Notarize with an Apple ID instead of an App Store Connect key

[devin-ai-integration]

Summary

notarytool has two auth modes and we were on the one this team can't use: an App Store Connect API key requires a Key ID, which only the Account Holder can mint (and which lives in the .p8's filename, so it can't be recovered from the file). Swapped to the Apple ID mode, which needs only an app-specific password from account.apple.com plus the team id we already read off the signing certificate.

 xcrun notarytool submit "$1" \
-  --key "$NOTARY_KEY_PATH" --key-id "$NOTARY_KEY_ID" --issuer "$NOTARY_ISSUER_ID" --wait
+  --apple-id "$NOTARY_APPLE_ID" --password "$NOTARY_PASSWORD" --team-id "$NOTARY_TEAM_ID" --wait

Release secrets accordingly: AC_API_KEY_P8 / AC_API_KEY_ID / AC_API_ISSUER_ID → APPLE_ID / APPLE_APP_PASSWORD / APPLE_TEAM_ID. The credentials step no longer writes a key file to $RUNNER_TEMP; the all-three-or-nothing gate, the ad-hoc-signing fallback and the app+dmg stapling are unchanged.

The trade-off worth knowing: an app-specific password is tied to a personal Apple ID rather than a team key, so it can't be scoped per-integration — revoking it revokes it everywhere.

Link to Devin session: https://app.devin.ai/sessions/45ed77efb9cd4fe39d69b35ee5c9076f
Open in Devin Desktop: https://app.devin.ai/desktop/session/45ed77efb9cd4fe39d69b35ee5c9076f?variant=devin
Requested by: @MrgSub

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring