Use the same secrets file across WordPress, Jetpack, and Reader (#25803)

mokagio · claude · web-flow · commit 6e272c88a540 · 2026-07-22T02:38:53.000Z
* Remove dead Google login credentials Removed with WordPressAuthenticator, via f8ad8c4 - #25646 * Remove dead GoogleSignIn URL scheme entries These were the OAuth callback schemes — reversed Google client IDs — for the Google sign-in flow that lived in `WordPressAuthenticator`, deleted in #25646. Nothing handles the scheme anymore. The schemes were hardcoded here rather than injected from `googleLoginSchemeId`, so removing that secret in the preceding commit left them untouched and equally dead. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com> * Move Sentry DSN definition from secrets to `Info.plist` That value does not need to be secret. See https://docs.sentry.io/concepts/key-terms/dsn-explainer/#dsn-utilization * Update DocsBot documentation links The `/docs/` path the widget comment pointed at is stale; the page now lives under `/documentation/developer/`. The same link sits on `docsBotId` because it establishes what the value is: the widget `id` is embed code, documented for placement in a site's public HTML. That makes it a candidate to leave `BuildSecrets` the way the Sentry DSN did. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com> * Move Docs Bot ID from secrets to Jetpack's `Info.plist` * Read one secrets file for all app targets The per-app branching existed because the secrets files held app-specific values. Those have since moved to each app's `Info.plist`, read via `BuildSettings`, leaving only values the three apps share. `WordPress-Secrets-Internal.swift` and `-Alpha.swift` leave the input list too: the script stopped reading them well before this change. The shebang moves to `#!/usr/bin/env bash` with a separate `set -euo pipefail`. `#!/bin/bash -euo pipefail` passed multiple parameters, which most systems do not support. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com> * Fix stale script path in credentials filelist The entry pointed at `ApplyConfiguration.sh`, renamed in e78ed88 and never updated here, so the self-dependency its comment describes was not wired: Xcode had no edge from the build phase to the script driving it. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com> * Store the Sentry DSN without its scheme `INFOPLIST_PREPROCESS` is on for WordPress and Jetpack, so the plist goes through the C preprocessor, where `//` opens a comment. The `https://` in the DSN swallowed the rest of the line including `</string>`, leaving XML that `ProcessInfoPlistFile` could not parse, and every app build failed. Reader does not preprocess its plist, but the value is read through one code path, so all three stay consistent. This mirrors `WPProductBlogURL`, which is stored scheme-less for the same reason. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com> * Slim down AI-generated comment * Name the Sentry DSN key for its missing scheme The constraint only shows up in `BuildSettings+Live.swift`, which someone editing the plist never opens. `WPSentryNoSchemeDSN` states it where a full DSN would otherwise get pasted, and unlike an XML comment it survives Xcode's plist editor. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com> * Remove now-unused app-specific secrets * Drop the app prefix from the secrets file name Every target reads this file now, so naming it after one of them misleads. It also matches the source name in the secrets repo, `iOS/WPiOS/Secrets.swift`. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Code Opus 4.8 <noreply@anthropic.com>
diff --git a/.configure b/.configure
@@ -5,27 +5,7 @@
   "files_to_copy": [
     {
       "file": "iOS/WPiOS/Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/WPiOS/Secrets-Internal.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/WPiOS/Secrets-Alpha.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/JPiOS/Jetpack-Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/Reader/Reader-Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/Reader-Secrets.swift",
+      "destination": "~/.configure/wordpress-ios/secrets/Secrets.swift",
       "encrypt": true
     }
   ],
diff --git a/.configure-files/Jetpack-Secrets.swift.enc b/.configure-files/Jetpack-Secrets.swift.enc
diff --git a/.configure-files/Reader-Secrets.swift.enc b/.configure-files/Reader-Secrets.swift.enc
diff --git a/.configure-files/Secrets-Alpha.swift.enc b/.configure-files/Secrets-Alpha.swift.enc
diff --git a/.configure-files/Secrets-Internal.swift.enc b/.configure-files/Secrets-Internal.swift.enc
diff --git a/Modules/Sources/BuildSettingsKit/BuildSecrets.swift b/Modules/Sources/BuildSettingsKit/BuildSecrets.swift
@@ -10,18 +10,6 @@ public struct BuildSecrets: Sendable {
         }
     }
 
-    public struct Google: Sendable {
-        public let clientId: String
-        public let schemeId: String
-        public let serverClientId: String
-
-        public init(clientId: String, schemeId: String, serverClientId: String) {
-            self.clientId = clientId
-            self.schemeId = schemeId
-            self.serverClientId = serverClientId
-        }
-    }
-
     public struct Zendesk: Sendable {
         public let appId: String
         public let url: String
@@ -35,27 +23,18 @@ public struct BuildSecrets: Sendable {
     }
 
     public let oauth: OAuth
-    public let google: Google
     public let zendesk: Zendesk
-    public let sentryDSN: String
-    public let docsBotId: String
     public let encryptedLogsKey: String
     public let debuggingKey: String
 
     public init(
         oauth: OAuth,
-        google: Google,
         zendesk: Zendesk,
-        sentryDSN: String,
-        docsBotId: String,
         encryptedLogsKey: String,
         debuggingKey: String
     ) {
         self.oauth = oauth
-        self.google = google
         self.zendesk = zendesk
-        self.sentryDSN = sentryDSN
-        self.docsBotId = docsBotId
         self.encryptedLogsKey = encryptedLogsKey
         self.debuggingKey = debuggingKey
     }
@@ -65,10 +44,7 @@ extension BuildSecrets {
 
     public static let dummy = BuildSecrets(
         oauth: .init(client: "", secret: ""),
-        google: .init(clientId: "", schemeId: "", serverClientId: ""),
         zendesk: .init(appId: "", url: "", clientId: ""),
-        sentryDSN: "",
-        docsBotId: "",
         encryptedLogsKey: "",
         debuggingKey: ""
     )
diff --git a/Modules/Sources/BuildSettingsKit/BuildSettings+Live.swift b/Modules/Sources/BuildSettingsKit/BuildSettings+Live.swift
@@ -34,6 +34,9 @@ extension BuildSettings {
         zendeskSourcePlatform = bundle.infoValue(forKey: "WPZendeskSourcePlatform")
         mobileAnnounceAppID = bundle.infoValue(forKey: "WPMobileAnnounceAppID")
         authKeychainServiceName = bundle.infoValue(forKey: "WPAuthKeychainServiceName")
+        // The plist does not carry the URL scheme because the C preprocessor treats the `//` as a comment resulting in a truncated value.
+        sentryDSN = "https://" + bundle.infoValue(forKey: "WPSentryNoSchemeDSN")
+        docsBotId = bundle.infoValue(forKey: "WPDocsBotId")
     }
 }
 
diff --git a/Modules/Sources/BuildSettingsKit/BuildSettings+Preview.swift b/Modules/Sources/BuildSettingsKit/BuildSettings+Preview.swift
@@ -20,7 +20,9 @@ extension BuildSettings {
         ),
         zendeskSourcePlatform: "zen",
         mobileAnnounceAppID: "1234567890",
-        authKeychainServiceName: "public-api.wordpress.com"
+        authKeychainServiceName: "public-api.wordpress.com",
+        sentryDSN: "",
+        docsBotId: ""
     )
 }
 
diff --git a/Modules/Sources/BuildSettingsKit/BuildSettings.swift b/Modules/Sources/BuildSettingsKit/BuildSettings.swift
@@ -38,6 +38,12 @@ public struct BuildSettings: Sendable {
     public var zendeskSourcePlatform: String
     public var mobileAnnounceAppID: String
     public var authKeychainServiceName: String
+    /// See [Sentry: DSN utilization](https://docs.sentry.io/concepts/key-terms/dsn-explainer/#dsn-utilization)
+    public var sentryDSN: String
+    /// Empty outside Jetpack, the only app that presents the support chat bot.
+    ///
+    /// See [DocsBot: Embeddable Chat Widget](https://docsbot.ai/documentation/developer/embeddable-chat-widget)
+    public var docsBotId: String
 
     public struct ProductAboutDetails: Sendable {
         public var blogURL: URL
diff --git a/Scripts/BuildPhases/GenerateCredentials.sh b/Scripts/BuildPhases/GenerateCredentials.sh
@@ -1,4 +1,6 @@
-#!/bin/bash -euo pipefail
+#!/usr/bin/env bash
+
+set -euo pipefail
 
 # The Secrets File Sources
 SECRETS_ROOT="${HOME}/.configure/wordpress-ios/secrets"
@@ -47,13 +49,8 @@ function ensure_is_in_input_files_list() {
   fi
 }
 
-WORDPRESS_SECRETS_FILE="${SECRETS_ROOT}/WordPress-Secrets.swift"
-ensure_is_in_input_files_list $WORDPRESS_SECRETS_FILE
-JETPACK_SECRETS_FILE="${SECRETS_ROOT}/Jetpack-Secrets.swift"
-ensure_is_in_input_files_list $JETPACK_SECRETS_FILE
-
-READER_SECRETS_FILE="${SECRETS_ROOT}/Reader-Secrets.swift"
-ensure_is_in_input_files_list $READER_SECRETS_FILE
+SECRETS_FILE="${SECRETS_ROOT}/Secrets.swift"
+ensure_is_in_input_files_list $SECRETS_FILE
 
 LOCAL_SECRETS_FILE="${SRCROOT}/Credentials/Secrets.swift"
 EXAMPLE_SECRETS_FILE="${SRCROOT}/Credentials/Secrets-example.swift"
@@ -63,26 +60,10 @@ ensure_is_in_input_files_list $EXAMPLE_SECRETS_FILE
 SECRETS_DESTINATION_FILE="${SCRIPT_OUTPUT_FILE_0}"
 mkdir -p "$(dirname "$SECRETS_DESTINATION_FILE")"
 
-WORDPRESS_TARGETS=("WordPress" "WordPressShareExtension" "WordPressDraftActionExtension" "WordPressNotificationServiceExtension")
-# If the WordPress Production Secrets are available for WordPress, use them
-if [ -f "$WORDPRESS_SECRETS_FILE" ] && [[ " ${WORDPRESS_TARGETS[*]} " == *" $TARGET_NAME "* ]]; then
+# WordPress, Jetpack, and Reader use all the same secrets at this time.
+if [ -f "$SECRETS_FILE" ]; then
     echo "Applying Production Secrets"
-    cp -v "$WORDPRESS_SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
-    exit 0
-fi
-
-JETPACK_TARGETS=("Jetpack" "JetpackStatsWidgets" "JetpackShareExtension" "JetpackDraftActionExtension" "JetpackNotificationServiceExtension")
-# If the Jetpack Secrets are available and if we're building Jetpack use them
-if [ -f "$JETPACK_SECRETS_FILE" ] && [[ " ${JETPACK_TARGETS[*]} " == *" $TARGET_NAME "* ]]; then
-    echo "Applying Jetpack Secrets"
-    cp -v "$JETPACK_SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
-    exit 0
-fi
-
-# If the Reader Secrets are available and if we're building Reader use them
-if [ -f "$READER_SECRETS_FILE" ] && [ "${TARGET_NAME}" == "Reader" ]; then
-    echo "Applying Reader Secrets"
-    cp -v "$READER_SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
+    cp -v "$SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
     exit 0
 fi
 
diff --git a/Scripts/BuildPhases/GenerateCredentials.xcfilelist b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
@@ -1,10 +1,6 @@
 # Lists of input files for the script that populates the app's secrets with the
 # correct values for the current scheme and build configuration.
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift
-${HOME}/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/Reader-Secrets.swift
+${HOME}/.configure/wordpress-ios/secrets/Secrets.swift
 
 # Local Secrets file that external contributors can use to specify their own
 # ClientID and Secrets. This file is created by the Rakefile when external
@@ -18,4 +14,4 @@ ${SRCROOT}/Credentials/Secrets-example.swift
 
 # Add the script that uses this file as a source, so that, if the script
 # changes, Xcode will run it again on the next build.
-${SRCROOT}/../Scripts/BuildPhases/ApplyConfiguration.sh
+${SRCROOT}/../Scripts/BuildPhases/GenerateCredentials.sh
diff --git a/Sources/Jetpack/Info.plist b/Sources/Jetpack/Info.plist
@@ -555,16 +555,6 @@
 				<string>jetpacknotificationmigration</string>
 			</array>
 		</dict>
-		<dict>
-			<key>CFBundleTypeRole</key>
-			<string>Editor</string>
-			<key>CFBundleURLName</key>
-			<string>GoogleSignIn</string>
-			<key>CFBundleURLSchemes</key>
-			<array>
-				<string>com.googleusercontent.apps.108380595987-qmh1rvuqi418cs6otokppnemo48288c9</string>
-			</array>
-		</dict>
 	</array>
 	<key>CFBundleVersion</key>
 	<string>$(CURRENT_PROJECT_VERSION)</string>
@@ -666,6 +656,8 @@
 	<string>jetpack.public-api.wordpress.com</string>
 	<key>WPBuildConfiguration</key>
 	<string>${WP_BUILD_CONFIGURATION}</string>
+	<key>WPDocsBotId</key>
+	<string>TqTdebbGjJeUjrmBIFjh/YbAMwiheXLs2Ue5j7elH</string>
 	<key>WPEventNamePrefix</key>
 	<string>jpios</string>
 	<key>WPExplatPlatform</key>
@@ -680,6 +672,8 @@
 	<string>jetpack.com/blog</string>
 	<key>WPPushNotificationAppID</key>
 	<string>${WP_PUSH_NOTIFICATION_APP_ID}</string>
+	<key>WPSentryNoSchemeDSN</key>
+	<string>ed059b31605743eb8cfb5034bc4a195c@o248881.ingest.sentry.io/5716771</string>
 	<key>WPZendeskSourcePlatform</key>
 	<string>mobile_-_jp_ios</string>
 </dict>
diff --git a/Sources/Reader/Info.plist b/Sources/Reader/Info.plist
@@ -19,6 +19,8 @@
 	<string>reader.public-api.wordpress.com</string>
 	<key>WPBuildConfiguration</key>
 	<string>${WP_BUILD_CONFIGURATION}</string>
+	<key>WPDocsBotId</key>
+	<string></string>
 	<key>WPEventNamePrefix</key>
 	<string>jpios</string>
 	<key>WPExplatPlatform</key>
@@ -33,6 +35,8 @@
 	<string>jetpack.com/blog</string>
 	<key>WPPushNotificationAppID</key>
 	<string>${WP_PUSH_NOTIFICATION_APP_ID}</string>
+	<key>WPSentryNoSchemeDSN</key>
+	<string>2a7b5c4f9d325dd2b93f0abff78cb9c1@o248881.ingest.us.sentry.io/4509160620621824</string>
 	<key>WPZendeskSourcePlatform</key>
 	<string>mobile_-_jp_ios</string>
 </dict>
diff --git a/Sources/WordPress/Info.plist b/Sources/WordPress/Info.plist
@@ -481,16 +481,6 @@
 				<string>wordpressnotificationmigration</string>
 			</array>
 		</dict>
-		<dict>
-			<key>CFBundleTypeRole</key>
-			<string>Editor</string>
-			<key>CFBundleURLName</key>
-			<string>GoogleSignIn</string>
-			<key>CFBundleURLSchemes</key>
-			<array>
-				<string>com.googleusercontent.apps.108380595987-ujhrhknecrqli756i72gkcs4aaia6nhb</string>
-			</array>
-		</dict>
 	</array>
 	<key>CFBundleVersion</key>
 	<string>${VERSION_LONG}</string>
@@ -591,6 +581,8 @@
 	<string>public-api.wordpress.com</string>
 	<key>WPBuildConfiguration</key>
 	<string>${WP_BUILD_CONFIGURATION}</string>
+	<key>WPDocsBotId</key>
+	<string></string>
 	<key>WPEventNamePrefix</key>
 	<string>wpios</string>
 	<key>WPExplatPlatform</key>
@@ -605,6 +597,8 @@
 	<string>wordpress.org/news/</string>
 	<key>WPPushNotificationAppID</key>
 	<string>${WP_PUSH_NOTIFICATION_APP_ID}</string>
+	<key>WPSentryNoSchemeDSN</key>
+	<string>484d81126ac9483da3756876e80148ab@o248881.ingest.sentry.io/1438083</string>
 	<key>WPZendeskSourcePlatform</key>
 	<string>mobile_-_ios</string>
 </dict>
diff --git a/WordPress/Classes/System/ApiCredentials+BuildSecrets.swift b/WordPress/Classes/System/ApiCredentials+BuildSecrets.swift
@@ -5,18 +5,11 @@ extension ApiCredentials {
     static func toSecrets() -> BuildSecrets {
         BuildSecrets(
             oauth: .init(client: client, secret: secret),
-            google: .init(
-                clientId: googleLoginClientId,
-                schemeId: googleLoginSchemeId,
-                serverClientId: googleLoginServerClientId
-            ),
             zendesk: .init(
                 appId: zendeskAppId,
                 url: zendeskUrl,
                 clientId: zendeskClientId
             ),
-            sentryDSN: sentryDSN,
-            docsBotId: docsBotId,
             encryptedLogsKey: encryptedLogKey,
             debuggingKey: debuggingKey
         )
diff --git a/WordPress/Classes/Utility/Logging/WPCrashLoggingProvider.swift b/WordPress/Classes/Utility/Logging/WPCrashLoggingProvider.swift
@@ -45,7 +45,7 @@ struct WPCrashLoggingDataProvider: CrashLoggingDataProvider {
 
     init(
         contextManager: ContextManager = .shared,
-        sentryDSN: String = BuildSettings.current.secrets.sentryDSN
+        sentryDSN: String = BuildSettings.current.sentryDSN
     ) {
         self.contextManager = contextManager
         self.sentryDSN = sentryDSN
diff --git a/WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewController.swift b/WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewController.swift
@@ -71,7 +71,7 @@ final class SupportChatBotViewController: UIViewController {
     }
 
     /// Creating DocsBotAI JavaScript code so we could tweak configuration from within Swift code
-    /// https://docsbot.ai/docs/embeddable-chat-widget
+    /// https://docsbot.ai/documentation/developer/embeddable-chat-widget
     private func createDocsBotInitCode() -> String {
         """
         (function() {
diff --git a/WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewModel.swift b/WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewModel.swift
@@ -11,7 +11,7 @@ struct SupportChatBotViewModel {
 
     init(
         zendeskUtils: ZendeskUtilsProtocol = ZendeskUtils.sharedInstance,
-        docsBotId: String = BuildSettings.current.secrets.docsBotId
+        docsBotId: String = BuildSettings.current.docsBotId
     ) {
         self.zendeskUtils = zendeskUtils
         self.docsBotId = docsBotId
diff --git a/WordPress/Credentials/Secrets-example.swift b/WordPress/Credentials/Secrets-example.swift
@@ -7,19 +7,12 @@ class ApiCredentials: NSObject {
     static let client = "0"
     static let secret = "your-secret-here"
 
-    // Google Login
-    static let googleLoginClientId = ""
-    static let googleLoginSchemeId = ""
-    static let googleLoginServerClientId = ""
-
     // ZenDesk
     static let zendeskAppId = ""
     static let zendeskUrl = ""
     static let zendeskClientId = ""
 
     // Other Services
-    static let sentryDSN = ""
     static let encryptedLogKey = ""
     static let debuggingKey = ""
-    static let docsBotId = ""
 }

Original file line number	Diff line number	Diff line change
`@@ -34,6 +34,9 @@ extension BuildSettings {`
`34`	`34`	`zendeskSourcePlatform = bundle.infoValue(forKey: "WPZendeskSourcePlatform")`
`35`	`35`	`mobileAnnounceAppID = bundle.infoValue(forKey: "WPMobileAnnounceAppID")`
`36`	`36`	`authKeychainServiceName = bundle.infoValue(forKey: "WPAuthKeychainServiceName")`
	`37`	+ // The plist does not carry the URL scheme because the C preprocessor treats the `//` as a comment resulting in a truncated value.
	`38`	`+ sentryDSN = "https://" + bundle.infoValue(forKey: "WPSentryNoSchemeDSN")`
	`39`	`+ docsBotId = bundle.infoValue(forKey: "WPDocsBotId")`
`37`	`40`	`}`
`38`	`41`	`}`
`39`	`42`
Original file line number	Diff line number	Diff line change
`@@ -20,7 +20,9 @@ extension BuildSettings {`
`20`	`20`	`),`
`21`	`21`	`zendeskSourcePlatform: "zen",`
`22`	`22`	`mobileAnnounceAppID: "1234567890",`
`23`		`- authKeychainServiceName: "public-api.wordpress.com"`
	`23`	`+ authKeychainServiceName: "public-api.wordpress.com",`
	`24`	`+ sentryDSN: "",`
	`25`	`+ docsBotId: ""`
`24`	`26`	`)`
`25`	`27`	`}`
`26`	`28`