From f1d9fdae3a25c7d3dca04db8d93c89b6e1ff9c2a Mon Sep 17 00:00:00 2001
From: "Adrian Alfred C. Bonpin" <adrianbonpin@gmail.com>
Date: Sun, 20 Sep 2026 15:58:05 +0800
Subject: [PATCH] fix(release): write the notarization .p8 with a trailing
 newline (#30)

`gh secret set` strips the trailing newline when storing APPLE_API_KEY_CONTENT,
and Apple's PEM parser expects the key file to end with one. Write it back
explicitly so notarization can load the key.
---
 .github/workflows/release.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3b23b1b..902b111 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -112,7 +112,11 @@ jobs:
           set -euo pipefail
           KEY_PATH="$RUNNER_TEMP/private_keys/AuthKey_${APPLE_API_KEY}.p8"
           mkdir -p "$(dirname "$KEY_PATH")"
-          printf '%s' "$APPLE_API_KEY_CONTENT" > "$KEY_PATH"
+          # Apple's PEM parser expects a terminating newline, which
+          # `gh secret set` strips from the stored value — so write one
+          # explicitly. A doubled trailing newline is harmless to PEM parsers,
+          # but a missing one can make notarization fail to load the key.
+          printf '%s\n' "$APPLE_API_KEY_CONTENT" > "$KEY_PATH"
           {
             echo "APPLE_API_KEY=${APPLE_API_KEY}"
             echo "APPLE_API_ISSUER=${APPLE_API_ISSUER}"