ci: keep the Sparkle private key out of the appcast script's trace
Problem. github_write_appcasts.sh runs with #!/bin/bash -eux. Under -x, the key check ([ -z "${RAC_SPARKLE_ED_PRIVATE_KEY:-}" ]) and the whitespace trim (RAC_SPARKLE_ED_PRIVATE_KEY=$(printf '%s' … | tr …)) each print the Sparkle private key into the release job's log. GitHub masks registered secrets, but a key that can sign updates for every installed copy shouldn't depend on masking. SWE-2's final pass on #26 flagged it; the behaviour predates #26.
Change. Tracing is turned off ({ set +x; } 2>/dev/null) before the key is checked and cleaned, and turned back on (set -x) right after. Nothing else changes.
Verified. I ran the script under bash -eux with stub rac_version.py and sparkle.py and a fake key SECRETKEYVALUE. Before this change the trace contained the key 3 times; after it, 0. The rest of the script is still traced. bash -n and shellcheck -S warning are clean.
Patch surface (D17): no change, because this PR touches no patches.
🤖 Generated with Claude Code (Claude Opus 5.5)
Summary by cubic
Prevents the Sparkle private key from leaking into the release job log when github_write_appcasts.sh runs under bash -x. The key check and whitespace trim previously printed the key up to three times; tracing is now suspended around just those lines and re-enabled immediately after, so the rest of the script is still traced.
[!NOTE]
Low Risk
CI logging hardening only; release and signing logic are unchanged.
Overview
Stops the Sparkle signing secret from leaking into CI logs when github_write_appcasts.sh runs under bash -eux. The script now disables command tracing (set +x) while it validates and normalizes RAC_SPARKLE_ED_PRIVATE_KEY (and the related public key), then re-enables tracing for the rest of the release work.
This mirrors the existing approach in github_sign_app.sh: the private key no longer depends on GitHub secret masking if a traced [ -z … ] or printf | tr would echo it. No change to appcast generation or signing behavior—only what gets printed during those sensitive lines.
Reviewed by Cursor Bugbot for commit 0d22c3acb3f1c6f30811e864e4c3065722a56096. Bugbot is set up for automated code reviews on this repo. Configure here.