[EAS-CLI 7.2.0] EAS build couldn't evaluate SECRET variables for auto submit

[leons1767]

Build/Submit details page URL

No response

Summary

Ran eas build --profile production --platform ios --auto-submit, and everything went well until eas evaluates variables needed for auto submit. Eas build failed to evaluate Apple ID for auto submit. I'm using SECRETS to store the required submit variables. It was working in SDK49.

"submit": {
    "production": {
      "ios": {
        "appleId": "${secrets.APPLE_ID}",
        "ascAppId": "${secrets.ASC_APP_ID",
        "appleTeamId": "${secrets.APPLE_TEAM_ID}"
      }
    }
  }

The error message is from eas-cli. The error does not appear in Expo builds page. And eas proceeded with the build despite the error.

Invalid Apple ID was specified. It should be a valid email address. Example: "[email protected]".. Invalid Apple App Store Connect App ID ("ascAppId") was specified. It should consist only of digits. Example: "1234567891". Learn more: https://expo.fyi/asc-app-id.. Invalid Apple Team ID was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CZE81F".

Managed or bare?

Managed

Environment

  expo-env-info 1.0.5 environment info:
    System:
      OS: Windows 10 10.0.22631
    Binaries:
      Node: 21.6.2 - C:\Program Files\nodejs\node.EXE
      Yarn: 1.22.19 - ~\AppData\Roaming\npm\yarn.CMD
      npm: 8.19.2 - C:\Program Files\nodejs\npm.CMD
      Watchman: 20231008.002904.0 - C:\ProgramData\chocolatey\bin\watchman.EXE
    npmPackages:
      @expo/webpack-config: ~19.0.1 => 19.0.1
      expo: ~50.0.6 => 50.0.6
      react: 18.2.0 => 18.2.0
      react-dom: 18.2.0 => 18.2.0
      react-native: 0.73.4 => 0.73.4
      react-native-web: ~0.19.6 => 0.19.8
    Expo Workflow: bare

(node:5860) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
WARNING: We recommend using PowerShell or Bash via WSL 2 for development with Expo CLI on Windows. You may encounter issues using cmd.exe.

√ Validating global prerequisites versions passed
√ Checking for incompatible packages passed
√ Checking for conflicting global packages in project passed
√ Verifying prebuild support package versions are compatible passed
× Checking dependency versions for compatibility with the installed Expo SDK failed
Issues:
  'sh' is not recognized as an internal or external command,
  operable program or batch file.
Advice:
  • Use npx expo install --check to review and upgrade your dependencies.
√ Validating Expo Config passed
× Checking package.json for common issues failed
Issues:
  The package "expo-modules-autolinking" should not be installed directly in your project. It is a dependency of other Expo packages and should be installed automatically.

✖ Found one or more possible issues with the project. See above logs for issues and advice to resolve.

Error output

Invalid Apple ID was specified. It should be a valid email address. Example: "[email protected]".. Invalid Apple App Store Connect App ID ("ascAppId") was specified. It should consist only of digits. Example: "1234567891". Learn more: https://expo.fyi/asc-app-id.. Invalid Apple Team ID was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CZE81F".
[Error [ValidationError]: Invalid Apple ID was specified. It should be a valid email address. Example: "[email protected]".. Invalid Apple App Store Connect App ID ("ascAppId") was specified. It should consist only of digits. Example: "1234567891". Learn more: https://expo.fyi/asc-app-id.. Invalid Apple Team ID was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CZE81F".] {
  _original: {
    language: 'en-US',
    appleId: '${secrets.APPLE_ID}',
    ascAppId: '${secrets.ASC_APP_ID}',
    appleTeamId: '${secrets.APPLE_TEAM_ID}'
  },
  details: [
    {
      message: 'Invalid Apple ID was specified. It should be a valid email address. Example: "[email protected]".',
      path: [Array],
      type: 'string.email',
      context: [Object]
    },
    {
      message: 'Invalid Apple App Store Connect App ID ("ascAppId") was specified. It should consist only of digits. Example: "1234567891". Learn more: https://expo.fyi/asc-app-id.',
      path: [Array],
      type: 'string.pattern.base',
      context: [Object]
    },
    {
      message: 'Invalid Apple Team ID was specified. It should consist of 10 uppercase letters or digits. Example: "AB32CZE81F".',
      path: [Array],
      type: 'string.pattern.base',
      context: [Object]
    }
  ]
}
    Error: build command failed.

Reproducible demo or steps to reproduce from a blank project

1. Create SECRETS variables for APPLE_ID, ASC_APP_ID and APPLE_TEAM_ID in expo.dev
2. Create new expo project
3. Use below eas.json configuration
4. eas build --profile production --platform ios --auto-submit

{
  "cli": {
    "version": ">= 3.3.2"
  },
  "build": {
    "production": {
      "channel": "production",
      "env": {
        "EAS_BUILD_PROFILE": "production",
      },
      "ios": {
        "image": "default"
      }
    }
  },
  "submit": {
    "production": {
      "ios": {
        "appleId": "${secrets.APPLE_ID}",
        "ascAppId": "${secrets.ASC_APP_ID}",
        "appleTeamId": "${secrets.APPLE_TEAM_ID}"
      }
    }
  }
}

[leons1767]

The same error for eas submit. The only workaround is to enter the ids in eas.json directly. It wouldn't even take environment variables.

[szdziedzic]

By doing

"submit": {
    "production": {
      "ios": {
        "appleId": "${secrets.APPLE_ID}",
        "ascAppId": "${secrets.ASC_APP_ID}",
        "appleTeamId": "${secrets.APPLE_TEAM_ID}"
      }
    }
  }

Do you want to access the env variables defined in your environment named APPLE_ID, ASC_APP_ID, and APPLE_TEAM_ID?

If so I think that

"submit": {
    "production": {
      "ios": {
        "appleId": "$APPLE_ID",
        "ascAppId": "$ASC_APP_ID",
        "appleTeamId": "$APPLE_TEAM_ID"
      }
    }
  }

should work.

If you want to access the secrets defined on EAS servers this way when trying to create a submission locally, I don't think it is possible and I don't think it ever was possible 🤔. If it worked for you in the past it was probably because we had too loose validation of these fields and they were evaluated to empty strings which probably fell back to default auth logic at the time.

[leons1767]

@szdziedzic , thank you for your response. I assure you ${secrets.XXX} to access Expo SECRETS environment variables was working previously. It couldn't have any fallback because I added .env to .easignore. There is no way Eas could figure out the ASC_APP_ID (for example) without reading it from SECRETS.

One possible explanation is the eas submit local validation was not there previously, and Eas, on the server, was able to access the SECRET variables through ${secrets.ASC_APP_ID}, for example.

Anyway, I tried your suggestion of using "$APPLE_ID", it has the same error. I even tried "$EXPO_PUBLIC_APPLE_ID". It seems that EAS-CLI doesn't have the capability to read any local environment variable in the eas.json
dotenv -e .env -- eas submit --platform ios

[leons1767]

I had a light-bulb moment, after reconsidering what you suggested. I removed the whole ios object from submit.production, and eas submit falls back to the environment variables. It works!

You are right to suggest the code worked previously because the validation was loose. It fell back to the default environment variables when the key value pairs were invalid without complaining. It was reading from the environment variables.