I am using a macos-latest executor to build a React Native app for iOS. The build itself works fine but deploying to TestFlight (via Fastlane) fails due to incorrect formatting of the Apple ID session token. I am generating the token locally and then saving it as a secret in the GitHub repo per this documentation. The Fastlane script expects the token to be available via environment variable FASTLANE_SESSION so I am exporting the value of the secret as the environment variable per the GitHub actions documentation. It should be noted that the token string has special and escaped characters and Apple expects it to be formatted exactly as it is generated. I have tested locally and the session tokens I have generated are valid - they only fail when being read from the secret store in GitHub Actions. The Fastlane step fails with the following error:

Screen Shot 2019-12-03 at 10.40.36 AM.png788×101 18.1 KB

Normal login (username and password) fails because 2FA is required - hence the use of the session token.

Relevant Actions yaml:

deply-ios-qa:
    runs-on: macos-latest
    env:
      MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
      FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD: $${{ secrets.FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD }}
      FASTLANE_PASSWORD: $${{ secrets.FASTLANE_PASSWORD }}
      FASTLANE_SESSION: $${{ secrets.FASTLANE_SESSION }}
    steps:
      - name: Checkout
        uses: actions/checkout@v1
  - name: Install gems
    run: |
      bundle install

  - name: Build iOS app
    run: bundle exec fastlane ios deploy_testflight_qa

Is there a way to confirm that the secret is coming out in the incorrect format? Is GitHub actions doing anything during the saving/reading of the secret that could affect the formatting? Again, Apple expects this string to be formatted exactly as their API gives it to you including spaces, special characters and escaped characters. Also of note: an identical Fastlane script with a similarly accessed secret works on another project in CircleCI so I know the workflow should succeed if the session token is correct.