Skip to content

Commit ddf9056

Browse files
mokagioclaudeAliSoftware
authored
Adopt a8c-secrets in WordPress iOS (#25772)
* Replace .configure secrets store with a8c-secrets Swap the secrets store from `.configure`/`.configure-files` to `.a8c-secrets`, tracking the encrypted `*.age` blobs alongside the already-committed repo id and public keys, and updating the `.gitignore` allowlist, `.gitattributes`, and `CODEOWNERS` to match. Part of AINFRA-1538. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Point the credentials build phase at a8c-secrets The hint named a `configure_secrets` fastlane lane this repo never gained. Name the tool's own command and link its repo, so the message stays correct as the setup steps evolve. Part of AINFRA-1538. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Decrypt secrets with a8c-secrets, not fastlane CI installs the tool through the toolkit's `install_a8c-secrets_binary`, added in plugin 6.2.0, which pins the version and checksums the download. `rake dependencies` now decrypts only when the tool is present, so external contributors bootstrap unchanged, and treats a failed decrypt as a warning: the build phase already falls back to the example secrets and errors on its own for Release builds. Part of AINFRA-1538. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Drop the GPG key onboarding tasks The flow existed to get developers a key for the `mobile-secrets` repo. a8c-secrets authenticates with age identities instead, so nothing in this repo reads a GPG key any more. Part of AINFRA-1538. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Ask a8c-secrets where the secrets are Neither file now names the tool's storage layout: the input list declares the committed `.age` blob it can actually see, and the script asks `a8c-secrets which` for the plaintext. A repo id or decrypt root spelled out here would silently rot the day either changes. `copy_if_changed` keeps a checkout that only bumps an input's mtime from forcing a recompile of `Secrets.swift`. Mirrors Gravatar-SDK-iOS `2fc29684`. Part of AINFRA-1538. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Normalize the secrets path like Xcode does Xcode collapses `..` when it resolves an `.xcfilelist`, so the entry landed in the processed list rooted at the repo while the script still held the `WordPress/..` form of the same path. `ensure_is_in_input_files_list` compares the two as strings, so every target running `Generate Credentials` failed the phase. The paths this replaced were rooted at `${HOME}` and had no `..` to collapse, which is why the check held up until now. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Source the secrets install so PATH reaches Xcode The `Generate Credentials` build phase resolves `a8c-secrets` off PATH, and the CI agents don't carry `~/.local/bin` — the installer says so itself on the way past. Running the script as a child process left the export behind with it, so the phase would have fallen through to the example secrets and failed every Release build. Gravatar-SDK-iOS keeps the install and the export inline in the job script for the same reason; sourcing gets there without copying them into six callers. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Fail loudly when install-secrets.sh is executed A comment asking callers to source the script is easy to miss, and the failure mode is silent: the build phase falls through to the example secrets and only breaks later, in a Release build. The guard matches the one in `set-up-git-to-fetch-private-packages.sh` in `dayone-apple` and `use-bot-for-git.sh` in the CI agent images. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Copy the secrets unconditionally Matches the shape agreed in Gravatar-SDK-iOS, whose build phase copies without comparing first: Automattic/Gravatar-SDK-iOS#824 The phase declares its inputs and output, so Xcode already skips it when nothing changed. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Drop cp's verbose flag Each call site already echoes which secrets it is applying. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Move secrets decryption to aggregate target to DRY and avoid races * Move decrypt run phase to a script and fix project format The AI use `xcodeproj` to make its changes, which smudged some of the comments and references. I opened the project in Xcode and added then removed a file to trigger a project file update. * Rename install-secrets.sh to install-a8c-secrets.sh The script installs the `a8c-secrets` binary; naming it after the secrets invited reading it as the step that puts them on disk. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Stop decrypting the secrets on CI The `Decrypt Secrets` aggregate target now decrypts once per build, so doing it here as well only repeated the work. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Stop decrypting the secrets from rake The `Decrypt Secrets` build phase covers local builds too, and it cannot go stale between a bootstrap and a build the way this task could. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 <noreply@anthropic.com> * Clean up code comments on Build Phase script --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Olivier Halligon <olivier.halligon@automattic.com>
1 parent cf81b86 commit ddf9056

19 files changed

Lines changed: 276 additions & 159 deletions

‎.a8c-secrets/Secrets.swift.age‎

1.01 KB
Binary file not shown.

‎.buildkite/commands/build-and-upload-testflight.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh <wordpress|jetpack|reader>}"
77
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
88
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
99

10-
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
10+
source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
1111

1212
echo "--- :testflight: Building and uploading ${APP} to TestFlight"
1313
bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}"

‎.buildkite/commands/build-for-testing.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ fi
1616

1717
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
1818

19-
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
19+
source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
2020

2121
echo "--- :hammer_and_wrench: Building"
2222
bundle exec fastlane "build_${APP}_for_testing"

‎.buildkite/commands/install-a8c-secrets.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/usr/bin/env bash
2+
3+
# The `Decrypt Secrets` and `Generate Credentials` build phases resolve
4+
# `a8c-secrets` off PATH, so the export below has to survive in the caller's shell.
5+
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
6+
echo "This script must be sourced, not executed, because it exports PATH." >&2
7+
exit 1
8+
fi
9+
10+
set -euo pipefail
11+
12+
echo "--- :closed_lock_with_key: Installing a8c-secrets"
13+
14+
# `install_a8c-secrets_binary` comes from the a8c-ci-toolkit plugin. It pins the
15+
# a8c-secrets version and checks the download against a checksum vendored there.
16+
install_dir="$HOME/.local/bin"
17+
install_a8c-secrets_binary --install-dir "$install_dir"
18+
export PATH="$install_dir:$PATH"

‎.buildkite/commands/install-secrets.sh‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎.buildkite/commands/prototype-build-jetpack.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ fi
77
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
88
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
99

10-
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
10+
source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
1111

1212
echo "--- :hammer_and_wrench: Building"
1313
bundle exec fastlane build_and_upload_jetpack_prototype_build

‎.buildkite/commands/prototype-build-wordpress.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ fi
77
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
88
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
99

10-
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
10+
source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
1111

1212
echo "--- :hammer_and_wrench: Building"
1313
bundle exec fastlane build_and_upload_wordpress_prototype_build

‎.buildkite/commands/release-build-jetpack.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
44
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
55

6-
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
6+
source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
77

88
echo "--- :hammer_and_wrench: Building"
99
bundle exec fastlane build_and_upload_jetpack_for_app_store

‎.buildkite/commands/release-build-wordpress.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
44
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
55

6-
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
6+
source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
77

88
echo "--- :hammer_and_wrench: Building"
99
bundle exec fastlane build_and_upload_app_store_connect \

‎.configure‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

0 commit comments

Comments
 (0)