CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

Direct store API calls in a project's scripts: androidpublisher.googleapis.com, the googleapis androidpublisher client, api.appstoreconnect.apple.com, altool / Transporter in CI files and scripts; scan rule direct-store-api, check and release status warnings with file:line and the storebound command; storebound's own checkout skipped; test, pitfall 97

Browse source
This commit is contained in:
CRTkafa 2026-10-22 02:04:28 +08:00
parent 4f993a906a
commit 4fcee60ba6
7 changed files with 72 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
skills/store-pitfalls/SKILL.md
View file

@ -1177,3 +1177,15 @@ that fails without the fix (see CONTRIBUTING.md).
- **Guard:** `findFastlaneTraces` in `cli/lib/fastlane-traces.ts` (Fastfile / Appfile, CI files and scripts with
`fastlane supply|deliver|pilot`); `check` warns, `scan` reports `fastlane-upload` with file:line, `release status`
warns per app (`tests/fastlane-traces.test.ts`).
## 97. The project's own scripts called the store APIs (no fastlane, same bypass)
- **Symptom:** an app uploaded AABs, set the track and rollout, pushed listing images and read the listing back with
three hand-written scripts (a self-signed JWT against `androidpublisher.googleapis.com`); storebound said nothing.
- **Cause:** pitfall 96 looked only for fastlane; direct API calls and upload tools (altool, Transporter) were not read.
- **Do:** replace each script with the storebound command: `play upload` / `play release` (MCP `play_release_testing`),
`play images` (`play_images`), `play listing pull` (`play_listing_pull`); for Apple `apple upload` and the other
`apple` commands (MCP `apple_*`). Keep one on purpose only with `scan.ignore` `direct-store-api` and the reason.
- **Guard:** `findFastlaneTraces` in `cli/lib/fastlane-traces.ts` also reports `androidpublisher.googleapis.com`, the
googleapis androidpublisher client, `api.appstoreconnect.apple.com`, `altool` / `iTMSTransporter` in CI files and
scripts (not storebound's own checkout, never node_modules); `scan` rule `direct-store-api`, `check` and
`release status` warnings with file:line and the storebound command (`tests/fastlane-traces.test.ts`).