key (`com.apple.developer.aps-environment`, which is what the synced Developer ID profile grants), matches SwiftPM's macOS 15 floor, and removes the dead `write_lately_macos_plist`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

founder added 1 commit

2026-08-16 05:51:23 +00:00

lately macOS: fix the two build-breakers found in pre-flight review

deploy-web/fly-decrypted fly token decrypted, length 651

deploy-web/masked add-mask emitted

deploy-web/decrypt-env-ok github env written

deploy-web/build-entered build step running

deploy-web/web-eval-ok web-container drv evaluated

deploy-web/pipe-deployed fly deploy complete

deploy-web/pipe-live NEW core live: 9804611 bytes

deploy-web/site-built pipeline complete: ok 9804611

deploy-web/cf-decrypted cloudflare token decrypted, length 40

deploy-web/prev-detached a-runtime-deps.drv'... building '/nix/store/1sx09vag1say8h235cjmfz0inaja1jyq-docker-image-key-store-web.tar.gz.drv'...

deploy-web/detached-started realization detached

Build: Apple / Check (SwiftLint) (pull_request) Successful in 16s

Details

Build: Apple / Check (SwiftLint) (push) Successful in 19s

Details

Build: Apple / Build (iOS) (pull_request) Successful in 30s

Details

Build: Apple / Build (visionOS) (pull_request) Successful in 30s

Details

Build: Apple / Build (iOS) (push) Successful in 28s

Details

Release: Signing Preflight / Release (Signing Preflight) (push) Successful in 1m2s

Details

Build: Apple / Build (visionOS) (push) Successful in 26s

Details

Namespace: Build Images / Refresh Linux runner image (push) Successful in 2m1s

Details

Build: Apple / Build (macOS) (pull_request) Successful in 1m50s

Details

Build: Apple / Build (macOS) (push) Successful in 2m3s

Details

Deploy: API / Deploy (API) (push) Successful in 3m14s

Details

deploy-web/detached-done 746sr9six5h-runtime-deps.drv'... building '/nix/store/ywkgg96h9bb7il4d2c6akvcfwhfhcq05-docker-image-key-store-web.tar.gz.drv'...

deploy-web/web-built container built

deploy-web/pipeline-launched detached deploy pipeline started

deploy-web/pipe-start pipeline running detached

deploy-web/pipe-site site built: /nix/store/d6p97r10sldv3ym7kzfl16fs5qn0gkwf-key-store-web-site-5b6dc6f

deploy-web/pipe-smoke site smoke passed

deploy-web/pipe-pushed image pushed registry.fly.io/key-store-web:5b6dc6fcda8a0c364b3dac8ecf2f04d73b0587d8

Deploy: Web / Deploy (Web) (push) Has been cancelled

Details

5b6dc6fcda

Review of the new lately_macos_release target (still gated behind
include_lately_macos) against rules_apple 4.5.3 found two hard failures
before any compile step, plus a runtime bug and stale helpers:

* build_lately_macos passed --embed_label=lately_<v>_build_<n>, but the
  target's version is :apple_release_version whose build_label_pattern is
  key.store_{version}_build_{build}; versiontool has no fallback when a
  label is present and does not match, so the AppleBundleVersion action
  fails. Use the key.store_ label like every other invocation.
* The target has no provisioning_profile (the lane builds ad-hoc and
  re-signs with Developer ID), but Lately.entitlements references
  $(AppIdentifierPrefix), which plisttool can only substitute from a
  profile -- ProcessEntitlementsFiles fails. Point the target at
  Lately-DeveloperID.entitlements, which hard-codes the team prefix and is
  exactly what sign-lately-macos-app applies.
* Both macOS entitlements files used the iOS key aps-environment; AppKit
  wants com.apple.developer.aps-environment, which is what the synced
  MAC_APP_DIRECT profile grants. Without the fix the pipeline passes but
  remote-notification registration fails at runtime.
* minimum_os_version 15.0 to match the .macOS(.v15) floor the SwiftPM
  package declared (Info.plist LSMinimumSystemVersion likewise).
* Drop the dead write_lately_macos_plist helper and its LatelyMac
  executable name; the Bazel bundle's executable is Lately.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>