Elevate keystore to team

[wesley-hl]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

Flutter (Dart)

Steps to reproduce

Hi, we have two workflows, one for our old Flutter codebase and another for our new Flutter codebase that supersedes the old one. They both need to publish Android builds to the same existing Play Store listing.

The Android keystore was originally added as an environment variable scoped to the old workflow. We now need to use the same keystore in the new workflow, but it doesn’t appear possible to reuse or promote workflow-scoped environment variables to the team level.

Unfortunately, we no longer have easy access to the original keystore file itself, and tracking it down across old machines and backups is proving time-consuming. The keystore already exists securely in Codemagic, so we’re hoping to reuse it rather than re-upload it.

To be clear, we’re not asking for the keystore to be exposed, downloaded or shared with us. We're only asking whether it’s possible for Codemagic to elevate or migrate the existing workflow-scoped keystore to a team-scoped/global level so it can be referenced by the new workflow.

Is this something you can help with please?

I am aware that you can request a new upload key but this is only if you have Google App Signing enabled on your play store listing, which we don't have enabled currently.

We would be willing to do whatever necessary to prove that we are the app and Codemagic account owners.

Expected results

The keystore currently scoped to a single workflow to be elevated to a team level secret.

Actual results

Currently the keystore is only available in the existing workflow and is not available for use in another workflow.

Build id (optional)

No response

[dam-ease]

Hello @wesley-hl,
Unfortunately, it's a secret; we can't access it either, so it is not possible to restore or retrieve the keystore. I'm afraid that if you have lost the key, the only way out will be to request a change of the signing key from Google.

As I shared in the email thread, you can refer to this Lost or compromised upload key

[wesley-hl]

Hi, thanks for your quick response.

Just to clarify: I’m not asking Codemagic to restore or retrieve the keystore, I understand you can’t access secret values. I’m only asking whether you can migrate/copy/elevate the existing secret record so it can be used by a second workflow in the same Codemagic account.

The “Lost or compromised upload key” link doesn’t fit our situation because it assumes Play App Signing is already enabled and it isn’t enabled for our Play Store listing.

If elevating a workflow-scoped secret to team scope isn’t possible in your system, could you help with one of these alternatives instead?

• Copy/duplicate the workflow configuration (including its secrets references) to a new workflow with a different Github repo URL in a way that preserves access to the same secret, without exposing the value.

• Change the repo URL of the existing Codemagic workflow (like you did in https://github.com/orgs/codemagic-ci-cd/discussions/1920), so the new codebase can build under the existing workflow where the secret already exists

Thanks in advance for your help with this.

[wesley-hl]

We have now found our keystore so require no more help with this. Thanks