CI builds App Store .pkg as artifact, upload happens locally (#376)

Removes the slow xcrun altool upload from CI (was hanging for 50+ min).
CI now just builds + signs and publishes the .pkg as a workflow artifact.
Local upload via 'fastlane upload_build pkg:...' uses the App Store
Connect API key from noxkey — fast feedback, cancellable, no CI hangs.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JasperNoBoxDev

.github/workflows/release-appstore.yml

@@ -112,33 +112,34 @@ jobs:
           </plist>
           PLIST
 
-      - name: Export and upload to App Store Connect
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      - name: Export App Store .pkg
         run: |
           xcodebuild -exportArchive \
             -archivePath build/NoxKey.xcarchive \
             -exportOptionsPlist build/ExportOptions.plist \
             -exportPath build/appstore-export
 
-          # Find the exported pkg
           PKG_FILE=$(find build/appstore-export -name "*.pkg" | head -1)
-          echo "Uploading: $PKG_FILE"
+          echo "Built: $PKG_FILE"
+          mv "$PKG_FILE" "build/NoxKey-${VERSION}-appstore.pkg"
 
-          # Upload to App Store Connect using app-specific password
-          xcrun altool --upload-app \
-            -f "$PKG_FILE" \
-            -u "$APPLE_ID" \
-            -p "$APPLE_APP_PASSWORD" \
-            --type macos
+      - name: Upload .pkg as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: NoxKey-appstore-pkg
+          path: build/NoxKey-${{ env.VERSION }}-appstore.pkg
+          retention-days: 30
 
       - name: Summary
         run: |
-          echo "## App Store Upload Complete" >> $GITHUB_STEP_SUMMARY
+          echo "## App Store Build Ready" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Version:** ${VERSION}" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "The build has been uploaded to App Store Connect." >> $GITHUB_STEP_SUMMARY
-          echo "Go to [App Store Connect](https://appstoreconnect.apple.com) to submit for review." >> $GITHUB_STEP_SUMMARY
+          echo "Download the artifact from the run page, then upload locally:" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "eval \"\$(noxkey get noboxdev/noxkey/APP_STORE_CONNECT_API_KEY_P8_B64)\" && \\" >> $GITHUB_STEP_SUMMARY
+          echo "eval \"\$(noxkey get noboxdev/noxkey/APP_STORE_CONNECT_KEY_ID)\" && \\" >> $GITHUB_STEP_SUMMARY
+          echo "eval \"\$(noxkey get noboxdev/noxkey/APP_STORE_CONNECT_ISSUER_ID)\" && \\" >> $GITHUB_STEP_SUMMARY
+          echo "fastlane deliver --pkg ~/Downloads/NoxKey-${VERSION}-appstore.pkg --skip_metadata --skip_screenshots" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY

fastlane/Fastfile

@@ -54,6 +54,23 @@ platform :mac do
     )
   end
 
+  desc "Upload a built .pkg to App Store Connect (build locally or download CI artifact)"
+  lane :upload_build do |options|
+    pkg = options[:pkg]
+    UI.user_error!("Pass pkg:/path/to/NoxKey.pkg") unless pkg
+    deliver(
+      api_key_path: ENV["APP_STORE_CONNECT_API_KEY_PATH"],
+      pkg: pkg,
+      skip_screenshots: true,
+      skip_metadata: true,
+      skip_app_version_update: true,
+      force: true,
+      run_precheck_before_submit: false,
+      platform: "osx",
+      submit_for_review: false,
+    )
+  end
+
   desc "Submit current build for review (uses latest uploaded build)"
   lane :submit_for_review do
     deliver(