{"id":20187609,"url":"https://github.com/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader","last_synced_at":"2025-10-13T00:21:58.576Z","repository":{"id":43257752,"uuid":"134726461","full_name":"bitrise-steplib/steps-deploy-to-itunesconnect-application-loader","owner":"bitrise-steplib","description":null,"archived":false,"fork":false,"pushed_at":"2025-10-03T13:30:21.000Z","size":524,"stargazers_count":11,"open_issues_count":0,"forks_count":13,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-10-03T14:25:13.974Z","etag":null,"topics":["bitrise","bitrise-step","ci","production-code"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bitrise-steplib.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2018-05-24T14:24:08.000Z","updated_at":"2025-10-03T13:28:56.000Z","dependencies_parsed_at":"2024-06-21T15:42:36.048Z","dependency_job_id":"6b679762-e2f4-47f5-aa4f-1e2aa57b47d7","html_url":"https://github.com/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader","commit_stats":null,"previous_names":[],"tags_count":24,"template":false,"template_full_name":null,"purl":"pkg:github/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bitrise-steplib","download_url":"https://codeload.github.com/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader/sbom","scorecard":{"id":240770,"data":{"date":"2025-08-11","repo":{"name":"github.com/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader","commit":"672ae8c03d3397664781785f061a83a6dea1b046"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.5,"checks":[{"name":"Code-Review","score":8,"reason":"Found 24/29 approved changesets -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/stale-issues-workflow.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale-issues-workflow.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader/stale-issues-workflow.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/stale-issues-workflow.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader/stale-issues-workflow.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/stale-issues-workflow.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader/stale-issues-workflow.yml/master?enable=pin","Info:   0 out of   1 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   2 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Vulnerabilities","score":9,"reason":"1 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2024-2947 / GHSA-v6v8-xj6m-xwqh"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 26 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-17T06:38:54.259Z","repository_id":43257752,"created_at":"2025-08-17T06:38:54.259Z","updated_at":"2025-08-17T06:38:54.259Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279013632,"owners_count":26085298,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-12T02:00:06.719Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bitrise","bitrise-step","ci","production-code"],"created_at":"2024-11-14T03:25:03.612Z","updated_at":"2025-10-13T00:21:58.571Z","avatar_url":"https://github.com/bitrise-steplib.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Deploy to App Store Connect - Application Loader (formerly iTunes Connect)\n\n[![Step changelog](https://shields.io/github/v/release/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader?include_prereleases\u0026label=changelog\u0026color=blueviolet)](https://github.com/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader/releases)\n\nUploads binaries (.ipa / .pkg files) to [App Store Connect](https://appstoreconnect.apple.com/).\n\n\u003cdetails\u003e\n\u003csummary\u003eDescription\u003c/summary\u003e\n\nUpload your binaries to [App Store Connect](https://appstoreconnect.apple.com/) using Apple's Application Loader. You can upload iOS, macOS, or Apple TV apps with the Step. The Step does not upload metadata, screenshots, nor does it submit your app for review. For that, use the **Deploy to App Store Connect with Deliver** Step.\n\nThis Step, however, does NOT build your binary: to create an IPA or PKG file, you need the right version of the **Xcode Archive** Step, or any other Step that is capable of building a binary file.\n\n### Configuring the Step\n\nBefore you start using this Step, you need to do a couple of things:\n\n* Register an app on the **My Apps** page of App Store Connect. Click on the **plus** sign and select the **New App** option. This requires an **admin** account.\n* This Step requires an app signed with App Store Distibution provisioning profile. Make sure that you use the correct code signing files and the correct export method with the Step that builds your binary.\n* Every build that you want to push to the App Store Connect must have a unique build and version number pair. Increment either or both before a new deploy to the App Store Connect.\n\nTo deploy your app with the Step:\n1. Make sure that either the **IPA path** or the **PKG path** input has a valid value. The default value is perfect for most cases: it points to the output generated by the **Xcode Archive** Step.\n1. Set up your connection depending on which authentication method you wish to use:\n    - Use a previously configured Bitrise Apple Developer connection: Set the **Bitrise Apple Developer Connection** to `automatic` (this is the default setting), `api_key` or `apple_id`.\n    - Provide manual Step inputs: Add authentication data depending on which authentication method you wish to use, either Apple ID or API key authentication. Set the **Bitrise Apple Developer Connection** to `off`. Use only one of the authentication methods.\n        * For API key: Provide your **API Key: URL** (for example, https://URL/TO/AuthKey_something.p8 or file:///PATH/TO/AuthKey_something.p8) and the **API Key: Issuer ID** inputs.\n        * For Apple ID: Use the Apple Developer connection based on Apple ID authentication. If no app-specific password has been added to the used connection, the **Apple ID: App-specific password** Step input will be used. Other authentication-related Step inputs are ignored.\n\n### Troubleshooting\n\nUse only one of the authentication methods, if you add both the Apple ID and the API key inputs the step will fail.\n\nMake sure your Apple ID credentials are correct. Be aware that if you use two-factor authentication, you need to [set up](https://devcenter.bitrise.io/getting-started/configuring-bitrise-steps-that-require-apple-developer-account-data/#setting-up-connection-with-the-apple-id-and-password) a connection with Apple ID.\n\nAlways make sure that **Platform** input is set to the correct value.\n\nThe Step can also fail if the **Xcode Archive** Step - or any other Step that builds your binary - did not generate an IPA or PKG with a `app-store` export method.\n\n### Useful links\n\n- [Deploying an app to iTunesConnect](https://devcenter.bitrise.io/deploy/ios-deploy/deploying-an-ios-app-to-itunes-connect/)\n- [iOS deployment](https://devcenter.bitrise.io/deploy/ios-deploy/ios-deploy-index/)\n\n### Related Steps\n\n- [Deploy to Google Play](https://www.bitrise.io/integrations/steps/google-play-deploy)\n- [Xcode Archive \u0026 Export for iOS](https://www.bitrise.io/integrations/steps/xcode-archive)\n- [Appetize.io deploy](https://www.bitrise.io/integrations/steps/appetize-deploy)\n\u003c/details\u003e\n\n## 🧩 Get started\n\nAdd this step directly to your workflow in the [Bitrise Workflow Editor](https://docs.bitrise.io/en/bitrise-ci/workflows-and-pipelines/steps/adding-steps-to-a-workflow.html).\n\nYou can also run this step directly with [Bitrise CLI](https://github.com/bitrise-io/bitrise).\n\n## ⚙️ Configuration\n\n\u003cdetails\u003e\n\u003csummary\u003eInputs\u003c/summary\u003e\n\n| Key | Description | Flags | Default |\n| --- | --- | --- | --- |\n| `connection` | The input determines the method used for Apple Service authentication. By default, any enabled Bitrise Apple Developer connection is used and other authentication-related Step inputs are ignored.  There are two types of Apple Developer connection you can enable on Bitrise: one is based on an API key of the App Store Connect API, the other is the Apple ID authentication. You can choose which type of Bitrise Apple Developer connection to use or you can tell the Step to only use Step inputs for authentication: - `automatic`: Use any enabled Apple Developer connection, either based on Apple ID authentication or API key authentication.  Step inputs are only used as a fallback. API key authentication has priority over Apple ID authentication in both cases. - `api_key`: Use the Apple Developer connection based on API key authentication. Authentication-related Step inputs are ignored. - `apple_id`: Use the Apple Developer connection based on Apple ID authentication and the **Application-specific password** Step input. Other authentication-related Step inputs are ignored. - `off`: Do not use any Apple Developer Connection. Use Inputs under \"App Store Connect connection override\" to configure athentication, as only these are considered. | required | `automatic` |\n| `ipa_path` | Path to your IPA file to be deployed. **NOTE:** This input or `PKG path` is required. |  | `$BITRISE_IPA_PATH` |\n| `pkg_path` | Path to your PKG file to be deployed. **NOTE:** This input or `IPA path` is required. |  | `$BITRISE_PKG_PATH` |\n| `platform` | Specify the platform of the file. When `auto` is selected the step uses the `Info.plist` to set the platform. |  | `auto` |\n| `app_id` | Specifies the Apple ID of the app.  Available on the **App Information** page of your app in App Store Connect. For example: `1023456789`. |  |  |\n| `bundle_id` | The bundle identifier of the app to be deployed.  When *App's Apple ID in App Store Connect* (`app_id`) is provided, will read it from `Info.plist` when not provided. |  |  |\n| `bundle_version` | Specifies the CFBundleVersion of the app package.  When *App's Apple ID in App Store Connect* (`app_id`) is provided, will read it from `Info.plist` when not provided. |  |  |\n| `bundle_short_version_string` | The version number of the app to be deployed.  When *App's Apple ID in App Store Connect* (`app_id`) is provided, will read it from `Info.plist` when not provided. |  |  |\n| `api_key_path` | Specify the path in an URL format where your API key is stored. For example: `https://URL/TO/AuthKey_[KEY_ID].p8` or `file:///PATH/TO/AuthKey_[KEY_ID].p8`. **NOTE:** The Step will only recognize the API key if the filename includes the  `KEY_ID` value as shown on the examples above.  You can upload your key on the **Generic File Storage** tab in the Workflow Editor and set the Environment Variable for the file here.  For example: `$BITRISEIO_MYKEY_URL` |  |  |\n| `api_issuer` | Issuer ID. Required if **API Key: URL** (`api_key_path`) is specified. |  |  |\n| `itunescon_user` | Email for Apple ID login. | sensitive |  |\n| `password` | Password for the specified Apple ID. | sensitive |  |\n| `app_password` | Use this input if TFA is enabled on the Apple ID but no app-specific password has been added to the used Bitrise Apple ID connection.  **NOTE:** Application-specific passwords can be created on the [AppleID Website](https://appleid.apple.com). It can be used to bypass two-factor authentication. | sensitive |  |\n| `verbose_log` | If this input is set, the Step will print additional logs for debugging. | required | `no` |\n| `retries` | Retry times when failed, set to `0` for infinite retry |  | `10` |\n| `altool_options` | Options added to the end of the `altool` call. You can use multiple options, separated by a space character. Example: - `--team-id \u003c\u003cwwdr_team_id\u003e\u003e` (Xcode 26 and above) - `--asc-provider\" \u003c\u003cprovider_id\u003e\u003e` (Xcode 16) |  |  |\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eOutputs\u003c/summary\u003e\nThere are no outputs defined in this step\n\u003c/details\u003e\n\n## 🙋 Contributing\n\nWe welcome [pull requests](https://github.com/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader/pulls) and [issues](https://github.com/bitrise-steplib/steps-deploy-to-itunesconnect-application-loader/issues) against this repository.\n\nFor pull requests, work on your changes in a forked repository and use the Bitrise CLI to [run step tests locally](https://docs.bitrise.io/en/bitrise-ci/bitrise-cli/running-your-first-local-build-with-the-cli.html).\n\nLearn more about developing steps:\n\n- [Create your own step](https://docs.bitrise.io/en/bitrise-ci/workflows-and-pipelines/developing-your-own-bitrise-step/developing-a-new-step.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbitrise-steplib%2Fsteps-deploy-to-itunesconnect-application-loader/lists"}