Use the same secrets file across WordPress, Jetpack, and Reader by mokagio · Pull Request #25803 · wordpress-mobile/WordPress-iOS

mokagio · 2026-07-18T09:54:03Z

Acts on @jkmassel note that the apps can use the same secrets from #25772 (comment)

See also https://linear.app/a8c/issue/AINFRA-2711/collapse-build-time-secrets-injected-the-wjr-apps

To do this, the PR bumps the app-specific, non-secret "secrets" to the Git-tracked code via Info.plist ingestion mechanism. It also removes a few secrets that are no longer used.

One consequence worth stating of this change is that now the Reader app will use the same OAuth details as WordPress and Jetpack, whereas previously it had its own dedicated OAuth app. I don't think this is an issue given the Reader app never when live, but it's worth keeping in mind.

Removed with WordPressAuthenticator, via f8ad8c4 - #25646

These were the OAuth callback schemes — reversed Google client IDs — for the Google sign-in flow that lived in `WordPressAuthenticator`, deleted in #25646. Nothing handles the scheme anymore. The schemes were hardcoded here rather than injected from `googleLoginSchemeId`, so removing that secret in the preceding commit left them untouched and equally dead. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com>

wpmobilebot · 2026-07-18T10:08:13Z

📲 You can test the changes from this Pull Request in WordPress by scanning the QR code below to install the corresponding build.

	App Name	WordPress
	Configuration	Release-Alpha
	Build Number	`33245`
	Version	`PR #25803`
	Bundle ID	`org.wordpress.alpha`
	Commit	`4224877`
	Installation URL	0v1b203kmkh50

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

wpmobilebot · 2026-07-18T10:08:50Z

📲 You can test the changes from this Pull Request in Jetpack by scanning the QR code below to install the corresponding build.

	App Name	Jetpack
	Configuration	Release-Alpha
	Build Number	`33245`
	Version	`PR #25803`
	Bundle ID	`com.jetpack.alpha`
	Commit	`4224877`
	Installation URL	22f47clktm2ko

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

wpmobilebot · 2026-07-18T10:11:10Z

🤖 Build Failure Analysis

This build has failures. Claude has analyzed them - check the build annotations for details.

That value does not need to be secret. See https://docs.sentry.io/concepts/key-terms/dsn-explainer/#dsn-utilization

The `/docs/` path the widget comment pointed at is stale; the page now lives under `/documentation/developer/`. The same link sits on `docsBotId` because it establishes what the value is: the widget `id` is embed code, documented for placement in a site's public HTML. That makes it a candidate to leave `BuildSecrets` the way the Sentry DSN did. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com>

The per-app branching existed because the secrets files held app-specific values. Those have since moved to each app's `Info.plist`, read via `BuildSettings`, leaving only values the three apps share. `WordPress-Secrets-Internal.swift` and `-Alpha.swift` leave the input list too: the script stopped reading them well before this change. The shebang moves to `#!/usr/bin/env bash` with a separate `set -euo pipefail`. `#!/bin/bash -euo pipefail` passed multiple parameters, which most systems do not support. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com>

The entry pointed at `ApplyConfiguration.sh`, renamed in e78ed88 and never updated here, so the self-dependency its comment describes was not wired: Xcode had no edge from the build phase to the script driving it. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com>

`INFOPLIST_PREPROCESS` is on for WordPress and Jetpack, so the plist goes through the C preprocessor, where `//` opens a comment. The `https://` in the DSN swallowed the rest of the line including `</string>`, leaving XML that `ProcessInfoPlistFile` could not parse, and every app build failed. Reader does not preprocess its plist, but the value is read through one code path, so all three stay consistent. This mirrors `WPProductBlogURL`, which is stored scheme-less for the same reason. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com>

mokagio · 2026-07-19T01:52:34Z

-${SRCROOT}/../Scripts/BuildPhases/ApplyConfiguration.sh
+${SRCROOT}/../Scripts/BuildPhases/GenerateCredentials.sh


This is a little inconsistency that had gone unnoticed so far.

mokagio · 2026-07-19T01:58:41Z

-    public struct Google: Sendable {
-        public let clientId: String
-        public let schemeId: String
-        public let serverClientId: String
-
-        public init(clientId: String, schemeId: String, serverClientId: String) {
-            self.clientId = clientId
-            self.schemeId = schemeId
-            self.serverClientId = serverClientId
-        }
-    }
-


Google login was removed recently, see #25644 and #25645. We don't need to track the credentials anymore.

mokagio · 2026-07-19T01:59:34Z

-    public let sentryDSN: String
-    public let docsBotId: String


Both Sentry's DSN and Docs Bot identifier are designed to be public. The links to the respective documentation are in the new properties definitions below.

The constraint only shows up in `BuildSettings+Live.swift`, which someone editing the plist never opens. `WPSentryNoSchemeDSN` states it where a full DSN would otherwise get pasted, and unlike an XML comment it survives Xcode's plist editor. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com>

mokagio · 2026-07-19T02:12:11Z

        mobileAnnounceAppID = bundle.infoValue(forKey: "WPMobileAnnounceAppID")
        authKeychainServiceName = bundle.infoValue(forKey: "WPAuthKeychainServiceName")
+        // The plist does not carry the URL scheme because the C preprocessor treats the `//` as a comment resulting in a truncated value.
+        sentryDSN = "https://" + bundle.infoValue(forKey: "WPSentryNoSchemeDSN")


Tracked https://linear.app/a8c/issue/AINFRA-2713 to follow up on making the "no scheme" requirement clearer in the whole plist.

Every target reads this file now, so naming it after one of them misleads. It also matches the source name in the secrets repo, `iOS/WPiOS/Secrets.swift`. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.8 <noreply@anthropic.com>

…ected-the-wjr-apps

mokagio · 2026-07-19T02:31:03Z

-    public let google: Google
    public let zendesk: Zendesk
-    public let sentryDSN: String
-    public let docsBotId: String


I assumed Docs Bot is actually in use, but haven't verified it. From the code, I can see that it's Jetpack-only and behind a feature flag.

@jkmassel @crazytonyli if the flag is off and the integration no longer needed, I can create a follow up to delete it and it's code usages from the app.

Otherwise, maybe we could refine to use a String? instead. This way, when reading from Info.plist we can treat empty string values as nil (or remove the empty string key in the first place) and keep the code clearer. But... I might be getting ahead of myself.

Copilot

Pull request overview

This PR consolidates build-time secrets handling so WordPress, Jetpack, and Reader all consume the same decrypted Secrets.swift, while moving app-specific, non-secret configuration (Sentry DSN and DocsBot ID) into per-app Info.plist keys exposed via BuildSettings.

Changes:

Collapse per-app secrets files to a single ~/.configure/wordpress-ios/secrets/Secrets.swift and simplify the Xcode build phase that generates credentials.
Move Sentry DSN and DocsBot ID out of BuildSecrets and into BuildSettings sourced from Info.plist (WPSentryNoSchemeDSN, WPDocsBotId).
Remove legacy Google login secret plumbing and URL scheme entries.

Reviewed changes

Copilot reviewed 15 out of 19 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
WordPress/Credentials/Secrets-example.swift	Removes unused Google/Sentry/DocsBot entries from the example secrets template.
WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewModel.swift	Reads `docsBotId` from `BuildSettings` instead of `BuildSecrets`.
WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewController.swift	Updates DocsBot documentation link used in comments.
WordPress/Classes/Utility/Logging/WPCrashLoggingProvider.swift	Reads Sentry DSN from `BuildSettings` instead of `BuildSecrets`.
WordPress/Classes/System/ApiCredentials+BuildSecrets.swift	Stops populating removed `BuildSecrets` fields (Google/Sentry/DocsBot).
Sources/WordPress/Info.plist	Adds `WPDocsBotId` and `WPSentryNoSchemeDSN`; removes GoogleSignIn URL scheme.
Sources/Reader/Info.plist	Adds `WPDocsBotId` and `WPSentryNoSchemeDSN`.
Sources/Jetpack/Info.plist	Adds `WPDocsBotId` and `WPSentryNoSchemeDSN`; removes GoogleSignIn URL scheme.
Scripts/BuildPhases/GenerateCredentials.xcfilelist	Updates inputs to a single shared `Secrets.swift` and tracks the new script.
Scripts/BuildPhases/GenerateCredentials.sh	Simplifies selection logic to copy a single secrets source for all apps/targets.
Modules/Sources/BuildSettingsKit/BuildSettings+Preview.swift	Extends preview settings with `sentryDSN` and `docsBotId`.
Modules/Sources/BuildSettingsKit/BuildSettings+Live.swift	Loads `sentryDSN` and `docsBotId` from `Info.plist` (with scheme workaround).
Modules/Sources/BuildSettingsKit/BuildSettings.swift	Adds new `BuildSettings` fields for Sentry DSN and DocsBot ID.
Modules/Sources/BuildSettingsKit/BuildSecrets.swift	Removes Google/Sentry/DocsBot from `BuildSecrets` API surface.
.configure	Updates decrypt/copy configuration to install only the shared `Secrets.swift`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

mokagio and others added 2 commits July 18, 2026 19:49

Remove dead Google login credentials

04991b8

Removed with WordPressAuthenticator, via f8ad8c4 - #25646

mokagio self-assigned this Jul 18, 2026

mokagio and others added 6 commits July 18, 2026 20:50

Move Sentry DSN definition from secrets to Info.plist

db82159

That value does not need to be secret. See https://docs.sentry.io/concepts/key-terms/dsn-explainer/#dsn-utilization

Move Docs Bot ID from secrets to Jetpack's Info.plist

d307d50

mokagio commented Jul 19, 2026

View reviewed changes

Comment thread Modules/Sources/BuildSettingsKit/BuildSettings+Live.swift Outdated

mokagio commented Jul 19, 2026

View reviewed changes

mokagio changed the title ~~Remove dead Google login credentials and URL schemes~~ Use the same secrets file across WordPress, Jetpack, and Reader Jul 19, 2026

mokagio commented Jul 19, 2026

View reviewed changes

mokagio and others added 2 commits July 19, 2026 11:59

Slim down AI-generated comment

75ac465

mokagio commented Jul 19, 2026

View reviewed changes

mokagio and others added 2 commits July 19, 2026 12:14

Remove now-unused app-specific secrets

734d36f

mokagio requested review from crazytonyli and jkmassel July 19, 2026 02:23

mokagio added the Tooling Build, Release, and Validation Tools label Jul 19, 2026

mokagio added this to the 27.2 milestone Jul 19, 2026

Merge branch 'trunk' into ainfra-2711-collapse-build-time-secrets-inj…

4224877

…ected-the-wjr-apps

mokagio marked this pull request as ready for review July 19, 2026 02:27

mokagio requested a review from a team as a code owner July 19, 2026 02:27

Copilot AI review requested due to automatic review settings July 19, 2026 02:27

Copilot started reviewing on behalf of mokagio July 19, 2026 02:28 View session

mokagio commented Jul 19, 2026

View reviewed changes

Copilot AI reviewed Jul 19, 2026

View reviewed changes

mokagio enabled auto-merge July 19, 2026 05:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Use the same secrets file across WordPress, Jetpack, and Reader#25803

Use the same secrets file across WordPress, Jetpack, and Reader#25803
mokagio wants to merge 13 commits into
trunkfrom
ainfra-2711-collapse-build-time-secrets-injected-the-wjr-apps

mokagio commented Jul 18, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Jul 18, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Jul 18, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Jul 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

mokagio Jul 19, 2026

Uh oh!

mokagio Jul 19, 2026

Uh oh!

mokagio Jul 19, 2026

Uh oh!

mokagio Jul 19, 2026

Uh oh!

mokagio Jul 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		${SRCROOT}/../Scripts/BuildPhases/ApplyConfiguration.sh
		${SRCROOT}/../Scripts/BuildPhases/GenerateCredentials.sh

Uh oh!

Conversation

mokagio commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Build Failure Analysis

Uh oh!

Uh oh!

mokagio Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mokagio commented Jul 18, 2026 •

edited

Loading

wpmobilebot commented Jul 18, 2026 •

edited

Loading

wpmobilebot commented Jul 18, 2026 •

edited

Loading

wpmobilebot commented Jul 18, 2026 •

edited

Loading