tmp

* [eas-cli] setup asc api key

* setup -> set up

* pr feedback

* update CHANGELOG.md

.github/workflows/changelog.yml

@@ -28,8 +28,8 @@ jobs:
             echo "Invalid /changelog-entry command"
             exit 1
           fi
-          CATEGORY=$( cut -d ' ' -f 1 <<< "$PARAMS" | xargs )
-          MESSAGE=$( cut -d ' ' -f 2- <<< "$PARAMS" | xargs )
+          CATEGORY=$( cut -d ' ' -f 1 <<< "$PARAMS" | sed -e 's/^[[:space:]]*//' )
+          MESSAGE=$( cut -d ' ' -f 2- <<< "$PARAMS" | sed -e 's/^[[:space:]]*//' )
           yarn changelog-entry "$CATEGORY" "$MESSAGE"
         env:
           GITHUB_PR_AUTHOR: ${{ github.event.issue.user.login }}

CHANGELOG.md

@@ -8,27 +8,84 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🎉 New features
 
+- Add ASC Api Key generation workflow. ([#718](https://github.com/expo/eas-cli/pull/718) by [@quinlanj](https://github.com/quinlanj))
+- Add support for removal of App Store Connect Api Keys. ([#721](https://github.com/expo/eas-cli/pull/721) by [@quinlanj](https://github.com/quinlanj))
+- Allow users to assign an ASC Api Key to their project. ([#719](https://github.com/expo/eas-cli/pull/719) by [@quinlanj](https://github.com/quinlanj))
+- Add setup support for ASC Api Keys. ([#733](https://github.com/expo/eas-cli/pull/733) by [@quinlanj](https://github.com/quinlanj))
+- Show initiating user display name when selecting a build to submit. ([#730](https://github.com/expo/eas-cli/pull/730) by [@barthap](https://github.com/barthap))
+
+### 🐛 Bug fixes
+
+### 🧹 Chores
+
+- Clean up credentials prompt method. ([#728](https://github.com/expo/eas-cli/pull/728) by [@quinlanj](https://github.com/quinlanj))
+- Bump @expo/apple-utils to 0.0.0-alpha.26. ([#723](https://github.com/expo/eas-cli/pull/723] by [@brentvatne](https://github.com/brentvatne))
+
+## [0.34.1](https://github.com/expo/eas-cli/releases/tag/0.34.1) - 2021-11-02
+
+### 🐛 Bug fixes
+
+- Don't show commit prompt in no-commit workflow after installing `expo-dev-client`. ([#722](https://github.com/expo/eas-cli/pull/722) by [@wkozyra95](https://github.com/wkozyra95))
+
+### 🧹 Chores
+
+- Add App Store Connect Api Key graphql type and print support. ([#717](https://github.com/expo/eas-cli/pull/717) by [@quinlanj](https://github.com/quinlanj))
+
+## [0.34.0](https://github.com/expo/eas-cli/releases/tag/0.34.0) - 2021-11-01
+
+### 🛠 Breaking changes
+
+- `[EAS BUILD API]` Use new build job format. ([#701](https://github.com/expo/eas-cli/pull/701) and [#711](https://github.com/expo/eas-cli/pull/711) by [@dsokal](https://github.com/dsokal))
+- Don't print logs to `stderr`. ([#708](https://github.com/expo/eas-cli/pull/708) by [@dsokal](https://github.com/dsokal))
+- Remove automatic migration for legacy `eas.json` format introduced in [v0.22.2](https://github.com/expo/eas-cli/releases/tag/v0.22.2). ([#695](https://github.com/expo/eas-cli/pull/695) by [@wkozyra95](https://github.com/wkozyra95))
+- Add required `cli` field in root of `eas.json` ([#695](https://github.com/expo/eas-cli/pull/695) by [@wkozyra95](https://github.com/wkozyra95))
+
+### 🐛 Bug fixes
+
+- Better error message when eas.json is invalid. ([#707](https://github.com/expo/eas-cli/pull/707) by [@dsokal](https://github.com/dsokal))
+- Fix credentials workflow for new users: add additionalTypenames for credentials. ([#703](https://github.com/expo/eas-cli/pull/703) by [@quinlanj](https://github.com/quinlanj))
+
+### 🧹 Chores
+
+- Add additionalTypenames for other queries. ([#704](https://github.com/expo/eas-cli/pull/704) by [@quinlanj](https://github.com/quinlanj))
+- Fix errors after pulling down most recent graphql schema changes. ([#713](https://github.com/expo/eas-cli/pull/713) by [@quinlanj](https://github.com/quinlanj))
+- Refactor credentials manager. ([#712](https://github.com/expo/eas-cli/pull/712) by [@quinlanj](https://github.com/quinlanj))
+- Remove unneeded parameters. ([#710](https://github.com/expo/eas-cli/pull/710) by [@quinlanj](https://github.com/quinlanj))
+- Enforce additionalTypenames for graphql queries. ([#709](https://github.com/expo/eas-cli/pull/709) by [@quinlanj](https://github.com/quinlanj))
+
+## [0.33.1](https://github.com/expo/eas-cli/releases/tag/0.33.1) - 2021-10-22
+
+### 🎉 New features
+
+- Compute runtime version using config-plugins. ([#697](https://github.com/expo/eas-cli/pull/697) by [@jkhales](https://github.com/jkhales))
+
+### 🐛 Bug fixes
+
+- [eas-cli] Skip validating updates scripts integration, which no longer exist in SDK 43+ ([#706](https://github.com/expo/eas-cli/pull/706) by [@brentvatne](https://github.com/brentvatne))
+
+## [0.33.0](https://github.com/expo/eas-cli/releases/tag/0.33.0) - 2021-10-20
+
+### 🎉 New features
+
 - Make "production" the default profile for building and submitting. ([#677](https://github.com/expo/eas-cli/pull/677)) by [@jonsamp](https://github.com/jonsamp)
   - Previously, the default profile when running `eas build` or `eas submit` was "release". We're changing it to a more recognizable name that is consistent with our docs, which is now "production". You can always specify a profile manually with the `--profile` flag. For this major version, if you do not have a profile named "production", and still have a profile named "release", we will fall back to the "release" profile as the default, however you'll see a warning as we're going to remove that behavior in the next major release of EAS CLI.
   - To upgrade, update **eas.json** to have a "production" profile in both the `build` and `submit` objects. If you already have a project set up, this will replace the existing "release" profile. After the change, eas.json should have the following profiles:
-  ```json
-  {
-    "build": {
-      "production": { ... }
-    },
-    "submit": {
-      "production": { ... }
-    }
-  }
-  ```
+    ```json
+      {
+        "build": {
+          "production": { ... }
+        },
+        "submit": {
+          "production": { ... }
+        }
+      }
+    ```
 
 ### 🐛 Bug fixes
 
 - Skip the second prompt for Apple ID if the user is already signed in with Apple. ([#691](https://github.com/expo/eas-cli/pull/691) by [@dsokal](https://github.com/dsokal))
 - Unify reading `app.json`. ([#692](https://github.com/expo/eas-cli/pull/692) by [@dsokal](https://github.com/dsokal))
 
-### 🧹 Chores
-
 ## [0.32.0](https://github.com/expo/eas-cli/releases/tag/0.32.0) - 2021-10-15
 
 ### 🎉 New features

CONTRIBUTING.md

@@ -4,7 +4,7 @@
 2. Wait, the `release` workflow on GitHub Actions is going to take care of the rest (including publishing packages to npm and updating the changelog).
 3. Check the changelog. If any of the entries have been tagged with `[EAS BUILD API]`
    - Open `package.json` and note the version of `@expo/eas-build-job` used in the eas-cli.
-   - Find the `Publish` commit in [expo/eas-build](https://github.com/expo/eas-build/commit/) for that version. In most cases, it will be the latest `Publish` commit.
+   - Find the `Publish` commit in [expo/eas-build](https://github.com/expo/eas-build/commits) for that version. In most cases, it will be the latest `Publish` commit.
    - Find the `eas-cli-local-build-plugin` version published in that commit.
      ![example publish commit](./.gh-assets/eas-build-publish-commit.png)
    - Run `npm dist-tags add eas-cli-local-build-plugin@VERSION latest` with the version from the previous step.

lerna.json

@@ -1,5 +1,5 @@
 {
   "npmClient": "yarn",
   "useWorkspaces": true,
-  "version": "0.33.0"
+  "version": "0.34.1"
 }

package.json

@@ -10,7 +10,8 @@
     "eas": "packages/eas-cli/bin/run",
     "lint": "eslint . --ext .ts --ext .js",
     "release": "lerna version",
-    "test": "jest"
+    "test": "jest",
+    "clean": "lerna run clean && rm -rf node_modules coverage"
   },
   "devDependencies": {
     "@expo/oclif-dev-cli": "1.24.0-expo",

packages/eas-cli/README.md

@@ -73,7 +73,7 @@ ALIASES
   $ eas login
 ```
 
-_See code: [src/commands/account/login.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/account/login.js)_
+_See code: [src/commands/account/login.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/account/login.js)_
 
 ## `eas account:logout`
 
@@ -87,7 +87,7 @@ ALIASES
   $ eas logout
 ```
 
-_See code: [src/commands/account/logout.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/account/logout.js)_
+_See code: [src/commands/account/logout.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/account/logout.js)_
 
 ## `eas account:view`
 
@@ -101,7 +101,7 @@ ALIASES
   $ eas whoami
 ```
 
-_See code: [src/commands/account/view.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/account/view.js)_
+_See code: [src/commands/account/view.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/account/view.js)_
 
 ## `eas analytics [STATUS]`
 
@@ -112,7 +112,7 @@ USAGE
   $ eas analytics [STATUS]
 ```
 
-_See code: [src/commands/analytics.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/analytics.js)_
+_See code: [src/commands/analytics.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/analytics.js)_
 
 ## `eas build`
 
@@ -146,7 +146,7 @@ OPTIONS
   --[no-]wait                              Wait for build(s) to complete
 ```
 
-_See code: [src/commands/build/index.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/build/index.js)_
+_See code: [src/commands/build/index.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/build/index.js)_
 
 ## `eas build:cancel [BUILD_ID]`
 
@@ -157,7 +157,7 @@ USAGE
   $ eas build:cancel [BUILD_ID]
 ```
 
-_See code: [src/commands/build/cancel.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/build/cancel.js)_
+_See code: [src/commands/build/cancel.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/build/cancel.js)_
 
 ## `eas build:configure`
 
@@ -171,7 +171,7 @@ OPTIONS
   -p, --platform=(android|ios|all)  Platform to configure
 ```
 
-_See code: [src/commands/build/configure.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/build/configure.js)_
+_See code: [src/commands/build/configure.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/build/configure.js)_
 
 ## `eas build:list`
 
@@ -204,7 +204,7 @@ OPTIONS
   --status=(new|in-queue|in-progress|errored|finished|canceled)
 ```
 
-_See code: [src/commands/build/list.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/build/list.js)_
+_See code: [src/commands/build/list.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/build/list.js)_
 
 ## `eas build:view [BUILD_ID]`
 
@@ -218,7 +218,7 @@ OPTIONS
   --json  Enable JSON output, non-JSON messages will be printed to stderr
 ```
 
-_See code: [src/commands/build/view.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/build/view.js)_
+_See code: [src/commands/build/view.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/build/view.js)_
 
 ## `eas config`
 
@@ -233,7 +233,7 @@ OPTIONS
   --profile=profile
 ```
 
-_See code: [src/commands/config.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/config.js)_
+_See code: [src/commands/config.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/config.js)_
 
 ## `eas credentials`
 
@@ -244,7 +244,7 @@ USAGE
   $ eas credentials
 ```
 
-_See code: [src/commands/credentials.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/credentials.js)_
+_See code: [src/commands/credentials.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/credentials.js)_
 
 ## `eas device:create`
 
@@ -255,7 +255,7 @@ USAGE
   $ eas device:create
 ```
 
-_See code: [src/commands/device/create.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/device/create.js)_
+_See code: [src/commands/device/create.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/device/create.js)_
 
 ## `eas device:list`
 
@@ -269,7 +269,7 @@ OPTIONS
   --apple-team-id=apple-team-id
 ```
 
-_See code: [src/commands/device/list.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/device/list.js)_
+_See code: [src/commands/device/list.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/device/list.js)_
 
 ## `eas device:view [UDID]`
 
@@ -280,7 +280,7 @@ USAGE
   $ eas device:view [UDID]
 ```
 
-_See code: [src/commands/device/view.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/device/view.js)_
+_See code: [src/commands/device/view.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/device/view.js)_
 
 ## `eas diagnostics`
 
@@ -291,7 +291,7 @@ USAGE
   $ eas diagnostics
 ```
 
-_See code: [src/commands/diagnostics.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/diagnostics.js)_
+_See code: [src/commands/diagnostics.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/diagnostics.js)_
 
 ## `eas help [COMMAND]`
 
@@ -319,7 +319,7 @@ USAGE
   $ eas project:info
 ```
 
-_See code: [src/commands/project/info.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/project/info.js)_
+_See code: [src/commands/project/info.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/project/info.js)_
 
 ## `eas project:init`
 
@@ -333,7 +333,7 @@ ALIASES
   $ eas init
 ```
 
-_See code: [src/commands/project/init.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/project/init.js)_
+_See code: [src/commands/project/init.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/project/init.js)_
 
 ## `eas secret:create`
 
@@ -350,7 +350,7 @@ OPTIONS
   --value=value              Value of the secret
 ```
 
-_See code: [src/commands/secret/create.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/secret/create.js)_
+_See code: [src/commands/secret/create.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/secret/create.js)_
 
 ## `eas secret:delete`
 
@@ -364,10 +364,10 @@ OPTIONS
   --id=id  ID of the secret to delete
 
 DESCRIPTION
-  Unsure where to find the secret's ID? Run eas secrets:list
+  Unsure where to find the secret's ID? Run eas secret:list
 ```
 
-_See code: [src/commands/secret/delete.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/secret/delete.js)_
+_See code: [src/commands/secret/delete.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/secret/delete.js)_
 
 ## `eas secret:list`
 
@@ -378,7 +378,7 @@ USAGE
   $ eas secret:list
 ```
 
-_See code: [src/commands/secret/list.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/secret/list.js)_
+_See code: [src/commands/secret/list.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/secret/list.js)_
 
 ## `eas submit`
 
@@ -412,7 +412,7 @@ ALIASES
   $ eas build:submit
 ```
 
-_See code: [src/commands/submit.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/submit.js)_
+_See code: [src/commands/submit.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/submit.js)_
 
 ## `eas webhook:create`
 
@@ -431,7 +431,7 @@ OPTIONS
   --url=url        Webhook URL
 ```
 
-_See code: [src/commands/webhook/create.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/webhook/create.js)_
+_See code: [src/commands/webhook/create.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/webhook/create.js)_
 
 ## `eas webhook:delete [ID]`
 
@@ -445,7 +445,7 @@ ARGUMENTS
   ID  ID of the webhook to delete
 ```
 
-_See code: [src/commands/webhook/delete.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/webhook/delete.js)_
+_See code: [src/commands/webhook/delete.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/webhook/delete.js)_
 
 ## `eas webhook:list`
 
@@ -459,7 +459,7 @@ OPTIONS
   --event=(BUILD)  Event type that triggers the webhook
 ```
 
-_See code: [src/commands/webhook/list.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/webhook/list.js)_
+_See code: [src/commands/webhook/list.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/webhook/list.js)_
 
 ## `eas webhook:update`
 
@@ -479,7 +479,7 @@ OPTIONS
   --url=url        Webhook URL
 ```
 
-_See code: [src/commands/webhook/update.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/webhook/update.js)_
+_See code: [src/commands/webhook/update.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/webhook/update.js)_
 
 ## `eas webhook:view ID`
 
@@ -493,5 +493,5 @@ ARGUMENTS
   ID  ID of the webhook to view
 ```
 
-_See code: [src/commands/webhook/view.js](https://github.com/expo/eas-cli/blob/v0.33.0/packages/eas-cli/src/commands/webhook/view.js)_
+_See code: [src/commands/webhook/view.js](https://github.com/expo/eas-cli/blob/v0.34.1/packages/eas-cli/src/commands/webhook/view.js)_
 <!-- commandsstop -->

packages/eas-cli/package.json

@@ -1,23 +1,23 @@
 {
   "name": "eas-cli",
   "description": "EAS command line tool",
-  "version": "0.33.0",
+  "version": "0.34.1",
   "author": "Expo <[email protected]>",
   "bin": {
     "eas": "./bin/run"
   },
   "bugs": "https://github.com/expo/eas-cli/issues",
   "dependencies": {
-    "@expo/apple-utils": "0.0.0-alpha.25",
-    "@expo/config": "6.0.2",
-    "@expo/config-plugins": "4.0.2",
-    "@expo/eas-build-job": "0.2.52",
-    "@expo/eas-json": "^0.33.0",
+    "@expo/apple-utils": "0.0.0-alpha.26",
+    "@expo/config": "6.0.3",
+    "@expo/config-plugins": "4.0.3",
+    "@expo/eas-build-job": "0.2.57",
+    "@expo/eas-json": "^0.34.1",
     "@expo/json-file": "8.2.33",
     "@expo/pkcs12": "0.0.4",
     "@expo/plist": "0.0.14",
     "@expo/plugin-warn-if-update-available": "1.7.0",
-    "@expo/prebuild-config": "3.0.2",
+    "@expo/prebuild-config": "3.0.3",
     "@expo/results": "1.0.0",
     "@expo/rudder-sdk-node": "1.1.0",
     "@expo/sdk-runtime-versions": "1.0.0",
@@ -113,7 +113,6 @@
     "cli"
   ],
   "license": "MIT",
-  "main": "build/index.js",
   "oclif": {
     "bin": "eas",
     "commands": "./build/commands",
@@ -177,6 +176,7 @@
     "typecheck": "tsc",
     "test": "jest",
     "version": "yarn oclif-dev readme && node patch-readme && git add README.md",
-    "generate-graphql-code": "graphql-codegen --config graphql-codegen.yml"
+    "generate-graphql-code": "graphql-codegen --config graphql-codegen.yml",
+    "clean": "rm -rf dist build node_modules yarn-error.log"
   }
 }

packages/eas-cli/src/analytics.ts

@@ -4,13 +4,7 @@ import { URL } from 'url';
 import { v4 as uuidv4 } from 'uuid';
 
 import UserSettings from './user/UserSettings';
-
-/**
- * We use require() to exclude package.json from TypeScript's analysis since it lives outside
- * the src directory and would change the directory structure of the emitted files
- * under the build directory
- */
-const packageJSON = require('../package.json');
+import { easCliVersion } from './utils/easCli';
 
 const PLATFORM_TO_ANALYTICS_PLATFORM: { [platform: string]: string } = {
   darwin: 'Mac',
@@ -97,7 +91,7 @@ export function logEvent(name: string, properties: Record<string, any> = {}): vo
   ensureUserIdentified();
 
   const { userId, deviceId } = identifyData ?? {};
-  const commonEventProperties = { source_version: packageJSON?.version, source: 'eas cli' };
+  const commonEventProperties = { source_version: easCliVersion, source: 'eas cli' };
 
   const identity = { userId: userId ?? undefined, anonymousId: deviceId ?? uuidv4() };
   rudderstackClient.track({
@@ -126,7 +120,7 @@ function getRudderStackContext(): Record<string, any> {
   return {
     os: { name: platform, version: os.release() },
     device: { type: platform, model: platform },
-    app: { name: 'eas cli', version: packageJSON?.version ?? undefined },
+    app: { name: 'eas cli', version: easCliVersion ?? undefined },
   };
 }
 

packages/eas-cli/src/build/android/UpdatesModule.ts

@@ -1,6 +1,5 @@
 import { ExpoConfig } from '@expo/config';
 import { AndroidConfig, AndroidManifest } from '@expo/config-plugins';
-import fs from 'fs-extra';
 
 import Log from '../../log';
 import { getProjectAccountName } from '../../project/projectUtils';
@@ -10,17 +9,6 @@ import { ensureValidVersions } from '../utils/updates';
 export async function configureUpdatesAsync(projectDir: string, exp: ExpoConfig): Promise<void> {
   ensureValidVersions(exp);
   const accountName = getProjectAccountName(exp, await ensureLoggedInAsync());
-  const buildGradlePath = AndroidConfig.Paths.getAppBuildGradleFilePath(projectDir);
-  const buildGradleContents = await fs.readFile(buildGradlePath, 'utf8');
-
-  if (!AndroidConfig.Updates.isBuildGradleConfigured(projectDir, buildGradleContents)) {
-    const updatedBuildGradleContents =
-      AndroidConfig.Updates.ensureBuildGradleContainsConfigurationScript(
-        projectDir,
-        buildGradleContents
-      );
-    await fs.writeFile(buildGradlePath, updatedBuildGradleContents);
-  }
 
   const androidManifestPath = await AndroidConfig.Paths.getAndroidManifestAsync(projectDir);
   const androidManifest = await getAndroidManifestAsync(projectDir);
@@ -39,7 +27,7 @@ export async function syncUpdatesConfigurationAsync(
   ensureValidVersions(exp);
   const accountName = getProjectAccountName(exp, await ensureLoggedInAsync());
   try {
-    await ensureUpdatesConfiguredAsync(projectDir, exp);
+    await ensureUpdatesConfiguredAsync(projectDir);
   } catch (error) {
     Log.error(
       'expo-updates module is not configured. Please run "eas build:configure" first to configure the project'
@@ -62,15 +50,9 @@ export async function syncUpdatesConfigurationAsync(
   }
 }
 
-async function ensureUpdatesConfiguredAsync(projectDir: string, exp: ExpoConfig): Promise<void> {
-  const buildGradlePath = AndroidConfig.Paths.getAppBuildGradleFilePath(projectDir);
-  const buildGradleContents = await fs.readFile(buildGradlePath, 'utf8');
-
-  if (!AndroidConfig.Updates.isBuildGradleConfigured(projectDir, buildGradleContents)) {
-    const gradleScriptApply = AndroidConfig.Updates.formatApplyLineForBuildGradle(projectDir);
-    throw new Error(`Missing ${gradleScriptApply} in ${buildGradlePath}`);
-  }
-
+// Note: we assume here that Expo modules are properly configured in the project. Aside from that,
+// all that is needed on Expo SDK 43+ to configure expo-updates configuration in AndroidManifest.xml
+async function ensureUpdatesConfiguredAsync(projectDir: string): Promise<void> {
   const androidManifest = await getAndroidManifestAsync(projectDir);
 
   if (!AndroidConfig.Updates.isMainApplicationMetaDataSet(androidManifest)) {

packages/eas-cli/src/build/android/configure.ts

@@ -9,7 +9,7 @@ import {
   warnIfAndroidPackageDefinedInAppConfigForBareWorkflowProject,
 } from '../../project/android/applicationId';
 import { resolveWorkflowAsync } from '../../project/workflow';
-import vcs from '../../vcs';
+import { getVcsClient } from '../../vcs';
 import { ConfigureContext } from '../context';
 import { isExpoUpdatesInstalled } from '../utils/updates';
 import { configureUpdatesAsync, syncUpdatesConfigurationAsync } from './UpdatesModule';
@@ -26,7 +26,7 @@ export async function configureAndroidAsync(ctx: ConfigureContext): Promise<void
   await AndroidConfig.EasBuild.configureEasBuildAsync(ctx.projectDir);
 
   const easGradlePath = AndroidConfig.EasBuild.getEasBuildGradlePath(ctx.projectDir);
-  await vcs.trackFileAsync(easGradlePath);
+  await getVcsClient().trackFileAsync(easGradlePath);
 
   if (isExpoUpdatesInstalled(ctx.projectDir)) {
     await configureUpdatesAsync(ctx.projectDir, ctx.exp);

packages/eas-cli/src/build/android/graphql.ts

@@ -17,15 +17,14 @@ export function transformJob(job: Android.Job): AndroidJobInput {
     artifactPath: job.artifactPath,
     username: job.username,
     buildType: job.buildType && transformBuildType(job.buildType),
+    developmentClient: job.developmentClient,
   };
 }
 
 function transformBuildType(buildType: Android.BuildType): AndroidBuildType {
   if (buildType === Android.BuildType.APK) {
     return AndroidBuildType.Apk;
-  } else if (buildType === Android.BuildType.APP_BUNDLE) {
-    return AndroidBuildType.AppBundle;
   } else {
-    return AndroidBuildType.DevelopmentClient;
+    return AndroidBuildType.AppBundle;
   }
 }

packages/eas-cli/src/build/android/prepareJob.ts

@@ -6,7 +6,7 @@ import slash from 'slash';
 import { AndroidCredentials } from '../../credentials/android/AndroidCredentialsProvider';
 import { getUsername } from '../../project/projectUtils';
 import { ensureLoggedInAsync } from '../../user/actions';
-import vcs from '../../vcs';
+import { getVcsClient } from '../../vcs';
 import { BuildContext } from '../context';
 
 interface JobData {
@@ -27,7 +27,7 @@ export async function prepareJobAsync(
   const username = getUsername(ctx.exp, await ensureLoggedInAsync());
   const buildProfile: AndroidBuildProfile = ctx.buildProfile;
   const projectRootDirectory =
-    slash(path.relative(await vcs.getRootPathAsync(), ctx.projectDir)) || '.';
+    slash(path.relative(await getVcsClient().getRootPathAsync(), ctx.projectDir)) || '.';
   const { credentials } = jobData;
   const buildCredentials = credentials
     ? {
@@ -70,12 +70,11 @@ export async function prepareJobAsync(
     },
     releaseChannel: ctx.buildProfile.releaseChannel,
     updates: { channel: ctx.buildProfile.channel },
-
+    developmentClient: buildProfile.developmentClient,
     gradleCommand: buildProfile.gradleCommand,
     artifactPath: buildProfile.artifactPath,
-
+    buildType,
     username,
-    buildType: buildProfile.developmentClient ? Android.BuildType.DEVELOPMENT_CLIENT : buildType,
   };
 
   return sanitizeJob(job);

packages/eas-cli/src/build/build.ts

@@ -13,7 +13,7 @@ import { uploadAsync } from '../uploads';
 import { formatBytes } from '../utils/files';
 import { createProgressTracker } from '../utils/progress';
 import { sleepAsync } from '../utils/promise';
-import vcs from '../vcs';
+import { getVcsClient } from '../vcs';
 import { BuildContext } from './context';
 import { runLocalBuildAsync } from './local';
 import { MetadataContext, collectMetadataAsync } from './metadata';
@@ -68,7 +68,7 @@ export async function prepareBuildRequestForPlatformAsync<
     });
   }
 
-  if (await vcs.hasUncommittedChangesAsync()) {
+  if (await getVcsClient().isCommitRequiredAsync()) {
     Log.addNewLineIfNone();
     await reviewAndCommitChangesAsync(
       `[EAS Build] Run EAS Build for ${requestedPlatformDisplayNames[ctx.platform as Platform]}`,

packages/eas-cli/src/build/configure.ts

@@ -10,7 +10,8 @@ import { RequestedPlatform } from '../platform';
 import { resolveWorkflowAsync } from '../project/workflow';
 import { confirmAsync, promptAsync } from '../prompts';
 import { ensureLoggedInAsync } from '../user/actions';
-import vcs from '../vcs';
+import { easCliVersion } from '../utils/easCli';
+import { getVcsClient } from '../vcs';
 import { configureAndroidAsync } from './android/configure';
 import { ConfigureContext } from './context';
 import { configureIosAsync } from './ios/configure';
@@ -37,7 +38,7 @@ export async function ensureProjectConfiguredAsync(
       projectDir,
       platform: requestedPlatform,
     });
-    if (await vcs.hasUncommittedChangesAsync()) {
+    if (await getVcsClient().isCommitRequiredAsync()) {
       error(
         'Build process requires clean working tree, please commit all your changes and run `eas build` again',
         { exit: 1 }
@@ -57,7 +58,7 @@ export async function configureAsync(options: {
   platform: RequestedPlatform;
   projectDir: string;
 }): Promise<void> {
-  await vcs.ensureRepoExistsAsync();
+  await getVcsClient().ensureRepoExistsAsync();
   await maybeBailOnRepoStatusAsync();
 
   const { exp } = getConfig(options.projectDir, { skipSDKVersionRequirement: true });
@@ -86,16 +87,19 @@ export async function configureAsync(options: {
     await configureIosAsync(ctx);
   }
 
-  if (await vcs.hasUncommittedChangesAsync()) {
+  if (await getVcsClient().isCommitRequiredAsync()) {
     Log.newLine();
     await reviewAndCommitChangesAsync(configureCommitMessage[options.platform]);
-  } else {
+  } else if (!(await getVcsClient().hasUncommittedChangesAsync())) {
     Log.newLine();
     Log.withTick('No changes were necessary, the project is already configured correctly.');
   }
 }
 
 const EAS_JSON_MANAGED_DEFAULT: EasJson = {
+  cli: {
+    version: `>= ${easCliVersion}`,
+  },
   build: {
     development: {
       developmentClient: true,
@@ -112,6 +116,9 @@ const EAS_JSON_MANAGED_DEFAULT: EasJson = {
 };
 
 const EAS_JSON_BARE_DEFAULT: EasJson = {
+  cli: {
+    version: `>= ${easCliVersion}`,
+  },
   build: {
     development: {
       distribution: 'internal',
@@ -149,7 +156,7 @@ export async function ensureEasJsonExistsAsync(ctx: ConfigureContext): Promise<v
       : EAS_JSON_MANAGED_DEFAULT;
 
   await fs.writeFile(easJsonPath, `${JSON.stringify(easJson, null, 2)}\n`);
-  await vcs.trackFileAsync(easJsonPath);
+  await getVcsClient().trackFileAsync(easJsonPath);
   Log.withTick('Generated eas.json');
 }
 
@@ -183,7 +190,7 @@ async function reviewAndCommitChangesAsync(
     await commitPromptAsync({ initialCommitMessage });
     Log.withTick('Committed changes');
   } else if (selected === ShouldCommitChanges.ShowDiffFirst) {
-    await vcs.showDiffAsync();
+    await getVcsClient().showDiffAsync();
     await reviewAndCommitChangesAsync(initialCommitMessage, false);
   }
 }

packages/eas-cli/src/build/ios/UpdatesModule.ts

@@ -1,30 +1,16 @@
 import { ExpoConfig } from '@expo/config';
 import { IOSConfig } from '@expo/config-plugins';
-import fs from 'fs-extra';
 
 import Log from '../../log';
 import { getProjectAccountName } from '../../project/projectUtils';
 import { ensureLoggedInAsync } from '../../user/actions';
-import vcs from '../../vcs';
+import { getVcsClient } from '../../vcs';
 import { ensureValidVersions } from '../utils/updates';
 import { readPlistAsync, writePlistAsync } from './plist';
 
 export async function configureUpdatesAsync(projectDir: string, exp: ExpoConfig): Promise<void> {
   ensureValidVersions(exp);
   const accountName = getProjectAccountName(exp, await ensureLoggedInAsync());
-  let xcodeProject = IOSConfig.XcodeUtils.getPbxproj(projectDir);
-
-  if (!IOSConfig.Updates.isShellScriptBuildPhaseConfigured(projectDir, xcodeProject)) {
-    xcodeProject = IOSConfig.Updates.ensureBundleReactNativePhaseContainsConfigurationScript(
-      projectDir,
-      xcodeProject
-    );
-    await fs.writeFile(
-      IOSConfig.Paths.getPBXProjectPath(projectDir),
-      // eslint-disable-next-line node/no-sync
-      xcodeProject.writeSync()
-    );
-  }
 
   let expoPlist = await readExpoPlistAsync(projectDir);
   if (!IOSConfig.Updates.isPlistConfigurationSynced(exp, expoPlist, accountName)) {
@@ -41,7 +27,7 @@ export async function syncUpdatesConfigurationAsync(
   ensureValidVersions(exp);
   const accountName = getProjectAccountName(exp, await ensureLoggedInAsync());
   try {
-    await ensureUpdatesConfiguredAsync(projectDir, exp);
+    await ensureUpdatesConfiguredAsync(projectDir);
   } catch (error) {
     Log.error(
       'expo-updates module is not configured. Please run "eas build:configure" first to configure the project'
@@ -62,15 +48,9 @@ export async function syncUpdatesConfigurationAsync(
   }
 }
 
-async function ensureUpdatesConfiguredAsync(projectDir: string, exp: ExpoConfig): Promise<void> {
-  const xcodeProject = IOSConfig.XcodeUtils.getPbxproj(projectDir);
-
-  if (!IOSConfig.Updates.isShellScriptBuildPhaseConfigured(projectDir, xcodeProject)) {
-    const script = 'expo-updates/scripts/create-manifest-ios.sh';
-    const buildPhase = '"Bundle React Native code and images"';
-    throw new Error(`Path to ${script} is missing in a ${buildPhase} build phase.`);
-  }
-
+// Note: we assume here that Expo modules are properly configured in the project. Aside from that,
+// all that is needed on Expo SDK 43+ to configure expo-updates configuration in Expo.plist
+async function ensureUpdatesConfiguredAsync(projectDir: string): Promise<void> {
   const expoPlist = await readExpoPlistAsync(projectDir);
   if (!IOSConfig.Updates.isPlistConfigurationSet(expoPlist)) {
     throw new Error('Missing values in Expo.plist');
@@ -88,7 +68,7 @@ async function writeExpoPlistAsync(
 ): Promise<void> {
   const expoPlistPath = IOSConfig.Paths.getExpoPlistPath(projectDir);
   await writePlistAsync(expoPlistPath, expoPlist);
-  await vcs.trackFileAsync(expoPlistPath);
+  await getVcsClient().trackFileAsync(expoPlistPath);
 }
 
 export async function readReleaseChannelSafelyAsync(projectDir: string): Promise<string | null> {

packages/eas-cli/src/build/ios/graphql.ts

@@ -1,12 +1,7 @@
 import { Env, Ios } from '@expo/eas-build-job';
 import nullthrows from 'nullthrows';
 
-import {
-  DistributionType,
-  IosBuildType,
-  IosJobInput,
-  IosJobSecretsInput,
-} from '../../graphql/generated';
+import { IosJobInput, IosJobSecretsInput } from '../../graphql/generated';
 import { transformProjectArchive, transformWorkflow } from '../graphql';
 
 export function transformJob(job: Ios.Job): IosJobInput {
@@ -16,30 +11,18 @@ export function transformJob(job: Ios.Job): IosJobInput {
     projectRootDirectory: job.projectRootDirectory,
     releaseChannel: job.releaseChannel,
     updates: job.updates,
-    distribution: job.distribution && transformDistributionType(job.distribution),
     secrets: transformIosSecrets(job.secrets),
     builderEnvironment: job.builderEnvironment,
     cache: job.cache,
-
     scheme: job.scheme,
     buildConfiguration: job.buildConfiguration,
     artifactPath: job.artifactPath,
-
-    buildType: job.buildType && transformBuildType(job.buildType),
     username: job.username,
+    developmentClient: job.developmentClient,
+    simulator: job.simulator,
   };
 }
 
-function transformDistributionType(distributionType: Ios.DistributionType): DistributionType {
-  if (distributionType === 'store') {
-    return DistributionType.Store;
-  } else if (distributionType === 'internal') {
-    return DistributionType.Internal;
-  } else {
-    return DistributionType.Simulator;
-  }
-}
-
 function transformIosSecrets(secrets: {
   buildCredentials?: Ios.BuildCredentials;
   env?: Env;
@@ -61,11 +44,3 @@ function transformIosSecrets(secrets: {
     environmentSecrets: secrets.env,
   };
 }
-
-function transformBuildType(buildType: Ios.BuildType): IosBuildType {
-  if (buildType === Ios.BuildType.DEVELOPMENT_CLIENT) {
-    return IosBuildType.DevelopmentClient;
-  } else {
-    return IosBuildType.Release;
-  }
-}

packages/eas-cli/src/build/ios/prepareJob.ts

@@ -5,7 +5,7 @@ import slash from 'slash';
 import { IosCredentials, TargetCredentials } from '../../credentials/ios/types';
 import { getUsername } from '../../project/projectUtils';
 import { ensureLoggedInAsync } from '../../user/actions';
-import vcs from '../../vcs';
+import { getVcsClient } from '../../vcs';
 import { BuildContext } from '../context';
 
 interface JobData {
@@ -25,7 +25,7 @@ export async function prepareJobAsync(
   jobData: JobData
 ): Promise<Job> {
   const projectRootDirectory =
-    slash(path.relative(await vcs.getRootPathAsync(), ctx.projectDir)) || '.';
+    slash(path.relative(await getVcsClient().getRootPathAsync(), ctx.projectDir)) || '.';
   const username = getUsername(ctx.exp, await ensureLoggedInAsync());
   const buildCredentials: Ios.Job['secrets']['buildCredentials'] = {};
   if (jobData.credentials) {
@@ -40,7 +40,6 @@ export async function prepareJobAsync(
     platform: Platform.IOS,
     projectArchive: jobData.projectArchive,
     projectRootDirectory,
-    distribution: ctx.buildProfile.simulator ? 'simulator' : ctx.buildProfile.distribution,
     builderEnvironment: {
       image: ctx.buildProfile.image,
       node: ctx.buildProfile.node,
@@ -61,14 +60,11 @@ export async function prepareJobAsync(
     },
     releaseChannel: ctx.buildProfile.releaseChannel,
     updates: { channel: ctx.buildProfile.channel },
-
+    developmentClient: ctx.buildProfile.developmentClient,
+    simulator: ctx.buildProfile.simulator,
     scheme: jobData.buildScheme,
     buildConfiguration: ctx.buildProfile.buildConfiguration,
     artifactPath: ctx.buildProfile.artifactPath,
-
-    buildType: ctx.buildProfile.developmentClient
-      ? Ios.BuildType.DEVELOPMENT_CLIENT
-      : Ios.BuildType.RELEASE,
     username,
   };
   return sanitizeJob(job);

packages/eas-cli/src/build/metadata.ts

@@ -7,7 +7,8 @@ import { GradleBuildContext } from '../project/android/gradle';
 import { getBundleIdentifierAsync } from '../project/ios/bundleIdentifier';
 import { getUsername } from '../project/projectUtils';
 import { ensureLoggedInAsync } from '../user/actions';
-import vcs from '../vcs';
+import { easCliVersion } from '../utils/easCli';
+import { getVcsClient } from '../vcs';
 import {
   readChannelSafelyAsync as readAndroidChannelSafelyAsync,
   readReleaseChannelSafelyAsync as readAndroidReleaseChannelSafelyAsync,
@@ -21,13 +22,6 @@ import {
 import { maybeResolveVersionsAsync as maybeResolveIosVersionsAsync } from './ios/version';
 import { isExpoUpdatesInstalled } from './utils/updates';
 
-/**
- * We use require() to exclude package.json from TypeScript's analysis since it lives outside
- * the src directory and would change the directory structure of the emitted files
- * under the build directory
- */
-const packageJSON = require('../../package.json');
-
 export type MetadataContext<T extends Platform> = T extends Platform.ANDROID
   ? AndroidMetadataContext
   : IosMetadataContext;
@@ -53,7 +47,7 @@ export async function collectMetadataAsync<T extends Platform>(
   const metadata = {
     trackingContext: ctx.trackingCtx,
     ...(await maybeResolveVersionsAsync(ctx, platformContext)),
-    cliVersion: packageJSON.version,
+    cliVersion: easCliVersion,
     workflow: ctx.workflow,
     credentialsSource: ctx.buildProfile.credentialsSource,
     sdkVersion: ctx.exp.sdkVersion,
@@ -63,7 +57,8 @@ export async function collectMetadataAsync<T extends Platform>(
     appName: ctx.exp.name,
     appIdentifier: await resolveAppIdentifierAsync(ctx, platformContext),
     buildProfile: ctx.buildProfileName,
-    gitCommitHash: await vcs.getCommitHashAsync(),
+    gitCommitHash: await getVcsClient().getCommitHashAsync(),
+    isGitWorkingTreeDirty: await getVcsClient().hasUncommittedChangesAsync(),
     username: getUsername(ctx.exp, await ensureLoggedInAsync()),
     ...(ctx.platform === Platform.IOS && {
       iosEnterpriseProvisioning: resolveIosEnterpriseProvisioning(

packages/eas-cli/src/build/utils/devClient.ts

@@ -9,8 +9,9 @@ import Log, { learnMore } from '../../log';
 import { appPlatformDisplayNames } from '../../platform';
 import { resolveWorkflowAsync } from '../../project/workflow';
 import { confirmAsync } from '../../prompts';
-import { expoCommandAsync } from '../../utils/expoCommand';
+import { expoCommandAsync } from '../../utils/expoCli';
 import { ProfileData } from '../../utils/profiles';
+import { getVcsClient } from '../../vcs';
 import { reviewAndCommitChangesAsync } from './repository';
 
 export async function ensureExpoDevClientInstalledForDevClientBuildsAsync({
@@ -107,7 +108,9 @@ async function installExpoDevClientAsync(
   Log.newLine();
   await expoCommandAsync(projectDir, ['install', 'expo-dev-client']);
   Log.newLine();
-  await reviewAndCommitChangesAsync('Install expo-dev-client', {
-    nonInteractive,
-  });
+  if (await getVcsClient().isCommitRequiredAsync()) {
+    await reviewAndCommitChangesAsync('Install expo-dev-client', {
+      nonInteractive,
+    });
+  }
 }

packages/eas-cli/src/build/utils/formatBuild.ts

@@ -120,11 +120,5 @@ export function formatGraphQLBuild(build: BuildFragment): string {
 }
 
 const getActorName = (build: BuildFragment): string => {
-  if (!build.initiatingActor) {
-    return 'unknown';
-  } else if (build.initiatingActor.__typename === 'User') {
-    return build.initiatingActor.username;
-  } else {
-    return build.initiatingActor.firstName ?? 'unknown';
-  }
+  return build.initiatingActor?.displayName || 'unknown';
 };

packages/eas-cli/src/build/utils/repository.ts

@@ -10,10 +10,10 @@ import { confirmAsync, promptAsync } from '../../prompts';
 import { formatBytes } from '../../utils/files';
 import { getTmpDirectory } from '../../utils/paths';
 import { endTimer, formatMilliseconds, startTimer } from '../../utils/timer';
-import vcs from '../../vcs';
+import { getVcsClient } from '../../vcs';
 
 export async function maybeBailOnRepoStatusAsync(): Promise<void> {
-  if (!(await vcs.hasUncommittedChangesAsync())) {
+  if (!(await getVcsClient().isCommitRequiredAsync())) {
     return;
   }
   Log.addNewLineIfNone();
@@ -33,7 +33,7 @@ export async function maybeBailOnRepoStatusAsync(): Promise<void> {
 }
 
 export async function ensureRepoIsCleanAsync(nonInteractive = false): Promise<void> {
-  if (!(await vcs.hasUncommittedChangesAsync())) {
+  if (!(await getVcsClient().isCommitRequiredAsync())) {
     return;
   }
   Log.addNewLineIfNone();
@@ -70,7 +70,7 @@ export async function commitPromptAsync({
     initial: initialCommitMessage,
     validate: (input: string) => input !== '',
   });
-  await vcs.commitAsync({ commitAllFiles, commitMessage: message });
+  await getVcsClient().commitAsync({ commitAllFiles, commitMessage: message });
 }
 
 export async function makeProjectTarballAsync(): Promise<{ path: string; size: number }> {
@@ -95,7 +95,7 @@ export async function makeProjectTarballAsync(): Promise<{ path: string; size: n
   startTimer(compressTimerLabel);
 
   try {
-    await vcs.makeShallowCopyAsync(shallowClonePath);
+    await getVcsClient().makeShallowCopyAsync(shallowClonePath);
     await tar.create({ cwd: shallowClonePath, file: tarPath, prefix: 'project', gzip: true }, [
       '.',
     ]);
@@ -133,7 +133,10 @@ export async function reviewAndCommitChangesAsync(
   { nonInteractive, askedFirstTime = true }: { nonInteractive: boolean; askedFirstTime?: boolean }
 ): Promise<void> {
   if (process.env.EAS_BUILD_AUTOCOMMIT) {
-    await vcs.commitAsync({ commitMessage: initialCommitMessage, commitAllFiles: false });
+    await getVcsClient().commitAsync({
+      commitMessage: initialCommitMessage,
+      commitAllFiles: false,
+    });
     Log.withTick('Committed changes.');
     return;
   }
@@ -166,7 +169,7 @@ export async function reviewAndCommitChangesAsync(
     await commitPromptAsync({ initialCommitMessage });
     Log.withTick('Committed changes.');
   } else if (selected === ShouldCommitChanges.ShowDiffFirst) {
-    await vcs.showDiffAsync();
+    await getVcsClient().showDiffAsync();
     await reviewAndCommitChangesAsync(initialCommitMessage, {
       nonInteractive,
       askedFirstTime: false,

packages/eas-cli/src/build/validate.ts

@@ -3,7 +3,7 @@ import fs from 'fs-extra';
 import path from 'path';
 
 import Log, { learnMore } from '../log';
-import vcs from '../vcs';
+import { getVcsClient } from '../vcs';
 import { BuildContext } from './context';
 
 export function checkNodeEnvVariable(ctx: BuildContext<Platform>): void {
@@ -25,12 +25,12 @@ export async function checkGoogleServicesFileAsync<T extends Platform>(
   if (!googleServicesFilePath) {
     return;
   }
-  const rootDir = path.normalize(await vcs.getRootPathAsync());
+  const rootDir = path.normalize(await getVcsClient().getRootPathAsync());
   const absGoogleServicesFilePath = path.resolve(ctx.projectDir, googleServicesFilePath);
   if (
     (await fs.pathExists(absGoogleServicesFilePath)) &&
     (!isInsideDirectory(absGoogleServicesFilePath, rootDir) ||
-      (await vcs.isFileIgnoredAsync(path.relative(rootDir, absGoogleServicesFilePath))))
+      (await getVcsClient().isFileIgnoredAsync(path.relative(rootDir, absGoogleServicesFilePath))))
   ) {
     Log.warn(
       `File specified via "${ctx.platform}.googleServicesFile" field in your app.json is not checked in to your repository and won't be uploaded to the builder.`
@@ -41,7 +41,7 @@ export async function checkGoogleServicesFileAsync<T extends Platform>(
       )}`
     );
     Log.warn(
-      'If you are using that file for compatibility with the classic build service (expo build) you can silence this warning by setting GOOGLE_SERVICES_FILE in your build profile in eas.json to any non-falsy value.'
+      `If you are using that file for compatibility with the classic build service (expo build) you can silence this warning by setting your build profile's env.GOOGLE_SERVICES_FILE in eas.json to any non-empty string.`
     );
     Log.newLine();
   }

packages/eas-cli/src/commandUtils/EasCommand.ts

@@ -1,4 +1,6 @@
+import { EasJsonReader } from '@expo/eas-json';
 import { Command } from '@oclif/command';
+import semver from 'semver';
 
 import {
   AnalyticsEvent,
@@ -6,8 +8,13 @@ import {
   initAsync as initAnalyticsAsync,
   logEvent,
 } from '../analytics';
+import Log from '../log';
+import { findProjectRootAsync } from '../project/projectUtils';
 import { getUserAsync } from '../user/User';
 import { ensureLoggedInAsync } from '../user/actions';
+import { easCliVersion } from '../utils/easCli';
+import { setVcsClient } from '../vcs';
+import GitClient from '../vcs/clients/git';
 
 export default abstract class EasCommand extends Command {
   /**
@@ -20,7 +27,10 @@ export default abstract class EasCommand extends Command {
 
   // eslint-disable-next-line async-protect/async-suffix
   async run(): Promise<any> {
+    EasJsonReader.setLog(Log);
+
     await initAnalyticsAsync();
+    await this.applyCliConfigAsync();
 
     if (this.requiresAuthentication) {
       const { flags } = this.parse();
@@ -42,4 +52,18 @@ export default abstract class EasCommand extends Command {
     await flushAnalyticsAsync();
     return super.finally(err);
   }
+
+  private async applyCliConfigAsync(): Promise<void> {
+    const projectDir = await findProjectRootAsync();
+    const easJsonReader = new EasJsonReader(projectDir);
+    const config = await easJsonReader.getCliConfigAsync();
+    if (config?.version && !semver.satisfies(easCliVersion, config.version)) {
+      throw new Error(
+        `You are on eas-cli@${easCliVersion} which does not satisfy the CLI version constraint in eas.json (${config.version})`
+      );
+    }
+    if (config?.requireCommit) {
+      setVcsClient(new GitClient());
+    }
+  }
 }

packages/eas-cli/src/commands/branch/create.ts

@@ -17,7 +17,7 @@ import {
   getProjectIdAsync,
 } from '../../project/projectUtils';
 import { promptAsync } from '../../prompts';
-import vcs from '../../vcs';
+import { getVcsClient } from '../../vcs';
 
 export async function createUpdateBranchOnAppAsync({
   appId,
@@ -90,7 +90,8 @@ export default class BranchCreate extends EasCommand {
         name: 'name',
         message: 'Please name the branch:',
         initial:
-          (await vcs.getBranchNameAsync()) || `branch-${Math.random().toString(36).substr(2, 4)}`,
+          (await getVcsClient().getBranchNameAsync()) ||
+          `branch-${Math.random().toString(36).substr(2, 4)}`,
         validate: value => (value ? true : validationMessage),
       }));
     }

packages/eas-cli/src/commands/branch/delete.ts

@@ -43,7 +43,8 @@ async function getBranchInfoAsync({
         {
           appId,
           name,
-        }
+        },
+        { additionalTypenames: ['UpdateBranch'] }
       )
       .toPromise()
   );

packages/eas-cli/src/commands/branch/list.ts

@@ -44,7 +44,8 @@ export async function listBranchesAsync({
         {
           appId: projectId,
           limit: BRANCHES_LIMIT,
-        }
+        },
+        { additionalTypenames: ['UpdateBranch'] }
       )
       .toPromise()
   );

packages/eas-cli/src/commands/branch/publish.ts

@@ -1,5 +1,6 @@
-import { ExpoConfig, getConfig, getDefaultTarget } from '@expo/config';
-import { getRuntimeVersionForSDKVersion } from '@expo/sdk-runtime-versions';
+import { ExpoConfig, getConfig } from '@expo/config';
+import { Updates } from '@expo/config-plugins';
+import { Platform, Workflow } from '@expo/eas-build-job';
 import { flags } from '@oclif/command';
 import assert from 'assert';
 import chalk from 'chalk';
@@ -28,11 +29,12 @@ import {
   collectAssetsAsync,
   uploadAssetsAsync,
 } from '../../project/publish';
+import { resolveWorkflowAsync } from '../../project/workflow';
 import { promptAsync, selectAsync } from '../../prompts';
 import { formatUpdate } from '../../update/utils';
 import uniqBy from '../../utils/expodash/uniqBy';
 import formatFields from '../../utils/formatFields';
-import vcs from '../../vcs';
+import { getVcsClient } from '../../vcs';
 import { createUpdateBranchOnAppAsync } from './create';
 import { listBranchesAsync } from './list';
 import { viewUpdateBranchAsync } from './view';
@@ -60,7 +62,8 @@ async function getUpdateGroupAsync({
         `,
         {
           group,
-        }
+        },
+        { additionalTypenames: ['Update'] }
       )
       .toPromise()
   );
@@ -168,13 +171,14 @@ export default class BranchPublish extends EasCommand {
       isPublicConfig: true,
     });
 
-    const runtimeVersions = getRuntimeVersionObject(exp, platformFlag, projectDir);
+    const runtimeVersions = await getRuntimeVersionObjectAsync(exp, platformFlag, projectDir);
 
     const projectId = await getProjectIdAsync(exp);
 
     if (!branchName && autoFlag) {
       branchName =
-        (await vcs.getBranchNameAsync()) || `branch-${Math.random().toString(36).substr(2, 4)}`;
+        (await getVcsClient().getBranchNameAsync()) ||
+        `branch-${Math.random().toString(36).substr(2, 4)}`;
     }
 
     if (!branchName) {
@@ -297,7 +301,7 @@ export default class BranchPublish extends EasCommand {
     }
 
     if (!message && autoFlag) {
-      message = (await vcs.getLastCommitMessageAsync())?.trim();
+      message = (await getVcsClient().getLastCommitMessageAsync())?.trim();
     }
 
     if (!message) {
@@ -311,7 +315,7 @@ export default class BranchPublish extends EasCommand {
         message: `Please enter a publication message.`,
         initial: republish
           ? `Republish "${oldMessage!}" - group: ${group}`
-          : (await vcs.getLastCommitMessageAsync())?.trim(),
+          : (await getVcsClient().getLastCommitMessageAsync())?.trim(),
         validate: value => (value ? true : validationMessage),
       }));
     }
@@ -388,59 +392,26 @@ export default class BranchPublish extends EasCommand {
   }
 }
 
-function getRuntimeVersionObject(
+async function getRuntimeVersionObjectAsync(
   exp: ExpoConfig,
-  platformFlag: string,
+  platformFlag: PlatformFlag,
   projectDir: string
-): Record<string, string> {
-  let { runtimeVersion: defaultRuntimeVersion, sdkVersion } = exp;
+): Promise<Record<string, string>> {
+  const platforms = (platformFlag === 'all' ? ['android', 'ios'] : [platformFlag]) as Platform[];
 
-  // When a SDK version is supplied instead of a runtime version and we're in the managed workflow
-  // construct the runtimeVersion with special meaning indicating that the runtime is an
-  // Expo SDK preset runtime that can be launched in Expo Go.
-  const isManagedProject = getDefaultTarget(projectDir) === 'managed';
-  if (!defaultRuntimeVersion && sdkVersion && isManagedProject) {
-    Log.withTick('Generating runtime version from sdk version');
-    defaultRuntimeVersion = getRuntimeVersionForSDKVersion(sdkVersion);
-  }
-  const iOSRuntimeVersion = (exp as any).ios?.runtimeVersion; // TODO-JJ remove cast to any
-  const androidRuntimeVersion = (exp as any).android?.runtimeVersion; // TODO-JJ remove cast to any
-  let runtimeVersions: Record<string, string>;
-  switch (platformFlag) {
-    case 'ios': {
-      runtimeVersions = {
-        ios: iOSRuntimeVersion ?? defaultRuntimeVersion,
-      };
-      break;
+  for (const platform of platforms) {
+    const isPolicy = typeof (exp[platform]?.runtimeVersion ?? exp.runtimeVersion) === 'object';
+    if (isPolicy) {
+      const isManaged = (await resolveWorkflowAsync(projectDir, platform)) === Workflow.MANAGED;
+      if (!isManaged) {
+        throw new Error('Runtime version policies are only supported in the managed workflow.');
+      }
     }
-    case 'android': {
-      runtimeVersions = {
-        android: androidRuntimeVersion ?? defaultRuntimeVersion,
-      };
-      break;
-    }
-    case 'all': {
-      runtimeVersions = {
-        ios: iOSRuntimeVersion ?? defaultRuntimeVersion,
-        android: androidRuntimeVersion ?? defaultRuntimeVersion,
-      };
-      break;
-    }
-    default:
-      throw new Error('Platform flag must be "ios", "android", or "all"');
-  }
-  if (Object.values(runtimeVersions).some(runtime => !runtime)) {
-    throw new Error(
-      "Couldn't find a 'runtimeVersion' for every platform. Please specify it under the 'expo' key in 'app.json'"
-    );
-  }
-  if (Object.values(runtimeVersions).some(runtime => typeof runtime !== 'string')) {
-    throw new Error(
-      `Please ensure that all of the runtime versions defined in the app.json are strings.`
-    );
   }
 
-  return runtimeVersions;
+  return Object.fromEntries(
+    platforms.map(platform => [platform, Updates.getRuntimeVersion(exp, platform)])
+  );
 }
 
 function formatUpdateTitle(

packages/eas-cli/src/commands/branch/view.ts

@@ -58,7 +58,8 @@ export async function viewUpdateBranchAsync({
           appId,
           name,
           limit: PAGE_LIMIT,
-        }
+        },
+        { additionalTypenames: ['UpdateBranch', 'Update'] }
       )
       .toPromise()
   );

packages/eas-cli/src/commands/build/index.ts

@@ -1,14 +1,10 @@
 import { Platform, Workflow } from '@expo/eas-build-job';
-import {
-  BuildProfile,
-  EasJsonReader,
-  hasMismatchedExtendsAsync,
-  isUsingDeprecatedFormatAsync,
-  migrateAsync,
-} from '@expo/eas-json';
+import { BuildProfile, EasJsonReader } from '@expo/eas-json';
 import { flags } from '@oclif/command';
 import { error } from '@oclif/errors';
 import chalk from 'chalk';
+import figures from 'figures';
+import fs from 'fs-extra';
 import nullthrows from 'nullthrows';
 
 import { prepareAndroidBuildAsync } from '../../build/android/build';
@@ -28,7 +24,7 @@ import {
   SubmissionFragment,
 } from '../../graphql/generated';
 import { toAppPlatform, toPlatform } from '../../graphql/types/AppPlatform';
-import Log from '../../log';
+import Log, { learnMore, link } from '../../log';
 import {
   RequestedPlatform,
   appPlatformDisplayNames,
@@ -42,16 +38,18 @@ import {
 } from '../../project/isEasEnabledForProject';
 import { validateMetroConfigForManagedWorkflowAsync } from '../../project/metroConfig';
 import { findProjectRootAsync } from '../../project/projectUtils';
-import { confirmAsync } from '../../prompts';
+import { selectAsync } from '../../prompts';
 import { createSubmissionContextAsync } from '../../submit/context';
 import {
   submitAsync,
   waitToCompleteAsync as waitForSubmissionsToCompleteAsync,
 } from '../../submit/submit';
 import { printSubmissionDetailsUrls } from '../../submit/utils/urls';
+import { easCliVersion } from '../../utils/easCli';
 import { enableJsonOutput } from '../../utils/json';
 import { ProfileData, getProfilesAsync } from '../../utils/profiles';
-import vcs from '../../vcs';
+import { getVcsClient, setVcsClient } from '../../vcs';
+import GitClient from '../../vcs/clients/git';
 
 interface RawBuildFlags {
   platform?: string;
@@ -148,7 +146,7 @@ export default class Build extends EasCommand {
     const projectDir = await findProjectRootAsync();
     await handleDeprecatedEasJsonAsync(projectDir, flags.nonInteractive);
 
-    await vcs.ensureRepoExistsAsync();
+    await getVcsClient().ensureRepoExistsAsync();
     await ensureRepoIsCleanAsync(flags.nonInteractive);
 
     await ensureProjectConfiguredAsync(projectDir, requestedPlatform);
@@ -394,36 +392,52 @@ export async function handleDeprecatedEasJsonAsync(
   projectDir: string,
   nonInteractive: boolean
 ): Promise<void> {
-  if (await isUsingDeprecatedFormatAsync(projectDir)) {
-    const hasMismatchedExtendsKeys = await hasMismatchedExtendsAsync(projectDir);
-    if (nonInteractive) {
-      Log.error('We detected that your eas.json is using a deprecated format.');
-      Log.error(
-        'We will convert it automatically if run this command without --non-interactive flag. Alternatively, you can update eas.json manually according to https://docs.expo.dev/build/eas-json'
-      );
-      error('Unsupported eas.json format', { exit: 1 });
-    }
+  if (!(await fs.pathExists(EasJsonReader.formatEasJsonPath(projectDir)))) {
+    return;
+  }
+  const easJsonReader = new EasJsonReader(projectDir);
+  const rawEasJson = await easJsonReader.readRawAsync();
+  if (rawEasJson?.cli) {
+    return;
+  }
 
-    const confirm = await confirmAsync({
-      message:
-        'We detected that your eas.json is using a deprecated format, do you want to migrate to the new format?',
-    });
-    if (confirm) {
-      await migrateAsync(projectDir);
-      if (hasMismatchedExtendsKeys) {
-        Log.warn(
-          '"extends" keyword can only be migrated automatically to the new format if both Android and iOS profiles extend base profiles with the same names for both platforms'
-        );
-        Log.warn(
-          'Migration was successful, but you need to manually adjust the extend rules for your profiles'
-        );
-        error('Fix eas.json manually', { exit: 1 });
-      }
-    } else {
-      Log.error(
-        "Aborting, update your eas.json according to https://docs.expo.dev/build/eas-json and run 'eas build' again"
-      );
-      error('Unsupported eas.json format', { exit: 1 });
-    }
+  if (nonInteractive) {
+    Log.warn(
+      `${
+        figures.warning
+      } Action required: the default behavior of EAS CLI has changed and your eas.json must be updated to remove ambiguity around which Git integration workflow to use. Refer to ${link(
+        'https://expo.fyi/eas-vcs-workflow'
+      )} for more information.`
+    );
+    Log.warn(
+      'This warning will become an error in an upcoming EAS CLI release. For now, we will proceed with the old default behavior to avoid disruption of your builds.'
+    );
+    setVcsClient(new GitClient());
+    return;
+  }
+  Log.log(
+    `${chalk.bold(
+      'eas-cli@>=0.34.0 no longer requires that you commit changes to Git before starting a build.'
+    )} ${learnMore('https://expo.fyi/eas-vcs-workflow')}`
+  );
+  Log.log(
+    `If you want to continue using the Git integration, you can opt in with ${chalk.bold(
+      'cli.requireCommit'
+    )} in ${chalk.bold('eas.json')} or with the following prompt.`
+  );
+  Log.newLine();
+
+  const mode = await selectAsync('Select your preferred Git integration', [
+    { title: 'Require changes to be committed in Git (old default)', value: 'requireCommit' },
+    { title: 'Allow builds with dirty Git working tree (new default)', value: 'noCommit' },
+  ]);
+
+  rawEasJson.cli =
+    mode === 'requireCommit'
+      ? { version: `>= ${easCliVersion}`, requireCommit: true }
+      : { version: `>= ${easCliVersion}` };
+  await fs.writeJSON(EasJsonReader.formatEasJsonPath(projectDir), rawEasJson, { spaces: 2 });
+  if (mode === 'requireCommit') {
+    setVcsClient(new GitClient());
   }
 }

packages/eas-cli/src/commands/channel/edit.ts

@@ -49,7 +49,8 @@ async function getChannelByNameForAppAsync({
             }
           }
         `,
-        { appId, channelName }
+        { appId, channelName },
+        { additionalTypenames: ['UpdateChannel', 'UpdateBranch'] }
       )
       .toPromise()
   );

packages/eas-cli/src/commands/channel/list.ts

@@ -58,7 +58,8 @@ async function getAllUpdateChannelForAppAsync({
             }
           }
         `,
-        { appId, offset: 0, limit: CHANNEL_LIMIT }
+        { appId, offset: 0, limit: CHANNEL_LIMIT },
+        { additionalTypenames: ['UpdateChannel', 'UpdateBranch', 'Update'] }
       )
       .toPromise()
   );

packages/eas-cli/src/commands/channel/view.ts

@@ -133,7 +133,8 @@ export async function getUpdateChannelByNameForAppAsync({
             }
           }
         `,
-        { appId, channelName }
+        { appId, channelName },
+        { additionalTypenames: ['UpdateChannel', 'UpdateBranch', 'Update'] }
       )
       .toPromise()
   );

packages/eas-cli/src/commands/diagnostics.ts

@@ -2,8 +2,7 @@ import envinfo from 'envinfo';
 
 import EasCommand from '../commandUtils/EasCommand';
 import Log from '../log';
-
-const packageJSON = require('../../package.json');
+import { easCliVersion } from '../utils/easCli';
 
 export default class Diagnostics extends EasCommand {
   static description = 'log environment info to the console';
@@ -30,7 +29,7 @@ export default class Diagnostics extends EasCommand {
         npmGlobalPackages: ['eas-cli', 'expo-cli'],
       },
       {
-        title: `EAS CLI ${packageJSON.version} environment info`,
+        title: `EAS CLI ${easCliVersion} environment info`,
       }
     );
     Log.log(info);

packages/eas-cli/src/commands/project/info.ts

@@ -22,7 +22,8 @@ async function projectInfoByIdAsync(appId: string): Promise<AppInfoQuery> {
             }
           }
         `,
-        { appId }
+        { appId },
+        { additionalTypenames: ['App'] }
       )
       .toPromise()
   );

packages/eas-cli/src/commands/secret/delete.ts

@@ -23,7 +23,7 @@ import { promptAsync, toggleConfirmAsync } from '../../prompts';
 
 export default class EnvironmentSecretDelete extends EasCommand {
   static description = `Delete an environment secret by ID.
-Unsure where to find the secret's ID? Run ${chalk.bold('eas secrets:list')}`;
+Unsure where to find the secret's ID? Run ${chalk.bold('eas secret:list')}`;
 
   static flags = {
     id: flags.string({

packages/eas-cli/src/commands/update/view.ts

@@ -39,7 +39,8 @@ export async function viewUpdateAsync({
         `,
         {
           groupId,
-        }
+        },
+        { additionalTypenames: ['Update'] }
       )
       .toPromise()
   );

packages/eas-cli/src/credentials/__tests__/fixtures-appstore.ts

@@ -4,7 +4,7 @@ import { AuthCtx } from '../ios/appstore/authenticate';
 export const testAuthCtx: AuthCtx = {
   appleId: 'test-apple-id',
   appleIdPassword: 'test-apple-password',
-  team: { id: 'test-team-id', name: 'test-team-name', inHouse: false },
+  team: { id: 'test-apple-team-identifier', name: 'test-team-name', inHouse: false },
 };
 
 export function getAppstoreMock(): AppStoreApi {
@@ -22,5 +22,9 @@ export function getAppstoreMock(): AppStoreApi {
     createProvisioningProfileAsync: jest.fn(),
     revokeProvisioningProfileAsync: jest.fn(),
     createOrReuseAdhocProvisioningProfileAsync: jest.fn(),
+    createAscApiKeyAsync: jest.fn(),
+    getAscApiKeyAsync: jest.fn(),
+    revokeAscApiKeyAsync: jest.fn(),
+    listAscApiKeysAsync: jest.fn(),
   } as any;
 }

packages/eas-cli/src/credentials/__tests__/fixtures-ios.ts

@@ -1,5 +1,9 @@
+import { UserRole } from '@expo/apple-utils';
+
 import {
   AppFragment,
+  AppStoreConnectApiKeyFragment,
+  AppStoreConnectUserRole,
   AppleAppIdentifierFragment,
   AppleDistributionCertificateFragment,
   AppleProvisioningProfileFragment,
@@ -10,12 +14,27 @@ import {
   IosDistributionType,
 } from '../../graphql/generated';
 import * as IosGraphqlClient from '../ios/api/GraphqlClient';
-import { DistributionCertificate, ProvisioningProfile } from '../ios/appstore/Credentials.types';
+import {
+  AscApiKey,
+  DistributionCertificate,
+  ProvisioningProfile,
+} from '../ios/appstore/Credentials.types';
 import { Target } from '../ios/types';
 import { testProvisioningProfileBase64 } from './fixtures-base64-data';
 
 const now = new Date();
 
+export const testAscApiKey: AscApiKey = {
+  keyId: 'test-keyIdentifier',
+  issuerId: 'test-issuer-id-from-apple',
+  teamId: 'test-team-id',
+  teamName: 'test-team-name',
+  name: 'test-name',
+  roles: [UserRole.ADMIN],
+  isRevoked: false,
+  keyP8: 'test-key-p8',
+};
+
 export const testProvisioningProfile: ProvisioningProfile = {
   provisioningProfileId: 'test-id',
   provisioningProfile: testProvisioningProfileBase64,
@@ -38,6 +57,17 @@ export const testAppFragment: AppFragment = {
   slug: 'testapp',
 };
 
+export const testAscApiKeyFragment: AppStoreConnectApiKeyFragment = {
+  id: 'test-asc-api-key-id',
+  appleTeam: { ...testAppleTeamFragment },
+  issuerIdentifier: 'test-issuerIdentifier',
+  keyIdentifier: 'test-keyIdentifier',
+  name: 'test-name',
+  roles: [AppStoreConnectUserRole.Admin],
+  updatedAt: now,
+  createdAt: now,
+};
+
 export const testPushKey: ApplePushKeyFragment = {
   id: 'test-push-key-id',
   keyIdentifier: 'test-key-identifier',
@@ -112,6 +142,7 @@ export const testCommonIosAppCredentialsFragment: CommonIosAppCredentialsFragmen
   appleAppIdentifier: testAppleAppIdentifierFragment,
   pushKey: testPushKey,
   iosAppBuildCredentialsList: [testIosAppBuildCredentialsFragment],
+  appStoreConnectApiKeyForSubmissions: testAscApiKeyFragment,
 };
 
 export const testAppleTeam = {
@@ -139,6 +170,9 @@ export function getNewIosApiMock(): { [key in keyof typeof IosGraphqlClient]?: a
     createPushKeyAsync: jest.fn(),
     getPushKeyForAppAsync: jest.fn(),
     deletePushKeyAsync: jest.fn(),
+    createAscApiKeyAsync: jest.fn(),
+    deleteAscApiKeyAsync: jest.fn(),
+    getAscApiKeysForAccountAsync: jest.fn(() => []),
   };
 }
 

packages/eas-cli/src/credentials/android/api/graphql/queries/GoogleServiceAccountKeyQuery.ts

@@ -29,6 +29,9 @@ export const GoogleServiceAccountKeyQuery = {
           `,
           {
             accountName,
+          },
+          {
+            additionalTypenames: ['GoogleServiceAccountKey'],
           }
         )
         .toPromise()

packages/eas-cli/src/credentials/credentialsJson/update.ts

@@ -6,8 +6,8 @@ import { AndroidAppBuildCredentialsFragment, IosDistributionType } from '../../g
 import Log from '../../log';
 import { findApplicationTarget, findTargetByName } from '../../project/ios/target';
 import zipObject from '../../utils/expodash/zipObject';
-import vcs from '../../vcs';
-import GitClient from '../../vcs/git';
+import { getVcsClient } from '../../vcs';
+import GitClient from '../../vcs/clients/git';
 import { CredentialsContext } from '../context';
 import { App, Target, TargetCredentials } from '../ios/types';
 import { readRawAsync } from './read';
@@ -294,8 +294,9 @@ async function updateFileAsync(
 }
 
 async function isFileUntrackedAsync(path: string): Promise<boolean> {
-  if (vcs instanceof GitClient) {
-    return await vcs.isFileUntrackedAsync(path);
+  const vcsClient = getVcsClient();
+  if (vcsClient instanceof GitClient) {
+    return await vcsClient.isFileUntrackedAsync(path);
   }
   return false;
 }

packages/eas-cli/src/credentials/errors.ts

@@ -11,3 +11,9 @@ export class MissingCredentialsError extends Error {
     super(message ?? 'Credentials are not set up.');
   }
 }
+
+export class UnsupportedCredentialsChoiceError extends Error {
+  constructor(message: string, public choice: string) {
+    super(message);
+  }
+}

packages/eas-cli/src/credentials/ios/actions/AscApiKeyUtils.ts

@@ -1,15 +1,122 @@
 import chalk from 'chalk';
 import fs from 'fs-extra';
+import { nanoid } from 'nanoid';
 import path from 'path';
-import * as uuid from 'uuid';
 
+import { AppStoreConnectApiKeyFragment } from '../../../graphql/generated';
 import Log, { learnMore } from '../../../log';
-import { promptAsync } from '../../../prompts';
-import { getCredentialsFromUserAsync } from '../../utils/promptForCredentials';
+import { confirmAsync, promptAsync } from '../../../prompts';
+import { Account } from '../../../user/Account';
+import { fromNow } from '../../../utils/date';
+import { CredentialsContext } from '../../context';
+import {
+  getCredentialsFromUserAsync,
+  shouldAutoGenerateCredentialsAsync,
+} from '../../utils/promptForCredentials';
 import { AscApiKey } from '../appstore/Credentials.types';
-import { AscApiKeyPath, MinimalAscApiKey, ascApiKeyMetadataSchema } from '../credentials';
+import {
+  AscApiKeyPath,
+  MinimalAscApiKey,
+  ascApiKeyIdSchema,
+  ascApiKeyIssuerIdSchema,
+} from '../credentials';
+import { isAscApiKeyValidAndTrackedAsync } from '../validators/validateAscApiKey';
+import { formatAppleTeam } from './AppleTeamUtils';
 
-export async function promptForAscApiKeyAsync(): Promise<AscApiKeyPath> {
+export enum AppStoreApiKeyPurpose {
+  SUBMISSION_SERVICE = 'EAS Submit',
+}
+
+export async function promptForAscApiKeyPathAsync(ctx: CredentialsContext): Promise<AscApiKeyPath> {
+  const { keyId, keyP8Path } = await promptForKeyP8AndIdAsync();
+
+  const bestEffortIssuerId = await getBestEffortIssuerIdAsync(ctx, keyId);
+  if (bestEffortIssuerId) {
+    Log.log(`Detected Issuer ID: ${bestEffortIssuerId}`);
+    return { keyId, issuerId: bestEffortIssuerId, keyP8Path };
+  }
+  const issuerId = await promptForIssuerIdAsync();
+  return { keyId, issuerId, keyP8Path };
+}
+
+export async function promptForIssuerIdAsync(): Promise<string> {
+  Log.log(chalk.bold('An App Store Connect Issuer ID is required'));
+  Log.log(
+    `If you're not sure what this is or how to find yours, ${learnMore(
+      'https://expo.fyi/asc-issuer-id'
+    )}`
+  );
+
+  // Do not perform uuid validation - Apple's issuerIds are not RFC4122 compliant
+  const { issuerId } = await getCredentialsFromUserAsync(ascApiKeyIssuerIdSchema);
+  return issuerId;
+}
+
+export async function getMinimalAscApiKeyAsync(ascApiKey: AscApiKey): Promise<MinimalAscApiKey> {
+  return {
+    ...ascApiKey,
+    issuerId: ascApiKey.issuerId ?? (await promptForIssuerIdAsync()),
+  };
+}
+
+export async function provideOrGenerateAscApiKeyAsync(
+  ctx: CredentialsContext,
+  purpose: AppStoreApiKeyPurpose
+): Promise<MinimalAscApiKey> {
+  if (ctx.nonInteractive) {
+    return await generateAscApiKeyAsync(ctx, purpose);
+  }
+
+  const userProvided = await promptForAscApiKeyAsync(ctx);
+  if (!userProvided) {
+    return await generateAscApiKeyAsync(ctx, purpose);
+  }
+
+  if (!ctx.appStore.authCtx) {
+    Log.warn('Unable to validate App Store Connect Api Key, you are not authenticated with Apple.');
+    return userProvided;
+  }
+
+  const isValidAndTracked = await isAscApiKeyValidAndTrackedAsync(ctx, userProvided);
+  if (isValidAndTracked) {
+    return userProvided;
+  }
+  const useUserProvided = await confirmAsync({
+    message: `App Store Connect Api Key with ID ${userProvided.keyId} is not valid on Apple's servers. Proceed anyway?`,
+  });
+  if (useUserProvided) {
+    return userProvided;
+  }
+  return await provideOrGenerateAscApiKeyAsync(ctx, purpose);
+}
+
+async function generateAscApiKeyAsync(
+  ctx: CredentialsContext,
+  purpose: AppStoreApiKeyPurpose
+): Promise<MinimalAscApiKey> {
+  await ctx.appStore.ensureAuthenticatedAsync();
+  const ascApiKey = await ctx.appStore.createAscApiKeyAsync({
+    nickname: getAscApiKeyName(purpose),
+  });
+  return await getMinimalAscApiKeyAsync(ascApiKey);
+}
+
+export function getAscApiKeyName(purpose: AppStoreApiKeyPurpose): string {
+  const nameParts = ['[Expo]', purpose, nanoid(10)];
+  return nameParts.join(' ');
+}
+
+async function promptForAscApiKeyAsync(ctx: CredentialsContext): Promise<MinimalAscApiKey | null> {
+  const shouldAutoGenerateCredentials = await shouldAutoGenerateCredentialsAsync(ascApiKeyIdSchema);
+  if (shouldAutoGenerateCredentials) {
+    return null;
+  }
+  const ascApiKeyPath = await promptForAscApiKeyPathAsync(ctx);
+  const { keyP8Path, keyId, issuerId } = ascApiKeyPath;
+  return { keyP8: await fs.readFile(keyP8Path, 'utf-8'), keyId, issuerId };
+}
+
+async function promptForKeyP8AndIdAsync(): Promise<Pick<AscApiKeyPath, 'keyP8Path' | 'keyId'>> {
   Log.log(
     chalk.bold('An App Store Connect Api key is required to upload your app to the Apple App Store')
   );
@@ -39,33 +146,108 @@ export async function promptForAscApiKeyAsync(): Promise<AscApiKeyPath> {
   });
   const regex = /^AuthKey_(?<keyId>\w+)\.p8$/; // Common ASC Api file name downloaded from Apple
   const bestEffortKeyId = path.basename(keyP8Path).match(regex)?.groups?.keyId;
-  const ascApiKeyMetadata = await getCredentialsFromUserAsync(ascApiKeyMetadataSchema, {
+  const { keyId } = await getCredentialsFromUserAsync(ascApiKeyIdSchema, {
     keyId: bestEffortKeyId,
   });
-  return { ...ascApiKeyMetadata, keyP8Path };
+  return { keyId, keyP8Path };
 }
 
-export async function promptForIssuerIdAsync(): Promise<string> {
-  Log.log(chalk.bold('An App Store Connect Issuer ID is required'));
-  Log.log(
-    `If you're not sure what this is or how to find yours, ${learnMore(
-      'https://expo.fyi/asc-issuer-id'
-    )}`
-  );
+async function getBestEffortIssuerIdAsync(
+  ctx: CredentialsContext,
+  ascApiKeyId: string
+): Promise<string | null> {
+  if (!ctx.appStore.authCtx) {
+    return null;
+  }
+  const ascApiKeyInfo = await ctx.appStore.getAscApiKeyAsync(ascApiKeyId);
+  return ascApiKeyInfo?.issuerId ?? null;
+}
 
-  const { issuerId } = await promptAsync({
-    type: 'text',
-    name: 'issuerId',
-    message: 'App Store Connect Issuer ID:',
-    validate: (input: string) => uuid.validate(input),
+export async function getAscApiKeysFromAccountAsync(
+  ctx: CredentialsContext,
+  account: Account,
+  { filterDifferentAppleTeam }: { filterDifferentAppleTeam?: boolean } = {}
+): Promise<AppStoreConnectApiKeyFragment[]> {
+  const ascApiKeysForAccount = await ctx.ios.getAscApiKeysForAccountAsync(account);
+
+  if (!filterDifferentAppleTeam) {
+    return ascApiKeysForAccount;
+  } else {
+    return filterKeysFromDifferentAppleTeam(ctx, ascApiKeysForAccount);
+  }
+}
+
+export async function selectAscApiKeysFromAccountAsync(
+  ctx: CredentialsContext,
+  account: Account,
+  { filterDifferentAppleTeam }: { filterDifferentAppleTeam?: boolean } = {}
+): Promise<AppStoreConnectApiKeyFragment | null> {
+  const ascApiKeysForAccount = await getAscApiKeysFromAccountAsync(ctx, account, {
+    filterDifferentAppleTeam,
   });
-
-  return issuerId;
+  if (ascApiKeysForAccount.length === 0) {
+    if (filterDifferentAppleTeam) {
+      const maybeAppleTeamId = ctx.appStore.authCtx?.team.id;
+      Log.warn(
+        `There are no App Store Connect Api Keys in your EAS account${
+          maybeAppleTeamId ? ` matching Apple Team ID: ${maybeAppleTeamId}.` : '.'
+        }`
+      );
+    } else {
+      Log.warn(`There are no App Store Connect Api Keys available in your EAS account.`);
+    }
+    return null;
+  }
+  return selectAscApiKeysAsync(ascApiKeysForAccount);
 }
 
-export async function getMinimalAscApiKeyAsync(ascApiKey: AscApiKey): Promise<MinimalAscApiKey> {
-  return {
-    ...ascApiKey,
-    issuerId: ascApiKey.issuerId ?? (await promptForIssuerIdAsync()),
-  };
+async function selectAscApiKeysAsync(
+  ascApiKeys: AppStoreConnectApiKeyFragment[]
+): Promise<AppStoreConnectApiKeyFragment | null> {
+  const sortedAscApiKeys = sortAscApiKeysByUpdatedAtDesc(ascApiKeys);
+  const { chosenAscApiKey } = await promptAsync({
+    type: 'select',
+    name: 'chosenAscApiKey',
+    message: 'Select an Api Key from the list:',
+    choices: sortedAscApiKeys.map(ascApiKey => ({
+      title: formatAscApiKey(ascApiKey),
+      value: ascApiKey,
+    })),
+  });
+  return chosenAscApiKey;
+}
+
+function filterKeysFromDifferentAppleTeam(
+  ctx: CredentialsContext,
+  keys: AppStoreConnectApiKeyFragment[]
+): AppStoreConnectApiKeyFragment[] {
+  if (!ctx.appStore.authCtx) {
+    return keys;
+  }
+  const teamId = ctx.appStore.authCtx.team.id;
+  return keys.filter(key => !key.appleTeam || key.appleTeam?.appleTeamIdentifier === teamId);
+}
+
+export function sortAscApiKeysByUpdatedAtDesc(
+  keys: AppStoreConnectApiKeyFragment[]
+): AppStoreConnectApiKeyFragment[] {
+  return keys.sort(
+    (keyA, keyB) => new Date(keyB.updatedAt).getTime() - new Date(keyA.updatedAt).getTime()
+  );
+}
+
+export function formatAscApiKey(ascApiKey: AppStoreConnectApiKeyFragment): string {
+  const { keyIdentifier, appleTeam, name, updatedAt } = ascApiKey;
+  let line: string = '';
+  line += `Key ID: ${keyIdentifier}`;
+
+  if (name) {
+    line += chalk.gray(`\n    Name: ${name}`);
+  }
+  if (appleTeam) {
+    line += chalk.gray(`\n    ${formatAppleTeam(appleTeam)}`);
+  }
+
+  line += chalk.gray(`\n    Updated: ${fromNow(new Date(updatedAt))} ago`);
+  return line;
 }

packages/eas-cli/src/credentials/ios/actions/AssignAscApiKey.ts

@@ -0,0 +1,38 @@
+import {
+  AppStoreConnectApiKeyFragment,
+  CommonIosAppCredentialsFragment,
+} from '../../../graphql/generated';
+import Log from '../../../log';
+import { CredentialsContext } from '../../context';
+import { AppLookupParams } from '../api/GraphqlClient';
+import { resolveAppleTeamIfAuthenticatedAsync } from './AppleTeamUtils';
+import { AppStoreApiKeyPurpose } from './AscApiKeyUtils';
+
+export class AssignAscApiKey {
+  constructor(private app: AppLookupParams) {}
+
+  public async runAsync(
+    ctx: CredentialsContext,
+    ascApiKey: AppStoreConnectApiKeyFragment,
+    purpose: AppStoreApiKeyPurpose
+  ): Promise<CommonIosAppCredentialsFragment> {
+    const appleTeam =
+      (await resolveAppleTeamIfAuthenticatedAsync(ctx, this.app)) ?? ascApiKey.appleTeam ?? null;
+    const appCredentials = await ctx.ios.createOrGetIosAppCredentialsWithCommonFieldsAsync(
+      this.app,
+      { appleTeam: appleTeam ?? undefined }
+    );
+    let updatedAppCredentials;
+    if (purpose === AppStoreApiKeyPurpose.SUBMISSION_SERVICE) {
+      updatedAppCredentials = await ctx.ios.updateIosAppCredentialsAsync(appCredentials, {
+        ascApiKeyIdForSubmissions: ascApiKey.id,
+      });
+    } else {
+      throw new Error(`${purpose} is not yet supported.`);
+    }
+    Log.succeed(
+      `App Store Connect Api Key assigned to ${this.app.projectName}: ${this.app.bundleIdentifier} for ${purpose}.`
+    );
+    return updatedAppCredentials;
+  }
+}

packages/eas-cli/src/credentials/ios/actions/CreateAscApiKey.ts

@@ -0,0 +1,23 @@
+import { AppStoreConnectApiKeyFragment } from '../../../graphql/generated';
+import Log from '../../../log';
+import { Account } from '../../../user/Account';
+import { CredentialsContext } from '../../context';
+import { AppStoreApiKeyPurpose, provideOrGenerateAscApiKeyAsync } from './AscApiKeyUtils';
+
+export class CreateAscApiKey {
+  constructor(private account: Account) {}
+
+  public async runAsync(
+    ctx: CredentialsContext,
+    purpose: AppStoreApiKeyPurpose
+  ): Promise<AppStoreConnectApiKeyFragment> {
+    if (ctx.nonInteractive) {
+      throw new Error(`A new App Store Connect Api Key cannot be created in non-interactive mode.`);
+    }
+
+    const ascApiKey = await provideOrGenerateAscApiKeyAsync(ctx, purpose);
+    const result = await ctx.ios.createAscApiKeyAsync(this.account, ascApiKey);
+    Log.succeed('Created App Store Connect Api Key');
+    return result;
+  }
+}

packages/eas-cli/src/credentials/ios/actions/CreateDistributionCertificate.ts

@@ -10,7 +10,7 @@ export class CreateDistributionCertificate {
   public async runAsync(
     ctx: CredentialsContext
   ): Promise<AppleDistributionCertificateMutationResult> {
-    const distCert = await provideOrGenerateDistributionCertificateAsync(ctx, this.account.name);
+    const distCert = await provideOrGenerateDistributionCertificateAsync(ctx);
     const result = await ctx.ios.createDistributionCertificateAsync(this.account, distCert);
     Log.succeed('Created distribution certificate');
     return result;

packages/eas-cli/src/credentials/ios/actions/CreatePushKey.ts

@@ -12,7 +12,7 @@ export class CreatePushKey {
       throw new Error(`A new push key cannot be created in non-interactive mode.`);
     }
 
-    const pushKey = await provideOrGeneratePushKeyAsync(ctx, this.account.name);
+    const pushKey = await provideOrGeneratePushKeyAsync(ctx);
     const result = await ctx.ios.createPushKeyAsync(this.account, pushKey);
     Log.succeed('Created push key');
     return result;

packages/eas-cli/src/credentials/ios/actions/DistributionCertificateUtils.ts

@@ -152,15 +152,14 @@ Please remember that Apple Distribution Certificates are not application specifi
 `;
 
 export async function provideOrGenerateDistributionCertificateAsync(
-  ctx: CredentialsContext,
-  accountName: string
+  ctx: CredentialsContext
 ): Promise<DistributionCertificate> {
   if (!ctx.nonInteractive) {
     const userProvided = await promptForDistCertAsync(ctx);
     if (userProvided) {
       if (!ctx.appStore.authCtx) {
         Log.warn(
-          'Unable to validate distribution certificate due to insufficient Apple Credentials'
+          'Unable to validate distribution certificate, you are not authenticated with Apple.'
         );
         return userProvided;
       } else {
@@ -168,13 +167,11 @@ export async function provideOrGenerateDistributionCertificateAsync(
         if (!isValid) {
           Log.warn("Provided Distribution Certificate is no longer valid on Apple's server");
         }
-        return isValid
-          ? userProvided
-          : await provideOrGenerateDistributionCertificateAsync(ctx, accountName);
+        return isValid ? userProvided : await provideOrGenerateDistributionCertificateAsync(ctx);
       }
     }
   }
-  return await generateDistributionCertificateAsync(ctx, accountName);
+  return await generateDistributionCertificateAsync(ctx);
 }
 
 async function promptForDistCertAsync(
@@ -200,8 +197,7 @@ async function promptForDistCertAsync(
 }
 
 async function generateDistributionCertificateAsync(
-  ctx: CredentialsContext,
-  accountName: string
+  ctx: CredentialsContext
 ): Promise<DistributionCertificate> {
   await ctx.appStore.ensureAuthenticatedAsync();
   try {
@@ -246,7 +242,7 @@ async function generateDistributionCertificateAsync(
       throw e;
     }
   }
-  return await generateDistributionCertificateAsync(ctx, accountName);
+  return await generateDistributionCertificateAsync(ctx);
 }
 
 function formatDistributionCertificateFromApple(

packages/eas-cli/src/credentials/ios/actions/PushKeyUtils.ts

@@ -14,15 +14,12 @@ import { pushKeySchema } from '../credentials';
 import { isPushKeyValidAndTrackedAsync } from '../validators/validatePushKey';
 import { formatAppleTeam } from './AppleTeamUtils';
 
-export async function provideOrGeneratePushKeyAsync(
-  ctx: CredentialsContext,
-  accountName: string
-): Promise<PushKey> {
+export async function provideOrGeneratePushKeyAsync(ctx: CredentialsContext): Promise<PushKey> {
   if (!ctx.nonInteractive) {
     const userProvided = await promptForPushKeyAsync(ctx);
     if (userProvided) {
       if (!ctx.appStore.authCtx) {
-        Log.warn('Unable to validate push key due to insufficient Apple Credentials');
+        Log.warn('Unable to validate push key, you are not authenticated with Apple.');
         return userProvided;
       } else {
         const isValidAndTracked = await isPushKeyValidAndTrackedAsync(ctx, userProvided);
@@ -36,11 +33,11 @@ export async function provideOrGeneratePushKeyAsync(
         if (useUserProvided) {
           return userProvided;
         }
-        return await provideOrGeneratePushKeyAsync(ctx, accountName);
+        return await provideOrGeneratePushKeyAsync(ctx);
       }
     }
   }
-  return await generatePushKeyAsync(ctx, accountName);
+  return await generatePushKeyAsync(ctx);
 }
 
 async function promptForPushKeyAsync(ctx: CredentialsContext): Promise<PushKey | null> {
@@ -63,10 +60,7 @@ async function promptForPushKeyAsync(ctx: CredentialsContext): Promise<PushKey |
   return userProvided;
 }
 
-async function generatePushKeyAsync(
-  ctx: CredentialsContext,
-  accountName: string
-): Promise<PushKey> {
+async function generatePushKeyAsync(ctx: CredentialsContext): Promise<PushKey> {
   await ctx.appStore.ensureAuthenticatedAsync();
   try {
     return await ctx.appStore.createPushKeyAsync();
@@ -106,7 +100,7 @@ async function generatePushKeyAsync(
       throw e;
     }
   }
-  return await generatePushKeyAsync(ctx, accountName);
+  return await generatePushKeyAsync(ctx);
 }
 
 function formatPushKeyFromApple(pushKey: PushKeyStoreInfo): string {

packages/eas-cli/src/credentials/ios/actions/RemoveAscApiKey.ts

@@ -0,0 +1,53 @@
+import { AppStoreConnectApiKeyFragment } from '../../../graphql/generated';
+import Log from '../../../log';
+import { confirmAsync } from '../../../prompts';
+import { Account } from '../../../user/Account';
+import { CredentialsContext } from '../../context';
+import { selectAscApiKeysFromAccountAsync } from './AscApiKeyUtils';
+
+export class SelectAndRemoveAscApiKey {
+  constructor(private account: Account) {}
+
+  async runAsync(ctx: CredentialsContext): Promise<void> {
+    const selected = await selectAscApiKeysFromAccountAsync(ctx, this.account);
+    if (selected) {
+      await new RemoveAscApiKey(this.account, selected).runAsync(ctx);
+      Log.succeed('Removed App Store Connect Api Key');
+      Log.newLine();
+    }
+  }
+}
+
+export class RemoveAscApiKey {
+  constructor(private account: Account, private ascApiKey: AppStoreConnectApiKeyFragment) {}
+
+  public async runAsync(ctx: CredentialsContext): Promise<void> {
+    if (ctx.nonInteractive) {
+      throw new Error(`Cannot remove App Store Connect Api Keys in non-interactive mode.`);
+    }
+
+    // TODO(quin): add an extra edge on AppStoreConnectApiKey to find the apps using it
+    const confirm = await confirmAsync({
+      message: `Deleting this Api Key may affect your projects that rely on it. Do you want to continue?`,
+    });
+    if (!confirm) {
+      Log.log('Aborting');
+      return;
+    }
+
+    Log.log('Removing Api Key');
+    await ctx.ios.deleteAscApiKeyAsync(this.ascApiKey.id);
+
+    let shouldRevoke = false;
+    if (!ctx.nonInteractive) {
+      shouldRevoke = await confirmAsync({
+        message: `Do you also want to revoke this Api Key on the Apple Developer Portal?`,
+      });
+    } else if (ctx.nonInteractive) {
+      Log.log('Skipping Api Key revocation on the Apple Developer Portal.');
+    }
+    if (shouldRevoke) {
+      await ctx.appStore.revokeAscApiKeyAsync(this.ascApiKey.keyIdentifier);
+    }
+  }
+}

packages/eas-cli/src/credentials/ios/actions/SetUpAscApiKey.ts

@@ -0,0 +1,148 @@
+import assert from 'assert';
+import nullthrows from 'nullthrows';
+
+import {
+  AppStoreConnectApiKeyFragment,
+  CommonIosAppCredentialsFragment,
+} from '../../../graphql/generated';
+import Log from '../../../log';
+import { confirmAsync, promptAsync } from '../../../prompts';
+import { CredentialsContext } from '../../context';
+import {
+  MissingCredentialsNonInteractiveError,
+  UnsupportedCredentialsChoiceError,
+} from '../../errors';
+import { AppLookupParams } from '../api/GraphqlClient';
+import { getValidAndTrackedAscApiKeysAsync } from '../validators/validateAscApiKey';
+import {
+  AppStoreApiKeyPurpose,
+  formatAscApiKey,
+  getAscApiKeysFromAccountAsync,
+  selectAscApiKeysFromAccountAsync,
+  sortAscApiKeysByUpdatedAtDesc,
+} from './AscApiKeyUtils';
+import { AssignAscApiKey } from './AssignAscApiKey';
+import { CreateAscApiKey } from './CreateAscApiKey';
+
+export enum SetupAscApiKeyChoice {
+  GENERATE = 'GENERATE',
+  USE_EXISTING = 'USE_EXISTING',
+}
+export class SetUpAscApiKey {
+  public choices: { title: string; value: string }[] = [
+    {
+      title: '[Choose an existing key]',
+      value: SetupAscApiKeyChoice.USE_EXISTING,
+    },
+    { title: '[Add a new key]', value: SetupAscApiKeyChoice.GENERATE },
+  ];
+
+  constructor(private app: AppLookupParams, private purpose: AppStoreApiKeyPurpose) {}
+
+  public async runAsync(ctx: CredentialsContext): Promise<CommonIosAppCredentialsFragment> {
+    const isKeySetup = await this.isAscApiKeySetupAsync(ctx, this.purpose);
+    if (isKeySetup) {
+      Log.succeed('App Store Connect Api Key already set up.');
+      return nullthrows(
+        await ctx.ios.getIosAppCredentialsWithCommonFieldsAsync(this.app),
+        'iosAppCredentials cannot be null if App Store Connect Api Key is already set up'
+      );
+    }
+    if (ctx.nonInteractive) {
+      throw new MissingCredentialsNonInteractiveError(
+        'App Store Connect Api Keys cannot be set up in --non-interactive mode.'
+      );
+    }
+
+    const keysForAccount = await getAscApiKeysFromAccountAsync(ctx, this.app.account, {
+      filterDifferentAppleTeam: true,
+    });
+    const maybeAutoselectedKey = await this.doBestEffortAutoselectAsync(ctx, keysForAccount);
+    if (maybeAutoselectedKey) {
+      return await new AssignAscApiKey(this.app).runAsync(ctx, maybeAutoselectedKey, this.purpose);
+    }
+
+    const availableChoices =
+      keysForAccount.length === 0
+        ? this.choices.filter(choice => choice.value !== SetupAscApiKeyChoice.USE_EXISTING)
+        : this.choices;
+    const ascApiKey = await this.processChoicesAsync(ctx, this.purpose, availableChoices);
+    return await new AssignAscApiKey(this.app).runAsync(ctx, ascApiKey, this.purpose);
+  }
+
+  private async doBestEffortAutoselectAsync(
+    ctx: CredentialsContext,
+    keysForAccount: AppStoreConnectApiKeyFragment[]
+  ): Promise<AppStoreConnectApiKeyFragment | null> {
+    if (!ctx.appStore.authCtx) {
+      return null;
+    }
+    if (keysForAccount.length === 0) {
+      return null;
+    }
+
+    // only provide autoselect if we can find a key that is certainly valid
+    const validKeys = await getValidAndTrackedAscApiKeysAsync(ctx, keysForAccount);
+    if (validKeys.length === 0) {
+      return null;
+    }
+    const [autoselectedKey] = sortAscApiKeysByUpdatedAtDesc(validKeys);
+    const useAutoselected = await confirmAsync({
+      message: `Reuse this App Store Connect Api Key?\n${formatAscApiKey(autoselectedKey)}`,
+    });
+
+    if (useAutoselected) {
+      Log.log(`Using App Store Connect Api Key with ID ${autoselectedKey.keyIdentifier}`);
+      return autoselectedKey;
+    } else {
+      return null;
+    }
+  }
+
+  private async isAscApiKeySetupAsync(
+    ctx: CredentialsContext,
+    purpose: AppStoreApiKeyPurpose
+  ): Promise<boolean> {
+    const appCredentials = await ctx.ios.getIosAppCredentialsWithCommonFieldsAsync(this.app);
+    if (purpose !== AppStoreApiKeyPurpose.SUBMISSION_SERVICE) {
+      throw new Error(`App Store Connect Api Key setup is not yet supported for ${purpose}.`);
+    }
+    return !!appCredentials?.appStoreConnectApiKeyForSubmissions;
+  }
+
+  private async processChoicesAsync(
+    ctx: CredentialsContext,
+    purpose: AppStoreApiKeyPurpose,
+    choices: { title: string; value: string }[]
+  ): Promise<AppStoreConnectApiKeyFragment> {
+    assert(choices.length > 0, 'SetupAscApiKey: There must be at least one choice');
+    let choice: string;
+    if (choices.length === 1) {
+      choice = choices[0].value;
+    } else {
+      const result = await promptAsync({
+        type: 'select',
+        name: 'choice',
+        message: 'Select the App Store Connect Api Key to use for your project:',
+        choices: this.choices,
+      });
+      choice = result.choice;
+    }
+
+    if (choice === SetupAscApiKeyChoice.GENERATE) {
+      return await new CreateAscApiKey(this.app.account).runAsync(ctx, purpose);
+    } else if (choice === SetupAscApiKeyChoice.USE_EXISTING) {
+      const selectedAscApiKey = await selectAscApiKeysFromAccountAsync(ctx, this.app.account, {
+        filterDifferentAppleTeam: true,
+      });
+      if (!selectedAscApiKey) {
+        return await this.processChoicesAsync(ctx, purpose, choices);
+      }
+      return selectedAscApiKey;
+    }
+    throw new UnsupportedCredentialsChoiceError(
+      `AscApiKey Setup does not support choice:${choice}`,
+      choice
+    );
+  }
+}

packages/eas-cli/src/credentials/ios/actions/SetupSubmissionCredentials.ts

@@ -0,0 +1,61 @@
+import chalk from 'chalk';
+import wrapAnsi from 'wrap-ansi';
+
+import { CommonIosAppCredentialsFragment } from '../../../graphql/generated';
+import Log, { learnMore } from '../../../log';
+import { promptAsync } from '../../../prompts';
+import { CredentialsContext } from '../../context';
+import { UnsupportedCredentialsChoiceError } from '../../errors';
+import { AppLookupParams } from '../api/GraphqlClient';
+import { AppStoreApiKeyPurpose } from './AscApiKeyUtils';
+import { SetupAscApiKey } from './SetupAscApiKey';
+
+const PROMPT_FOR_APP_SPECIFIC_PASSWORD = 'PROMPT_FOR_APP_SPECIFIC_PASSWORD';
+export class SetupSubmissionCredential {
+  private setupAscApiKeyAction;
+  constructor(app: AppLookupParams) {
+    this.setupAscApiKeyAction = new SetupAscApiKey(app, AppStoreApiKeyPurpose.SUBMISSION_SERVICE);
+    this.setupAscApiKeyAction.choices = this.setupAscApiKeyAction.choices.concat({
+      title: '[Enter an App Specific Password]',
+      value: PROMPT_FOR_APP_SPECIFIC_PASSWORD,
+    });
+  }
+
+  public async runAsync(
+    ctx: CredentialsContext
+  ): Promise<CommonIosAppCredentialsFragment | string> {
+    try {
+      return await this.setupAscApiKeyAction.runAsync(ctx);
+    } catch (e) {
+      if (e instanceof UnsupportedCredentialsChoiceError) {
+        const choice = e.choice;
+        if (choice === PROMPT_FOR_APP_SPECIFIC_PASSWORD) {
+          return await this.promptForAppSpecificPasswordAsync();
+        }
+      }
+      throw e;
+    }
+  }
+
+  async promptForAppSpecificPasswordAsync(): Promise<string> {
+    Log.addNewLineIfNone();
+    Log.warn(
+      wrapAnsi(
+        `This option will be deprecated soon. You will still be able to provide your password with the ${chalk.bold(
+          'EXPO_APPLE_APP_SPECIFIC_PASSWORD'
+        )} environment variable.`,
+        process.stdout.columns || 80
+      )
+    );
+    Log.log(`Please enter your Apple app-specific password.`);
+    Log.log(learnMore('https://expo.fyi/apple-app-specific-password'));
+
+    const { appSpecificPassword } = await promptAsync({
+      name: 'appSpecificPassword',
+      message: 'Your Apple app-specific password:',
+      type: 'password',
+      validate: (val: string) => val !== '' || 'Apple app-specific password cannot be empty!',
+    });
+    return appSpecificPassword;
+  }
+}

packages/eas-cli/src/credentials/ios/actions/__tests__/AscApiKeyUtils-test.ts

@@ -0,0 +1,90 @@
+import { asMock } from '../../../../__tests__/utils';
+import { promptAsync } from '../../../../prompts';
+import { getAppstoreMock, testAuthCtx } from '../../../__tests__/fixtures-appstore';
+import { createCtxMock } from '../../../__tests__/fixtures-context';
+import { testAscApiKey } from '../../../__tests__/fixtures-ios';
+import { getCredentialsFromUserAsync } from '../../../utils/promptForCredentials';
+import {
+  AppStoreApiKeyPurpose,
+  getAscApiKeyName,
+  promptForAscApiKeyPathAsync,
+} from '../AscApiKeyUtils';
+
+jest.mock('../../../../prompts');
+jest.mock('../../../utils/promptForCredentials');
+
+function enumKeys<O extends object, K extends keyof O = keyof O>(obj: O): K[] {
+  return Object.keys(obj) as K[];
+}
+
+afterEach(() => {
+  asMock(promptAsync).mockClear();
+  asMock(getCredentialsFromUserAsync).mockClear();
+});
+
+describe(getAscApiKeyName, () => {
+  // Apple enforces a 30 char limit on this name
+  it('produces a name under 30 chars', async () => {
+    for (const value of enumKeys(AppStoreApiKeyPurpose)) {
+      const purpose = AppStoreApiKeyPurpose[value];
+      const name = getAscApiKeyName(purpose);
+      expect(name.length < 30).toBe(true);
+    }
+  });
+});
+
+describe(promptForAscApiKeyPathAsync, () => {
+  it('prompts for keyId, keyP8Path and issuerId when user is not authenticated to Apple', async () => {
+    asMock(promptAsync).mockImplementationOnce(() => ({
+      keyP8Path: '/asc-api-key.p8',
+    }));
+    asMock(getCredentialsFromUserAsync).mockImplementation(() => ({
+      keyId: 'test-key-id',
+      issuerId: 'test-issuer-id',
+    }));
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      appStore: {
+        ...getAppstoreMock(),
+        ensureAuthenticatedAsync: jest.fn(() => {
+          throw new Error('this should not be called');
+        }),
+        authCtx: null,
+      },
+    });
+    const ascApiKeyPath = await promptForAscApiKeyPathAsync(ctx);
+    expect(ascApiKeyPath).toEqual({
+      keyId: 'test-key-id',
+      issuerId: 'test-issuer-id',
+      keyP8Path: '/asc-api-key.p8',
+    });
+    expect(promptAsync).toHaveBeenCalledTimes(1); // keyP8Path
+    expect(getCredentialsFromUserAsync).toHaveBeenCalledTimes(2); // keyId, issuerId
+  });
+  it('prompts for keyId, keyP8Path and detects issuerId when user is authenticated to Apple', async () => {
+    asMock(promptAsync).mockImplementationOnce(() => ({
+      keyP8Path: '/asc-api-key.p8',
+    }));
+    asMock(getCredentialsFromUserAsync).mockImplementation(() => ({
+      keyId: 'test-key-id',
+    }));
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      appStore: {
+        ...getAppstoreMock(),
+        ensureAuthenticatedAsync: jest.fn(() => testAuthCtx),
+        authCtx: testAuthCtx,
+        getAscApiKeyAsync: jest.fn(() => testAscApiKey),
+      },
+    });
+    const ascApiKeyPath = await promptForAscApiKeyPathAsync(ctx);
+    expect(ascApiKeyPath).toEqual({
+      keyId: 'test-key-id',
+      issuerId: 'test-issuer-id-from-apple',
+      keyP8Path: '/asc-api-key.p8',
+    });
+    expect(promptAsync).toHaveBeenCalledTimes(1); // keyP8Path
+    expect(getCredentialsFromUserAsync).toHaveBeenCalledTimes(1); // keyId
+    expect(asMock(ctx.appStore.getAscApiKeyAsync).mock.calls.length).toBe(1); // issuerId
+  });
+});

packages/eas-cli/src/credentials/ios/actions/__tests__/AssignAscApiKey-test.ts

@@ -0,0 +1,46 @@
+import { findApplicationTarget } from '../../../../project/ios/target';
+import { createCtxMock } from '../../../__tests__/fixtures-context';
+import { testAscApiKeyFragment, testTargets } from '../../../__tests__/fixtures-ios';
+import { AppStoreApiKeyPurpose } from '../AscApiKeyUtils';
+import { AssignAscApiKey } from '../AssignAscApiKey';
+import { getAppLookupParamsFromContext } from '../BuildCredentialsUtils';
+
+describe(AssignAscApiKey, () => {
+  it('assigns an App Store Connect Api Key in Interactive Mode for EAS Submit', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: false,
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const assignAscApiKeyAction = new AssignAscApiKey(appLookupParams);
+    await assignAscApiKeyAction.runAsync(
+      ctx,
+      testAscApiKeyFragment,
+      AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+    );
+
+    // expect app credentials to be fetched/created, then updated
+    expect(ctx.ios.createOrGetIosAppCredentialsWithCommonFieldsAsync).toHaveBeenCalledTimes(1);
+    expect(ctx.ios.updateIosAppCredentialsAsync).toHaveBeenCalledTimes(1);
+  });
+  it('works in Non-Interactive Mode', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: true,
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const assignAscApiKeyAction = new AssignAscApiKey(appLookupParams);
+    await assignAscApiKeyAction.runAsync(
+      ctx,
+      testAscApiKeyFragment,
+      AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+    );
+
+    // dont fail if users are running in non-interactive mode
+    await expect(
+      assignAscApiKeyAction.runAsync(
+        ctx,
+        testAscApiKeyFragment,
+        AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+      )
+    ).resolves.not.toThrowError();
+  });
+});

packages/eas-cli/src/credentials/ios/actions/__tests__/CreateAscApiKey-test.ts

@@ -0,0 +1,44 @@
+import { asMock } from '../../../../__tests__/utils';
+import { findApplicationTarget } from '../../../../project/ios/target';
+import { confirmAsync } from '../../../../prompts';
+import { getAppstoreMock, testAuthCtx } from '../../../__tests__/fixtures-appstore';
+import { createCtxMock } from '../../../__tests__/fixtures-context';
+import { testAscApiKey, testTargets } from '../../../__tests__/fixtures-ios';
+import { AppStoreApiKeyPurpose } from '../AscApiKeyUtils';
+import { getAppLookupParamsFromContext } from '../BuildCredentialsUtils';
+import { CreateAscApiKey } from '../CreateAscApiKey';
+
+jest.mock('../../../../prompts');
+asMock(confirmAsync).mockImplementation(() => true);
+
+describe(CreateAscApiKey, () => {
+  it('creates a App Store Api Key in Interactive Mode', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      appStore: {
+        ...getAppstoreMock(),
+        ensureAuthenticatedAsync: jest.fn(() => testAuthCtx),
+        authCtx: testAuthCtx,
+        createAscApiKeyAsync: jest.fn(() => testAscApiKey),
+      },
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const createAscApiKeyAction = new CreateAscApiKey(appLookupParams.account);
+    await createAscApiKeyAction.runAsync(ctx, AppStoreApiKeyPurpose.SUBMISSION_SERVICE);
+
+    // expect api key to be created on expo servers
+    expect(asMock(ctx.ios.createAscApiKeyAsync).mock.calls.length).toBe(1);
+    // expect api key to be created on apple portal
+    expect(asMock(ctx.appStore.createAscApiKeyAsync).mock.calls.length).toBe(1);
+  });
+  it('errors in Non Interactive Mode', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: true,
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const createAscApiKeyAction = new CreateAscApiKey(appLookupParams.account);
+    await expect(
+      createAscApiKeyAction.runAsync(ctx, AppStoreApiKeyPurpose.SUBMISSION_SERVICE)
+    ).rejects.toThrowError();
+  });
+});

packages/eas-cli/src/credentials/ios/actions/__tests__/RemoveAscApiKey-test.ts

@@ -0,0 +1,33 @@
+import { asMock } from '../../../../__tests__/utils';
+import { findApplicationTarget } from '../../../../project/ios/target';
+import { confirmAsync } from '../../../../prompts';
+import { createCtxMock } from '../../../__tests__/fixtures-context';
+import { testAscApiKeyFragment, testTargets } from '../../../__tests__/fixtures-ios';
+import { getAppLookupParamsFromContext } from '../BuildCredentialsUtils';
+import { RemoveAscApiKey } from '../RemoveAscApiKey';
+
+jest.mock('../../../../prompts');
+asMock(confirmAsync).mockImplementation(() => true);
+
+describe(RemoveAscApiKey, () => {
+  it('removes an Asc Api Key', async () => {
+    const ctx = createCtxMock({ nonInteractive: false });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const removeAscApiKeyAction = new RemoveAscApiKey(
+      appLookupParams.account,
+      testAscApiKeyFragment
+    );
+    await removeAscApiKeyAction.runAsync(ctx);
+    expect(ctx.ios.deleteAscApiKeyAsync).toHaveBeenCalledTimes(1);
+    expect(ctx.appStore.revokeAscApiKeyAsync).toHaveBeenCalledTimes(1);
+  });
+  it('errors in Non-Interactive Mode', async () => {
+    const ctx = createCtxMock({ nonInteractive: true });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const removeAscApiKeyAction = new RemoveAscApiKey(
+      appLookupParams.account,
+      testAscApiKeyFragment
+    );
+    await expect(removeAscApiKeyAction.runAsync(ctx)).rejects.toThrowError();
+  });
+});

packages/eas-cli/src/credentials/ios/actions/__tests__/SetUpAscApiKey-test.ts

@@ -0,0 +1,129 @@
+import { asMock } from '../../../../__tests__/utils';
+import { findApplicationTarget } from '../../../../project/ios/target';
+import { confirmAsync, promptAsync } from '../../../../prompts';
+import { getAppstoreMock, testAuthCtx } from '../../../__tests__/fixtures-appstore';
+import { createCtxMock } from '../../../__tests__/fixtures-context';
+import {
+  getNewIosApiMock,
+  testAscApiKey,
+  testAscApiKeyFragment,
+  testCommonIosAppCredentialsFragment,
+  testTargets,
+} from '../../../__tests__/fixtures-ios';
+import { AppStoreApiKeyPurpose } from '../AscApiKeyUtils';
+import { getAppLookupParamsFromContext } from '../BuildCredentialsUtils';
+import { SetUpAscApiKey, SetupAscApiKeyChoice } from '../SetUpAscApiKey';
+
+jest.mock('../../../../prompts');
+asMock(confirmAsync).mockImplementation(() => true);
+
+describe(SetUpAscApiKey, () => {
+  it('skips setting up a ASC Api Key if it is already configured', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      ios: {
+        ...getNewIosApiMock(),
+        getIosAppCredentialsWithCommonFieldsAsync: jest.fn(
+          () => testCommonIosAppCredentialsFragment
+        ),
+      },
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const setupAscApiKeyAction = new SetUpAscApiKey(
+      appLookupParams,
+      AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+    );
+    await setupAscApiKeyAction.runAsync(ctx);
+
+    // expect not to create a new ASC Api Key on expo servers
+    expect(asMock(ctx.ios.createAscApiKeyAsync).mock.calls.length).toBe(0);
+    // expect configuration not to be updated with a new ASC Api Key
+    expect(asMock(ctx.ios.updateIosAppCredentialsAsync).mock.calls.length).toBe(0);
+  });
+  it('sets up a ASC Api Key, creating a new one if there are no existing ASC Api Keys', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      appStore: {
+        ...getAppstoreMock(),
+        createAscApiKeyAsync: jest.fn(() => testAscApiKey),
+      },
+      ios: {
+        ...getNewIosApiMock(),
+        getIosAppCredentialsWithCommonFieldsAsync: jest.fn(),
+        createAscApiKeyAsync: jest.fn(() => testAscApiKeyFragment),
+      },
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const setupAscApiKeyAction = new SetUpAscApiKey(
+      appLookupParams,
+      AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+    );
+    await setupAscApiKeyAction.runAsync(ctx);
+
+    // expect to create a new ASC Api Key on expo servers
+    expect(asMock(ctx.ios.createAscApiKeyAsync).mock.calls.length).toBe(1);
+    // expect configuration to be updated with a new ASC Api Key
+    expect(asMock(ctx.ios.updateIosAppCredentialsAsync).mock.calls.length).toBe(1);
+  });
+  it('sets up a ASC Api Key, use autoselected ASC Api Key when there are existing keys', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      appStore: {
+        ...getAppstoreMock(),
+        ensureAuthenticatedAsync: jest.fn(() => testAuthCtx),
+        authCtx: testAuthCtx,
+        listAscApiKeysAsync: jest.fn(() => [testAscApiKey]),
+      },
+      ios: {
+        ...getNewIosApiMock(),
+        getAscApiKeysForAccountAsync: jest.fn(() => [testAscApiKeyFragment]),
+      },
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const setupAscApiKeyAction = new SetUpAscApiKey(
+      appLookupParams,
+      AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+    );
+    await setupAscApiKeyAction.runAsync(ctx);
+
+    // expect not to create a new ASC Api Key on expo servers, we are using the existing one
+    expect(asMock(ctx.ios.createAscApiKeyAsync).mock.calls.length).toBe(0);
+    // expect configuration to be updated with a new ASC Api Key
+    expect(asMock(ctx.ios.updateIosAppCredentialsAsync).mock.calls.length).toBe(1);
+  });
+  it('sets up a ASC Api Key, allowing user to choose existing keys', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      ios: {
+        ...getNewIosApiMock(),
+        getAscApiKeysForAccountAsync: jest.fn(() => [testAscApiKeyFragment]),
+      },
+    });
+    asMock(promptAsync).mockImplementation(() => ({
+      choice: SetupAscApiKeyChoice.USE_EXISTING,
+      chosenAscApiKey: testAscApiKeyFragment,
+    }));
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const setupAscApiKeyAction = new SetUpAscApiKey(
+      appLookupParams,
+      AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+    );
+    await setupAscApiKeyAction.runAsync(ctx);
+
+    // expect not to create a new ASC Api Key on expo servers, we are using the existing one
+    expect(asMock(ctx.ios.createAscApiKeyAsync).mock.calls.length).toBe(0);
+    // expect configuration to be updated with a new ASC Api Key
+    expect(asMock(ctx.ios.updateIosAppCredentialsAsync).mock.calls.length).toBe(1);
+  });
+  it('errors in Non Interactive Mode', async () => {
+    const ctx = createCtxMock({
+      nonInteractive: true,
+    });
+    const appLookupParams = getAppLookupParamsFromContext(ctx, findApplicationTarget(testTargets));
+    const createAscApiKeyAction = new SetUpAscApiKey(
+      appLookupParams,
+      AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+    );
+    await expect(createAscApiKeyAction.runAsync(ctx)).rejects.toThrowError();
+  });
+});

packages/eas-cli/src/credentials/ios/api/GraphqlClient.ts

@@ -1,7 +1,10 @@
+import { UserRole } from '@expo/apple-utils';
 import nullthrows from 'nullthrows';
 
 import {
   AppFragment,
+  AppStoreConnectApiKeyFragment,
+  AppStoreConnectUserRole,
   AppleAppIdentifierFragment,
   AppleDeviceFragment,
   AppleDistributionCertificateFragment,
@@ -14,7 +17,9 @@ import {
 import { isWildcardBundleIdentifier } from '../../../project/ios/bundleIdentifier';
 import { Account } from '../../../user/Account';
 import { DistributionCertificate, PushKey } from '../appstore/Credentials.types';
+import { MinimalAscApiKey } from '../credentials';
 import { AppleTeamMissingError } from '../errors';
+import { AppStoreConnectApiKeyMutation } from './graphql/mutations/AppStoreConnectApiKeyMutation';
 import { AppleAppIdentifierMutation } from './graphql/mutations/AppleAppIdentifierMutation';
 import {
   AppleDistributionCertificateMutation,
@@ -29,6 +34,7 @@ import { AppleTeamMutation } from './graphql/mutations/AppleTeamMutation';
 import { IosAppBuildCredentialsMutation } from './graphql/mutations/IosAppBuildCredentialsMutation';
 import { IosAppCredentialsMutation } from './graphql/mutations/IosAppCredentialsMutation';
 import { AppQuery } from './graphql/queries/AppQuery';
+import { AppStoreConnectApiKeyQuery } from './graphql/queries/AppStoreConnectApiKeyQuery';
 import { AppleAppIdentifierQuery } from './graphql/queries/AppleAppIdentifierQuery';
 import { AppleDeviceQuery } from './graphql/queries/AppleDeviceQuery';
 import { AppleDistributionCertificateQuery } from './graphql/queries/AppleDistributionCertificateQuery';
@@ -161,8 +167,10 @@ export async function updateIosAppCredentialsAsync(
   appCredentials: CommonIosAppCredentialsFragment,
   {
     applePushKeyId,
+    ascApiKeyIdForSubmissions,
   }: {
     applePushKeyId?: string;
+    ascApiKeyIdForSubmissions?: string;
   }
 ): Promise<CommonIosAppCredentialsFragment> {
   let updatedAppCredentials = appCredentials;
@@ -172,6 +180,13 @@ export async function updateIosAppCredentialsAsync(
       applePushKeyId
     );
   }
+  if (ascApiKeyIdForSubmissions) {
+    updatedAppCredentials =
+      await IosAppCredentialsMutation.setAppStoreConnectApiKeyForSubmissionsAsync(
+        updatedAppCredentials.id,
+        ascApiKeyIdForSubmissions
+      );
+  }
   return updatedAppCredentials;
 }
 
@@ -413,5 +428,78 @@ export async function deletePushKeyAsync(pushKeyId: string): Promise<void> {
   return await ApplePushKeyMutation.deleteApplePushKeyAsync(pushKeyId);
 }
 
+export async function createAscApiKeyAsync(
+  account: Account,
+  ascApiKey: MinimalAscApiKey
+): Promise<AppStoreConnectApiKeyFragment> {
+  const maybeAppleTeam = ascApiKey.teamId
+    ? await createOrGetExistingAppleTeamAsync(account, {
+        appleTeamIdentifier: ascApiKey.teamId,
+        appleTeamName: ascApiKey.teamName,
+      })
+    : null;
+  return await AppStoreConnectApiKeyMutation.createAppStoreConnectApiKeyAsync(
+    {
+      issuerIdentifier: ascApiKey.issuerId,
+      keyIdentifier: ascApiKey.keyId,
+      keyP8: ascApiKey.keyP8,
+      name: ascApiKey.name ?? null,
+      roles: ascApiKey.roles?.map(role => convertUserRoleToGraphqlType(role)) ?? null,
+      appleTeamId: maybeAppleTeam ? maybeAppleTeam.id : null,
+    },
+    account.id
+  );
+}
+
+export async function getAscApiKeysForAccountAsync(
+  account: Account
+): Promise<AppStoreConnectApiKeyFragment[]> {
+  return await AppStoreConnectApiKeyQuery.getAllForAccountAsync(account.name);
+}
+
+export async function getAscApiKeyForAppSubmissionsAsync(
+  appLookupParams: AppLookupParams
+): Promise<AppStoreConnectApiKeyFragment | null> {
+  const maybeIosAppCredentials = await getIosAppCredentialsWithCommonFieldsAsync(appLookupParams);
+  return maybeIosAppCredentials?.appStoreConnectApiKeyForSubmissions ?? null;
+}
+
+export async function deleteAscApiKeyAsync(ascApiKeyId: string): Promise<void> {
+  return await AppStoreConnectApiKeyMutation.deleteAppStoreConnectApiKeyAsync(ascApiKeyId);
+}
+
+function convertUserRoleToGraphqlType(userRole: UserRole): AppStoreConnectUserRole {
+  switch (userRole) {
+    case UserRole.ADMIN:
+      return AppStoreConnectUserRole.Admin;
+    case UserRole.ACCESS_TO_REPORTS:
+      return AppStoreConnectUserRole.AccessToReports;
+    case UserRole.ACCOUNT_HOLDER:
+      return AppStoreConnectUserRole.AccountHolder;
+    case UserRole.APP_MANAGER:
+      return AppStoreConnectUserRole.AppManager;
+    case UserRole.CLOUD_MANAGED_APP_DISTRIBUTION:
+      return AppStoreConnectUserRole.CloudManagedAppDistribution;
+    case UserRole.CLOUD_MANAGED_DEVELOPER_ID:
+      return AppStoreConnectUserRole.CloudManagedDeveloperId;
+    case UserRole.CREATE_APPS:
+      return AppStoreConnectUserRole.CreateApps;
+    case UserRole.CUSTOMER_SUPPORT:
+      return AppStoreConnectUserRole.CustomerSupport;
+    case UserRole.DEVELOPER:
+      return AppStoreConnectUserRole.Developer;
+    case UserRole.FINANCE:
+      return AppStoreConnectUserRole.Finance;
+    case UserRole.MARKETING:
+      return AppStoreConnectUserRole.Marketing;
+    case UserRole.READ_ONLY:
+      return AppStoreConnectUserRole.ReadOnly;
+    case UserRole.SALES:
+      return AppStoreConnectUserRole.Sales;
+    case UserRole.TECHNICAL:
+      return AppStoreConnectUserRole.Technical;
+  }
+}
+
 const formatProjectFullName = ({ account, projectName }: AppLookupParams): string =>
   `@${account.name}/${projectName}`;

packages/eas-cli/src/credentials/ios/api/graphql/mutations/AppStoreConnectApiKeyMutation.ts

@@ -0,0 +1,75 @@
+import assert from 'assert';
+import { print } from 'graphql';
+import gql from 'graphql-tag';
+
+import { graphqlClient, withErrorHandlingAsync } from '../../../../../graphql/client';
+import {
+  AppStoreConnectApiKeyFragment,
+  AppStoreConnectApiKeyInput,
+  CreateAppStoreConnectApiKeyMutation,
+  DeleteAppStoreConnectApiKeyMutation,
+} from '../../../../../graphql/generated';
+import { AppStoreConnectApiKeyFragmentNode } from '../../../../../graphql/types/credentials/AppStoreConnectApiKey';
+
+export const AppStoreConnectApiKeyMutation = {
+  async createAppStoreConnectApiKeyAsync(
+    appStoreConnectApiKeyInput: AppStoreConnectApiKeyInput,
+    accountId: string
+  ): Promise<AppStoreConnectApiKeyFragment> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .mutation<CreateAppStoreConnectApiKeyMutation>(
+          gql`
+            mutation CreateAppStoreConnectApiKeyMutation(
+              $appStoreConnectApiKeyInput: AppStoreConnectApiKeyInput!
+              $accountId: ID!
+            ) {
+              appStoreConnectApiKey {
+                createAppStoreConnectApiKey(
+                  appStoreConnectApiKeyInput: $appStoreConnectApiKeyInput
+                  accountId: $accountId
+                ) {
+                  id
+                  ...AppStoreConnectApiKeyFragment
+                }
+              }
+            }
+            ${print(AppStoreConnectApiKeyFragmentNode)}
+          `,
+          {
+            appStoreConnectApiKeyInput,
+            accountId,
+          }
+        )
+        .toPromise()
+    );
+    assert(
+      data.appStoreConnectApiKey.createAppStoreConnectApiKey,
+      'GraphQL: `createAppStoreConnectApiKey` not defined in server response'
+    );
+    return data.appStoreConnectApiKey.createAppStoreConnectApiKey;
+  },
+  async deleteAppStoreConnectApiKeyAsync(appStoreConnectApiKeyId: string): Promise<void> {
+    await withErrorHandlingAsync(
+      graphqlClient
+        .mutation<DeleteAppStoreConnectApiKeyMutation>(
+          gql`
+            mutation DeleteAppStoreConnectApiKeyMutation($appStoreConnectApiKeyId: ID!) {
+              appStoreConnectApiKey {
+                deleteAppStoreConnectApiKey(id: $appStoreConnectApiKeyId) {
+                  id
+                }
+              }
+            }
+          `,
+          {
+            appStoreConnectApiKeyId,
+          },
+          {
+            additionalTypenames: ['AppStoreConnectApiKey', 'IosAppCredentials'],
+          }
+        )
+        .toPromise()
+    );
+  },
+};

packages/eas-cli/src/credentials/ios/api/graphql/mutations/IosAppCredentialsMutation.ts

@@ -7,6 +7,7 @@ import {
   CommonIosAppCredentialsFragment,
   CreateIosAppCredentialsMutation,
   IosAppCredentialsInput,
+  SetAppStoreConnectApiKeyForSubmissionsMutation,
   SetPushKeyMutation,
 } from '../../../../../graphql/generated';
 import { CommonIosAppCredentialsFragmentNode } from '../../../../../graphql/types/credentials/IosAppCredentials';
@@ -80,4 +81,37 @@ export const IosAppCredentialsMutation = {
     );
     return data.iosAppCredentials.setPushKey;
   },
+  async setAppStoreConnectApiKeyForSubmissionsAsync(
+    iosAppCredentialsId: string,
+    ascApiKeyId: string
+  ): Promise<CommonIosAppCredentialsFragment> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .mutation<SetAppStoreConnectApiKeyForSubmissionsMutation>(
+          gql`
+            mutation SetAppStoreConnectApiKeyForSubmissionsMutation(
+              $iosAppCredentialsId: ID!
+              $ascApiKeyId: ID!
+            ) {
+              iosAppCredentials {
+                setAppStoreConnectApiKeyForSubmissions(
+                  id: $iosAppCredentialsId
+                  ascApiKeyId: $ascApiKeyId
+                ) {
+                  id
+                  ...CommonIosAppCredentialsFragment
+                }
+              }
+            }
+            ${print(CommonIosAppCredentialsFragmentNode)}
+          `,
+          {
+            iosAppCredentialsId,
+            ascApiKeyId,
+          }
+        )
+        .toPromise()
+    );
+    return data.iosAppCredentials.setAppStoreConnectApiKeyForSubmissions;
+  },
 };

packages/eas-cli/src/credentials/ios/api/graphql/queries/AppQuery.ts

@@ -22,7 +22,10 @@ export const AppQuery = {
             }
             ${print(AppFragmentNode)}
           `,
-          { fullName }
+          { fullName },
+          {
+            additionalTypenames: ['App'],
+          }
         )
         .toPromise()
     );

packages/eas-cli/src/credentials/ios/api/graphql/queries/AppStoreConnectApiKeyQuery.ts

@@ -0,0 +1,41 @@
+import { print } from 'graphql';
+import gql from 'graphql-tag';
+
+import { graphqlClient, withErrorHandlingAsync } from '../../../../../graphql/client';
+import {
+  AppStoreConnectApiKeyByAccountQuery,
+  AppStoreConnectApiKeyFragment,
+} from '../../../../../graphql/generated';
+import { AppStoreConnectApiKeyFragmentNode } from '../../../../../graphql/types/credentials/AppStoreConnectApiKey';
+
+export const AppStoreConnectApiKeyQuery = {
+  async getAllForAccountAsync(accountName: string): Promise<AppStoreConnectApiKeyFragment[]> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<AppStoreConnectApiKeyByAccountQuery>(
+          gql`
+            query AppStoreConnectApiKeyByAccountQuery($accountName: String!) {
+              account {
+                byName(accountName: $accountName) {
+                  id
+                  appStoreConnectApiKeys {
+                    id
+                    ...AppStoreConnectApiKeyFragment
+                  }
+                }
+              }
+            }
+            ${print(AppStoreConnectApiKeyFragmentNode)}
+          `,
+          {
+            accountName,
+          },
+          {
+            additionalTypenames: ['AppStoreConnectApiKey'],
+          }
+        )
+        .toPromise()
+    );
+    return data.account.byName.appStoreConnectApiKeys;
+  },
+};

packages/eas-cli/src/credentials/ios/api/graphql/queries/AppleDeviceQuery.ts

@@ -111,7 +111,10 @@ export const AppleDeviceQuery = {
               }
             }
           `,
-          { accountName, appleTeamIdentifier }
+          { accountName, appleTeamIdentifier },
+          {
+            additionalTypenames: ['AppleDevice', 'AppleTeam'],
+          }
         )
         .toPromise()
     );
@@ -147,7 +150,10 @@ export const AppleDeviceQuery = {
               }
             }
           `,
-          { accountName, identifier }
+          { accountName, identifier },
+          {
+            additionalTypenames: ['AppleDevice', 'AppleTeam'],
+          }
         )
         .toPromise()
     );

packages/eas-cli/src/credentials/ios/api/graphql/queries/AppleDistributionCertificateQuery.ts

@@ -60,7 +60,11 @@ export const AppleDistributionCertificateQuery = {
             iosDistributionType,
           },
           {
-            additionalTypenames: ['IosAppCredentials', 'IosAppBuildCredentials'],
+            additionalTypenames: [
+              'AppleDistributionCertificate',
+              'IosAppCredentials',
+              'IosAppBuildCredentials',
+            ],
           }
         )
         .toPromise()
@@ -93,6 +97,9 @@ export const AppleDistributionCertificateQuery = {
           `,
           {
             accountName,
+          },
+          {
+            additionalTypenames: ['AppleDistributionCertificate'],
           }
         )
         .toPromise()

packages/eas-cli/src/credentials/ios/api/graphql/queries/AppleProvisioningProfileQuery.ts

@@ -77,7 +77,11 @@ export const AppleProvisioningProfileQuery = {
             iosDistributionType,
           },
           {
-            additionalTypenames: ['IosAppCredentials', 'IosAppBuildCredentials'],
+            additionalTypenames: [
+              'AppleProvisioningProfile',
+              'IosAppCredentials',
+              'IosAppBuildCredentials',
+            ],
           }
         )
         .toPromise()

packages/eas-cli/src/credentials/ios/api/graphql/queries/ApplePushKeyQuery.ts

@@ -26,6 +26,9 @@ export const ApplePushKeyQuery = {
           `,
           {
             accountName,
+          },
+          {
+            additionalTypenames: ['ApplePushKey'],
           }
         )
         .toPromise()

packages/eas-cli/src/credentials/ios/api/graphql/queries/AppleTeamQuery.ts

@@ -28,7 +28,10 @@ export const AppleTeamQuery = {
               }
             }
           `,
-          { accountName }
+          { accountName },
+          {
+            additionalTypenames: ['AppleTeam'],
+          }
         )
         .toPromise()
     );
@@ -57,6 +60,9 @@ export const AppleTeamQuery = {
           {
             accountId,
             appleTeamIdentifier,
+          },
+          {
+            additionalTypenames: ['AppleTeam'],
           }
         )
         .toPromise()

packages/eas-cli/src/credentials/ios/api/graphql/queries/__mocks__/IosAppCredentialsQuery.ts

@@ -30,6 +30,21 @@ export const IosAppCredentialsQuery = {
         },
         __typename: 'ApplePushKey',
       },
+      appStoreConnectApiKeyForSubmissions: {
+        id: 'b8fe2225-3024-4ebe-9e36-7b9022d3b13e',
+        appleTeam: {
+          id: 'ca27f9f6-c7cb-40d1-8c41-c168e8548261',
+          appleTeamIdentifier: '77KQ969CHE',
+          appleTeamName: null,
+          __typename: 'AppleTeam',
+        },
+        issuerIdentifier: '69a6de93-e4e4-47e3-e053-5b8c7c11a4d1',
+        keyIdentifier: 'NYN468XNN3',
+        name: 'Expo Submissions pl94k8_lnS',
+        roles: ['ADMIN'],
+        updatedAt: '2020-10-13T18:39:04.463Z',
+        __typename: 'AppStoreConnectApiKey',
+      },
       iosAppBuildCredentialsList: [
         {
           id: '6f8d0175-0caf-4922-b09b-eae757b83144',

packages/eas-cli/src/credentials/ios/appstore/AppStoreApi.ts

@@ -150,7 +150,7 @@ export default class AppStoreApi {
     return await listAscApiKeysAsync(ctx);
   }
 
-  public async getAscApiKeyAsync(keyId: string): Promise<AscApiKeyInfo> {
+  public async getAscApiKeyAsync(keyId: string): Promise<AscApiKeyInfo | null> {
     const ctx = await this.ensureAuthenticatedAsync();
     return await getAscApiKeyAsync(ctx, keyId);
   }

packages/eas-cli/src/credentials/ios/appstore/Credentials.types.ts

@@ -76,6 +76,7 @@ export type AscApiKeyInfo = {
   name: string;
   teamName?: string;
   roles: UserRole[];
+  isRevoked: boolean;
 };
 
 export type AscApiKey = AscApiKeyInfo & {

packages/eas-cli/src/credentials/ios/appstore/__tests__/ascApiKey-test.ts

@@ -47,6 +47,7 @@ const mockAscApiKeyInfo = {
   roles: ['ADMIN'],
   teamId: 'test-id',
   teamName: 'test-name',
+  isRevoked: false,
 };
 
 beforeEach(() => {

packages/eas-cli/src/credentials/ios/appstore/ascApiKey.ts

@@ -6,28 +6,36 @@ import { AscApiKey, AscApiKeyInfo } from './Credentials.types';
 import { AuthCtx, getRequestContext } from './authenticate';
 
 export async function listAscApiKeysAsync(authCtx: AuthCtx): Promise<AscApiKeyInfo[]> {
-  const spinner = ora(`Fetching App Store Connect API Keys.`).start();
+  const spinner = ora(`Fetching App Store Connect Api Keys.`).start();
   try {
     const context = getRequestContext(authCtx);
     const keys = await ApiKey.getAsync(context);
-    spinner.succeed(`Fetched App Store Connect API Keys.`);
+    spinner.succeed(`Fetched App Store Connect Api Keys.`);
     return keys.map(key => getAscApiKeyInfo(key, authCtx));
   } catch (error) {
-    spinner.fail(`Failed to fetch App Store Connect API Keys.`);
+    spinner.fail(`Failed to fetch App Store Connect Api Keys.`);
     throw error;
   }
 }
 
-export async function getAscApiKeyAsync(authCtx: AuthCtx, keyId: string): Promise<AscApiKeyInfo> {
-  const spinner = ora(`Fetching App Store Connect API Key.`).start();
+export async function getAscApiKeyAsync(
+  authCtx: AuthCtx,
+  keyId: string
+): Promise<AscApiKeyInfo | null> {
+  const spinner = ora(`Fetching App Store Connect Api Key.`).start();
   try {
     const context = getRequestContext(authCtx);
     const apiKey = await ApiKey.infoAsync(context, { id: keyId });
-    spinner.succeed(`Fetched App Store Connect API Key (ID: ${keyId}).`);
+    spinner.succeed(`Fetched App Store Connect Api Key (ID: ${keyId}).`);
     return getAscApiKeyInfo(apiKey, authCtx);
-  } catch (error) {
+  } catch (error: any) {
+    const message = error?.message ?? '';
+    if (message.includes("There is no resource of type 'apiKeys' with id")) {
+      spinner.stop();
+      return null;
+    }
     Log.error(error);
-    spinner.fail(`Failed to fetch App Store Connect API Key.`);
+    spinner.fail(`Failed to fetch App Store Connect Api Key.`);
     throw error;
   }
 }
@@ -41,7 +49,7 @@ export async function createAscApiKeyAsync(
     keyType,
   }: Partial<Pick<ApiKeyProps, 'nickname' | 'roles' | 'allAppsVisible' | 'keyType'>>
 ): Promise<AscApiKey> {
-  const spinner = ora(`Creating App Store Connect API Key.`).start();
+  const spinner = ora(`Creating App Store Connect Api Key.`).start();
   try {
     const context = getRequestContext(authCtx);
     const key = await ApiKey.createAsync(context, {
@@ -64,12 +72,15 @@ export async function createAscApiKeyAsync(
       }
       throw new Error(`Failed to download .p8 file of ${humanReadableKey}.`);
     }
+    // this object has more optional parameters populated
+    const fullKey = await ApiKey.infoAsync(context, { id: key.id });
+    spinner.succeed(`Created App Store Connect Api Key.`);
     return {
-      ...getAscApiKeyInfo(key, authCtx),
+      ...getAscApiKeyInfo(fullKey, authCtx),
       keyP8,
     };
   } catch (err: any) {
-    spinner.fail('Failed to create App Store Connect API Key.');
+    spinner.fail('Failed to create App Store Connect Api Key.');
     throw err;
   }
 }
@@ -78,16 +89,16 @@ export async function revokeAscApiKeyAsync(
   authCtx: AuthCtx,
   keyId: string
 ): Promise<AscApiKeyInfo> {
-  const spinner = ora(`Revoking App Store Connect API Key.`).start();
+  const spinner = ora(`Revoking App Store Connect Api Key.`).start();
   try {
     const context = getRequestContext(authCtx);
     const apiKey = await ApiKey.infoAsync(context, { id: keyId });
     const revokedKey = await apiKey.revokeAsync();
-    spinner.succeed(`Revoked App Store Connect API Key.`);
+    spinner.succeed(`Revoked App Store Connect Api Key.`);
     return getAscApiKeyInfo(revokedKey, authCtx);
   } catch (error) {
     Log.error(error);
-    spinner.fail(`Failed to revoke App Store Connect API Key.`);
+    spinner.fail(`Failed to revoke App Store Connect Api Key.`);
     throw error;
   }
 }
@@ -100,5 +111,6 @@ export function getAscApiKeyInfo(apiKey: ApiKey, authCtx: AuthCtx): AscApiKeyInf
     teamId: authCtx.team.id,
     teamName: authCtx.team.name,
     roles: apiKey.attributes.roles,
+    isRevoked: !!apiKey.attributes.revokingDate,
   };
 }

packages/eas-cli/src/credentials/ios/credentials.ts

@@ -118,14 +118,20 @@ export interface AscApiKeyPath {
   issuerId: string;
 }
 
-export const ascApiKeyMetadataSchema: CredentialSchema<Omit<MinimalAscApiKey, 'keyP8'>> = {
-  name: 'App Store Connect API Key',
+export const ascApiKeyIdSchema: CredentialSchema<Pick<MinimalAscApiKey, 'keyId'>> = {
+  name: 'App Store Connect Api Key',
   questions: [
     {
       field: 'keyId',
       type: 'string',
       question: 'Key ID:',
     },
+  ],
+};
+
+export const ascApiKeyIssuerIdSchema: CredentialSchema<Pick<MinimalAscApiKey, 'issuerId'>> = {
+  name: 'App Store Connect Api Key',
+  questions: [
     {
       field: 'issuerId',
       type: 'string',

packages/eas-cli/src/credentials/ios/utils/__tests__/__snapshots__/printCredentials-test.ts.snap

@@ -2,47 +2,55 @@
 
 exports[`print credentials prints the IosAppCredentials map 1`] = `
 Array [
-  "iOS Credentials           
-Project                   @quinlanj/test52
-Bundle Identifier         com.quinlanj.test52
-Apple Team                test-apple-identifier 
-                          
-Push Key                  
-Developer Portal ID       9839M6AY8W
-Apple Team                77KQ969CHE 
-Updated                   6 months ago
-                          
-                          
-App Store Configuration   
-                          
-Distribution Certificate  
-Serial Number             test-serial
-Expiration Date           Wed, 13 Oct 2021 18:28:44 UTC
-Apple Team                test-apple-identifier 
-Updated                   6 months ago
-                          
-Provisioning Profile      
-Developer Portal ID       test-profile-id
-Status                    active
-Expiration                Wed, 13 Oct 2021 18:28:44 UTC
-Apple Team                test-apple-identifier 
-Updated                   5 months ago
-                          
-                          
-Ad Hoc Configuration      
-                          
-Distribution Certificate  
-Serial Number             test-serial
-Expiration Date           Wed, 13 Oct 2021 18:28:44 UTC
-Apple Team                test-apple-identifier 
-Updated                   6 months ago
-                          
-Provisioning Profile      
-Developer Portal ID       test-profile-id
-Status                    active
-Expiration                Wed, 13 Oct 2021 18:28:44 UTC
-Apple Team                test-apple-identifier 
-Updated                   5 months ago
-                          ",
+  "iOS Credentials            
+Project                    @quinlanj/test52
+Bundle Identifier          com.quinlanj.test52
+Apple Team                 test-apple-identifier 
+                           
+Push Key                   
+Developer Portal ID        9839M6AY8W
+Apple Team                 77KQ969CHE 
+Updated                    6 months ago
+                           
+App Store Connect Api Key  
+Developer Portal ID        NYN468XNN3
+Name                       Expo Submissions pl94k8_lnS
+Issuer ID                  69a6de93-e4e4-47e3-e053-5b8c7c11a4d1
+Roles                      ADMIN
+Apple Team                 77KQ969CHE 
+Updated                    6 months ago
+                           
+                           
+App Store Configuration    
+                           
+Distribution Certificate   
+Serial Number              test-serial
+Expiration Date            Wed, 13 Oct 2021 18:28:44 UTC
+Apple Team                 test-apple-identifier 
+Updated                    6 months ago
+                           
+Provisioning Profile       
+Developer Portal ID        test-profile-id
+Status                     active
+Expiration                 Wed, 13 Oct 2021 18:28:44 UTC
+Apple Team                 test-apple-identifier 
+Updated                    5 months ago
+                           
+                           
+Ad Hoc Configuration       
+                           
+Distribution Certificate   
+Serial Number              test-serial
+Expiration Date            Wed, 13 Oct 2021 18:28:44 UTC
+Apple Team                 test-apple-identifier 
+Updated                    6 months ago
+                           
+Provisioning Profile       
+Developer Portal ID        test-profile-id
+Status                     active
+Expiration                 Wed, 13 Oct 2021 18:28:44 UTC
+Apple Team                 test-apple-identifier 
+Updated                    5 months ago
+                           ",
 ]
 `;

packages/eas-cli/src/credentials/ios/utils/printCredentials.ts

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import dateformat from 'dateformat';
 
 import {
+  AppStoreConnectApiKeyFragment,
   AppleDeviceFragment,
   ApplePushKeyFragment,
   IosAppBuildCredentialsFragment,
@@ -91,7 +92,7 @@ export function displayIosCredentials(
       continue;
     }
 
-    const { appleTeam, pushKey } = targetAppCredentials;
+    const { appleTeam, pushKey, appStoreConnectApiKeyForSubmissions } = targetAppCredentials;
     if (appleTeam) {
       const { appleTeamIdentifier, appleTeamName } = appleTeam;
       fields.push({
@@ -105,6 +106,10 @@ export function displayIosCredentials(
       displayApplePushKey(pushKey, fields);
     }
 
+    if (appStoreConnectApiKeyForSubmissions) {
+      displayAscApiKey(appStoreConnectApiKeyForSubmissions, fields);
+    }
+
     const sortedIosAppBuildCredentialsList = sortBuildCredentialsByDistributionType(
       targetAppCredentials.iosAppBuildCredentialsList
     );
@@ -230,6 +235,35 @@ function displayApplePushKey(
   fields.push({ label: '', value: '' });
 }
 
+function displayAscApiKey(
+  maybeAscApiKey: AppStoreConnectApiKeyFragment | null,
+  fields: { label: string; value: string }[]
+): void {
+  fields.push({ label: 'App Store Connect Api Key', value: '' });
+  if (maybeAscApiKey) {
+    const { keyIdentifier, issuerIdentifier, appleTeam, name, roles, updatedAt } = maybeAscApiKey;
+    fields.push({ label: 'Developer Portal ID', value: keyIdentifier });
+    if (name) {
+      fields.push({ label: 'Name', value: name });
+    }
+    fields.push({ label: 'Issuer ID', value: issuerIdentifier });
+    if (roles) {
+      fields.push({ label: 'Roles', value: roles.join(',') });
+    }
+    if (appleTeam) {
+      const { appleTeamIdentifier, appleTeamName } = appleTeam;
+      fields.push({
+        label: 'Apple Team',
+        value: `${appleTeamIdentifier} ${appleTeamName ? `(${appleTeamName})` : ''}`,
+      });
+    }
+    fields.push({ label: 'Updated', value: `${fromNow(new Date(updatedAt))} ago` });
+  } else {
+    fields.push({ label: '', value: 'None assigned yet' });
+  }
+  fields.push({ label: '', value: '' });
+}
+
 function formatAppleDevice(device: AppleDeviceFragment): string {
   let deviceString = '';
   if (device.name) {

packages/eas-cli/src/credentials/ios/validators/validateAscApiKey.ts

@@ -0,0 +1,29 @@
+import { AppStoreConnectApiKeyFragment } from '../../../graphql/generated';
+import { CredentialsContext } from '../../context';
+import { AscApiKeyInfo } from '../appstore/Credentials.types';
+import { MinimalAscApiKey } from '../credentials';
+
+export async function isAscApiKeyValidAndTrackedAsync(
+  ctx: CredentialsContext,
+  ascApiKey: MinimalAscApiKey
+): Promise<boolean> {
+  const ascApiKeyInfo = await ctx.appStore.getAscApiKeyAsync(ascApiKey.keyId);
+  return isKeyValid(ascApiKeyInfo);
+}
+
+export async function getValidAndTrackedAscApiKeysAsync(
+  ctx: CredentialsContext,
+  ascApiKeys: AppStoreConnectApiKeyFragment[]
+): Promise<AppStoreConnectApiKeyFragment[]> {
+  const ascApiKeysInfo = await ctx.appStore.listAscApiKeysAsync();
+  const validAscApiKeysInfo = ascApiKeysInfo.filter(keyInfo => isKeyValid(keyInfo));
+  const validKeyIdentifiers = new Set(validAscApiKeysInfo.map(keyInfo => keyInfo.keyId));
+  return ascApiKeys.filter(key => validKeyIdentifiers.has(key.keyIdentifier));
+}
+
+function isKeyValid(ascApiKeyInfo: AscApiKeyInfo | null): boolean {
+  if (!ascApiKeyInfo) {
+    return false;
+  }
+  return !ascApiKeyInfo.isRevoked;
+}

packages/eas-cli/src/credentials/manager/Actions.ts

@@ -0,0 +1,55 @@
+export type ActionInfo = {
+  value: AndroidActionType | IosActionType;
+  title: string;
+  scope: Scope;
+};
+
+export enum Scope {
+  Project,
+  Manager,
+  Account,
+}
+
+export enum AndroidActionType {
+  ManageBuildCredentials,
+  ManageFcm,
+  ManageGoogleServiceAccountKey,
+  ManageCredentialsJson,
+  GoBackToCaller,
+  GoBackToHighLevelActions,
+  CreateKeystore,
+  DownloadKeystore,
+  RemoveKeystore,
+  CreateFcm,
+  RemoveFcm,
+  CreateGsaKey,
+  UseExistingGsaKey,
+  RemoveGsaKey,
+  SetupGsaKey,
+  UpdateCredentialsJson,
+  SetupBuildCredentialsFromCredentialsJson,
+}
+
+export enum IosActionType {
+  ManageCredentialsJson,
+  ManageBuildCredentials,
+  ManagePushKey,
+  ManageAscApiKey,
+  GoBackToCaller,
+  GoBackToHighLevelActions,
+  SetupBuildCredentials,
+  SetupBuildCredentialsFromCredentialsJson,
+  UpdateCredentialsJson,
+  UseExistingDistributionCertificate,
+  RemoveProvisioningProfile,
+  CreateDistributionCertificate,
+  RemoveDistributionCertificate,
+  SetupPushKey,
+  CreatePushKey,
+  UseExistingPushKey,
+  RemovePushKey,
+  SetUpAscApiKeyForSubmissions,
+  UseExistingAscApiKeyForSubmissions,
+  CreateAscApiKeyForSubmissions,
+  RemoveAscApiKey,
+}

packages/eas-cli/src/credentials/manager/AndroidActions.ts

@@ -0,0 +1,116 @@
+import { ActionInfo, AndroidActionType, Scope } from './Actions';
+
+export const highLevelActions: ActionInfo[] = [
+  {
+    value: AndroidActionType.ManageBuildCredentials,
+    title: 'Keystore: Manage everything needed to build your project',
+    scope: Scope.Manager,
+  },
+  {
+    value: AndroidActionType.ManageFcm,
+    title: 'Push Notifications: Manage your FCM Api Key',
+    scope: Scope.Manager,
+  },
+  {
+    value: AndroidActionType.ManageGoogleServiceAccountKey,
+    title: 'Google Service Account: Manage your Service Account Key',
+    scope: Scope.Manager,
+  },
+  {
+    value: AndroidActionType.ManageCredentialsJson,
+    title: 'credentials.json: Upload/Download credentials between EAS servers and your local json ',
+    scope: Scope.Manager,
+  },
+  {
+    value: AndroidActionType.GoBackToCaller,
+    title: 'Go back',
+    scope: Scope.Manager,
+  },
+];
+
+export const credentialsJsonActions: ActionInfo[] = [
+  {
+    value: AndroidActionType.UpdateCredentialsJson,
+    title: 'Download credentials from EAS to credentials.json',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.SetupBuildCredentialsFromCredentialsJson,
+    title: 'Upload credentials from credentials.json to EAS',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.GoBackToHighLevelActions,
+    title: 'Go back',
+    scope: Scope.Manager,
+  },
+];
+
+export const buildCredentialsActions: ActionInfo[] = [
+  {
+    value: AndroidActionType.CreateKeystore,
+    title: 'Set up a new keystore',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.DownloadKeystore,
+    title: 'Download existing keystore',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.RemoveKeystore,
+    title: 'Delete your keystore',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.GoBackToHighLevelActions,
+    title: 'Go back',
+    scope: Scope.Manager,
+  },
+];
+
+export const fcmActions: ActionInfo[] = [
+  {
+    value: AndroidActionType.CreateFcm,
+    title: 'Upload an FCM Api Key',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.RemoveFcm,
+    title: 'Delete your FCM Api Key',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.GoBackToHighLevelActions,
+    title: 'Go back',
+    scope: Scope.Manager,
+  },
+];
+
+export const gsaKeyActions: ActionInfo[] = [
+  {
+    value: AndroidActionType.SetupGsaKey,
+    title: 'Setup a Google Service Account Key',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.CreateGsaKey,
+    title: 'Upload a Google Service Account Key',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.UseExistingGsaKey,
+    title: 'Use an existing Google Service Account Key',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.RemoveGsaKey,
+    title: 'Delete a Google Service Account Key',
+    scope: Scope.Project,
+  },
+  {
+    value: AndroidActionType.GoBackToHighLevelActions,
+    title: 'Go back',
+    scope: Scope.Manager,
+  },
+];

packages/eas-cli/src/credentials/manager/IosActions.ts

@@ -0,0 +1,145 @@
+import { CredentialsContext } from '../context';
+import { ActionInfo, IosActionType, Scope } from './Actions';
+
+export const highLevelActions: ActionInfo[] = [
+  {
+    value: IosActionType.ManageBuildCredentials,
+    title: 'Build Credentials: Manage everything needed to build your project',
+    scope: Scope.Manager,
+  },
+  {
+    value: IosActionType.ManagePushKey,
+    title: 'Push Notifications: Manage your Apple Push Notifications Key',
+    scope: Scope.Manager,
+  },
+  {
+    value: IosActionType.ManageAscApiKey,
+    title: 'App Store Connect: Manage your Api Key',
+    scope: Scope.Manager,
+  },
+  {
+    value: IosActionType.ManageCredentialsJson,
+    title: 'credentials.json: Upload/Download credentials between EAS servers and your local json ',
+    scope: Scope.Manager,
+  },
+  {
+    value: IosActionType.GoBackToCaller,
+    title: 'Go back',
+    scope: Scope.Manager,
+  },
+];
+
+export const credentialsJsonActions: ActionInfo[] = [
+  {
+    value: IosActionType.UpdateCredentialsJson,
+    title: 'Download credentials from EAS to credentials.json',
+    scope: Scope.Project,
+  },
+  {
+    value: IosActionType.SetupBuildCredentialsFromCredentialsJson,
+    title: 'Upload credentials from credentials.json to EAS',
+    scope: Scope.Project,
+  },
+  {
+    value: IosActionType.GoBackToHighLevelActions,
+    title: 'Go back',
+    scope: Scope.Manager,
+  },
+];
+
+export function getPushKeyActions(ctx: CredentialsContext): ActionInfo[] {
+  return [
+    {
+      value: IosActionType.SetupPushKey,
+      title: 'Setup your project to use Push Notifications',
+      scope: Scope.Project,
+    },
+    {
+      value: IosActionType.CreatePushKey,
+      title: 'Add a new push key',
+      scope: ctx.hasProjectContext ? Scope.Project : Scope.Account,
+    },
+    {
+      value: IosActionType.UseExistingPushKey,
+      title: 'Use an existing push key',
+      scope: Scope.Project,
+    },
+    {
+      value: IosActionType.RemovePushKey,
+      title: 'Remove a push key from your account',
+      scope: Scope.Account,
+    },
+    {
+      value: IosActionType.GoBackToHighLevelActions,
+      title: 'Go back',
+      scope: Scope.Manager,
+    },
+  ];
+}
+
+export function getAscApiKeyActions(ctx: CredentialsContext): ActionInfo[] {
+  return [
+    {
+      value: IosActionType.SetUpAscApiKeyForSubmissions,
+      title: 'Set up your project to use an Api Key for EAS Submit',
+      scope: Scope.Project,
+    },
+    {
+      value: IosActionType.UseExistingAscApiKeyForSubmissions,
+      title: 'Use an existing Api Key for EAS Submit',
+      scope: Scope.Project,
+    },
+    {
+      value: IosActionType.CreateAscApiKeyForSubmissions,
+      title: 'Add a new Api Key For EAS Submit',
+      scope: ctx.hasProjectContext ? Scope.Project : Scope.Account,
+    },
+    {
+      value: IosActionType.RemoveAscApiKey,
+      title: 'Delete an Api Key',
+      scope: Scope.Account,
+    },
+    {
+      value: IosActionType.GoBackToHighLevelActions,
+      title: 'Go back',
+      scope: Scope.Manager,
+    },
+  ];
+}
+
+export function getBuildCredentialsActions(ctx: CredentialsContext): ActionInfo[] {
+  return [
+    {
+      // This command will be triggered during build to ensure all credentials are ready
+      // I'm leaving it here for now to simplify testing
+      value: IosActionType.SetupBuildCredentials,
+      title: 'All: Set up all the required credentials to build your project',
+      scope: Scope.Project,
+    },
+    {
+      value: IosActionType.UseExistingDistributionCertificate,
+      title: 'Distribution Certificate: Use an existing one for your project',
+      scope: Scope.Project,
+    },
+    {
+      value: IosActionType.CreateDistributionCertificate,
+      title: `Distribution Certificate: Add a new one to your account`,
+      scope: ctx.hasProjectContext ? Scope.Project : Scope.Account,
+    },
+    {
+      value: IosActionType.RemoveDistributionCertificate,
+      title: 'Distribution Certificate: Delete one from your account',
+      scope: Scope.Account,
+    },
+    {
+      value: IosActionType.RemoveProvisioningProfile,
+      title: 'Provisioning Profile: Delete one from your project',
+      scope: Scope.Project,
+    },
+    {
+      value: IosActionType.GoBackToHighLevelActions,
+      title: 'Go back',
+      scope: Scope.Manager,
+    },
+  ];
+}

packages/eas-cli/src/credentials/manager/ManageAndroid.ts

@@ -34,6 +34,14 @@ import {
   displayEmptyAndroidCredentials,
 } from '../android/utils/printCredentials';
 import { CredentialsContext } from '../context';
+import { ActionInfo, AndroidActionType, Scope } from './Actions';
+import {
+  buildCredentialsActions,
+  credentialsJsonActions,
+  fcmActions,
+  gsaKeyActions,
+  highLevelActions,
+} from './AndroidActions';
 import { Action, PressAnyKeyToContinue } from './HelperActions';
 import {
   SelectAndroidBuildCredentials,
@@ -42,148 +50,6 @@ import {
 } from './SelectAndroidBuildCredentials';
 import { SelectBuildProfileFromEasJson } from './SelectBuildProfileFromEasJson';
 
-enum ActionType {
-  ManageBuildCredentials,
-  ManageFcm,
-  ManageGoogleServiceAccountKey,
-  ManageCredentialsJson,
-  GoBackToCaller,
-  GoBackToHighLevelActions,
-  CreateKeystore,
-  DownloadKeystore,
-  RemoveKeystore,
-  CreateFcm,
-  RemoveFcm,
-  CreateGsaKey,
-  UseExistingGsaKey,
-  RemoveGsaKey,
-  SetupGsaKey,
-  UpdateCredentialsJson,
-  SetupBuildCredentialsFromCredentialsJson,
-}
-
-enum Scope {
-  Project,
-  Manager,
-}
-
-type ActionInfo = { value: ActionType; title: string; scope: Scope };
-
-const highLevelActions: ActionInfo[] = [
-  {
-    value: ActionType.ManageBuildCredentials,
-    title: 'Keystore: Manage everything needed to build your project',
-    scope: Scope.Manager,
-  },
-  {
-    value: ActionType.ManageFcm,
-    title: 'Push Notifications: Manage your FCM Api Key',
-    scope: Scope.Manager,
-  },
-  {
-    value: ActionType.ManageGoogleServiceAccountKey,
-    title: 'Google Service Account: Manage your Service Account Key',
-    scope: Scope.Manager,
-  },
-  {
-    value: ActionType.ManageCredentialsJson,
-    title: 'credentials.json: Upload/Download credentials between EAS servers and your local json ',
-    scope: Scope.Manager,
-  },
-  {
-    value: ActionType.GoBackToCaller,
-    title: 'Go back',
-    scope: Scope.Manager,
-  },
-];
-
-const credentialsJsonActions: ActionInfo[] = [
-  {
-    value: ActionType.UpdateCredentialsJson,
-    title: 'Download credentials from EAS to credentials.json',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.SetupBuildCredentialsFromCredentialsJson,
-    title: 'Upload credentials from credentials.json to EAS',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.GoBackToHighLevelActions,
-    title: 'Go back',
-    scope: Scope.Manager,
-  },
-];
-
-const buildCredentialsActions: ActionInfo[] = [
-  {
-    value: ActionType.CreateKeystore,
-    title: 'Set up a new keystore',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.DownloadKeystore,
-    title: 'Download existing keystore',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.RemoveKeystore,
-    title: 'Delete your keystore',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.GoBackToHighLevelActions,
-    title: 'Go back',
-    scope: Scope.Manager,
-  },
-];
-
-const fcmActions: ActionInfo[] = [
-  {
-    value: ActionType.CreateFcm,
-    title: 'Upload an FCM Api Key',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.RemoveFcm,
-    title: 'Delete your FCM Api Key',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.GoBackToHighLevelActions,
-    title: 'Go back',
-    scope: Scope.Manager,
-  },
-];
-
-const gsaKeyActions: ActionInfo[] = [
-  {
-    value: ActionType.SetupGsaKey,
-    title: 'Setup a Google Service Account Key',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.CreateGsaKey,
-    title: 'Upload a Google Service Account Key',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.UseExistingGsaKey,
-    title: 'Use an existing Google Service Account Key',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.RemoveGsaKey,
-    title: 'Delete a Google Service Account Key',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.GoBackToHighLevelActions,
-    title: 'Go back',
-    scope: Scope.Manager,
-  },
-];
-
 export class ManageAndroid {
   constructor(private callingAction: Action) {}
 
@@ -242,22 +108,22 @@ export class ManageAndroid {
           throw new Error('Action not supported yet');
         }
         if (actionInfo.scope === Scope.Manager) {
-          if (chosenAction === ActionType.ManageBuildCredentials) {
+          if (chosenAction === AndroidActionType.ManageBuildCredentials) {
             currentActions = buildCredentialsActions;
             continue;
-          } else if (chosenAction === ActionType.ManageFcm) {
+          } else if (chosenAction === AndroidActionType.ManageFcm) {
             currentActions = fcmActions;
             continue;
-          } else if (chosenAction === ActionType.ManageGoogleServiceAccountKey) {
+          } else if (chosenAction === AndroidActionType.ManageGoogleServiceAccountKey) {
             currentActions = gsaKeyActions;
             continue;
-          } else if (chosenAction === ActionType.ManageCredentialsJson) {
+          } else if (chosenAction === AndroidActionType.ManageCredentialsJson) {
             currentActions = credentialsJsonActions;
             continue;
-          } else if (chosenAction === ActionType.GoBackToHighLevelActions) {
+          } else if (chosenAction === AndroidActionType.GoBackToHighLevelActions) {
             currentActions = highLevelActions;
             continue;
-          } else if (chosenAction === ActionType.GoBackToCaller) {
+          } else if (chosenAction === AndroidActionType.GoBackToCaller) {
             return await this.callingAction.runAsync(ctx);
           }
         }
@@ -302,7 +168,7 @@ export class ManageAndroid {
 
   private async runProjectSpecificActionAsync(
     ctx: CredentialsContext,
-    action: ActionType,
+    action: AndroidActionType,
     gradleContext?: GradleBuildContext
   ): Promise<void> {
     assert(
@@ -310,7 +176,7 @@ export class ManageAndroid {
       'You must be in your project directory in order to perform this action'
     );
     const appLookupParams = await getAppLookupParamsFromContextAsync(ctx, gradleContext);
-    if (action === ActionType.CreateKeystore) {
+    if (action === AndroidActionType.CreateKeystore) {
       const selectBuildCredentialsResult = await new SelectAndroidBuildCredentials(
         appLookupParams
       ).runAsync(ctx);
@@ -331,47 +197,47 @@ export class ManageAndroid {
           }
         );
       }
-    } else if (action === ActionType.DownloadKeystore) {
+    } else if (action === AndroidActionType.DownloadKeystore) {
       const buildCredentials = await new SelectExistingAndroidBuildCredentials(
         appLookupParams
       ).runAsync(ctx);
       if (buildCredentials) {
         await new DownloadKeystore({ app: appLookupParams }).runAsync(ctx, buildCredentials);
       }
-    } else if (action === ActionType.RemoveKeystore) {
+    } else if (action === AndroidActionType.RemoveKeystore) {
       const buildCredentials = await new SelectExistingAndroidBuildCredentials(
         appLookupParams
       ).runAsync(ctx);
       if (buildCredentials) {
         await new RemoveKeystore(appLookupParams).runAsync(ctx, buildCredentials);
       }
-    } else if (action === ActionType.CreateFcm) {
+    } else if (action === AndroidActionType.CreateFcm) {
       const fcm = await new CreateFcm(appLookupParams.account).runAsync(ctx);
       await new AssignFcm(appLookupParams).runAsync(ctx, fcm);
-    } else if (action === ActionType.RemoveFcm) {
+    } else if (action === AndroidActionType.RemoveFcm) {
       await new RemoveFcm(appLookupParams).runAsync(ctx);
-    } else if (action === ActionType.CreateGsaKey) {
+    } else if (action === AndroidActionType.CreateGsaKey) {
       const gsaKey = await new CreateGoogleServiceAccountKey(appLookupParams.account).runAsync(ctx);
       await new AssignGoogleServiceAccountKey(appLookupParams).runAsync(ctx, gsaKey);
-    } else if (action === ActionType.UseExistingGsaKey) {
+    } else if (action === AndroidActionType.UseExistingGsaKey) {
       const gsaKey = await new UseExistingGoogleServiceAccountKey(appLookupParams.account).runAsync(
         ctx
       );
       if (gsaKey) {
         await new AssignGoogleServiceAccountKey(appLookupParams).runAsync(ctx, gsaKey);
       }
-    } else if (action === ActionType.RemoveGsaKey) {
+    } else if (action === AndroidActionType.RemoveGsaKey) {
       await new SelectAndRemoveGoogleServiceAccountKey(appLookupParams.account).runAsync(ctx);
-    } else if (action === ActionType.SetupGsaKey) {
+    } else if (action === AndroidActionType.SetupGsaKey) {
       await new SetupGoogleServiceAccountKey(appLookupParams).runAsync(ctx);
-    } else if (action === ActionType.UpdateCredentialsJson) {
+    } else if (action === AndroidActionType.UpdateCredentialsJson) {
       const buildCredentials = await new SelectExistingAndroidBuildCredentials(
         appLookupParams
       ).runAsync(ctx);
       if (buildCredentials) {
         await new UpdateCredentialsJson().runAsync(ctx, buildCredentials);
       }
-    } else if (action === ActionType.SetupBuildCredentialsFromCredentialsJson) {
+    } else if (action === AndroidActionType.SetupBuildCredentialsFromCredentialsJson) {
       await new SetupBuildCredentialsFromCredentialsJson(appLookupParams).runAsync(ctx);
     }
   }

packages/eas-cli/src/credentials/manager/ManageIos.ts

@@ -19,15 +19,23 @@ import { confirmAsync, promptAsync, selectAsync } from '../../prompts';
 import { Account, findAccountByName } from '../../user/Account';
 import { ensureActorHasUsername } from '../../user/actions';
 import { CredentialsContext } from '../context';
+import {
+  AppStoreApiKeyPurpose,
+  selectAscApiKeysFromAccountAsync,
+} from '../ios/actions/AscApiKeyUtils';
+import { AssignAscApiKey } from '../ios/actions/AssignAscApiKey';
 import { AssignPushKey } from '../ios/actions/AssignPushKey';
 import { getAppLookupParamsFromContext } from '../ios/actions/BuildCredentialsUtils';
+import { CreateAscApiKey } from '../ios/actions/CreateAscApiKey';
 import { CreateDistributionCertificate } from '../ios/actions/CreateDistributionCertificate';
 import { CreatePushKey } from '../ios/actions/CreatePushKey';
 import { selectValidDistributionCertificateAsync } from '../ios/actions/DistributionCertificateUtils';
 import { selectPushKeyAsync } from '../ios/actions/PushKeyUtils';
+import { SelectAndRemoveAscApiKey } from '../ios/actions/RemoveAscApiKey';
 import { SelectAndRemoveDistributionCertificate } from '../ios/actions/RemoveDistributionCertificate';
 import { RemoveProvisioningProfiles } from '../ios/actions/RemoveProvisioningProfile';
 import { SelectAndRemovePushKey } from '../ios/actions/RemovePushKey';
+import { SetUpAscApiKey } from '../ios/actions/SetUpAscApiKey';
 import { SetupAdhocProvisioningProfile } from '../ios/actions/SetupAdhocProvisioningProfile';
 import { SetupBuildCredentials } from '../ios/actions/SetupBuildCredentials';
 import { SetupBuildCredentialsFromCredentialsJson } from '../ios/actions/SetupBuildCredentialsFromCredentialsJson';
@@ -38,145 +46,18 @@ import { AppLookupParams } from '../ios/api/GraphqlClient';
 import { getManagedEntitlementsJsonAsync } from '../ios/appstore/entitlements';
 import { App, IosAppCredentialsMap, Target } from '../ios/types';
 import { displayIosCredentials } from '../ios/utils/printCredentials';
+import { ActionInfo, IosActionType, Scope } from './Actions';
 import { Action, PressAnyKeyToContinue } from './HelperActions';
+import {
+  credentialsJsonActions,
+  getAscApiKeyActions,
+  getBuildCredentialsActions,
+  getPushKeyActions,
+  highLevelActions,
+} from './IosActions';
 import { SelectBuildProfileFromEasJson } from './SelectBuildProfileFromEasJson';
 import { SelectIosDistributionTypeGraphqlFromBuildProfile } from './SelectIosDistributionTypeGraphqlFromBuildProfile';
 
-enum ActionType {
-  ManageCredentialsJson,
-  ManageBuildCredentials,
-  ManagePushKey,
-  GoBackToCaller,
-  GoBackToHighLevelActions,
-  SetupBuildCredentials,
-  SetupBuildCredentialsFromCredentialsJson,
-  UpdateCredentialsJson,
-  UseExistingDistributionCertificate,
-  RemoveProvisioningProfile,
-  CreateDistributionCertificate,
-  RemoveDistributionCertificate,
-  SetupPushKey,
-  CreatePushKey,
-  UseExistingPushKey,
-  RemovePushKey,
-}
-
-enum Scope {
-  Project,
-  Account,
-  Manager,
-}
-
-type ActionInfo = { value: ActionType; title: string; scope: Scope };
-
-const highLevelActions: ActionInfo[] = [
-  {
-    value: ActionType.ManageBuildCredentials,
-    title: 'Build Credentials: Manage everything needed to build your project',
-    scope: Scope.Manager,
-  },
-  {
-    value: ActionType.ManagePushKey,
-    title: 'Push Notifications: Manage your Apple Push Notifications Key',
-    scope: Scope.Manager,
-  },
-  {
-    value: ActionType.ManageCredentialsJson,
-    title: 'credentials.json: Upload/Download credentials between EAS servers and your local json ',
-    scope: Scope.Manager,
-  },
-  {
-    value: ActionType.GoBackToCaller,
-    title: 'Go back',
-    scope: Scope.Manager,
-  },
-];
-
-const credentialsJsonActions: ActionInfo[] = [
-  {
-    value: ActionType.UpdateCredentialsJson,
-    title: 'Download credentials from EAS to credentials.json',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.SetupBuildCredentialsFromCredentialsJson,
-    title: 'Upload credentials from credentials.json to EAS',
-    scope: Scope.Project,
-  },
-  {
-    value: ActionType.GoBackToHighLevelActions,
-    title: 'Go back',
-    scope: Scope.Manager,
-  },
-];
-
-function getPushKeyActions(ctx: CredentialsContext): ActionInfo[] {
-  return [
-    {
-      value: ActionType.SetupPushKey,
-      title: 'Setup your project to use Push Notifications',
-      scope: Scope.Project,
-    },
-    {
-      value: ActionType.CreatePushKey,
-      title: 'Add a new push key',
-      scope: ctx.hasProjectContext ? Scope.Project : Scope.Account,
-    },
-    {
-      value: ActionType.UseExistingPushKey,
-      title: 'Use an existing push key',
-      scope: Scope.Project,
-    },
-    {
-      value: ActionType.RemovePushKey,
-      title: 'Remove a push key from your account',
-      scope: Scope.Account,
-    },
-    {
-      value: ActionType.GoBackToHighLevelActions,
-      title: 'Go back',
-      scope: Scope.Manager,
-    },
-  ];
-}
-
-function getBuildCredentialsActions(ctx: CredentialsContext): ActionInfo[] {
-  return [
-    {
-      // This command will be triggered during build to ensure all credentials are ready
-      // I'm leaving it here for now to simplify testing
-      value: ActionType.SetupBuildCredentials,
-      title: 'All: Set up all the required credentials to build your project',
-      scope: Scope.Project,
-    },
-    {
-      value: ActionType.UseExistingDistributionCertificate,
-      title: 'Distribution Certificate: Use an existing one for your project',
-      scope: Scope.Project,
-    },
-    {
-      value: ActionType.CreateDistributionCertificate,
-      title: `Distribution Certificate: Add a new one to your account`,
-      scope: ctx.hasProjectContext ? Scope.Project : Scope.Account,
-    },
-    {
-      value: ActionType.RemoveDistributionCertificate,
-      title: 'Distribution Certificate: Delete one from your account',
-      scope: Scope.Account,
-    },
-    {
-      value: ActionType.RemoveProvisioningProfile,
-      title: 'Provisioning Profile: Delete one from your project',
-      scope: Scope.Project,
-    },
-    {
-      value: ActionType.GoBackToHighLevelActions,
-      title: 'Go back',
-      scope: Scope.Manager,
-    },
-  ];
-}
-
 export class ManageIos {
   constructor(private callingAction: Action) {}
 
@@ -186,9 +67,9 @@ export class ManageIos {
   ): Promise<void> {
     const buildCredentialsActions = getBuildCredentialsActions(ctx);
     const pushKeyActions = getPushKeyActions(ctx);
+    const ascApiKeyActions = getAscApiKeyActions(ctx);
 
     await ctx.bestEffortAppStoreAuthenticateAsync();
-
     const accountName = ctx.hasProjectContext
       ? getProjectAccountName(ctx.exp, ctx.user)
       : ensureActorHasUsername(ctx.user);
@@ -198,7 +79,6 @@ export class ManageIos {
       throw new Error(`You do not have access to account: ${accountName}`);
     }
     const { app, targets, buildProfile } = await this.createProjectContextAsync(ctx, account);
-
     while (true) {
       try {
         if (ctx.hasProjectContext) {
@@ -226,19 +106,22 @@ export class ManageIos {
           throw new Error('Action not supported yet');
         }
         if (actionInfo.scope === Scope.Manager) {
-          if (chosenAction === ActionType.ManageBuildCredentials) {
+          if (chosenAction === IosActionType.ManageBuildCredentials) {
             currentActions = buildCredentialsActions;
             continue;
-          } else if (chosenAction === ActionType.ManageCredentialsJson) {
+          } else if (chosenAction === IosActionType.ManageCredentialsJson) {
             currentActions = credentialsJsonActions;
             continue;
-          } else if (chosenAction === ActionType.ManagePushKey) {
+          } else if (chosenAction === IosActionType.ManagePushKey) {
             currentActions = pushKeyActions;
             continue;
-          } else if (chosenAction === ActionType.GoBackToHighLevelActions) {
+          } else if (chosenAction === IosActionType.ManageAscApiKey) {
+            currentActions = ascApiKeyActions;
+            continue;
+          } else if (chosenAction === IosActionType.GoBackToHighLevelActions) {
             currentActions = highLevelActions;
             continue;
-          } else if (chosenAction === ActionType.GoBackToCaller) {
+          } else if (chosenAction === IosActionType.GoBackToCaller) {
             return await this.callingAction.runAsync(ctx);
           }
         } else if (actionInfo.scope === Scope.Project) {
@@ -315,16 +198,20 @@ export class ManageIos {
   private async runAccountSpecificActionAsync(
     ctx: CredentialsContext,
     account: Account,
-    action: ActionType
+    action: IosActionType
   ): Promise<void> {
-    if (action === ActionType.RemoveDistributionCertificate) {
+    if (action === IosActionType.RemoveDistributionCertificate) {
       await new SelectAndRemoveDistributionCertificate(account).runAsync(ctx);
-    } else if (action === ActionType.CreateDistributionCertificate) {
+    } else if (action === IosActionType.CreateDistributionCertificate) {
       await new CreateDistributionCertificate(account).runAsync(ctx);
-    } else if (action === ActionType.CreatePushKey) {
+    } else if (action === IosActionType.CreatePushKey) {
       await new CreatePushKey(account).runAsync(ctx);
-    } else if (action === ActionType.RemovePushKey) {
+    } else if (action === IosActionType.CreateAscApiKeyForSubmissions) {
+      await new CreateAscApiKey(account).runAsync(ctx, AppStoreApiKeyPurpose.SUBMISSION_SERVICE);
+    } else if (action === IosActionType.RemovePushKey) {
       await new SelectAndRemovePushKey(account).runAsync(ctx);
+    } else if (action === IosActionType.RemoveAscApiKey) {
+      await new SelectAndRemoveAscApiKey(account).runAsync(ctx);
     }
   }
 
@@ -333,9 +220,9 @@ export class ManageIos {
     app: App,
     targets: Target[],
     buildProfile: IosBuildProfile,
-    action: ActionType
+    action: IosActionType
   ): Promise<void> {
-    if (action === ActionType.SetupBuildCredentials) {
+    if (action === IosActionType.SetupBuildCredentials) {
       await new SetupBuildCredentials({
         app,
         targets,
@@ -352,12 +239,12 @@ export class ManageIos {
       buildProfile
     ).runAsync(ctx);
 
-    if (action === ActionType.SetupBuildCredentialsFromCredentialsJson) {
+    if (action === IosActionType.SetupBuildCredentialsFromCredentialsJson) {
       await new SetupBuildCredentialsFromCredentialsJson(app, targets, distributionType).runAsync(
         ctx
       );
       return;
-    } else if (action === ActionType.UpdateCredentialsJson) {
+    } else if (action === IosActionType.UpdateCredentialsJson) {
       await new UpdateCredentialsJson(app, targets, distributionType).runAsync(ctx);
       return;
     }
@@ -365,7 +252,7 @@ export class ManageIos {
     const target = await this.selectTargetAsync(targets);
     const appLookupParams = getAppLookupParamsFromContext(ctx, target);
     switch (action) {
-      case ActionType.UseExistingDistributionCertificate: {
+      case IosActionType.UseExistingDistributionCertificate: {
         const distCert = await selectValidDistributionCertificateAsync(ctx, appLookupParams);
         if (!distCert) {
           return;
@@ -378,7 +265,7 @@ export class ManageIos {
         );
         return;
       }
-      case ActionType.CreateDistributionCertificate: {
+      case IosActionType.CreateDistributionCertificate: {
         const distCert = await new CreateDistributionCertificate(appLookupParams.account).runAsync(
           ctx
         );
@@ -395,7 +282,7 @@ export class ManageIos {
         }
         return;
       }
-      case ActionType.RemoveProvisioningProfile: {
+      case IosActionType.RemoveProvisioningProfile: {
         const iosAppCredentials = await ctx.ios.getIosAppCredentialsWithCommonFieldsAsync(
           appLookupParams
         );
@@ -418,7 +305,7 @@ export class ManageIos {
         }
         return;
       }
-      case ActionType.SetupPushKey: {
+      case IosActionType.SetupPushKey: {
         const setupPushKeyAction = await new SetupPushKey(appLookupParams);
         const isPushKeySetup = await setupPushKeyAction.isPushKeySetupAsync(ctx);
         if (isPushKeySetup) {
@@ -430,7 +317,7 @@ export class ManageIos {
         }
         return;
       }
-      case ActionType.CreatePushKey: {
+      case IosActionType.CreatePushKey: {
         const pushKey = await new CreatePushKey(appLookupParams.account).runAsync(ctx);
         const confirm = await confirmAsync({
           message: `Do you want ${appLookupParams.projectName} to use the new Push Key?`,
@@ -440,13 +327,50 @@ export class ManageIos {
         }
         return;
       }
-      case ActionType.UseExistingPushKey: {
+      case IosActionType.UseExistingPushKey: {
         const selectedPushKey = await selectPushKeyAsync(ctx, appLookupParams.account);
         if (selectedPushKey) {
           await new AssignPushKey(appLookupParams).runAsync(ctx, selectedPushKey);
         }
         return;
       }
+      case IosActionType.SetUpAscApiKeyForSubmissions: {
+        await new SetUpAscApiKey(
+          appLookupParams,
+          AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+        ).runAsync(ctx);
+        return;
+      }
+      case IosActionType.UseExistingAscApiKeyForSubmissions: {
+        const ascApiKey = await selectAscApiKeysFromAccountAsync(ctx, appLookupParams.account, {
+          filterDifferentAppleTeam: true,
+        });
+        if (ascApiKey) {
+          await new AssignAscApiKey(appLookupParams).runAsync(
+            ctx,
+            ascApiKey,
+            AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+          );
+        }
+        return;
+      }
+      case IosActionType.CreateAscApiKeyForSubmissions: {
+        const ascApiKey = await new CreateAscApiKey(appLookupParams.account).runAsync(
+          ctx,
+          AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+        );
+        const confirm = await confirmAsync({
+          message: `Do you want ${appLookupParams.projectName} to use the new Api Key?`,
+        });
+        if (confirm) {
+          await new AssignAscApiKey(appLookupParams).runAsync(
+            ctx,
+            ascApiKey,
+            AppStoreApiKeyPurpose.SUBMISSION_SERVICE
+          );
+        }
+        return;
+      }
       default:
         throw new Error('Unknown action selected');
     }

packages/eas-cli/src/credentials/utils/promptForCredentials.ts

@@ -49,7 +49,7 @@ export async function askForUserProvidedAsync<T>(
 
 export async function getCredentialsFromUserAsync<T>(
   credentialsSchema: CredentialSchema<T>,
-  initialValues: Partial<T>
+  initialValues: Partial<T> = {}
 ): Promise<T> {
   const results: any = {};
   for (const question of credentialsSchema.questions) {
@@ -63,7 +63,7 @@ export async function getCredentialsFromUserAsync<T>(
     : (results as T);
 }
 
-async function shouldAutoGenerateCredentialsAsync<T>(
+export async function shouldAutoGenerateCredentialsAsync<T>(
   schema: CredentialSchema<T>
 ): Promise<boolean> {
   const answer = await confirmAsync({

packages/eas-cli/src/graphql/client.ts

@@ -1,12 +1,17 @@
 import {
+  Client,
   CombinedError as GraphqlError,
+  OperationContext,
   OperationResult,
+  PromisifiedSource,
+  TypedDocumentNode,
   cacheExchange,
   createClient as createUrqlClient,
   dedupExchange,
   fetchExchange,
 } from '@urql/core';
 import { retryExchange } from '@urql/exchange-retry';
+import { DocumentNode } from 'graphql';
 // node-fetch is used here because @urql/core uses the fetch API under the hood
 // don't use node-fetch elsewhere
 // eslint-disable-next-line
@@ -57,7 +62,17 @@ export const graphqlClient = createUrqlClient({
     }
     return {};
   },
-});
+}) as StricterClient;
+
+/* Please specify additionalTypenames in your Graphql queries */
+export interface StricterClient extends Client {
+  // eslint-disable-next-line @typescript-eslint/ban-types
+  query<Data = any, Variables extends object = {}>(
+    query: DocumentNode | TypedDocumentNode<Data, Variables> | string,
+    variables: Variables | undefined,
+    context: Partial<OperationContext> & { additionalTypenames: string[] }
+  ): PromisifiedSource<OperationResult<Data, Variables>>;
+}
 
 export async function withErrorHandlingAsync<T>(promise: Promise<OperationResult<T>>): Promise<T> {
   const { data, error } = await promise;

packages/eas-cli/src/graphql/generated.ts

@@ -147,6 +147,11 @@ export type Actor = {
   firstName?: Maybe<Scalars['String']>;
   created: Scalars['DateTime'];
   isExpoAdmin: Scalars['Boolean'];
+  /**
+   * Best-effort human readable name for this actor for use in user interfaces during action attribution.
+   * For example, when displaying a sentence indicating that actor X created a build or published an update.
+   */
+  displayName: Scalars['String'];
   /** Associated accounts */
   accounts: Array<Account>;
   /** Access Tokens belonging to this actor */
@@ -212,7 +217,7 @@ export type Account = {
   applePushKeys: Array<ApplePushKey>;
   appleProvisioningProfiles: Array<AppleProvisioningProfile>;
   appleDevices: Array<AppleDevice>;
-  appleAppSpecificPasswords: Array<AppleAppSpecificPassword>;
+  appStoreConnectApiKeys: Array<AppStoreConnectApiKey>;
   /** Android credentials for account */
   googleServiceAccountKeys: Array<GoogleServiceAccountKey>;
   /** Environment secrets for an account */
@@ -435,6 +440,7 @@ export type App = Project & {
   privacySetting: AppPrivacy;
   latestReleaseId: Scalars['ID'];
   pushSecurityEnabled: Scalars['Boolean'];
+  releaseChannels: Array<Scalars['String']>;
   /** (EAS Build) Builds associated with this app */
   builds: Array<Build>;
   buildJobs: Array<BuildJob>;
@@ -590,6 +596,8 @@ export type AppActivityTimelineProjectActivitiesArgs = {
   limit: Scalars['Int'];
   createdBefore?: Maybe<Scalars['DateTime']>;
   filterTypes?: Maybe<Array<ActivityTimelineProjectActivityType>>;
+  filterPlatforms?: Maybe<Array<AppPlatform>>;
+  filterReleaseChannels?: Maybe<Array<Scalars['String']>>;
 };
 
 
@@ -705,6 +713,7 @@ export type Build = ActivityTimelineProjectActivity & BuildOrBuildJob & {
   iosEnterpriseProvisioning?: Maybe<BuildIosEnterpriseProvisioning>;
   buildProfile?: Maybe<Scalars['String']>;
   gitCommitHash?: Maybe<Scalars['String']>;
+  isGitWorkingTreeDirty?: Maybe<Scalars['Boolean']>;
   error?: Maybe<BuildError>;
   submissions: Array<Submission>;
 };
@@ -732,6 +741,7 @@ export type User = Actor & {
   appetizeCode?: Maybe<Scalars['String']>;
   emailVerified: Scalars['Boolean'];
   isExpoAdmin: Scalars['Boolean'];
+  displayName: Scalars['String'];
   isSecondFactorAuthenticationEnabled: Scalars['Boolean'];
   /** Get all certified second factor authentication methods */
   secondFactorDevices: Array<UserSecondFactorDevice>;
@@ -965,7 +975,7 @@ export type IosSubmissionConfig = {
   __typename?: 'IosSubmissionConfig';
   ascAppIdentifier: Scalars['String'];
   appleIdUsername: Scalars['String'];
-  appleAppSpecificPasswordId?: Maybe<Scalars['String']>;
+  ascApiKeyId?: Maybe<Scalars['String']>;
 };
 
 export type SubmissionError = {
@@ -1112,7 +1122,7 @@ export type IosAppCredentials = {
   appleAppIdentifier: AppleAppIdentifier;
   iosAppBuildCredentialsList: Array<IosAppBuildCredentials>;
   pushKey?: Maybe<ApplePushKey>;
-  appSpecificPassword?: Maybe<AppleAppSpecificPassword>;
+  appStoreConnectApiKeyForSubmissions?: Maybe<AppStoreConnectApiKey>;
   /** @deprecated use iosAppBuildCredentialsList instead */
   iosAppBuildCredentialsArray: Array<IosAppBuildCredentials>;
 };
@@ -1244,16 +1254,38 @@ export type IosAppBuildCredentialsFilter = {
   iosDistributionType?: Maybe<IosDistributionType>;
 };
 
-export type AppleAppSpecificPassword = {
-  __typename?: 'AppleAppSpecificPassword';
+export type AppStoreConnectApiKey = {
+  __typename?: 'AppStoreConnectApiKey';
   id: Scalars['ID'];
   account: Account;
-  appleIdUsername: Scalars['String'];
-  passwordLabel?: Maybe<Scalars['String']>;
+  appleTeam?: Maybe<AppleTeam>;
+  issuerIdentifier: Scalars['String'];
+  keyIdentifier: Scalars['String'];
+  name?: Maybe<Scalars['String']>;
+  roles?: Maybe<Array<AppStoreConnectUserRole>>;
   createdAt: Scalars['DateTime'];
   updatedAt: Scalars['DateTime'];
 };
 
+export enum AppStoreConnectUserRole {
+  Admin = 'ADMIN',
+  Finance = 'FINANCE',
+  Technical = 'TECHNICAL',
+  AccountHolder = 'ACCOUNT_HOLDER',
+  ReadOnly = 'READ_ONLY',
+  Sales = 'SALES',
+  Marketing = 'MARKETING',
+  AppManager = 'APP_MANAGER',
+  Developer = 'DEVELOPER',
+  AccessToReports = 'ACCESS_TO_REPORTS',
+  CustomerSupport = 'CUSTOMER_SUPPORT',
+  CreateApps = 'CREATE_APPS',
+  CloudManagedDeveloperId = 'CLOUD_MANAGED_DEVELOPER_ID',
+  CloudManagedAppDistribution = 'CLOUD_MANAGED_APP_DISTRIBUTION',
+  ImageManager = 'IMAGE_MANAGER',
+  Unknown = 'UNKNOWN'
+}
+
 export type AndroidAppCredentialsFilter = {
   legacyOnly?: Maybe<Scalars['Boolean']>;
   applicationIdentifier?: Maybe<Scalars['String']>;
@@ -1426,6 +1458,7 @@ export type SubscriptionDetails = {
   planId?: Maybe<Scalars['String']>;
   addons: Array<AddonDetails>;
   name?: Maybe<Scalars['String']>;
+  price: Scalars['Int'];
   nextInvoice?: Maybe<Scalars['DateTime']>;
   cancelledAt?: Maybe<Scalars['DateTime']>;
   willCancel?: Maybe<Scalars['Boolean']>;
@@ -1439,6 +1472,8 @@ export type AddonDetails = {
   id: Scalars['ID'];
   planId: Scalars['String'];
   name: Scalars['String'];
+  nextInvoice?: Maybe<Scalars['DateTime']>;
+  willCancel?: Maybe<Scalars['Boolean']>;
 };
 
 export type Charge = {
@@ -1514,7 +1549,10 @@ export type AppQuery = {
   /** Look up app by app id */
   byId: App;
   byFullName: App;
-  /** Public apps in the app directory */
+  /**
+   * Public apps in the app directory
+   * @deprecated App directory no longer supported
+   */
   all: Array<App>;
 };
 
@@ -1841,8 +1879,6 @@ export type RootMutation = {
   googleServiceAccountKey: GoogleServiceAccountKeyMutation;
   /** Mutations that modify an Identifier for an iOS App */
   appleAppIdentifier: AppleAppIdentifierMutation;
-  /** Mutations that modify an App Specific Password for an Apple User Account */
-  appleAppSpecificPassword: AppleAppSpecificPasswordMutation;
   /** Mutations that modify an Apple Device */
   appleDevice: AppleDeviceMutation;
   /** Mutations that modify an Apple Device registration request */
@@ -1855,6 +1891,8 @@ export type RootMutation = {
   applePushKey: ApplePushKeyMutation;
   /** Mutations that modify an Apple Team */
   appleTeam: AppleTeamMutation;
+  /** Mutations that modify an App Store Connect Api Key */
+  appStoreConnectApiKey: AppStoreConnectApiKeyMutation;
   /** Mutations that modify an App */
   app?: Maybe<AppMutation>;
   asset: AssetMutation;
@@ -1960,6 +1998,8 @@ export type AccountMutation = {
   subscribeToProduct?: Maybe<Account>;
   /** Cancels the active subscription */
   cancelSubscription?: Maybe<Account>;
+  /** Requests a refund for the specified charge. Returns true if auto-refund was possible, otherwise requests a manual refund from support and returns false. */
+  requestRefund?: Maybe<Scalars['Boolean']>;
   /**
    * Makes a one time purchase
    * @deprecated Build packs are no longer supported
@@ -2005,6 +2045,12 @@ export type AccountMutationCancelSubscriptionArgs = {
 };
 
 
+export type AccountMutationRequestRefundArgs = {
+  accountID: Scalars['ID'];
+  chargeIdentifier: Scalars['ID'];
+};
+
+
 export type AccountMutationBuyProductArgs = {
   accountName: Scalars['ID'];
   productId: Scalars['ID'];
@@ -2232,24 +2278,6 @@ export type AppleAppIdentifierInput = {
   parentAppleAppId?: Maybe<Scalars['ID']>;
 };
 
-export type AppleAppSpecificPasswordMutation = {
-  __typename?: 'AppleAppSpecificPasswordMutation';
-  /** Create an App Specific Password for an Apple User Account */
-  createAppleAppSpecificPassword: AppleAppSpecificPassword;
-};
-
-
-export type AppleAppSpecificPasswordMutationCreateAppleAppSpecificPasswordArgs = {
-  appleAppSpecificPasswordInput: AppleAppSpecificPasswordInput;
-  accountId: Scalars['ID'];
-};
-
-export type AppleAppSpecificPasswordInput = {
-  appleIdUsername: Scalars['String'];
-  passwordLabel?: Maybe<Scalars['String']>;
-  appSpecificPassword: Scalars['String'];
-};
-
 export type AppleDeviceMutation = {
   __typename?: 'AppleDeviceMutation';
   /** Create an Apple Device */
@@ -2420,6 +2448,39 @@ export type AppleTeamInput = {
   appleTeamName?: Maybe<Scalars['String']>;
 };
 
+export type AppStoreConnectApiKeyMutation = {
+  __typename?: 'AppStoreConnectApiKeyMutation';
+  /** Create an App Store Connect Api Key for an Apple Team */
+  createAppStoreConnectApiKey: AppStoreConnectApiKey;
+  /** Delete an App Store Connect Api Key */
+  deleteAppStoreConnectApiKey: DeleteAppStoreConnectApiKeyResult;
+};
+
+
+export type AppStoreConnectApiKeyMutationCreateAppStoreConnectApiKeyArgs = {
+  appStoreConnectApiKeyInput: AppStoreConnectApiKeyInput;
+  accountId: Scalars['ID'];
+};
+
+
+export type AppStoreConnectApiKeyMutationDeleteAppStoreConnectApiKeyArgs = {
+  id: Scalars['ID'];
+};
+
+export type AppStoreConnectApiKeyInput = {
+  issuerIdentifier: Scalars['String'];
+  keyIdentifier: Scalars['String'];
+  keyP8: Scalars['String'];
+  name?: Maybe<Scalars['String']>;
+  roles?: Maybe<Array<AppStoreConnectUserRole>>;
+  appleTeamId?: Maybe<Scalars['ID']>;
+};
+
+export type DeleteAppStoreConnectApiKeyResult = {
+  __typename?: 'deleteAppStoreConnectApiKeyResult';
+  id: Scalars['ID'];
+};
+
 export type AppMutation = {
   __typename?: 'AppMutation';
   /** Create an unpublished app */
@@ -2526,6 +2587,7 @@ export type AndroidJobInput = {
   projectRootDirectory: Scalars['String'];
   releaseChannel?: Maybe<Scalars['String']>;
   updates?: Maybe<BuildUpdatesInput>;
+  developmentClient?: Maybe<Scalars['Boolean']>;
   secrets?: Maybe<AndroidJobSecretsInput>;
   builderEnvironment?: Maybe<AndroidBuilderEnvironmentInput>;
   cache?: Maybe<BuildCacheInput>;
@@ -2591,6 +2653,7 @@ export type BuildCacheInput = {
 export enum AndroidBuildType {
   Apk = 'APK',
   AppBundle = 'APP_BUNDLE',
+  /** @deprecated Use developmentClient option instead. */
   DevelopmentClient = 'DEVELOPMENT_CLIENT'
 }
 
@@ -2611,6 +2674,7 @@ export type BuildMetadataInput = {
   appIdentifier?: Maybe<Scalars['String']>;
   buildProfile?: Maybe<Scalars['String']>;
   gitCommitHash?: Maybe<Scalars['String']>;
+  isGitWorkingTreeDirty?: Maybe<Scalars['Boolean']>;
   username?: Maybe<Scalars['String']>;
 };
 
@@ -2642,13 +2706,17 @@ export type IosJobInput = {
   projectRootDirectory: Scalars['String'];
   releaseChannel?: Maybe<Scalars['String']>;
   updates?: Maybe<BuildUpdatesInput>;
+  /** @deprecated */
   distribution?: Maybe<DistributionType>;
+  simulator?: Maybe<Scalars['Boolean']>;
+  developmentClient?: Maybe<Scalars['Boolean']>;
   secrets?: Maybe<IosJobSecretsInput>;
   builderEnvironment?: Maybe<IosBuilderEnvironmentInput>;
   cache?: Maybe<BuildCacheInput>;
   scheme?: Maybe<Scalars['String']>;
   buildConfiguration?: Maybe<Scalars['String']>;
   artifactPath?: Maybe<Scalars['String']>;
+  /** @deprecated */
   buildType?: Maybe<IosBuildType>;
   username?: Maybe<Scalars['String']>;
 };
@@ -2680,6 +2748,7 @@ export type IosBuilderEnvironmentInput = {
   env?: Maybe<Scalars['JSONObject']>;
 };
 
+/** @deprecated Use developmentClient option instead. */
 export enum IosBuildType {
   Release = 'RELEASE',
   DevelopmentClient = 'DEVELOPMENT_CLIENT'
@@ -2725,8 +2794,8 @@ export type IosAppCredentialsMutation = {
   createIosAppCredentials: IosAppCredentials;
   /** Set the push key to be used in an iOS app */
   setPushKey: IosAppCredentials;
-  /** Set the app-specific password to be used for an iOS app */
-  setAppSpecificPassword: IosAppCredentials;
+  /** Set the App Store Connect Api Key to be used for submitting an iOS app */
+  setAppStoreConnectApiKeyForSubmissions: IosAppCredentials;
 };
 
 
@@ -2743,15 +2812,15 @@ export type IosAppCredentialsMutationSetPushKeyArgs = {
 };
 
 
-export type IosAppCredentialsMutationSetAppSpecificPasswordArgs = {
+export type IosAppCredentialsMutationSetAppStoreConnectApiKeyForSubmissionsArgs = {
   id: Scalars['ID'];
-  appSpecificPasswordId: Scalars['ID'];
+  ascApiKeyId: Scalars['ID'];
 };
 
 export type IosAppCredentialsInput = {
   appleTeamId?: Maybe<Scalars['ID']>;
   pushKeyId?: Maybe<Scalars['ID']>;
-  appSpecificPasswordId?: Maybe<Scalars['ID']>;
+  appStoreConnectApiKeyForSubmissionsId?: Maybe<Scalars['ID']>;
 };
 
 export type RobotMutation = {
@@ -2793,6 +2862,7 @@ export type Robot = Actor & {
   firstName?: Maybe<Scalars['String']>;
   created: Scalars['DateTime'];
   isExpoAdmin: Scalars['Boolean'];
+  displayName: Scalars['String'];
   /** Associated accounts */
   accounts: Array<Account>;
   /** Access Tokens belonging to this actor */
@@ -2863,11 +2933,11 @@ export type CreateIosSubmissionInput = {
 };
 
 export type IosSubmissionConfigInput = {
-  appleAppSpecificPasswordId?: Maybe<Scalars['String']>;
   appleAppSpecificPassword?: Maybe<Scalars['String']>;
   ascApiKey?: Maybe<AscApiKeyInput>;
+  ascApiKeyId?: Maybe<Scalars['String']>;
   archiveUrl?: Maybe<Scalars['String']>;
-  appleIdUsername: Scalars['String'];
+  appleIdUsername?: Maybe<Scalars['String']>;
   ascAppIdentifier: Scalars['String'];
 };
 
@@ -3433,6 +3503,7 @@ export enum IosSchemeBuildConfiguration {
   Debug = 'DEBUG'
 }
 
+/** @deprecated Use developmentClient option instead. */
 export enum IosManagedBuildType {
   Release = 'RELEASE',
   DevelopmentClient = 'DEVELOPMENT_CLIENT'
@@ -4020,6 +4091,40 @@ export type GoogleServiceAccountKeyByAccountQuery = (
   ) }
 );
 
+export type CreateAppStoreConnectApiKeyMutationVariables = Exact<{
+  appStoreConnectApiKeyInput: AppStoreConnectApiKeyInput;
+  accountId: Scalars['ID'];
+}>;
+
+
+export type CreateAppStoreConnectApiKeyMutation = (
+  { __typename?: 'RootMutation' }
+  & { appStoreConnectApiKey: (
+    { __typename?: 'AppStoreConnectApiKeyMutation' }
+    & { createAppStoreConnectApiKey: (
+      { __typename?: 'AppStoreConnectApiKey' }
+      & Pick<AppStoreConnectApiKey, 'id'>
+      & AppStoreConnectApiKeyFragment
+    ) }
+  ) }
+);
+
+export type DeleteAppStoreConnectApiKeyMutationVariables = Exact<{
+  appStoreConnectApiKeyId: Scalars['ID'];
+}>;
+
+
+export type DeleteAppStoreConnectApiKeyMutation = (
+  { __typename?: 'RootMutation' }
+  & { appStoreConnectApiKey: (
+    { __typename?: 'AppStoreConnectApiKeyMutation' }
+    & { deleteAppStoreConnectApiKey: (
+      { __typename?: 'deleteAppStoreConnectApiKeyResult' }
+      & Pick<DeleteAppStoreConnectApiKeyResult, 'id'>
+    ) }
+  ) }
+);
+
 export type CreateAppleAppIdentifierMutationVariables = Exact<{
   appleAppIdentifierInput: AppleAppIdentifierInput;
   accountId: Scalars['ID'];
@@ -4323,6 +4428,24 @@ export type SetPushKeyMutation = (
   ) }
 );
 
+export type SetAppStoreConnectApiKeyForSubmissionsMutationVariables = Exact<{
+  iosAppCredentialsId: Scalars['ID'];
+  ascApiKeyId: Scalars['ID'];
+}>;
+
+
+export type SetAppStoreConnectApiKeyForSubmissionsMutation = (
+  { __typename?: 'RootMutation' }
+  & { iosAppCredentials: (
+    { __typename?: 'IosAppCredentialsMutation' }
+    & { setAppStoreConnectApiKeyForSubmissions: (
+      { __typename?: 'IosAppCredentials' }
+      & Pick<IosAppCredentials, 'id'>
+      & CommonIosAppCredentialsFragment
+    ) }
+  ) }
+);
+
 export type AppByFullNameQueryVariables = Exact<{
   fullName: Scalars['String'];
 }>;
@@ -4340,6 +4463,27 @@ export type AppByFullNameQuery = (
   )> }
 );
 
+export type AppStoreConnectApiKeyByAccountQueryVariables = Exact<{
+  accountName: Scalars['String'];
+}>;
+
+
+export type AppStoreConnectApiKeyByAccountQuery = (
+  { __typename?: 'RootQuery' }
+  & { account: (
+    { __typename?: 'AccountQuery' }
+    & { byName: (
+      { __typename?: 'Account' }
+      & Pick<Account, 'id'>
+      & { appStoreConnectApiKeys: Array<(
+        { __typename?: 'AppStoreConnectApiKey' }
+        & Pick<AppStoreConnectApiKey, 'id'>
+        & AppStoreConnectApiKeyFragment
+      )> }
+    ) }
+  ) }
+);
+
 export type AppleAppIdentifierByBundleIdQueryVariables = Exact<{
   accountName: Scalars['String'];
   bundleIdentifier: Scalars['String'];
@@ -5174,10 +5318,10 @@ export type BuildFragment = (
     & Pick<BuildArtifacts, 'buildUrl' | 'xcodeBuildLogsUrl'>
   )>, initiatingActor?: Maybe<(
     { __typename: 'User' }
-    & Pick<User, 'username' | 'id'>
+    & Pick<User, 'id' | 'displayName'>
   ) | (
     { __typename: 'Robot' }
-    & Pick<Robot, 'firstName' | 'id'>
+    & Pick<Robot, 'id' | 'displayName'>
   )>, project: (
     { __typename: 'Snack' }
     & Pick<Snack, 'id' | 'name'>
@@ -5288,6 +5432,16 @@ export type AndroidKeystoreFragment = (
   & Pick<AndroidKeystore, 'id' | 'type' | 'keystore' | 'keystorePassword' | 'keyAlias' | 'keyPassword' | 'md5CertificateFingerprint' | 'sha1CertificateFingerprint' | 'sha256CertificateFingerprint' | 'createdAt' | 'updatedAt'>
 );
 
+export type AppStoreConnectApiKeyFragment = (
+  { __typename?: 'AppStoreConnectApiKey' }
+  & Pick<AppStoreConnectApiKey, 'id' | 'issuerIdentifier' | 'keyIdentifier' | 'name' | 'roles' | 'createdAt' | 'updatedAt'>
+  & { appleTeam?: Maybe<(
+    { __typename?: 'AppleTeam' }
+    & Pick<AppleTeam, 'id'>
+    & AppleTeamFragment
+  )> }
+);
+
 export type AppleAppIdentifierFragment = (
   { __typename?: 'AppleAppIdentifier' }
   & Pick<AppleAppIdentifier, 'id' | 'bundleIdentifier'>
@@ -5417,6 +5571,10 @@ export type CommonIosAppCredentialsWithoutBuildCredentialsFragment = (
     { __typename?: 'ApplePushKey' }
     & Pick<ApplePushKey, 'id'>
     & ApplePushKeyFragment
+  )>, appStoreConnectApiKeyForSubmissions?: Maybe<(
+    { __typename?: 'AppStoreConnectApiKey' }
+    & Pick<AppStoreConnectApiKey, 'id'>
+    & AppStoreConnectApiKeyFragment
   )> }
 );
 

packages/eas-cli/src/graphql/queries/BuildQuery.ts

@@ -54,6 +54,7 @@ export const BuildQuery = {
           { buildId },
           {
             requestPolicy: useCache ? 'cache-first' : 'network-only',
+            additionalTypenames: ['Build'],
           }
         )
         .toPromise()
@@ -89,7 +90,10 @@ export const BuildQuery = {
             }
             ${print(BuildFragmentNode)}
           `,
-          { appId, offset, limit, filter }
+          { appId, offset, limit, filter },
+          {
+            additionalTypenames: ['Build'],
+          }
         )
         .toPromise()
     );

packages/eas-cli/src/graphql/queries/EnvironmentSecretsQuery.ts

@@ -37,7 +37,10 @@ export const EnvironmentSecretsQuery = {
             }
             ${print(EnvironmentSecretFragmentNode)}
           `,
-          { accountName }
+          { accountName },
+          {
+            additionalTypenames: ['EnvironmentSecret'],
+          }
         )
         .toPromise()
     );
@@ -62,7 +65,8 @@ export const EnvironmentSecretsQuery = {
             }
             ${print(EnvironmentSecretFragmentNode)}
           `,
-          { appId }
+          { appId },
+          { additionalTypenames: ['EnvironmentSecret'] }
         )
         .toPromise()
     );

packages/eas-cli/src/graphql/queries/ProjectQuery.ts

@@ -19,7 +19,10 @@ export const ProjectQuery = {
               }
             }
           `,
-          { username, slug }
+          { username, slug },
+          {
+            additionalTypenames: ['App', 'Snack'] /* typenames that use the Project type*/,
+          }
         )
         .toPromise()
     );

packages/eas-cli/src/graphql/queries/PublishQuery.ts

@@ -21,7 +21,10 @@ export const PublishQuery = {
           {
             storageKeys,
           },
-          { requestPolicy: 'network-only' } // Since we reptitively query this to monitor the asset upload, we need to ensure it is not cached.
+          {
+            requestPolicy: 'network-only',
+            additionalTypenames: ['AssetMetadataResult'],
+          } // Since we reptitively query this to monitor the asset upload, we need to ensure it is not cached.
         )
         .toPromise()
     );

packages/eas-cli/src/graphql/queries/SubmissionQuery.ts

@@ -40,7 +40,10 @@ export const SubmissionQuery = {
             ${print(SubmissionFragmentNode)}
           `,
           { submissionId },
-          { requestPolicy: useCache ? 'cache-first' : 'network-only' }
+          {
+            requestPolicy: useCache ? 'cache-first' : 'network-only',
+            additionalTypenames: ['Submission'],
+          }
         )
         .toPromise()
     );
@@ -78,7 +81,8 @@ export const SubmissionQuery = {
             }
             ${print(SubmissionFragmentNode)}
           `,
-          { appId, offset, limit, status, platform }
+          { appId, offset, limit, status, platform },
+          { additionalTypenames: ['Submission'] }
         )
         .toPromise()
     );

packages/eas-cli/src/graphql/queries/UserQuery.ts

@@ -26,7 +26,11 @@ export const UserQuery = {
                 isExpoAdmin
               }
             }
-          `
+          `,
+          /* variables */ undefined,
+          {
+            additionalTypenames: ['User'],
+          }
         )
         .toPromise()
     );

packages/eas-cli/src/graphql/queries/WebhookQuery.ts

@@ -31,7 +31,10 @@ export const WebhookQuery = {
             }
             ${print(WebhookFragmentNode)}
           `,
-          { appId, webhookFilter }
+          { appId, webhookFilter },
+          {
+            additionalTypenames: ['Webhook'],
+          }
         )
         .toPromise()
     );
@@ -52,7 +55,10 @@ export const WebhookQuery = {
             }
             ${print(WebhookFragmentNode)}
           `,
-          { webhookId }
+          { webhookId },
+          {
+            additionalTypenames: ['Webhook'],
+          }
         )
         .toPromise()
     );

packages/eas-cli/src/graphql/types/Build.ts

@@ -17,12 +17,7 @@ export const BuildFragmentNode = gql`
     initiatingActor {
       __typename
       id
-      ... on User {
-        username
-      }
-      ... on Robot {
-        firstName
-      }
+      displayName
     }
     project {
       __typename

packages/eas-cli/src/graphql/types/credentials/AppStoreConnectApiKey.ts

@@ -0,0 +1,21 @@
+import { print } from 'graphql';
+import gql from 'graphql-tag';
+
+import { AppleTeamFragmentNode } from './AppleTeam';
+
+export const AppStoreConnectApiKeyFragmentNode = gql`
+  fragment AppStoreConnectApiKeyFragment on AppStoreConnectApiKey {
+    id
+    appleTeam {
+      id
+      ...AppleTeamFragment
+    }
+    issuerIdentifier
+    keyIdentifier
+    name
+    roles
+    createdAt
+    updatedAt
+  }
+  ${print(AppleTeamFragmentNode)}
+`;

packages/eas-cli/src/graphql/types/credentials/IosAppCredentials.ts

@@ -1,6 +1,7 @@
 import gql from 'graphql-tag';
 
 import { AppFragmentNode } from '../App';
+import { AppStoreConnectApiKeyFragmentNode } from './AppStoreConnectApiKey';
 import { AppleAppIdentifierFragmentNode } from './AppleAppIdentifier';
 import { ApplePushKeyFragmentNode } from './ApplePushKey';
 import { AppleTeamFragmentNode } from './AppleTeam';
@@ -25,11 +26,16 @@ export const CommonIosAppCredentialsWithoutBuildCredentialsFragmentNode = gql`
       id
       ...ApplePushKeyFragment
     }
+    appStoreConnectApiKeyForSubmissions {
+      id
+      ...AppStoreConnectApiKeyFragment
+    }
   }
   ${AppFragmentNode}
   ${AppleTeamFragmentNode}
   ${AppleAppIdentifierFragmentNode}
   ${ApplePushKeyFragmentNode}
+  ${AppStoreConnectApiKeyFragmentNode}
 `;
 
 export const CommonIosAppCredentialsFragmentNode = gql`

packages/eas-cli/src/log.ts

@@ -24,11 +24,11 @@ export default class Log {
   }
 
   public static error(...args: any[]): void {
-    Log.consoleError(...Log.withTextColor(args, chalk.red));
+    Log.consoleLog(...Log.withTextColor(args, chalk.red));
   }
 
   public static warn(...args: any[]): void {
-    Log.consoleWarn(...Log.withTextColor(args, chalk.yellow));
+    Log.consoleLog(...Log.withTextColor(args, chalk.yellow));
   }
 
   public static debug(...args: any[]): void {
@@ -59,18 +59,6 @@ export default class Log {
     console.log(...args);
   }
 
-  private static consoleWarn(...args: any[]): void {
-    Log.updateIsLastLineNewLine(args);
-    // eslint-disable-next-line no-console
-    console.warn(...args);
-  }
-
-  private static consoleError(...args: any[]): void {
-    Log.updateIsLastLineNewLine(args);
-    // eslint-disable-next-line no-console
-    console.error(...args);
-  }
-
   private static withTextColor(args: any[], chalkColor: Color): string[] {
     return args.map(arg => chalkColor(arg));
   }

packages/eas-cli/src/project/projectUtils.ts

@@ -231,7 +231,8 @@ export async function getBranchByNameAsync({
         {
           appId,
           name,
-        }
+        },
+        { additionalTypenames: ['UpdateBranch'] }
       )
       .toPromise()
   );

packages/eas-cli/src/project/publish.ts

@@ -12,7 +12,7 @@ import { PresignedPost } from '../graphql/mutations/UploadSessionMutation';
 import { PublishQuery } from '../graphql/queries/PublishQuery';
 import Log from '../log';
 import { uploadWithPresignedPostAsync } from '../uploads';
-import { expoCommandAsync } from '../utils/expoCommand';
+import { expoCommandAsync } from '../utils/expoCli';
 import uniqBy from '../utils/expodash/uniqBy';
 
 export const TIMEOUT_LIMIT = 60_000; // 1 minute

packages/eas-cli/src/project/workflow.ts

@@ -3,7 +3,7 @@ import { Platform, Workflow } from '@expo/eas-build-job';
 import fs from 'fs-extra';
 import path from 'path';
 
-import vcs from '../vcs';
+import { getVcsClient } from '../vcs';
 
 export async function resolveWorkflowAsync(
   projectDir: string,
@@ -20,7 +20,9 @@ export async function resolveWorkflowAsync(
   }
 
   if (await fs.pathExists(platformWorkflowMarker)) {
-    return (await vcs.isFileIgnoredAsync(path.relative(projectDir, platformWorkflowMarker)))
+    return (await getVcsClient().isFileIgnoredAsync(
+      path.relative(projectDir, platformWorkflowMarker)
+    ))
       ? Workflow.MANAGED
       : Workflow.GENERIC;
   } else {

packages/eas-cli/src/submit/ArchiveSource.ts

@@ -288,6 +288,7 @@ function formatBuildChoice(build: BuildFragment, expiryDate: Date): prompts.Choi
     buildProfile,
     appBuildVersion,
     releaseChannel,
+    initiatingActor,
   } = build;
 
   const formatValue = (field?: string | null): string =>
@@ -310,6 +311,7 @@ function formatBuildChoice(build: BuildFragment, expiryDate: Date): prompts.Choi
       .filter(it => it != null)
       .join(', '),
     `\tProfile: ${formatValue(buildProfile)}, Release channel: ${formatValue(releaseChannel)}`,
+    `\tAuthored by: ${formatValue(initiatingActor?.displayName)}`,
   ].join('\n');
 
   return {
@@ -326,16 +328,16 @@ async function handlePromptSourceAsync(source: ArchivePromptSource): Promise<Arc
     message: 'What would you like to submit?',
     choices: [
       {
-        title: 'Selected build from EAS',
+        title: 'Select a build from EAS',
         value: ArchiveSourceType.buildList,
       },
-      { title: 'I have a url to the app archive', value: ArchiveSourceType.url },
+      { title: 'Provide a URL to the app archive', value: ArchiveSourceType.url },
       {
-        title: 'Local app binary file',
+        title: 'Provide a path to a local app binary file',
         value: ArchiveSourceType.path,
       },
       {
-        title: 'A build identified by a build ID',
+        title: 'Provide a build ID to identify a build on EAS',
         value: ArchiveSourceType.buildId,
       },
     ],

packages/eas-cli/src/submit/ios/AscApiKeySource.ts

@@ -1,8 +1,10 @@
+import { Platform } from '@expo/eas-build-job';
 import fs from 'fs-extra';
 
-import { promptForAscApiKeyAsync } from '../../credentials/ios/actions/AscApiKeyUtils';
+import { promptForAscApiKeyPathAsync } from '../../credentials/ios/actions/AscApiKeyUtils';
 import { AscApiKeyPath, MinimalAscApiKey } from '../../credentials/ios/credentials';
 import Log from '../../log';
+import { SubmissionContext } from '../context';
 import { isExistingFileAsync } from '../utils/files';
 
 export enum AscApiKeySourceType {
@@ -36,8 +38,11 @@ export type AscApiKeyResult = {
   summary: AscApiKeySummary;
 };
 
-export async function getAscApiKeyLocallyAsync(source: AscApiKeySource): Promise<AscApiKeyResult> {
-  const ascApiKeyPath = await getAscApiKeyPathAsync(source);
+export async function getAscApiKeyLocallyAsync(
+  ctx: SubmissionContext<Platform.IOS>,
+  source: AscApiKeySource
+): Promise<AscApiKeyResult> {
+  const ascApiKeyPath = await getAscApiKeyPathAsync(ctx, source);
   const { keyP8Path, keyId, issuerId } = ascApiKeyPath;
   const keyP8 = await fs.readFile(keyP8Path, 'utf-8');
 
@@ -51,27 +56,36 @@ export async function getAscApiKeyLocallyAsync(source: AscApiKeySource): Promise
   };
 }
 
-export async function getAscApiKeyPathAsync(source: AscApiKeySource): Promise<AscApiKeyPath> {
+export async function getAscApiKeyPathAsync(
+  ctx: SubmissionContext<Platform.IOS>,
+  source: AscApiKeySource
+): Promise<AscApiKeyPath> {
   switch (source.sourceType) {
     case AscApiKeySourceType.path:
-      return await handlePathSourceAsync(source);
+      return await handlePathSourceAsync(ctx, source);
     case AscApiKeySourceType.prompt:
-      return await handlePromptSourceAsync(source);
+      return await handlePromptSourceAsync(ctx, source);
   }
 }
 
-async function handlePathSourceAsync(source: AscApiKeyEnvVarSource): Promise<AscApiKeyPath> {
+async function handlePathSourceAsync(
+  ctx: SubmissionContext<Platform.IOS>,
+  source: AscApiKeyEnvVarSource
+): Promise<AscApiKeyPath> {
   const { keyP8Path } = source.path;
   if (!(await isExistingFileAsync(keyP8Path))) {
     Log.warn(`File ${keyP8Path} doesn't exist.`);
-    return await getAscApiKeyPathAsync({ sourceType: AscApiKeySourceType.prompt });
+    return await getAscApiKeyPathAsync(ctx, { sourceType: AscApiKeySourceType.prompt });
   }
   return source.path;
 }
 
-async function handlePromptSourceAsync(_source: AscApiKeyPromptSource): Promise<AscApiKeyPath> {
-  const ascApiKeyPath = await promptForAscApiKeyAsync();
-  return await getAscApiKeyPathAsync({
+async function handlePromptSourceAsync(
+  ctx: SubmissionContext<Platform.IOS>,
+  _source: AscApiKeyPromptSource
+): Promise<AscApiKeyPath> {
+  const ascApiKeyPath = await promptForAscApiKeyPathAsync(ctx.credentialsCtx);
+  return await getAscApiKeyPathAsync(ctx, {
     sourceType: AscApiKeySourceType.path,
     path: ascApiKeyPath,
   });