fix: diagnose and handle various API key formats

[graycreate]

Adds diagnostics to understand API key format issues and handles both base64 and raw .p8 formats

[Copilot]

Pull Request Overview

This PR enhances the GitHub Actions release workflow to better diagnose and handle different API key formats for App Store Connect authentication. It adds comprehensive debugging and multiple fallback methods to handle both base64-encoded and raw .p8 format API keys.

• Adds diagnostic logging to check API key format and characteristics
• Implements multiple fallback methods for decoding base64 strings with better error handling
• Adds support for raw .p8 content as an alternative to base64-encoded keys

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Logging partial API key content could expose sensitive information in build logs. Consider removing or masking these debug statements to prevent potential security exposure.

Suggested change

	echo "First 10 chars: $(echo -n "$APP_STORE_CONNECT_API_KEY_BASE64" | head -c 10)..."
	echo "Last 10 chars: ...$(echo -n "$APP_STORE_CONNECT_API_KEY_BASE64" | tail -c 10)"
	# Omitted logging of first/last 10 chars to avoid exposing sensitive information

[Copilot]

This command could potentially expose parts of the API key by showing invalid characters. Consider replacing with a safer approach that doesn't process the actual secret content.

Suggested change

	# Show which characters are invalid
	echo "$APP_STORE_CONNECT_API_KEY_BASE64" | sed 's/[A-Za-z0-9+/=]//g' | od -c
	# Report the number of invalid characters, but do not display them
	INVALID_COUNT=$(echo "$APP_STORE_CONNECT_API_KEY_BASE64" | sed 's/[A-Za-z0-9+/=]//g' | wc -c)
	echo "❌ String contains $INVALID_COUNT invalid character(s) (not shown for security)."

[github-actions]

Code Coverage Report ❌

Current coverage: 0%