From 9cc0f4f8a3365fab29d67423db4750c401371c53 Mon Sep 17 00:00:00 2001 From: Tony Giorgio Date: Sat, 23 May 2026 19:11:58 -0500 Subject: [PATCH] Enforce iOS signed reproducibility before upload --- .github/workflows/mobile-build.yml | 1 + .github/workflows/release.yml | 1 + scripts/ci/signed-release-rehearsal.sh | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml index 5d5172c2f..7c4615936 100644 --- a/.github/workflows/mobile-build.yml +++ b/.github/workflows/mobile-build.yml @@ -76,6 +76,7 @@ jobs: APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }} APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_TEAM_ID }} + MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY: "1" timeout-minutes: 90 - name: Collect iOS release checksums diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aa6209776..20bbee225 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -330,6 +330,7 @@ jobs: APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }} APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }} APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_TEAM_ID }} + MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY: "1" timeout-minutes: 90 - name: Collect iOS release checksums diff --git a/scripts/ci/signed-release-rehearsal.sh b/scripts/ci/signed-release-rehearsal.sh index 03f85924b..07b9084eb 100755 --- a/scripts/ci/signed-release-rehearsal.sh +++ b/scripts/ci/signed-release-rehearsal.sh @@ -155,6 +155,7 @@ run_ios_rehearsal() { return 1 fi + export MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY="${MAPLE_ENFORCE_IOS_SIGNED_REPRODUCIBILITY:-1}" "${script_dir}/ios-onnxruntime.sh" "${script_dir}/ios-release.sh" }