From 1159d12d489ef39c6056bea19835cb3a97c43855 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Fri, 10 Jul 2026 14:30:05 +1000
Subject: [PATCH 01/15] Add helper to read build settings from xcconfig

Wraps `Xcodeproj::Config` with the error handling its raw API lacks: a
missing file, a missing key, and a key set to an empty value all raise
rather than silently yielding `nil`.

Uses `to_hash` rather than `attributes`, since the latter only sees the
settings assigned in the file itself, not those it pulls in via
`#include`.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fastlane/lanes/xcconfig_helper.rb | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 fastlane/lanes/xcconfig_helper.rb

diff --git a/fastlane/lanes/xcconfig_helper.rb b/fastlane/lanes/xcconfig_helper.rb
new file mode 100644
index 000000000000..93e849ecec6e
--- /dev/null
+++ b/fastlane/lanes/xcconfig_helper.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'xcodeproj'
+
+# Reads build settings out of `.xcconfig` files, so that values the Xcode project already declares don't
+# need to be duplicated in fastlane's environment.
+module XcconfigHelper
+  module_function
+
+  class Error < StandardError
+  end
+
+  # Returns the value of `key`, resolving `#include`s and raising unless it's a non-empty string.
+  #
+  # @param path [String] Path to the `.xcconfig` file to read.
+  # @param key [String] Name of the build setting, e.g. `DEVELOPMENT_TEAM`.
+  #
+  def fetch(path:, key:)
+    raise Error, "No such xcconfig file: #{path}" unless File.file?(path)
+
+    # `to_hash` resolves `#include`d files, unlike `attributes`, which only sees the ones set in `path`.
+    value = Xcodeproj::Config.new(path).to_hash[key]
+
+    raise Error, "Build setting '#{key}' not found in #{path}" if value.nil?
+    raise Error, "Build setting '#{key}' is empty in #{path}" if value.empty?
+
+    value
+  end
+end

From 79f9bf39fe5566a02d5ffc8243f8b15112699ca3 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Fri, 10 Jul 2026 14:30:15 +1000
Subject: [PATCH 02/15] Read the internal team ID from xcconfig

`INT_EXPORT_TEAM_ID` duplicated a value the project already declares:
enterprise and prototype builds use the `Release-Alpha` configuration,
whose `DEVELOPMENT_TEAM` is set in `config/Common.alpha.xcconfig`.
Reading it from there removes one secret from the environment the
tooling needs to be handed.

Note the value also lives in `project.env` in the `mobile-secrets`
repository, where it now has no consumer.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fastlane/Fastfile                | 4 ++++
 fastlane/env/project.env-example | 1 -
 fastlane/lanes/build.rb          | 2 +-
 fastlane/lanes/codesign.rb       | 2 +-
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index fe70397c5c5d..475424dab526 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -5,6 +5,8 @@ fastlane_require 'dotenv'
 fastlane_require 'open-uri'
 fastlane_require 'git'
 
+require_relative 'lanes/xcconfig_helper'
+
 UI.user_error!('Please run fastlane via `bundle exec`') unless FastlaneCore::Helper.bundler?
 
 ########################################################################
@@ -58,6 +60,8 @@ Dotenv.load(PROJECT_ENV_FILE_PATH)
 GITHUB_REPO = 'wordpress-mobile/wordpress-iOS'
 DEFAULT_BRANCH = 'trunk'
 PUBLIC_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Version.public.xcconfig')
+ALPHA_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Common.alpha.xcconfig')
+INTERNAL_TEAM_ID = XcconfigHelper.fetch(path: ALPHA_CONFIG_FILE, key: 'DEVELOPMENT_TEAM')
 ENV['FASTLANE_WWDR_USE_HTTP1_AND_RETRIES'] = 'true'
 
 # Fastlane's `git_branch` action and its relevant helpers use environment variables to modify the output.
diff --git a/fastlane/env/project.env-example b/fastlane/env/project.env-example
index 371b75b57b51..845baa77e2e6 100644
--- a/fastlane/env/project.env-example
+++ b/fastlane/env/project.env-example
@@ -1,4 +1,3 @@
-INT_EXPORT_TEAM_ID=<Team id for internal distribution>
 EXT_EXPORT_TEAM_ID=<Team id for public distribution>
 
 FASTLANE_ITC_TEAM_ID=<Team ID for AppStore Connect>
diff --git a/fastlane/lanes/build.rb b/fastlane/lanes/build.rb
index 40b8ff09e0dc..3c83e3507293 100644
--- a/fastlane/lanes/build.rb
+++ b/fastlane/lanes/build.rb
@@ -486,7 +486,7 @@ def build_and_upload_prototype_build(scheme:, output_app_name:, firebase_app_con
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: output_app_name,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: ENV.fetch('INT_EXPORT_TEAM_ID', nil),
+      export_team_id: INTERNAL_TEAM_ID,
       export_method: 'enterprise',
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'enterprise' }
     )
diff --git a/fastlane/lanes/codesign.rb b/fastlane/lanes/codesign.rb
index 7133cdce61f1..b4564f63c29b 100644
--- a/fastlane/lanes/codesign.rb
+++ b/fastlane/lanes/codesign.rb
@@ -131,7 +131,7 @@ def update_code_signing_enterprise(readonly:, app_identifiers:)
   update_code_signing(
     type: 'enterprise',
     # Enterprise builds belong to the "internal" team
-    team_id: get_required_env('INT_EXPORT_TEAM_ID'),
+    team_id: INTERNAL_TEAM_ID,
     readonly: readonly,
     app_identifiers: app_identifiers,
     api_key: nil

From f9d0081af465a039f2d83c9b5b905b1e467a0a92 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Fri, 10 Jul 2026 14:31:46 +1000
Subject: [PATCH 03/15] Read the external team ID from xcconfig

Same reasoning as the internal team ID in the previous commit:
`EXT_EXPORT_TEAM_ID` duplicated the `DEVELOPMENT_TEAM` that
`config/Common.release.xcconfig` already declares for the App Store
builds, which use the `Release` configuration.

With both gone, `project.env` no longer has to carry either team ID.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fastlane/Fastfile                | 2 ++
 fastlane/env/project.env-example | 1 -
 fastlane/lanes/build.rb          | 8 ++++----
 fastlane/lanes/codesign.rb       | 2 +-
 4 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 475424dab526..41896f349c56 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -61,7 +61,9 @@ GITHUB_REPO = 'wordpress-mobile/wordpress-iOS'
 DEFAULT_BRANCH = 'trunk'
 PUBLIC_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Version.public.xcconfig')
 ALPHA_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Common.alpha.xcconfig')
+RELEASE_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Common.release.xcconfig')
 INTERNAL_TEAM_ID = XcconfigHelper.fetch(path: ALPHA_CONFIG_FILE, key: 'DEVELOPMENT_TEAM')
+EXTERNAL_TEAM_ID = XcconfigHelper.fetch(path: RELEASE_CONFIG_FILE, key: 'DEVELOPMENT_TEAM')
 ENV['FASTLANE_WWDR_USE_HTTP1_AND_RETRIES'] = 'true'
 
 # Fastlane's `git_branch` action and its relevant helpers use environment variables to modify the output.
diff --git a/fastlane/env/project.env-example b/fastlane/env/project.env-example
index 845baa77e2e6..c3455486cc8f 100644
--- a/fastlane/env/project.env-example
+++ b/fastlane/env/project.env-example
@@ -1,4 +1,3 @@
-EXT_EXPORT_TEAM_ID=<Team id for public distribution>
 
 FASTLANE_ITC_TEAM_ID=<Team ID for AppStore Connect>
 
diff --git a/fastlane/lanes/build.rb b/fastlane/lanes/build.rb
index 3c83e3507293..7400821c43bd 100644
--- a/fastlane/lanes/build.rb
+++ b/fastlane/lanes/build.rb
@@ -168,7 +168,7 @@
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_WORDPRESS,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'app-store' }
     )
 
@@ -234,7 +234,7 @@
       scheme: 'Jetpack',
       workspace: WORKSPACE_PATH,
       clean: true,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_JETPACK,
       derived_data_path: DERIVED_DATA_PATH,
@@ -283,7 +283,7 @@
       scheme: 'Reader',
       workspace: WORKSPACE_PATH,
       clean: true,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_READER,
       derived_data_path: DERIVED_DATA_PATH,
@@ -373,7 +373,7 @@
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: output_name,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       xcargs: { VERSION_LONG: build_code },
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'app-store' }
     )
diff --git a/fastlane/lanes/codesign.rb b/fastlane/lanes/codesign.rb
index b4564f63c29b..1ee464a8d5ef 100644
--- a/fastlane/lanes/codesign.rb
+++ b/fastlane/lanes/codesign.rb
@@ -142,7 +142,7 @@ def update_code_signing_app_store(readonly:, app_identifiers:)
   update_code_signing(
     type: 'appstore',
     # App Store builds belong to the "external" team
-    team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+    team_id: EXTERNAL_TEAM_ID,
     readonly: readonly,
     app_identifiers: app_identifiers,
     api_key: app_store_connect_api_key

From 897638f346727798d74db79baa5759a350ff3767 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Fri, 10 Jul 2026 15:48:23 +1000
Subject: [PATCH 04/15] Stop passing team_id to upload_to_testflight
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both call sites authenticate with `api_key`, and pilot only ever reads
`team_id` on the username/password Spaceship path — see
`pilot/lib/pilot/manager.rb:36`, the sole reader of `config[:team_id]` in
the whole of `pilot/lib`, which sits in the `else` branch that an API
token skips.

An App Store Connect API key is issued by a single team, so there is no
team left to disambiguate. `woocommerce-ios` has shipped its TestFlight
uploads without the parameter for this reason.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fastlane/lanes/build.rb   | 1 -
 fastlane/lanes/promote.rb | 1 -
 2 files changed, 2 deletions(-)

diff --git a/fastlane/lanes/build.rb b/fastlane/lanes/build.rb
index 7400821c43bd..1c46008e6097 100644
--- a/fastlane/lanes/build.rb
+++ b/fastlane/lanes/build.rb
@@ -516,7 +516,6 @@ def upload_build_to_testflight(ipa_path:, whats_new_path:, distribution_groups:,
     distribute_external = distribution_groups.empty? == false
 
     upload_to_testflight(
-      team_id: get_required_env('FASTLANE_ITC_TEAM_ID'),
       api_key: app_store_connect_api_key,
       ipa: ipa_path,
       beta_app_description: File.read(beta_app_description_path),
diff --git a/fastlane/lanes/promote.rb b/fastlane/lanes/promote.rb
index 045c61899907..599efb0faa42 100644
--- a/fastlane/lanes/promote.rb
+++ b/fastlane/lanes/promote.rb
@@ -208,7 +208,6 @@ def promote_existing_build_to_groups(app:, app_version:, build_code:, changelog:
 
   upload_to_testflight(
     api_key: app_store_connect_api_key,
-    team_id: get_required_env('FASTLANE_ITC_TEAM_ID'),
     app_identifier: app[:identifier],
     app_platform: 'ios',
     app_version: app_version,

From 3f93d5c7f4ca403aebc9b2209563a99634f753f4 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Fri, 10 Jul 2026 15:48:35 +1000
Subject: [PATCH 05/15] Stop provisioning project.env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every key it carried is now unused: the two export team IDs come from
`xcconfig`, `FASTLANE_ITC_TEAM_ID` was inert alongside an `api_key`, the
Sentry slugs are hardcoded constants in `build.rb`, and the two HockeyApp
IDs outlived the service.

With nothing reading the file, the `before_all` guard demanding it had no
purpose either — which is what the three CI scripts were copying the
example file to satisfy. `configure_apply` creates its destination
directory itself, so nothing else needed that block.

The file still exists in `mobile-secrets`, where it can now be deleted.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .buildkite/commands/build-for-testing.sh             | 4 ----
 .buildkite/commands/lint-localized-strings-format.sh | 4 ----
 .buildkite/commands/verify-strings-catalog.sh        | 4 ----
 .configure                                           | 5 -----
 fastlane/Fastfile                                    | 7 -------
 fastlane/env/project.env-example                     | 5 -----
 6 files changed, 29 deletions(-)
 delete mode 100644 fastlane/env/project.env-example

diff --git a/.buildkite/commands/build-for-testing.sh b/.buildkite/commands/build-for-testing.sh
index 2fda0beeb241..80fd7fae1e68 100755
--- a/.buildkite/commands/build-for-testing.sh
+++ b/.buildkite/commands/build-for-testing.sh
@@ -16,10 +16,6 @@ fi
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 echo "--- :closed_lock_with_key: Installing Secrets"
 bundle exec fastlane run configure_apply
 
diff --git a/.buildkite/commands/lint-localized-strings-format.sh b/.buildkite/commands/lint-localized-strings-format.sh
index 90a18c347d63..6780e2247dad 100644
--- a/.buildkite/commands/lint-localized-strings-format.sh
+++ b/.buildkite/commands/lint-localized-strings-format.sh
@@ -4,8 +4,4 @@ if "$(dirname "${BASH_SOURCE[0]}")/should-skip-job.sh" --job-type localization;
   exit 0
 fi
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 lint_localized_strings_format
diff --git a/.buildkite/commands/verify-strings-catalog.sh b/.buildkite/commands/verify-strings-catalog.sh
index 574c1717fb68..c8d543059846 100644
--- a/.buildkite/commands/verify-strings-catalog.sh
+++ b/.buildkite/commands/verify-strings-catalog.sh
@@ -11,10 +11,6 @@ fi
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 echo "--- :package: Generate Localizable.xcstrings from source"
 bundle exec fastlane ios generate_strings_catalog
 
diff --git a/.configure b/.configure
index 7ed53ff28161..4da74081ca7c 100644
--- a/.configure
+++ b/.configure
@@ -3,11 +3,6 @@
   "branch": "trunk",
   "pinned_hash": "6baf4e086398ddf8141d7132e557703a715fafd2",
   "files_to_copy": [
-    {
-      "file": "iOS/WPiOS/project.env",
-      "destination": "~/.configure/wordpress-ios/secrets/project.env",
-      "encrypt": true
-    },
     {
       "file": "iOS/WPiOS/Secrets.swift",
       "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 41896f349c56..823955b10a10 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -29,8 +29,6 @@ BETA_APP_DESCRIPTION_PATH_READER = File.join(PROJECT_ROOT_FOLDER, 'fastlane', 'r
 # Env file paths to load
 ENV_FILE_NAME = '.wpios-env.default'
 USER_ENV_FILE_PATH = File.join(Dir.home, ENV_FILE_NAME)
-SECRETS_DIR = File.join(Dir.home, '.configure', 'wordpress-ios', 'secrets')
-PROJECT_ENV_FILE_PATH = File.join(SECRETS_DIR, 'project.env')
 
 WORDPRESS_BUNDLE_IDENTIFIER = 'org.wordpress'
 WORDPRESS_EXTENSIONS_BUNDLE_IDENTIFIERS = %w[
@@ -56,7 +54,6 @@ ALL_READER_BUNDLE_IDENTIFIERS = [READER_BUNDLE_IDENTIFIER].freeze
 
 # Environment Variables — used by lanes but also potentially actions
 Dotenv.load(USER_ENV_FILE_PATH)
-Dotenv.load(PROJECT_ENV_FILE_PATH)
 GITHUB_REPO = 'wordpress-mobile/wordpress-iOS'
 DEFAULT_BRANCH = 'trunk'
 PUBLIC_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Version.public.xcconfig')
@@ -203,10 +200,6 @@ before_all do |lane|
     example_path = 'fastlane/env/user.env-example '
     UI.user_error! "#{ENV_FILE_NAME} not found: Please copy #{example_path} to #{USER_ENV_FILE_PATH} and fill in the values."
   end
-
-  unless File.file?(PROJECT_ENV_FILE_PATH)
-    UI.user_error!("project.env not found at #{PROJECT_ENV_FILE_PATH}: Make sure your configuration is up to date with `rake dependencies`")
-  end
 end
 
 def compute_release_branch_name(options:, version: release_version_current)
diff --git a/fastlane/env/project.env-example b/fastlane/env/project.env-example
deleted file mode 100644
index c3455486cc8f..000000000000
--- a/fastlane/env/project.env-example
+++ /dev/null
@@ -1,5 +0,0 @@
-
-FASTLANE_ITC_TEAM_ID=<Team ID for AppStore Connect>
-
-SENTRY_ORG_SLUG=<Org Slug for Sentry>
-SENTRY_PROJECT_SLUG=<Project Slug for Sentry>

From c84f12dffee54dfb1aa4ff3c82d78556bbf1932b Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 15:40:43 +1000
Subject: [PATCH 06/15] Remove now unused `project.env.enc`

---
 .configure-files/project.env.enc | 2 --
 1 file changed, 2 deletions(-)
 delete mode 100644 .configure-files/project.env.enc

diff --git a/.configure-files/project.env.enc b/.configure-files/project.env.enc
deleted file mode 100644
index c40dc4e59287..000000000000
--- a/.configure-files/project.env.enc
+++ /dev/null
@@ -1,2 +0,0 @@
-�o����_�+�1�R�����i�0���3e�3�*��/Ukp�nQ�i��]b¢�v�喭9Տ���h�ԩtK�:�lxMـE�
-!m�+�O�r�<0s����o��O���\|[�JPq,�*�h	2��խ�����[�=4��I'y����>v�1l2���TH����=a��[��F�P�$��T�ۀ��}no�������t~���.��gw�g��g3��7��O�]�D�H78�ұ�驊/BB]���k�!�d�	(���V
\ No newline at end of file

From fd02fe88ade6f0274f6c47082d47dd6937b02dbf Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 15:47:40 +1000
Subject: [PATCH 07/15] Extract secret install into shared script

Centralize the `configure_apply` invocation, duplicated across 12 command
scripts and 5 release pipelines, into `install-secrets.sh`.
The upcoming move to a8c-secrets then swaps a single call site instead of
seventeen.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .buildkite/commands/build-and-upload-testflight.sh        | 3 +--
 .buildkite/commands/build-for-testing.sh                  | 3 +--
 .buildkite/commands/complete-code-freeze.sh               | 3 +--
 .buildkite/commands/finalize-hotfix.sh                    | 3 +--
 .buildkite/commands/finalize-release.sh                   | 3 +--
 .buildkite/commands/gather-testflight-candidates.sh       | 3 +--
 .buildkite/commands/install-secrets.sh                    | 6 ++++++
 .buildkite/commands/promote-build-to-public.sh            | 3 +--
 .buildkite/commands/promote-nightly.sh                    | 3 +--
 .buildkite/commands/prototype-build-jetpack.sh            | 3 +--
 .buildkite/commands/prototype-build-wordpress.sh          | 3 +--
 .buildkite/commands/release-build-jetpack.sh              | 3 +--
 .buildkite/commands/release-build-wordpress.sh            | 3 +--
 .buildkite/release-pipelines/code-freeze.yml              | 3 +--
 .buildkite/release-pipelines/new-beta-release.yml         | 3 +--
 .buildkite/release-pipelines/new-hotfix.yml               | 3 +--
 .buildkite/release-pipelines/publish-release.yml          | 3 +--
 .buildkite/release-pipelines/update-app-store-strings.yml | 3 +--
 18 files changed, 23 insertions(+), 34 deletions(-)
 create mode 100755 .buildkite/commands/install-secrets.sh

diff --git a/.buildkite/commands/build-and-upload-testflight.sh b/.buildkite/commands/build-and-upload-testflight.sh
index d8d6ee04a81b..7a65810c4917 100755
--- a/.buildkite/commands/build-and-upload-testflight.sh
+++ b/.buildkite/commands/build-and-upload-testflight.sh
@@ -7,8 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh <wordpress|jetpack|reader>}"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :testflight: Building and uploading ${APP} to TestFlight"
 bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}"
diff --git a/.buildkite/commands/build-for-testing.sh b/.buildkite/commands/build-for-testing.sh
index 80fd7fae1e68..4350e855fed2 100755
--- a/.buildkite/commands/build-for-testing.sh
+++ b/.buildkite/commands/build-for-testing.sh
@@ -16,8 +16,7 @@ fi
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane "build_${APP}_for_testing"
diff --git a/.buildkite/commands/complete-code-freeze.sh b/.buildkite/commands/complete-code-freeze.sh
index 9297d9e4d298..bde99028ed0c 100755
--- a/.buildkite/commands/complete-code-freeze.sh
+++ b/.buildkite/commands/complete-code-freeze.sh
@@ -14,8 +14,7 @@ source use-bot-for-git
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Complete code freeze'
 bundle exec fastlane complete_code_freeze skip_confirm:true
diff --git a/.buildkite/commands/finalize-hotfix.sh b/.buildkite/commands/finalize-hotfix.sh
index cb3be53d1d66..d42699302d2d 100755
--- a/.buildkite/commands/finalize-hotfix.sh
+++ b/.buildkite/commands/finalize-hotfix.sh
@@ -15,8 +15,7 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Finalize hotfix'
 bundle exec fastlane finalize_hotfix_release skip_confirm:true
diff --git a/.buildkite/commands/finalize-release.sh b/.buildkite/commands/finalize-release.sh
index bbba37e01b8d..e553e49b3e53 100755
--- a/.buildkite/commands/finalize-release.sh
+++ b/.buildkite/commands/finalize-release.sh
@@ -15,8 +15,7 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Finalize release'
 bundle exec fastlane finalize_release skip_confirm:true
diff --git a/.buildkite/commands/gather-testflight-candidates.sh b/.buildkite/commands/gather-testflight-candidates.sh
index c7c2052b62c6..9100c091e958 100755
--- a/.buildkite/commands/gather-testflight-candidates.sh
+++ b/.buildkite/commands/gather-testflight-candidates.sh
@@ -6,8 +6,7 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :testflight: Gathering candidates and opening the block step"
 bundle exec fastlane gather_testflight_candidates
diff --git a/.buildkite/commands/install-secrets.sh b/.buildkite/commands/install-secrets.sh
new file mode 100755
index 000000000000..181f3e3267da
--- /dev/null
+++ b/.buildkite/commands/install-secrets.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "--- :closed_lock_with_key: Installing Secrets"
+bundle exec fastlane run configure_apply
diff --git a/.buildkite/commands/promote-build-to-public.sh b/.buildkite/commands/promote-build-to-public.sh
index d7d510d10196..935e316a2df8 100755
--- a/.buildkite/commands/promote-build-to-public.sh
+++ b/.buildkite/commands/promote-build-to-public.sh
@@ -14,8 +14,7 @@ fi
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :rocket: Promoting ${BUILD_CODE} to public beta"
 bundle exec fastlane promote_build build_code:"${BUILD_CODE}"
diff --git a/.buildkite/commands/promote-nightly.sh b/.buildkite/commands/promote-nightly.sh
index 76e15e7aa168..e313e561f2e1 100755
--- a/.buildkite/commands/promote-nightly.sh
+++ b/.buildkite/commands/promote-nightly.sh
@@ -5,8 +5,7 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :new_moon: Promoting last build of the day to nightly beta"
 # The lane refuses to run anywhere but trunk.
diff --git a/.buildkite/commands/prototype-build-jetpack.sh b/.buildkite/commands/prototype-build-jetpack.sh
index 8e91a0bdbfe8..621edef8bd75 100644
--- a/.buildkite/commands/prototype-build-jetpack.sh
+++ b/.buildkite/commands/prototype-build-jetpack.sh
@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_prototype_build
diff --git a/.buildkite/commands/prototype-build-wordpress.sh b/.buildkite/commands/prototype-build-wordpress.sh
index 1798ddb780b8..9b649f5b636a 100644
--- a/.buildkite/commands/prototype-build-wordpress.sh
+++ b/.buildkite/commands/prototype-build-wordpress.sh
@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_wordpress_prototype_build
diff --git a/.buildkite/commands/release-build-jetpack.sh b/.buildkite/commands/release-build-jetpack.sh
index 0c8b3ad9f3e0..7de02454d910 100755
--- a/.buildkite/commands/release-build-jetpack.sh
+++ b/.buildkite/commands/release-build-jetpack.sh
@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_for_app_store
diff --git a/.buildkite/commands/release-build-wordpress.sh b/.buildkite/commands/release-build-wordpress.sh
index 86326de30ba7..d8e92522c4d9 100755
--- a/.buildkite/commands/release-build-wordpress.sh
+++ b/.buildkite/commands/release-build-wordpress.sh
@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_app_store_connect \
diff --git a/.buildkite/release-pipelines/code-freeze.yml b/.buildkite/release-pipelines/code-freeze.yml
index e03a83cfbe41..aebbd91bf1f5 100644
--- a/.buildkite/release-pipelines/code-freeze.yml
+++ b/.buildkite/release-pipelines/code-freeze.yml
@@ -18,8 +18,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Run code freeze'
       bundle exec fastlane code_freeze version:"${RELEASE_VERSION}" skip_confirm:true
diff --git a/.buildkite/release-pipelines/new-beta-release.yml b/.buildkite/release-pipelines/new-beta-release.yml
index 4835caaf293e..e0040a418816 100644
--- a/.buildkite/release-pipelines/new-beta-release.yml
+++ b/.buildkite/release-pipelines/new-beta-release.yml
@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Deploy new beta'
       bundle exec fastlane new_beta_release skip_confirm:true
diff --git a/.buildkite/release-pipelines/new-hotfix.yml b/.buildkite/release-pipelines/new-hotfix.yml
index ec8deef72852..b9b499a5fed0 100644
--- a/.buildkite/release-pipelines/new-hotfix.yml
+++ b/.buildkite/release-pipelines/new-hotfix.yml
@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Start new hotfix'
       bundle exec fastlane new_hotfix_release skip_confirm:true version:"$VERSION"
diff --git a/.buildkite/release-pipelines/publish-release.yml b/.buildkite/release-pipelines/publish-release.yml
index 024c3f616f90..abb9518ce335 100644
--- a/.buildkite/release-pipelines/publish-release.yml
+++ b/.buildkite/release-pipelines/publish-release.yml
@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :package: Publish Release'
       bundle exec fastlane publish_release skip_confirm:true
diff --git a/.buildkite/release-pipelines/update-app-store-strings.yml b/.buildkite/release-pipelines/update-app-store-strings.yml
index 83dc1a1bd6b5..7fc327ed43ba 100644
--- a/.buildkite/release-pipelines/update-app-store-strings.yml
+++ b/.buildkite/release-pipelines/update-app-store-strings.yml
@@ -18,8 +18,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Update relaese notes and other App Store metadata'
       bundle exec fastlane update_appstore_strings skip_confirm:true

From 0dde17ef8900d97c0e6a108a1d2a983fe03d437a Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 15:51:12 +1000
Subject: [PATCH 08/15] Set up `a8c-secrets`

---
 .a8c-secrets/keys.pub | 4 ++++
 .a8c-secrets/repo-id  | 1 +
 2 files changed, 5 insertions(+)
 create mode 100644 .a8c-secrets/keys.pub
 create mode 100644 .a8c-secrets/repo-id

diff --git a/.a8c-secrets/keys.pub b/.a8c-secrets/keys.pub
new file mode 100644
index 000000000000..af1dfa3e9cfc
--- /dev/null
+++ b/.a8c-secrets/keys.pub
@@ -0,0 +1,4 @@
+# dev
+age1srcq3hl92ym9jk3ezj5prwhche3w8szc0cssy8t7afrkjmtkxu2qkjsdfn
+# ci
+age1a7xcr6qzwnzgcxq95sq33p58xdzsmful8w7mp2zktvuy5434yuss9rmv8f
diff --git a/.a8c-secrets/repo-id b/.a8c-secrets/repo-id
new file mode 100644
index 000000000000..b60ad318d574
--- /dev/null
+++ b/.a8c-secrets/repo-id
@@ -0,0 +1 @@
+wordpress-ios@github.com@wordpress-mobile

From 9e5343b58c43a930fb558d7ed13cedae2c8212e6 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 16:03:10 +1000
Subject: [PATCH 09/15] Remove dead-weight secret file for internal
 configuration

Unused since c86dd3e66e
---
 .configure                                       |   5 -----
 .configure-files/Secrets-Internal.swift.enc      | Bin 1152 -> 0 bytes
 .../BuildPhases/GenerateCredentials.xcfilelist   |   1 -
 3 files changed, 6 deletions(-)
 delete mode 100644 .configure-files/Secrets-Internal.swift.enc

diff --git a/.configure b/.configure
index 4da74081ca7c..37a9507bd534 100644
--- a/.configure
+++ b/.configure
@@ -8,11 +8,6 @@
       "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
       "encrypt": true
     },
-    {
-      "file": "iOS/WPiOS/Secrets-Internal.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift",
-      "encrypt": true
-    },
     {
       "file": "iOS/WPiOS/Secrets-Alpha.swift",
       "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift",
diff --git a/.configure-files/Secrets-Internal.swift.enc b/.configure-files/Secrets-Internal.swift.enc
deleted file mode 100644
index 034b369c157ce05e7f1ed63d7918b677d6d4a80f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1152
zcmV-`1b_SQ#81BYE8wZir~1r;eZ9xI!DK;Y=}%{P&2fa|1j~$?<89t;V~^{tm=Byy
zU)jvpe3*JI(*uZlh!$=|@Suhs@LH^zBq*&U21muS6EW|=P@c9j;g-YPr_3bjSpEvo
ziz=W}u65u?k~go*-Z-Bk^qyIxl7}q>XjNdS1T;GMLEgioNS;P*8?t+@62a>b3vRlS
zps+2@Jnpi}fyO&Y_Ks(9v-c_GAVlk`>8AB+CK>hj!rMXb(H#1HFNAx<4uz1Aw9NpQ
z+u5<8PVk#7<zj@4>d_rcQM|*{6d2m1+Vm;W%GV<;nlThV1q68r$M_`a<>@Ja^bEv7
zFQu2kA4tV63inv`qOI;^iU#!b-=2n{v&ex^#;g9q@YBgXa1S6rA>TN}^t~+=A+$zZ
zr;K;HMRf}0048k%v$Ce}081nSUkN-wq5L*I5A<BtEFZiR`&qQ@kIL8l@CUHTOu%~?
zPPMRtJ|DU`fhvUo2}JIJ*(Q;mmb9JKbX1;11a_bA!|PP@AFo(1-`^tv$_1O%<E)c}
zS)~Zh&@8ID9%Mq~KXGem$zuOCMBYa2z=Ubw+793K&u2Uvr~TUWAzJK)s58J00y|db
z+#b4%%X%bvuAm3cFj{a{Pb|f9)iR9>W>4x7!ZPIFrFkBZ5|F&8uDjLr$i%Ew(6{od
ziLnF2`(2??!wTIVAh9$mPn3wV4Bt9_$pa!73az8rX76RoLZ?AybXx;8%W?JI7V~=q
z$1o|5_P?ax$Ye59d^IZ0u)EH$_Q*Hs`%TBO)2}9hH4r)-q3iY*8@~fb_070<JN+en
zHsqLXQ)UrX9XOZg|3~tpw4Bc|Jc*l>Ai(h-L0-HkwP+f?I1St3r;&@89n!t>9GTL$
zzdQxl4@K5sZx$5)TB2bnP{{uD)Tx9@i<25UNFD+uN#Txmz5_>!pKSyV#%C2nQnGsN
z8L~;u5{IL9%L84pL21odYi;4xm;Q;y-?L%On3j%NDXgF6%<3PmX&q&rDh(|bN_@_I
z{}Fh8IpsTo&=nq6W^9LIFFP}OYQcz1PplQ|clF6Hr4rk6d6#1m=$KxNgM}KCrda$m
z3EZ?%S$n2VuqRDxofUDMa}6oh-IFd-E<Tt3#6rqSW#gO%7YW2YXre_3cH)EtT~$X#
zn<F*vH;EO0goQ<G0d$a!PD*O=1WvzOD+!aT5<X{c?X<T%9M2jsB-x5dR`W!|w5HYH
zgs>jqv2=dg@K(%h&{K^Rs=%|XX#E8n5RgRU0I}gonc+eX4ta-w)r{q48)_&6q^!>g
zgtiNzwQY^?^09+BAm=pW1231tIFnl-x!`ieX{YQG2F;9_B{Vym{0>NFK=n|BoJrpX
zNO=C3<@>pmo8Oz{&%m^kmpf<SGe6|e3F<5ik=2tF_5*|d{<MQ5K9K9VEuZ<(m6k<7
z>s<=nRcKZ8HJCEis{KP+eb;x&Ci7fFDf3EzYxX-ll!WH?7ulr_{va`4njwn9>;kz&
SX+`H?+k<@GA4;ErNN^_y@ka;%

diff --git a/Scripts/BuildPhases/GenerateCredentials.xcfilelist b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
index c52def6be2d1..df89cbe1afb3 100644
--- a/Scripts/BuildPhases/GenerateCredentials.xcfilelist
+++ b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
@@ -1,7 +1,6 @@
 # Lists of input files for the script that populates the app's secrets with the
 # correct values for the current scheme and build configuration.
 ${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift
 ${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift
 ${HOME}/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift
 ${HOME}/.configure/wordpress-ios/secrets/Reader-Secrets.swift

From b27a9096625f65a6a38a12eda703615a89ff1d74 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 16:30:29 +1000
Subject: [PATCH 10/15] Remove dead-weight secret file for alpha configuration

---
 .configure                                       |   5 -----
 .configure-files/Secrets-Alpha.swift.enc         | Bin 1152 -> 0 bytes
 .../BuildPhases/GenerateCredentials.xcfilelist   |   1 -
 3 files changed, 6 deletions(-)
 delete mode 100644 .configure-files/Secrets-Alpha.swift.enc

diff --git a/.configure b/.configure
index 37a9507bd534..b17061cf7a7a 100644
--- a/.configure
+++ b/.configure
@@ -8,11 +8,6 @@
       "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
       "encrypt": true
     },
-    {
-      "file": "iOS/WPiOS/Secrets-Alpha.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift",
-      "encrypt": true
-    },
     {
       "file": "iOS/JPiOS/Jetpack-Secrets.swift",
       "destination": "~/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift",
diff --git a/.configure-files/Secrets-Alpha.swift.enc b/.configure-files/Secrets-Alpha.swift.enc
deleted file mode 100644
index 6d064130c09954e605590ec6a005fb097b909275..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1152
zcmV-`1b_SQ#81BYE8wZir~1r;eZ9xI!DK;Y=}%{P&2fa|1j~$?<89t;V~^{tm=Byy
zU)jvpe3*JI(*uZlh!$=|@Suhs@LH^zBq*&U21muS6EW|=P@c9j;g-YPr_3bjSpEvo
ziz=W}u65u?k~go*-Z-Bk^qyIxl7}q>XjNdS1T;Ey?Fv{}*@;-#i0qMzy{HF*VlFB}
zmdutX^#Qv#AJV}=LV@8teJkcSu&zMqtn6zN>nJCT+0|bko(Vn05>Sk|C%;mydBa?l
zF`Tvm*lF?WmJ90pnN=PqP3}CsJR_h6-nlL36M(dHLo5bKaQ}w;gBJb5h_s!j!8bQ4
ziD<R|VeO3jg1sb$aM!;<RfXES=p#hAd0Xvwbix)T8}2RzM!|P6O~sicxA)ILe@pm;
z5PEO2wN6OvrUTKw_3r9WR{N`{V>1PDy-W<7w>S;adY+vujhGX)`nmiVE-P5<vIuP_
zf2ng5(A`@0qPUnNJ<ZF4MtdAxA^Mo^n4%4K99r2x(lGtH`Z|U%8t1IIi9oZoLvixf
zzS1AiUzDw(+k6#a%_5hG-!iTTy|a7)q~y-{Iy=1=>151>CJ+#Rzat6p%O)lgyXe4z
z7avFtOIg&{GL36D>SRP?@#H@pfB*PUCbt!7_WRe?c-dwcx@f9X+P4&<)}+(=I9PVq
z=sz3loB|o&E)7!{@%!|+?qL%;w`D&f_rbp&q*r9c5$PHh_g*Xu4@}a%D!bTo^SJ72
z4G0qlgpNDRl6WiU*%YwZTLBiy)mt<h#pXww^<Fh;OEuXCwAe&v5P5eR5dhv?&x@{D
zO#K_8B4=P?GD%y8*P)ySVE>X{5W=(DTXOvpgBa!tUp@yIw;BH$X|$EH9kE%%PrCaT
zylD(+{145%jXrw5Pe0nilodLe743)8=U8<MY~|&*c+V{asdmn(3j(P#h?7aIF!cq>
z1X-;sER?{RWuyS<XtP?`3V%aP%|2s7OPD(wY+zARIWBgwdK@|#h5Yt4OU?(K?-T{9
zq24_JBTz>|vr!iVzTtzWG^U?yARz=r3BE3$OF@eN!joy2ZuOQfoX|}MJpxInI+Co+
z3gkS*;;-x-?>mBRS5|$OsQ<m3s&{g+^23xLw+kd7B>V!KFaZ&4U$68!aXA+O{~=x<
zby*T#kN$`R_5v$-mbe+5X1qynYZRnVlKN1v@)(JZddq9eVPvXI4hN^BPxW$JRa5$>
zL)-a3pyE_Xem89i3wM$^uT}F3V7%$rD7mobL2PX-Z`KV~8*xE2>pTsVn<6$d`!L!i
z9KfN>UxFvtl9osb<P?{$n?Dz|$!~&q-?w=h`+XkB2JO@spYven%f<w?x!t$z#$)b#
zbP4e_o%yT`PY=!L)&6%oC|!6usM5Uv2<>3Vf({u@XL*^90)=4jVrCxI_=A9g<GVn3
zH<>|H4FTLt-jyC&<S+?ub|P~LMovFZtEV~zF9JbiaDTKcH9u@^gznhz$6q{)jrXeI
SD6mA+cK0-{p0P?WX_YR2RWg?V

diff --git a/Scripts/BuildPhases/GenerateCredentials.xcfilelist b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
index df89cbe1afb3..32e71d39a874 100644
--- a/Scripts/BuildPhases/GenerateCredentials.xcfilelist
+++ b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
@@ -1,7 +1,6 @@
 # Lists of input files for the script that populates the app's secrets with the
 # correct values for the current scheme and build configuration.
 ${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift
 ${HOME}/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift
 ${HOME}/.configure/wordpress-ios/secrets/Reader-Secrets.swift
 

From cd93e97bb5371f67828498ff968a7b7f971ed125 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 17:43:46 +1000
Subject: [PATCH 11/15] Replace .configure secrets store with a8c-secrets

Swap the secrets store from `.configure`/`.configure-files` to `.a8c-secrets`,
tracking the encrypted `*.age` blobs alongside the already-committed repo id
and public keys, and updating the `.gitignore` allowlist, `.gitattributes`,
and `CODEOWNERS` to match.

Part of AINFRA-1538.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .a8c-secrets/Jetpack-Secrets.swift.age     | Bin 0 -> 1544 bytes
 .a8c-secrets/Reader-Secrets.swift.age      | Bin 0 -> 1792 bytes
 .a8c-secrets/WordPress-Secrets.swift.age   | Bin 0 -> 1585 bytes
 .configure                                 |  23 ---------------------
 .configure-files/Jetpack-Secrets.swift.enc | Bin 1200 -> 0 bytes
 .configure-files/Reader-Secrets.swift.enc  | Bin 1360 -> 0 bytes
 .configure-files/Secrets.swift.enc         | Bin 1152 -> 0 bytes
 .gitattributes                             |   2 +-
 .gitignore                                 |  10 +++++----
 CODEOWNERS                                 |   2 +-
 10 files changed, 8 insertions(+), 29 deletions(-)
 create mode 100644 .a8c-secrets/Jetpack-Secrets.swift.age
 create mode 100644 .a8c-secrets/Reader-Secrets.swift.age
 create mode 100644 .a8c-secrets/WordPress-Secrets.swift.age
 delete mode 100644 .configure
 delete mode 100644 .configure-files/Jetpack-Secrets.swift.enc
 delete mode 100644 .configure-files/Reader-Secrets.swift.enc
 delete mode 100644 .configure-files/Secrets.swift.enc

diff --git a/.a8c-secrets/Jetpack-Secrets.swift.age b/.a8c-secrets/Jetpack-Secrets.swift.age
new file mode 100644
index 0000000000000000000000000000000000000000..9651032edc073faed52f48299f8a6738e54172ae
GIT binary patch
literal 1544
zcmV+j2KV`4XJsvAZewzJaCB*JZZ2<fXD@a!3N1b$STZ#=F*zV&WkG0XO+!OSQBOBm
zMl@qnYF2GFa${04YC}?XL2E);YD;Z2O-6Y_ZZHaBXnA8)Q*<_1Gek&vId*w+Y;#dV
zS5<B}Y&29xaZzn&RCX(JdPjIlL^uj9J|I{!H8n9gAbD^xb7*X1RY@>UWot=CIaWz^
zNiTFWVPs=OQbssMW?ExVH)2Y7Wms)z3QR9TH8Vy;Gcr_YbU{XED|m8kRYh+&W>iTt
zQDkZ`OifBnF=2C8ZA3O}3N1b$axG_aWnpt=3U@PjH%U=BQ#C{}Ght*^FJ?w{ZA?UG
zRxf#Ra4SqpICXJ2VRATZdO372ac_2KPYNw9Eg(ZVdRb^uLvAo?IdV8rN?0pSGDu=t
zc2Y$_D@<ruSy4E8HdaSZFjG!6ZwkiZAxxT><^*<9dwR=81tt^XE;wWZ$DLs$9&3Ju
zbU2~?eqNSyxHe9a6B)!mPzJU+2~yGZsRXKTg#U<yxB^LGSzwoL?m;<xH9DThMvsd$
zHtSpJ@K3Gj@nocY)yN;S0}{BJUtck6^<H$1K~0urXT~5s2VR|Yz_5371Veh03Z?<l
znC^jxc};XK7x>DNK8?wtq-;0Ekrb@k9EqI0N6F@}Th}`PeUVA1w!}nG3X^slHvKD}
z5(^Tp&5A;A^4bJ!{h4Qq?37a}#;x+7C*Hv=iL>`f9O*<=O_-5l6pr@*Q7z0KmSPF3
z01m=a_};;cwIgHA`6^N`dJO!4$P(A0KWTbWMSQI{oZY8qUES(15z?N9@aV>iLb`mT
zED<4i{1~IXA$uW`Ewa=j=1Qhsz5a|6u~oui)xd5`$<Sl-l4Vt9acf1U05-c~^62rf
zH+`ZcYX>A1m#~YM&hQ>^(2_!6X5|9;)!{mtkJ7zHU|zm|e1>*Gde=&r?m%aWQ78(~
zXjNN9MGT6<L7See8bIN|*Y7%7^JSbPeLc9VZ8}NG9t~~<dpDJQ&z8uwOR=DuoBzOa
zAw<n1h4=or=yP+gcr|X|TfmrNKAkgrZW;9!N<?k>=S}#_hOFEm#hlhf-cf8+2pWv_
zvv}2SxWhWYl;X1{iQFX4m8fB!#uS13rN#WF8+W-=?V^uLS=lsYGTf)MUgt@cMcseh
zzG*HfCGV$eIFN?3CAmCfxs43}rk1rN?*e$ENq#K6$pJ7GHCm01F)GnP;)iIWl&2Lq
zBd#UX3HPR8ExqB>X<bq&qAXh_WHA2Pe!<IZ0}20=?j|%43Vp=J$QZLAY<7=c2TT&h
z)OhuNgiI7!sL!!Glk3KqN{KF^2+QHuq&xv)OoFbDz7Y2)1<ts*zcKQV`11;E3*9$>
zb;kpJts5G#ZvbLb!gQqMBi4lOa9$AY80ONm%|H3jtbAV*($7JUaVPByzA$0$`lUJA
zT7cp9DWG>2&ZPR!v?`s5DZE~d1nDz>*wpUoHP%1Ui*{=rln9nx`}7uOIQ+^3^j4R;
z3@Lr~6x-U<RQwgZGlBn}WuiVS{ZNsZ0sSWZx@(DALmQ)*k@6|9<7l#-VG3#&&|bNK
zUbrr8kua{4cV$-H2+9`%mo`K8#99@$KsTH3s)lkd$ikFSYtU-(q@DBM#dE2_H<o4h
zJn}D64O+OBa{VhFPns_zMhJ0A61rycMZHOZE#G|$iG6P%^v*{e_I?s87+aA>lh8vj
z5`@I+ux`|TC8vaZ7AeI+Iu$j~nSa#zdrw!QBmvBI-M}fC4i~%plmDzDh<9kfND!q*
zclBR`6+dVxcx?Z!v6mdk&~O7m^(YPDXm8W^#p-^&EKcHRXU$C*DPJ2L?k-(um(sbu
zC~qwtTQS$lxWd}@PDO0U%vp$_pAS6?XaT(&)Cn>VH*_Pa&%0ffVh&gKrxRbB0y^+n
z871CQO(=98l!ejiR*%>W2!0`%%5{ink3TT@eQnlwcyHEGg7$w@sa37nN?#wkrh)Z&
uHD6|bUEMo$G|1V+q-3*Of8!BXZ-rSM=$#q&A{>@Hc#~<W>3E1Bq$f~IOum=^

literal 0
HcmV?d00001

diff --git a/.a8c-secrets/Reader-Secrets.swift.age b/.a8c-secrets/Reader-Secrets.swift.age
new file mode 100644
index 0000000000000000000000000000000000000000..d26e60b68340c7153c95f51e607b53efbbcb08e2
GIT binary patch
literal 1792
zcmV+b2mknCXJsvAZewzJaCB*JZZ2<fXD@a!3N1b$STZ#=F*zVuW=UytQfWv^Z9+(H
zb9ZGqYiv(5Z*ovIdRK64V^lXxaBxUYP<2vER#6H{X>?aBXlZe4YDra0YIZeMM0ZAE
zI74$*W=ktUQDah1Y*0>AM{{9pIdcjvJ|I{!H8n9gATnh&Q9@*FPIY)WMn_?9Lughq
zG)r?rP(x{9NOO8kZhBRBHc4+%M|XO63Q$x^M{zS&c}i4ybWK@IWpQyfOm1XzLuz4Z
zD?)lROjBxaXlpBSM>IEg3N1b$X<kw-XL4m>b7df2KP*FYTwV%pNMllGNqH+XR#bUH
zSwdx3PG@Fva7TJFW_d?+SyfOkXlQ9Raydj}H&t;qQ8Y$xSVwJeHfl?1Wl$?;YE?4|
zY-e(AN<?!rRAf0yY;RR`Qh9G$YD;=cN^Da&H+N@4YH?3-F>o?gQA$`=FhManZ(}k+
zQZa6L3N0-yAUH!ba&~Q6dNX7zIb>%`LP<3%Nia)hZ)-tJLV7b<WJ*q0G-og~VKizq
z3fEI$3qKqLLPW5uXWO%`DhafTQer#Q4?=O_?OIHBeUK|KoyZL>=p3{pNNkLy|96AY
zm;e&gpj$)!C><5H5|H=g(5Q4MDWTyPY$pxlHZ&=>L?|Jh=_?$lB@0xV$U0Z}M>NvG
zq*6O>s+NcFH8dhI!0?#hRsSP8Zga?Y=V?oA=n(iH^qrGsFT4=P>Oazwxigs!(Y%mK
zmE?k{*e?qlp#a80Q4E6kJdBMq1A&^!^Yvj*$AvjXWClI%6SKBVKb}wkzFDh8aXn?h
ze6FNYx!;hjNIU(o0O;=#so#_TBXU(}BHt7wvgZsj{4cm~9Uc9rj4<Qy(7;2tX|j~<
zU*05muR}SN!VPrv^02dZ=bKxfod>@1@tU)@zm)nn`0TI~;o@Z3aa)`XxOzG;k$_aC
z;~VS0GDYG+A_wRcBKG#>S~bBptUtN=W0SCm;AJE$HdFyOr=_Eb))DAj<hx?z@*|VQ
zSvJFmzpkNJzaajAwBPm7V{=v{aXf1lrDG+9ifv9wf)0-M$u-lheX!=hr3&g6g`elE
z534T3E)ONXFn0LD226jMY0?@4c*(^jcv|Clgo5JNpRw_www>Sw&lHcl@d7p~VBA@i
zxS^g7?Ws=NvbjAw-I*3|^4vk(*;Ycz$eg@}>LanLN^xeDgmQPbXTEW)?F6LU==YrQ
z**EHWYb34-U;oz2;_8=@?<U4E0b-5z%IsfJ>ORlYColLBlMauZ&SA{P6=>Z;-CRO8
zlq*U#9L(@3d1yL&jF7`(8#VYA<y^65^%<BcSCabd;Z{!$)|=13a9YHs0R4p_2f=<x
zexGzZ8Pl>85py0PpucUhI(g7i88Kb=6H2rYK1fn_pvL%jJd73xGi-64jxUf~_p|mo
zuVz#uL<yb&axSRAvY{5+)K36r*p0kryQt$-p<w|7`p#Rbbnw<Ik32^B@-RNgNWas%
zED-xb65s9;xi{sa4!(l}95FSxHxm>k;q_IK1+6I&UaBGfhsk0=?B)u|k(vmx=Fx5w
z==}0#MT+0VLPANbagzrKz1EI?%``(b+qi|H;HkOgM55Pdn%KPlGCB{<;N=fD4LLWn
zw2P{wR5IS{p{-_k{VrJ^Ww6Jwv;SNhAV_apFj)u2dqGcCJ=tC9tMf6ywX`}h+f=vs
z25T}+_DDP?a70+sq8FBqicGUrM%NX$E^~9mm?@P>-duwkw0AirHOcv)#z3<~D?hv*
z*WQ)ZTeYuh=P=6@S|O#&9OPO4;pQ@bZ?>LzW&2{H&ohkCeeh!wm-v!`asBZ-k=HYx
z2;L)=AAc#$*D_r3)ZV`5J(WfY4Nyk~O8BoIA2O=&*za<wpj?8Rx9S96CGK%=s&0|J
zC`3$KwxSO@`E9-cKlHR*7%1mRDb5)vpDs;#v_-HrgS?V9TK1Ag8V#lWeYFDdlx$ZX
zojEw{U54aag&LDQ!d&BCzE%#+AG4biIIU?PnW}nfwO8qjcr*1Cy87)N=j{XJQR-Zv
zI5b@|Uv%)T2}n-F2+T#G3_96+9KvWGt!`DIG2J8#UEt{pvq95Zwk0yv67~!@BWiMP
z$H29+aYEg;LipiR>;-IRt7yy$FTJg6_jxR#M07k|A1w4qR2PL@Mlzj;#CW}1V7-6F
zy?B!d9<CCVw=JkOTBkBM*v>BZ;ALa5(DvIU(Y~MHx137CUfR?t^nZ+!{0iZw4jJ64
z9*L2cdx_u#P$Ah&S{F{8kEs0YXih6de+^>vjIanJt5brJ*uo5LhPlU?B((=<5M!OF
iCr?3vm4gYsddSUj^YYb&B0T@~{vL#7%;OJ$+dhQmusJ{g

literal 0
HcmV?d00001

diff --git a/.a8c-secrets/WordPress-Secrets.swift.age b/.a8c-secrets/WordPress-Secrets.swift.age
new file mode 100644
index 0000000000000000000000000000000000000000..e65b3b22e8549ecc9281e2e41070380a92dc810f
GIT binary patch
literal 1585
zcmV-12G03mXJsvAZewzJaCB*JZZ2<fXD@a!3N1b$STZ#=F*zW0I8s`9RAgr}dNWK)
zX*6YFb98WOV@6FgYeX+jHcwD?Ge}lxV?#(|XjKX|LRxAsS8!T&F>6alSusv@SY>rY
zGI4ZHIBYpXWi&NuX-#u$YA{GJD_IIHJ|I{!H8n9gATe@yZ$xldWHC2(Xm)UDdQntX
zSXg5;Fe_<!L}GbzIZ;qVOmjF+Fh*)s3UyCGZBa%wNl|fbNN{pyOf^MPabsp}Get5`
zd3bhfD?({FZ8KwJO>1Fe3N1b$EM71%OIa;va%Ew2WgsRlHf|>=Aa8z3J0L0wXm~3_
zS7~inQZjLIO*49WO-)cZXm>?=Gf8MvG-_u;IaOCRVQy|qZB8&(QB-L&Y-2)fMPg}B
zb9XpXb8KT}3UO#gIW=N&Z8lJEF+@spQ*&@Icvo>RMOJucY-Cz%X*Nq)XD?$lFHbix
zcSlhQEiEk|Vs}SZRar+>QcFTPFH2BHM?o(!b~9&BHf1zbXj*k}PgZ(KW^qAJIcRqZ
zq-8wcdiy^~ht?3AUk^u|LX?O|_m>Kvc)lprKA_hR8?*QuPCg9Mi%*en2Dj;hk3D6J
z9vPPXXBnJyLceXV1LbdMr!IEzY9<NKyV&prXl`7DG7Zw4`*L0a8lF^AmI!Y${-7u0
zv)5`xA?vf`iupVUKeS&e2S#!)K!m!JVr;s=1)Kv|Ps`EZSnzAg`T_C*jE2XieY>(|
zyGnVzxwR7wdC98YZXt9#B6qnyYNHU7VH_##HZf0~bX{Gv`(?Ci50jZ4`2qvdJlyH0
zlq@9RwV^j;LeF@dr&VMTgngt5(Z>WXS&ZH+H%rpKZ(}n9r#Ql#n~8Tto<>iKdK@)H
zYP;CfTr{kYSc^SGwXVw}n5?g$D^lQ@*K;GRSQxHXIP7%|2rt$23g%kUQH%Zs-F2-G
zMNRMHFk8;ty&fXcRidT2Ab*>*=LC?P8CwFAFnOr~**)LAHvq07ZtvKijp10aC0wxB
zmo8u+(y(iR+ToGhf`cO_>=tQUT?hELgEwk?`GDe?Wnw*<Na*`gF8)%Aw##B~yuO(|
zZ39L22V)9`AR3gWObCvUfU=hMEpwE220_m19YqH4KE;O4zlHEi@T?&qVAsDM_jq^)
zTcBtXQUxK5W}!sG`D+#)ytwHq)x{00^cfVBaOZy7xS<qOo0TbZ*AD}N5I);ENfR7z
z#?vPDu?|Cquu3R*=f;3#X^W{rQ=0tXC`Dk^YG*Cv&o)1dmx##4vf{dP@<LDA(tqgD
zZ~}MJ+{eO}?jQqDQ{C~-k|He@u3}pS*2|1N^qlU8DD()WmL$B$G0u87PfapP`Hh5-
zE)K7PGzh~M%t){QUxol?laJH;B=HiSx{wkmO~Z{_W!-VqOq;Hj<fNKakW!;{+Y?=4
zy2+^ad57o)eTGKxZNLU&+is+w8MWzAE;aD4Q|qFb$fmy5aa*Fov!y)5Ck}~}2Q!^X
zs$w8-)$%~|lO_93ah%>OzCc^&k}@1D@&LhU7jh2kT!6@k(pdk_7fG1giyDG<Ai1bm
zAG3CIDdZ{QLvtC3#Lgw30gs?$pMRsxePB{(Btw`VohargJK!`VnQs@PCb3-xq76a!
z*PneF9<CBy>wR{jw7teOCdUVy7IO2VLwHeu{kymoPAC2jPIMeg&NDZ-#_9Vs?=Y2@
z;R0+WtcSpBPoBDi{0Cs>R2zb$0|4Xr)D{Ip4f(B1ok#f7^ooa=UX#x99_#arJ_#WH
zOLbVFQ5JJ{^m{xmLuFI`Tg!;OlOLQj*TT2GZ{h0LW_e`%%dr_s#gXN5(@r3Hq?Pe5
zC#2l?KEA~B*T#ahkWW8OwVSfOT3H}7_*21^JrAW=HR^_PI>%0wAc9RuzZY+8U&gFR
znYvjgvtppg%Dw_}JH7fI5!SJq#LX<Y-c!OdjR*?0u>>JhO+BaBLW>gUq{imRdR_j#
z3062uQmoc_Ceve2I<<=|`X{LzDY*<hP&?>h=LVxAUNT!-zG^7Jl@15heLIG;_+woO
j2<o$}j`J<1L!W$w+z28CvO&o#+`kUBA81ajvn*EupNhc$

literal 0
HcmV?d00001

diff --git a/.configure b/.configure
deleted file mode 100644
index b17061cf7a7a..000000000000
--- a/.configure
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "project_name": "WordPress-iOS",
-  "branch": "trunk",
-  "pinned_hash": "6baf4e086398ddf8141d7132e557703a715fafd2",
-  "files_to_copy": [
-    {
-      "file": "iOS/WPiOS/Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/JPiOS/Jetpack-Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift",
-      "encrypt": true
-    },
-    {
-      "file": "iOS/Reader/Reader-Secrets.swift",
-      "destination": "~/.configure/wordpress-ios/secrets/Reader-Secrets.swift",
-      "encrypt": true
-    }
-  ],
-  "file_dependencies": []
-}
diff --git a/.configure-files/Jetpack-Secrets.swift.enc b/.configure-files/Jetpack-Secrets.swift.enc
deleted file mode 100644
index ea3cc37302b2dd571ff5743d3e278b0139d2a568..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1200
zcmV;h1W)_##81BYE8wZir~1r;eZ9xI!DK;Y=}%{P&2fa|1j~$?<89t;V~^{tm=Byy
zU)jvpe3*JI(*uZlh!$=|@Suhs@LH^zBq*&U21muS6EW|=P@c9j;g-YPr_3bjSpEvo
ziz=W}u65u?k~go*-Z-Bk^qyIxl7}q>XjNdS1T;Ey?Fv{}*@;-#i0qMzy{HF*VlFB}
zmdutX^#Qv#AJV}=LV@8teJkcSu&zMqtn6zN>nJCT+0|bko(Vn05>Sk|C%;mydBa?l
zF`Tvm*lF?WmJ90pnN=PqP3}CsJR_h6-nlL36M(dHLo5bKaQ}w;gBJb5h_s!j!8bQ4
ziD<R|VeO3jg1sb$aM!;<RfXES=p#hAd0Xvwbix)T8}2Ry*xClK&5{F@S|y(6HRmu~
zVm<c`wZS#YqNoeBBi%t(oM=2?fq3j1-cKI*CSG^=xC~fYX4<>d-eRy20Cy9H13XJR
z$1yH6ZKsmw=t3lM3}N7o9ePaZBNk)Eg%7*joWYUg&YZLcTEE!h(M7ta!%+K`*x&B2
zs#bf#KrVU{q{*PaGimvF8E}^{^NlGT$k(JfR6Q|{0uHX%@yyU9`PP^3B^KiwsI7t9
z#blO($1S(#x;^8}W|<UbPj`G9?LN3EKYJPRjSH_oL?obvgJQfHj8RO=4#YkTo+yS9
zm2UO13%M@wXvOtYcdX;``77e}{sM6tyRWs{jSxO~Q2(JeKOT|q7e-az2R&h#pa}y`
zRGY_J?e6bmFP9&xGW{;Dj>X%?8k!Gt8qk>@@VQ_CDx`Lb#_5HA?@;ST1SR$T>nGcN
zZPXm6{o{#WThN*^mve4xnePnb@IE}JS55`?m<Yr;Z|z>=L;jeyLd4UAZZ}=0WNcw2
zqUeU^L>5%Sprnp8vjC9DoP45VbnuO^6N!B@Y2DAx!>A8;w(|VqVD$9A*n#rQ)Y9QD
zDMAFG#l(+No1#<PqC2a5Sq+MY-IJ$e@F&m38%*Z=fCt!DQsq?kZ0xw1NIMTQ2O%u<
zgj<2O37K|3sPfh>6^B``;06F=-L+NS1A|U)l_jdK5&#ox;?$16#x7FA^hm_OJbE=c
zB_$e$3(p={KG514Y6~W=r&K;q^Q>L-ZPB$9pEiOn-#}^ENXQR2LL57G@iO%i!_x|c
z$M|z=aanMwwk>aJW<R>=x+<6z?lfLndH3NQ<^Vb0&_rr?cr%)k&=n%m&L^bcOcPv8
z?xu9iF=hHuB{c3}l)t4(xKZOl+e=a@PH3I4w=9xeE9bMEMZ-{=ziS=I@}C$YX=TMx
zZbsHFI>0mjcsz?X)hyQln>GG857-<<D(tRUoJNg6tJlJ#m7^~rR(cW{p1>TL?2YhM
zku)XebsT~VXKgGcFIfhn6UAfx^Rc)KcSw_KtD8^no#a&{Eo|%iQxZ59&r*BJ4v<)1
ziBpV3sq~SrX2yD$CivF3de!{305vu3t>=^4GR~)TrdP`c0G@Uo`T%FrR0v4u{n4Po
zU}(939N0iYXJXj8O~@FCG<ms{PHE&A^~R8X&fxu?#Q~Hd8gr2+CIfEKtacgLK5iQK
O2#JGLP>)uD=J4sp)Liob

diff --git a/.configure-files/Reader-Secrets.swift.enc b/.configure-files/Reader-Secrets.swift.enc
deleted file mode 100644
index ccf158a9cbf119b3648e92bba7687ba23106090f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1360
zcmV-W1+V(=#81BYE8wZir~1r;eZ9xI!DK;Y=}%{P&2fa|1j~$?<89t;V~^{tm=Byy
zU)jvpe3*JI(*uZlh!$=|@SuiJ(ItJs#-{fh1^z(bHgq4NGHd9Y7zB-IE|qYG`|vX{
zgUSfOvJ@G{Xb#Lk9h-lM*tRqI_2a}rRsR8l6v*~wwJbs{14{6aXe>9--TwyMcGEg(
zC*ACJTh#v+POGP>A}H|`qLW7F1N-d%7DmZ$U|=QkauUG?T4B<~ed}rvj#hHZ!i-l+
zvDXGBS_E9Ntt@fL`9;l#7ksU*+;_`d7y7rBJ7Rz#SHJO2-){Wru3!{$Za99#(?&rV
zI$QTsNU+xA8jR?>;RM|YL}C)sldZC<E4ti0=%jyJ>d{C{W5aDxXEd|JcmT*{g1n-%
z93roA0+7)hr;H?<O=unu{!7)5{PwBs@KwFOZZWg&Sfv#<6(~BLfO>S4ESJi(m<9Cz
z?Hh&uRyX~SNPHO-D)!L8AogL?(z`!r49{RAr5%W0JwNbkU36d>6#QlR0KR4wGi0C6
zH;EA0Uu+nW16K1tiC^wp=4uAKx0&Q-5|6o!0vKbNo)Y0yphGw8{BHB6weqv@gZ>Nd
zTQ&lEn@4|q0nLwYT1Vg|v_K#i2Q%D<pAt>286cs^R1}*w&qOcgvNsWr#_myBDLKZl
zu8O?y$9kI;6j+pr0SSvd{N5<T0tLyGz`4+Yd;cAQpq2BHs!G)8Bn;;{ug<YNRybiK
zkpWUQS9PARCODva4i!o;-3dmK6#57AewxULP$5lxtLszOx67T{0KtA?(<!(Wu%=>y
z-sRzuQ)S5&^>Y;KwhvB}$|z34p~KP{DFq3p9;gHa6pGsK^%JZ+OFA}~Vj>y3c;M=Z
z=MQK~llGe*KX1I?Jc};-5-e<!7-`=<)qN6-9)ZWjd7QmHN4}6naMG0uOWxt|RbS1m
z)Zk0fGuF-1@ls~H&F0>zKxMUeVVFt??)0JS1OJ;g;O01S?!zq2-jh8n?fMRE8K-kB
zsih0mN_TNfk{$4*I+O;hhGcEedR{sF+ZikDPMX37O^9=QBp2oK*QhH}ZD)yuI;D{y
zpH9HLjEt^1DuA(E*<WCww-TK7waflCBcWxl1-Ry6NJ(R^(!15^2w9cza!G=!AcP;Y
zXmZIsMsn#`vLW3KIbajbm3L^99qu2=o3Hc%!I*-O^%3)8A(dDLJMdT@mCWZDk~+1p
z$BKCT;CvB?2bC^~Qk<ud@1L+!&^)ytDpn0SJ}|e%0V0s6)MBsbNbopVs#Q@QUR&Em
z4_()IM9C11u<f`X<H6pKn(9*0d3L(mk4p3M0LhalakTM6Hm{4gQFjv6)VN$oBYI5w
zO6bLCt*fJbXsMz(l}&QJ33}PPUb+Y%cJ2d$w>#_L5T7$k1el?mOO8vp)k^Jz{%P%O
zakmf=h;wtpAKreF?c`(4wh;pmRuJRy+-L8y4jW;Pj;j}$L=c>r8JG26C?JpJl6V9T
zaq0P>^+nqBm33Yn=W+}q5wYX=aTg*}?J)W(DfZ2~+h`Dkn{F9^dad=MGQ_7Kg9s1%
zRY%75p<hb;MG8rEAH`sPrSCFwFdOOAsp&V-$ymK_PXfRm)hN^HirCOIBgD`m+y`gl
zIzsfR(!rxOdN5+}0q)expuG~0JR$rC1g2gWvpI}a1$l|w%YQ8(@KB2o>Mr*2O-6uA
zA^oPo+GHcbYrujb3+_m0l4LrKkeA#4p78TH8&o%cymZdx-C|6aLtDs2XqtU(A!Ess
S<{7-Td5KYFZ9Q!TUqtr~#H@w@

diff --git a/.configure-files/Secrets.swift.enc b/.configure-files/Secrets.swift.enc
deleted file mode 100644
index 500132fd96da05c30bd388e46a952e78597fd96d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1152
zcmV-`1b_SQ#81BYE8wZir~1r;eZ9xI!DK;Y=}%{P&2fa|1j~$?<89t;V~^{tm=Byy
zU)jvpe3*JI(*uZlh!$=|@Suhs@LH^zBq*&U21muS6EW|=P@c9j;g-YPr_3bjSpEvo
ziz=W}u65u?k~go*-Z-Bk^qyIxl7}q>XjNdS1T;Ey?Fv{}*@;-#i0qMzy{HF*VlFB}
zmdutX^#Qv#AJV}=LV@8teJkcSu&zMqtn6zN>nJCT+0|bko(Vn05>Sk|C%;mydBa?l
zF`Tvm*lF?WmJ90pnN=PqP3}CsJR_h6-nlL36M(dHLo5bKaQ}w;gBJb5h_s!j!8bQ4
ziD<R|VeO3jg1sb$aM!;<RfXES=p#hAd0Xvwbix)T8}2RzM!|P6O~sicxA)ILe@pm;
z5PEO2wN6OvrUTKw_3r9WR{N`{V>1PDy-W<7w>S;adY+vujhGX)`nmiVE-P5<vIuP_
zf2ng5(A`@0qPUnNJ<ZF4MtdAxA^Mo^n4%4K99r2x(lGtH`Z|U%8t1IIi9oZoLvixf
zzS1AiUzDw(+k6#a%_5hG-!iTTy|a7)q~y-{Iy=1=>151>CJ+#Rzat6p%O)lgyXe4z
z7avFtOIg&{GL36D>SRP?@#H@pfB*PUCbt!7_WRe?c-dwcx@f9X+P4&<)}+(=I9PVq
z=sz3loB|o&E)7!{@%!|+?qL%;w`D&f_rbp&q*r9c5$PHh_g*Xu4@}a%D!bTo^SJ72
z4G0qlgpNDRl6WiU*%YwZTLBiy)mt<h#pXww^<Fh;OEuXCwAe&v5P5eR5dhv?&x@{D
zO#K_8B4=P?GD%y8*P)ySVE>X{5W=(DTXOvpgBa!tUp@yIw;BH$X|$EH9kE%%PrCaT
zylD(+{145%jXrw5Pe0nilodLe743)8=U8<MY~|&*c+V{asdmn(3j(P#h?7aIF!cq>
z1X-;sER?{RWuyS<XtP?`3V%aP%|2s7OPD(wY+zARIWBgwdK@|#h5Yt4OU?(K?-T{9
zq24_JBTz>|vr!iVzTtzWG^U?yARz=r3BE3$OF@eN!joy2ZuOQfoX|}MJpxInI+Co+
z3gkS*;;-x-?>mBRS5|$OsQ<m3s&{g+^23xLw+kd7B>V!KFaZ&4U$68!aXA+O{~=x<
zby*T#kN$`R_5v$-mbe+5X1qynYZRnVlKN1v@)(JZddq9eVPvXI4hN^BPxW$JRa5#>
zf9@5)$J3@J*DWJc`o=6zT#<+$kugGpj*L6OI7e5O7b%p|4u>jjlEj+|Tc)#aJ^x;)
zx6b3t?2!*Sh=qx2`p2IG1jRr;lB@ceP6CJ{g^E5}y1wlcb-Om$+mHZ~KQV)whJ{6z
zgs$B<JX@FX6x(6&Ia4I^5r%DWe4HkH|29(U#lHz%W~>jycJ8Hq(i4$Ml&huv)7ev(
zCY3zBmy{6^N}6Htm6ODTUE*M<4C(aih<M&<Er@dIwE4&Sn1o7Z=0v7KT@2tGkQVn|
S`12v0`Yg14T*PlNGO-hLV>pxm

diff --git a/.gitattributes b/.gitattributes
index 648ab329c02f..3b002f08fa65 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,4 @@
 RELEASE-NOTES.txt merge=union
 *.strings diff=localizablestrings
 
-.configure-files/*.enc binary
+.a8c-secrets/*.age binary
diff --git a/.gitignore b/.gitignore
index 5a9c41b95f6e..8d4ddae3e134 100644
--- a/.gitignore
+++ b/.gitignore
@@ -90,10 +90,12 @@ Artifacts
 WordPress/Resources/AppImages.xcassets/AppIcon-Internal.appiconset
 WordPress/Resources/Icons-Internal
 
-# All encrypted secrets should be stored under .configure-files
-# Everything without a .enc extension is ignored
-.configure-files/*
-!.configure-files/*.enc
+# a8c-secrets decrypts into ~/.a8c-secrets/<repo-id>/, outside the checkout.
+# In-repo, track only the repo id, the public keys, and the encrypted *.age blobs.
+.a8c-secrets/*
+!.a8c-secrets/repo-id
+!.a8c-secrets/keys.pub
+!.a8c-secrets/*.age
 
 # A file external contributors can have locally to provide their own credentials.
 # This file is created during the `rake init:oss` task, based on the Secrets-example.swift file.
diff --git a/CODEOWNERS b/CODEOWNERS
index c29db1d94519..220249b7e6e5 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -24,4 +24,4 @@ Dangerfile*           @wordpress-mobile/apps-infra-tooling
 .xcode-version        @wordpress-mobile/apps-infra-tooling
 
 # Secrets
-.configure-files/     @wordpress-mobile/apps-infra-tooling
+.a8c-secrets/         @wordpress-mobile/apps-infra-tooling

From 971a798c4f988594b3418be12c9c198ec4ae3d00 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 17:43:55 +1000
Subject: [PATCH 12/15] Point credentials build phase at a8c-secrets

Read the three secrets from the a8c-secrets decrypt location
(`~/.a8c-secrets/<repo-id>/`) instead of `~/.configure/`, and point the
fallback message at the new `configure_secrets` lane.

Part of AINFRA-1538.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Scripts/BuildPhases/GenerateCredentials.sh         | 4 ++--
 Scripts/BuildPhases/GenerateCredentials.xcfilelist | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Scripts/BuildPhases/GenerateCredentials.sh b/Scripts/BuildPhases/GenerateCredentials.sh
index ebef9d0644cc..9fbdcc68386f 100755
--- a/Scripts/BuildPhases/GenerateCredentials.sh
+++ b/Scripts/BuildPhases/GenerateCredentials.sh
@@ -1,7 +1,7 @@
 #!/bin/bash -euo pipefail
 
 # The Secrets File Sources
-SECRETS_ROOT="${HOME}/.configure/wordpress-ios/secrets"
+SECRETS_ROOT="${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile"
 
 # To help the Xcode build system optimize the build, we want to ensure each of
 # the secrets we want to copy is defined as an input file for the run script
@@ -105,7 +105,7 @@ fi
 # resort, unless building for Release.
 
 COULD_NOT_FIND_SECRET_MSG="Could not find secrets file at ${SECRETS_DESTINATION_FILE}. This is likely due to the source secrets being missing from ${SECRETS_ROOT}"
-INTERNAL_CONTRIBUTOR_MSG="If you are an internal contributor, run \`bundle exec fastlane run configure_apply\` to update your secrets and try again"
+INTERNAL_CONTRIBUTOR_MSG="If you are an internal contributor, run \`bundle exec fastlane configure_secrets\` to update your secrets and try again"
 EXTERNAL_CONTRIBUTOR_MSG="If you are an external contributor, run \`bundle exec rake init:oss\` to set up and use your own credentials"
 
 case $CONFIGURATION in
diff --git a/Scripts/BuildPhases/GenerateCredentials.xcfilelist b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
index 32e71d39a874..ac97ea792efe 100644
--- a/Scripts/BuildPhases/GenerateCredentials.xcfilelist
+++ b/Scripts/BuildPhases/GenerateCredentials.xcfilelist
@@ -1,8 +1,8 @@
 # Lists of input files for the script that populates the app's secrets with the
 # correct values for the current scheme and build configuration.
-${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift
-${HOME}/.configure/wordpress-ios/secrets/Reader-Secrets.swift
+${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/WordPress-Secrets.swift
+${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/Jetpack-Secrets.swift
+${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/Reader-Secrets.swift
 
 # Local Secrets file that external contributors can use to specify their own
 # ClientID and Secrets. This file is created by the Rakefile when external

From 3143cc4b4d6517a9b123896d6b33b2a88606be8c Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 17:44:05 +1000
Subject: [PATCH 13/15] Add configure_secrets fastlane lane
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Decrypt secrets via `a8c-secrets` behind a preflight that points at the
installer when the tool is missing, and call it from `before_all` so every
lane can rely on the secrets being present.

In CI the binary isn't on the lane process's PATH — install-secrets.sh
decrypts in its own process — so the preflight detects CI and skips rather
than failing the build.

Part of AINFRA-1538.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 fastlane/Fastfile | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 823955b10a10..6aafef0f4353 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -195,6 +195,11 @@ before_all do |lane|
   # Fixes weird Keychain bugs
   setup_ci
 
+  # Decrypt secrets so every lane can rely on them. Cheap and redundant on dev
+  # machines; in CI the binary isn't on this process's PATH (install-secrets.sh
+  # already decrypted them), so configure_secrets no-ops via its is_ci branch.
+  configure_secrets unless lane == :configure_secrets
+
   # Check that the env files exist
   unless is_ci || File.file?(USER_ENV_FILE_PATH)
     example_path = 'fastlane/env/user.env-example '
@@ -202,6 +207,20 @@ before_all do |lane|
   end
 end
 
+# Decrypt the app secrets using `a8c-secrets`.
+lane :configure_secrets do
+  unless FastlaneCore::CommandExecutor.which('a8c-secrets')
+    if is_ci
+      UI.important('`a8c-secrets` was not found on the PATH, but given CI execution was detected, we assume secrets have already been decrypted. See https://linear.app/a8c/issue/AINFRA-2681.')
+      next
+    else
+      UI.user_error!('`a8c-secrets` was not found on your PATH. See https://github.com/Automattic/a8c-secrets for installation and usage instructions.')
+    end
+  end
+
+  sh('a8c-secrets', 'decrypt')
+end
+
 def compute_release_branch_name(options:, version: release_version_current)
   branch_option = :branch
   branch_name = options[branch_option]

From 4ae70a12e65b3ba292d475346d38d3391d86c6c1 Mon Sep 17 00:00:00 2001
From: Gio Lodi <gio@mokacoding.com>
Date: Sun, 12 Jul 2026 17:44:12 +1000
Subject: [PATCH 14/15] Switch CI and Rake secrets setup to a8c-secrets

Point the shared `install-secrets.sh` helper and the `credentials:apply`
Rake task at `a8c-secrets`: the helper installs the tool and runs
`configure_secrets` in one process so the PATH export reaches the decrypt,
and the Rake task guards on the tool being installed so open-source builds
fall back to templated credentials.

The Buildkite command scripts and release pipelines already route through
`install-secrets.sh`, so no call sites change here.

Part of AINFRA-1538.

---

Generated with the help of Claude Code, https://claude.com/claude-code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .buildkite/commands/install-secrets.sh |  5 ++++-
 Rakefile                               | 19 +++++--------------
 2 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/.buildkite/commands/install-secrets.sh b/.buildkite/commands/install-secrets.sh
index 181f3e3267da..e5192c78f8ff 100755
--- a/.buildkite/commands/install-secrets.sh
+++ b/.buildkite/commands/install-secrets.sh
@@ -3,4 +3,7 @@
 set -euo pipefail
 
 echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+curl -fsSL https://raw.githubusercontent.com/Automattic/a8c-secrets/main/install.sh | bash
+# The installer puts the binary in ~/.local/bin, which isn't on the agent's PATH.
+export PATH="$HOME/.local/bin:$PATH"
+bundle exec fastlane configure_secrets
diff --git a/Rakefile b/Rakefile
index fd7736531eda..ebd8e8e857b7 100644
--- a/Rakefile
+++ b/Rakefile
@@ -77,20 +77,11 @@ namespace :dependencies do
 
   namespace :credentials do
     task :apply do
-      next unless Dir.exist?(File.join(Dir.home, '.mobile-secrets/.git')) || ENV.key?('CONFIGURE_ENCRYPTION_KEY')
-
-      # The string is indented all the way to the left to avoid padding when printed in the terminal
-      command = %(
-FASTLANE_SKIP_UPDATE_CHECK=1 \
-FASTLANE_HIDE_CHANGELOG=1 \
-FASTLANE_HIDE_PLUGINS_TABLE=1 \
-FASTLANE_ENV_PRINTER=1 \
-FASTLANE_SKIP_ACTION_SUMMARY=1 \
-FASTLANE_HIDE_TIMESTAMP=1 \
-bundle exec fastlane run configure_apply force:true
-      )
-
-      sh(command)
+      # Skip when a8c-secrets isn't installed so open-source builds — which fall back
+      # to the templated credentials — don't fail here.
+      next unless system('command -v a8c-secrets > /dev/null 2>&1')
+
+      sh('FASTLANE_SKIP_UPDATE_CHECK=1 bundle exec fastlane configure_secrets')
     end
   end
 

From 7de02407f4dd1afa23c9fd9def97e86c9dfa201e Mon Sep 17 00:00:00 2001
From: Olivier Halligon <olivier.halligon@automattic.com>
Date: Mon, 13 Jul 2026 22:21:36 +0200
Subject: [PATCH 15/15] Fix typo in pipeline log message

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .buildkite/release-pipelines/update-app-store-strings.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.buildkite/release-pipelines/update-app-store-strings.yml b/.buildkite/release-pipelines/update-app-store-strings.yml
index 7fc327ed43ba..dbab84f50e0c 100644
--- a/.buildkite/release-pipelines/update-app-store-strings.yml
+++ b/.buildkite/release-pipelines/update-app-store-strings.yml
@@ -20,7 +20,7 @@ steps:
 
       .buildkite/commands/install-secrets.sh
 
-      echo '--- :shipit: Update relaese notes and other App Store metadata'
+      echo '--- :shipit: Update release notes and other App Store metadata'
       bundle exec fastlane update_appstore_strings skip_confirm:true
     retry:
       manual: