# Non-secret settings for scripts/setup-macos-signing-secrets.sh.
# Copy to a path outside the checkout (for example $HOME/secure/peek-signing/signing.env),
# replace every placeholder, and pass it with --config. Lines are KEY=value, read as data
# (never sourced); unknown keys are rejected. No quotes. Only a leading $HOME/ or ~/ in the
# two path keys is expanded.
#
# Passwords never belong here: the P12 export password and any app-specific password are
# only accepted at the script's hidden prompts.

# Credential files
P12_PATH=$HOME/secure/peek-signing/signing.p12
P8_PATH=$HOME/secure/peek-signing/AuthKey_XXXXXXXXXX.p8

# Identity and notarization (values from the certificate and App Store Connect)
SIGNING_IDENTITY=Developer ID Application: Example Publisher (XXXXXXXXXX)
TEAM_ID=XXXXXXXXXX
API_KEY_ID=XXXXXXXXXX
API_ISSUER=00000000-0000-0000-0000-000000000000
# Password mode only (instead of the API key settings above):
# APPLE_ID_EMAIL=signing@example.invalid

# Destination (defaults shown)
# REPO=autonome/peek-builds
# ENVIRONMENT=macos-release-signing

# Environment protection, created or updated and verified before any upload
REVIEWER_LOGIN=github-login-of-the-reviewer
REF_PATTERN=candidate-*
REF_TYPE=tag