Fix release.yml: secrets context not allowed in if: conditions - #1
Merged
Conversation
GitHub Actions validation rejects the secrets context inside step-level if: expressions, which was failing the entire workflow file before any job could run. Hoist APPLE_SIGNING_ENABLED into a job-level env var and reference that in the two conditionals instead.
Tauri's universal binary (lipo) merge only handles the main app binary, not the second stegstr-cli [[bin]] target this package defines, so bundling failed looking for a universal stegstr-cli that was never produced (known Tauri limitation, see tauri-apps/tauri#8152, #9422). Build natively for the runner's arch (Apple Silicon) instead. Also fixes two other steps that hardcoded the universal-apple-darwin bundle path regardless of which target was actually built.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release.ymlhas been failing every run since 2026-03-02 ("failed because of a workflow file issue", no jobs even started).actionlintlocally: two step-levelif:conditions reference thesecretscontext (secrets.APPLE_SIGNING_ENABLED == 'true'), which GitHub Actions does not permit inif:expressions — only inenv:/with:. This is a hard validation failure, not a runtime error.APPLE_SIGNING_ENABLEDinto a job-levelenv:var (from the secret) and referenceenv.APPLE_SIGNING_ENABLEDin the twoif:conditions instead. No behavior change otherwise.actionlintnow passes clean on the blocking errors; only pre-existing shellcheck info/warning-level quoting nits remain (unrelated, not blocking).Test plan
actionlint .github/workflows/release.ymlno longer reports thesecretscontext errorworkflow_dispatchon this branch/after merge to confirm the build + release jobs complete end-to-end and produce artifacts (hasn't succeeded in ~4 months, so this needs to be verified live, not assumed)🤖 Generated with Claude Code