Remove unused env vars from fastlane tooling (#25771)

mokagio · claude · web-flow · commit b90d6b8101ea · 2026-07-18T02:37:06.000Z
* Add helper to read build settings from xcconfig Wraps `Xcodeproj::Config` with the error handling its raw API lacks: a missing file, a missing key, and a key set to an empty value all raise rather than silently yielding `nil`. Uses `to_hash` rather than `attributes`, since the latter only sees the settings assigned in the file itself, not those it pulls in via `#include`. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Read the internal team ID from xcconfig `INT_EXPORT_TEAM_ID` duplicated a value the project already declares: enterprise and prototype builds use the `Release-Alpha` configuration, whose `DEVELOPMENT_TEAM` is set in `config/Common.alpha.xcconfig`. Reading it from there removes one secret from the environment the tooling needs to be handed. Note the value also lives in `project.env` in the `mobile-secrets` repository, where it now has no consumer. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Read the external team ID from xcconfig Same reasoning as the internal team ID in the previous commit: `EXT_EXPORT_TEAM_ID` duplicated the `DEVELOPMENT_TEAM` that `config/Common.release.xcconfig` already declares for the App Store builds, which use the `Release` configuration. With both gone, `project.env` no longer has to carry either team ID. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Stop passing team_id to upload_to_testflight Both call sites authenticate with `api_key`, and pilot only ever reads `team_id` on the username/password Spaceship path — see `pilot/lib/pilot/manager.rb:36`, the sole reader of `config[:team_id]` in the whole of `pilot/lib`, which sits in the `else` branch that an API token skips. An App Store Connect API key is issued by a single team, so there is no team left to disambiguate. `woocommerce-ios` has shipped its TestFlight uploads without the parameter for this reason. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Stop provisioning project.env Every key it carried is now unused: the two export team IDs come from `xcconfig`, `FASTLANE_ITC_TEAM_ID` was inert alongside an `api_key`, the Sentry slugs are hardcoded constants in `build.rb`, and the two HockeyApp IDs outlived the service. With nothing reading the file, the `before_all` guard demanding it had no purpose either — which is what the three CI scripts were copying the example file to satisfy. `configure_apply` creates its destination directory itself, so nothing else needed that block. The file still exists in `mobile-secrets`, where it can now be deleted. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Remove now unused `project.env.enc` --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
diff --git a/.buildkite/commands/build-for-testing.sh b/.buildkite/commands/build-for-testing.sh
@@ -16,10 +16,6 @@ fi
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 echo "--- :closed_lock_with_key: Installing Secrets"
 bundle exec fastlane run configure_apply
 
diff --git a/.buildkite/commands/lint-localized-strings-format.sh b/.buildkite/commands/lint-localized-strings-format.sh
@@ -4,8 +4,4 @@ if "$(dirname "${BASH_SOURCE[0]}")/should-skip-job.sh" --job-type localization;
   exit 0
 fi
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 lint_localized_strings_format
diff --git a/.buildkite/commands/verify-strings-catalog.sh b/.buildkite/commands/verify-strings-catalog.sh
@@ -11,10 +11,6 @@ fi
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 echo "--- :package: Generate Localizable.xcstrings from source"
 bundle exec fastlane ios generate_strings_catalog
 
diff --git a/.configure b/.configure
@@ -3,11 +3,6 @@
   "branch": "trunk",
   "pinned_hash": "6baf4e086398ddf8141d7132e557703a715fafd2",
   "files_to_copy": [
-    {
-      "file": "iOS/WPiOS/project.env",
-      "destination": "~/.configure/wordpress-ios/secrets/project.env",
-      "encrypt": true
-    },
     {
       "file": "iOS/WPiOS/Secrets.swift",
       "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
diff --git a/.configure-files/project.env.enc b/.configure-files/project.env.enc
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
@@ -5,6 +5,8 @@ fastlane_require 'dotenv'
 fastlane_require 'open-uri'
 fastlane_require 'git'
 
+require_relative 'lanes/xcconfig_helper'
+
 UI.user_error!('Please run fastlane via `bundle exec`') unless FastlaneCore::Helper.bundler?
 
 ########################################################################
@@ -27,8 +29,6 @@ BETA_APP_DESCRIPTION_PATH_READER = File.join(PROJECT_ROOT_FOLDER, 'fastlane', 'r
 # Env file paths to load
 ENV_FILE_NAME = '.wpios-env.default'
 USER_ENV_FILE_PATH = File.join(Dir.home, ENV_FILE_NAME)
-SECRETS_DIR = File.join(Dir.home, '.configure', 'wordpress-ios', 'secrets')
-PROJECT_ENV_FILE_PATH = File.join(SECRETS_DIR, 'project.env')
 
 WORDPRESS_BUNDLE_IDENTIFIER = 'org.wordpress'
 WORDPRESS_EXTENSIONS_BUNDLE_IDENTIFIERS = %w[
@@ -54,10 +54,13 @@ ALL_READER_BUNDLE_IDENTIFIERS = [READER_BUNDLE_IDENTIFIER].freeze
 
 # Environment Variables — used by lanes but also potentially actions
 Dotenv.load(USER_ENV_FILE_PATH)
-Dotenv.load(PROJECT_ENV_FILE_PATH)
 GITHUB_REPO = 'wordpress-mobile/wordpress-iOS'
 DEFAULT_BRANCH = 'trunk'
 PUBLIC_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Version.public.xcconfig')
+ALPHA_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Common.alpha.xcconfig')
+RELEASE_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Common.release.xcconfig')
+INTERNAL_TEAM_ID = XcconfigHelper.fetch(path: ALPHA_CONFIG_FILE, key: 'DEVELOPMENT_TEAM')
+EXTERNAL_TEAM_ID = XcconfigHelper.fetch(path: RELEASE_CONFIG_FILE, key: 'DEVELOPMENT_TEAM')
 ENV['FASTLANE_WWDR_USE_HTTP1_AND_RETRIES'] = 'true'
 
 # Fastlane's `git_branch` action and its relevant helpers use environment variables to modify the output.
@@ -197,10 +200,6 @@ before_all do |lane|
     example_path = 'fastlane/env/user.env-example '
     UI.user_error! "#{ENV_FILE_NAME} not found: Please copy #{example_path} to #{USER_ENV_FILE_PATH} and fill in the values."
   end
-
-  unless File.file?(PROJECT_ENV_FILE_PATH)
-    UI.user_error!("project.env not found at #{PROJECT_ENV_FILE_PATH}: Make sure your configuration is up to date with `rake dependencies`")
-  end
 end
 
 def compute_release_branch_name(options:, version: release_version_current)
diff --git a/fastlane/env/project.env-example b/fastlane/env/project.env-example
diff --git a/fastlane/lanes/build.rb b/fastlane/lanes/build.rb
@@ -168,7 +168,7 @@
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_WORDPRESS,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'app-store' }
     )
 
@@ -234,7 +234,7 @@
       scheme: 'Jetpack',
       workspace: WORKSPACE_PATH,
       clean: true,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_JETPACK,
       derived_data_path: DERIVED_DATA_PATH,
@@ -283,7 +283,7 @@
       scheme: 'Reader',
       workspace: WORKSPACE_PATH,
       clean: true,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_READER,
       derived_data_path: DERIVED_DATA_PATH,
@@ -373,7 +373,7 @@
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: output_name,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       xcargs: { VERSION_LONG: build_code },
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'app-store' }
     )
@@ -486,7 +486,7 @@ def build_and_upload_prototype_build(scheme:, output_app_name:, firebase_app_con
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: output_app_name,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: ENV.fetch('INT_EXPORT_TEAM_ID', nil),
+      export_team_id: INTERNAL_TEAM_ID,
       export_method: 'enterprise',
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'enterprise' }
     )
@@ -516,7 +516,6 @@ def upload_build_to_testflight(ipa_path:, whats_new_path:, distribution_groups:,
     distribute_external = distribution_groups.empty? == false
 
     upload_to_testflight(
-      team_id: get_required_env('FASTLANE_ITC_TEAM_ID'),
       api_key: app_store_connect_api_key,
       ipa: ipa_path,
       beta_app_description: File.read(beta_app_description_path),
diff --git a/fastlane/lanes/codesign.rb b/fastlane/lanes/codesign.rb
@@ -131,7 +131,7 @@ def update_code_signing_enterprise(readonly:, app_identifiers:)
   update_code_signing(
     type: 'enterprise',
     # Enterprise builds belong to the "internal" team
-    team_id: get_required_env('INT_EXPORT_TEAM_ID'),
+    team_id: INTERNAL_TEAM_ID,
     readonly: readonly,
     app_identifiers: app_identifiers,
     api_key: nil
@@ -142,7 +142,7 @@ def update_code_signing_app_store(readonly:, app_identifiers:)
   update_code_signing(
     type: 'appstore',
     # App Store builds belong to the "external" team
-    team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+    team_id: EXTERNAL_TEAM_ID,
     readonly: readonly,
     app_identifiers: app_identifiers,
     api_key: app_store_connect_api_key
diff --git a/fastlane/lanes/promote.rb b/fastlane/lanes/promote.rb
@@ -208,7 +208,6 @@ def promote_existing_build_to_groups(app:, app_version:, build_code:, changelog:
 
   upload_to_testflight(
     api_key: app_store_connect_api_key,
-    team_id: get_required_env('FASTLANE_ITC_TEAM_ID'),
     app_identifier: app[:identifier],
     app_platform: 'ios',
     app_version: app_version,
diff --git a/fastlane/lanes/xcconfig_helper.rb b/fastlane/lanes/xcconfig_helper.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'xcodeproj'
+
+# Reads build settings out of `.xcconfig` files, so that values the Xcode project already declares don't
+# need to be duplicated in fastlane's environment.
+module XcconfigHelper
+  module_function
+
+  class Error < StandardError
+  end
+
+  # Returns the value of `key`, resolving `#include`s and raising unless it's a non-empty string.
+  #
+  # @param path [String] Path to the `.xcconfig` file to read.
+  # @param key [String] Name of the build setting, e.g. `DEVELOPMENT_TEAM`.
+  #
+  def fetch(path:, key:)
+    raise Error, "No such xcconfig file: #{path}" unless File.file?(path)
+
+    # `to_hash` resolves `#include`d files, unlike `attributes`, which only sees the ones set in `path`.
+    value = Xcodeproj::Config.new(path).to_hash[key]
+
+    raise Error, "Build setting '#{key}' not found in #{path}" if value.nil?
+    raise Error, "Build setting '#{key}' is empty in #{path}" if value.empty?
+
+    value
+  end
+end
