.env.example

# Apple Developer Credentials
# Required for importing signing certificates and accessing App Store Connect API

# Apple Developer Certificate (P12 format, base64 encoded)
# To generate: base64 -i certificate.p12 -o -
APPLE_DEV_CERT_P12_ENCODED=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t...

# Password for the P12 certificate
APPLE_DEV_CERT_PASSWORD=your_p12_password

# App Store Connect API Key (for profile management)
# Generate at: https://appstoreconnect.apple.com/access/api
# Key ID (e.g., ABC123XYZ)
ASC_KEY_ID=YOUR_KEY_ID

# Issuer ID (UUID format)
ASC_ISSUER_ID=12345678-1234-1234-1234-123456789012

# Private Key (.p8 file content, base64 encoded)
# To generate: base64 -i AuthKey_ABC123XYZ.p8 -o -
ASC_PRIVATE_KEY_B64=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0t...

# Bypass keychain to use env-based auth (required for CI and headless environments)
ASC_BYPASS_KEYCHAIN=1

# Cloudflare R2 Object Storage (publishes signed IPAs, icons, apps.json)
# S3-compatible API; the signing pipeline uses boto3 against this endpoint.

# Cloudflare account ID (used to build the R2 endpoint host)
R2_ACCOUNT_ID=your_cloudflare_account_id

# R2 API token with Object Read & Write, scoped to the single bucket
R2_ACCESS_KEY_ID=your_r2_access_key_id
R2_SECRET_ACCESS_KEY=your_r2_secret_access_key

# Bucket name
R2_BUCKET=zeroclover-ipa

# Public base URL of the bucket's custom domain (no trailing slash)
R2_PUBLIC_BASE_URL=https://ipa.zeroclover.io

# Optional: S3 signing region — the bucket's location hint
# (wnam/enam/weur/eeur/apac/oc) or "auto" (default). Set explicitly: boto3
# otherwise picks up the local AWS config region, which R2 rejects.
R2_REGION=apac

# Vercel on-demand revalidation (download-page / plist cache refresh)
# Shared secret for https://itms.zeroclover.io/api/revalidate
VERCEL_REVALIDATE_SECRET=your_revalidate_secret

# Optional: override the revalidation hook URL (e.g. preview deployments)
# VERCEL_REVALIDATE_URL=https://itms.zeroclover.io/api/revalidate

# Optional: Debug mode SSH public key
# Required only when running workflow with debug=true
# DEBUG_SSH_PUBLIC_KEY=ssh-rsa AAAAB3NzaC1yc2E...