Problem. github_write_appcasts.sh runs with #!/bin/bash -eux. Under -x, the key check ([ -z "${RAC_SPARKLE_ED_PRIVATE_KEY:-}" ]) and the whitespace trim (RAC_SPARKLE_ED_PRIVATE_KEY=$(printf '%s' … | tr …)) each print the Sparkle private key into the release job's log. GitHub masks registered secrets, but a key that can sign updates for every installed copy shouldn't depend on masking. SWE-2's final pass on #26 flagged it; the behaviour predates #26.
Change. Tracing is turned off ({ set +x; } 2>/dev/null) before the key is checked and cleaned, and turned back on (set -x) right after. Nothing else changes.
Verified. I ran the script under bash -eux with stub rac_version.py and sparkle.py and a fake key SECRETKEYVALUE. Before this change the trace contained the key 3 times; after it, 0. The rest of the script is still traced. bash -n and shellcheck -S warning are clean.
Patch surface (D17): no change, because this PR touches no patches.
🤖 Generated with Claude Code (Claude Opus 5.5)
Prevents the Sparkle private key from leaking into the release job log when github_write_appcasts.sh runs under bash -x. The key check and whitespace trim previously printed the key up to three times; tracing is now suspended around just those lines and re-enabled immediately after, so the rest of the script is still traced.
Written for commit 0d22c3acb3f1c6f30811e864e4c3065722a56096. Summary will update on new commits.
View guided diff Turn on auto-fix
Note
Low Risk CI logging hardening only; release and signing logic are unchanged.
Overview
Stops the Sparkle signing secret from leaking into CI logs when github_write_appcasts.sh runs under bash -eux. The script now disables command tracing (set +x) while it validates and normalizes RAC_SPARKLE_ED_PRIVATE_KEY (and the related public key), then re-enables tracing for the rest of the release work.
This mirrors the existing approach in github_sign_app.sh: the private key no longer depends on GitHub secret masking if a traced [ -z … ] or printf | tr would echo it. No change to appcast generation or signing behavior—only what gets printed during those sensitive lines.
Reviewed by Cursor Bugbot for commit 0d22c3acb3f1c6f30811e864e4c3065722a56096. Bugbot is set up for automated code reviews on this repo. Configure here.
Added 1 commit
Your OpenCode Zen account is out of credit. Top it up, then re-trigger Pullfrog.
| 1 | provider error: Upstream request failed: Insufficient account funds |
Pullfrog ｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using kimi-k3
Deployment failed for project rac with the following error:
| 1 | Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day"). |
Learn More: https://vercel.com/knewton?upgradeToPro=build-rate-limit
Important
Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.
a4051150-50be-4d71-aa4c-5b648933bafcYou can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: bbc5869b-c901-4d31-951a-69b522052b5c)
Devin Review analyzed this PR and found no bugs or issues to report.
[Medium impact] The PR appears safe to merge.
Keeps the Sparkle private key out of the appcast script's shell trace.
Reviews (1) · Last reviewed commit: "ci: keep the Sparkle private key out of ..." · Reviewed by Greptile
