Skip to content
Draft
Show file tree
Hide file tree
Changes from 15 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added .a8c-secrets/Jetpack-Secrets.swift.age
Binary file not shown.
Binary file added .a8c-secrets/Reader-Secrets.swift.age
Binary file not shown.
Binary file added .a8c-secrets/WordPress-Secrets.swift.age
Binary file not shown.
4 changes: 4 additions & 0 deletions .a8c-secrets/keys.pub
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# dev
age1srcq3hl92ym9jk3ezj5prwhche3w8szc0cssy8t7afrkjmtkxu2qkjsdfn
# ci
age1a7xcr6qzwnzgcxq95sq33p58xdzsmful8w7mp2zktvuy5434yuss9rmv8f

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI public key validated by using age-keygen -y on the private key stored in our CI secrets 👍

1 change: 1 addition & 0 deletions .a8c-secrets/repo-id
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
wordpress-ios@github.com@wordpress-mobile
3 changes: 1 addition & 2 deletions .buildkite/commands/build-and-upload-testflight.sh
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh <wordpress|jetpack|reader>}"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :testflight: Building and uploading ${APP} to TestFlight"
bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}"
7 changes: 1 addition & 6 deletions .buildkite/commands/build-for-testing.sh
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,7 @@ fi

"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"

echo "--- :writing_hand: Copy Files"
mkdir -pv ~/.configure/wordpress-ios/secrets
cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane "build_${APP}_for_testing"
Expand Down
3 changes: 1 addition & 2 deletions .buildkite/commands/complete-code-freeze.sh
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@ source use-bot-for-git

"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo '--- :shipit: Complete code freeze'
bundle exec fastlane complete_code_freeze skip_confirm:true
3 changes: 1 addition & 2 deletions .buildkite/commands/finalize-hotfix.sh
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,7 @@ source use-bot-for-git
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo '--- :shipit: Finalize hotfix'
bundle exec fastlane finalize_hotfix_release skip_confirm:true
3 changes: 1 addition & 2 deletions .buildkite/commands/finalize-release.sh
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,7 @@ source use-bot-for-git
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo '--- :shipit: Finalize release'
bundle exec fastlane finalize_release skip_confirm:true
3 changes: 1 addition & 2 deletions .buildkite/commands/gather-testflight-candidates.sh
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,7 @@
echo "--- :rubygems: Setting up Gems"
install_gems

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :testflight: Gathering candidates and opening the block step"
bundle exec fastlane gather_testflight_candidates
9 changes: 9 additions & 0 deletions .buildkite/commands/install-secrets.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#!/usr/bin/env bash

set -euo pipefail

echo "--- :closed_lock_with_key: Installing Secrets"
curl -fsSL https://raw.githubusercontent.com/Automattic/a8c-secrets/main/install.sh | bash
# The installer puts the binary in ~/.local/bin, which isn't on the agent's PATH.
export PATH="$HOME/.local/bin:$PATH"
Comment on lines +6 to +8

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that in the future we plan to have a8c-secrets pre-installed and provisionned on all of our CI agents.
We're not there yet so for the iterative migration we might still need this curl and export PATH calls indeed, but that's good to keep in mind and track in some Linear issue to remember to follow-up on this later.

Alternatively, maybe we could start deploying the a8c-secrets (and PATH addition) to our CI agents first, so that PRs that will start to adopt it don't have to do that curl themselves already?

bundle exec fastlane configure_secrets
4 changes: 0 additions & 4 deletions .buildkite/commands/lint-localized-strings-format.sh
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,4 @@ if "$(dirname "${BASH_SOURCE[0]}")/should-skip-job.sh" --job-type localization;
exit 0
fi

echo "--- :writing_hand: Copy Files"
mkdir -pv ~/.configure/wordpress-ios/secrets
cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env

lint_localized_strings_format
3 changes: 1 addition & 2 deletions .buildkite/commands/promote-build-to-public.sh
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@ fi
echo "--- :rubygems: Setting up Gems"
install_gems

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :rocket: Promoting ${BUILD_CODE} to public beta"
bundle exec fastlane promote_build build_code:"${BUILD_CODE}"
3 changes: 1 addition & 2 deletions .buildkite/commands/promote-nightly.sh
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@
echo "--- :rubygems: Setting up Gems"
install_gems

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :new_moon: Promoting last build of the day to nightly beta"
# The lane refuses to run anywhere but trunk.
Expand Down
3 changes: 1 addition & 2 deletions .buildkite/commands/prototype-build-jetpack.sh
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ fi
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_jetpack_prototype_build
3 changes: 1 addition & 2 deletions .buildkite/commands/prototype-build-wordpress.sh
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ fi
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_wordpress_prototype_build
3 changes: 1 addition & 2 deletions .buildkite/commands/release-build-jetpack.sh
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_jetpack_for_app_store
3 changes: 1 addition & 2 deletions .buildkite/commands/release-build-wordpress.sh
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_app_store_connect \
Expand Down
4 changes: 0 additions & 4 deletions .buildkite/commands/verify-strings-catalog.sh
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,6 @@ fi
echo "--- :rubygems: Setting up Gems"
install_gems

echo "--- :writing_hand: Copy Files"
mkdir -pv ~/.configure/wordpress-ios/secrets
cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env

echo "--- :package: Generate Localizable.xcstrings from source"
bundle exec fastlane ios generate_strings_catalog

Expand Down
3 changes: 1 addition & 2 deletions .buildkite/release-pipelines/code-freeze.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,7 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
.buildkite/commands/install-secrets.sh

echo '--- :shipit: Run code freeze'
bundle exec fastlane code_freeze version:"${RELEASE_VERSION}" skip_confirm:true
Expand Down
3 changes: 1 addition & 2 deletions .buildkite/release-pipelines/new-beta-release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,7 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
.buildkite/commands/install-secrets.sh

echo '--- :shipit: Deploy new beta'
bundle exec fastlane new_beta_release skip_confirm:true
Expand Down
3 changes: 1 addition & 2 deletions .buildkite/release-pipelines/new-hotfix.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,7 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
.buildkite/commands/install-secrets.sh

echo '--- :shipit: Start new hotfix'
bundle exec fastlane new_hotfix_release skip_confirm:true version:"$VERSION"
Expand Down
3 changes: 1 addition & 2 deletions .buildkite/release-pipelines/publish-release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,7 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
.buildkite/commands/install-secrets.sh

echo '--- :package: Publish Release'
bundle exec fastlane publish_release skip_confirm:true
Expand Down
5 changes: 2 additions & 3 deletions .buildkite/release-pipelines/update-app-store-strings.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,9 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply
.buildkite/commands/install-secrets.sh

echo '--- :shipit: Update relaese notes and other App Store metadata'
echo '--- :shipit: Update release notes and other App Store metadata'
bundle exec fastlane update_appstore_strings skip_confirm:true
retry:
manual:
Expand Down
38 changes: 0 additions & 38 deletions .configure

This file was deleted.

Binary file removed .configure-files/Jetpack-Secrets.swift.enc
Binary file not shown.
Binary file removed .configure-files/Reader-Secrets.swift.enc
Binary file not shown.
Binary file removed .configure-files/Secrets-Alpha.swift.enc
Binary file not shown.
Binary file removed .configure-files/Secrets-Internal.swift.enc
Binary file not shown.
Binary file removed .configure-files/Secrets.swift.enc
Binary file not shown.
2 changes: 0 additions & 2 deletions .configure-files/project.env.enc

This file was deleted.

2 changes: 1 addition & 1 deletion .gitattributes
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
RELEASE-NOTES.txt merge=union
*.strings diff=localizablestrings

.configure-files/*.enc binary
.a8c-secrets/*.age binary
10 changes: 6 additions & 4 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -90,10 +90,12 @@ Artifacts
WordPress/Resources/AppImages.xcassets/AppIcon-Internal.appiconset
WordPress/Resources/Icons-Internal

# All encrypted secrets should be stored under .configure-files
# Everything without a .enc extension is ignored
.configure-files/*
!.configure-files/*.enc
# a8c-secrets decrypts into ~/.a8c-secrets/<repo-id>/, outside the checkout.
# In-repo, track only the repo id, the public keys, and the encrypted *.age blobs.
.a8c-secrets/*
!.a8c-secrets/repo-id
!.a8c-secrets/keys.pub
!.a8c-secrets/*.age

# A file external contributors can have locally to provide their own credentials.
# This file is created during the `rake init:oss` task, based on the Secrets-example.swift file.
Expand Down
2 changes: 1 addition & 1 deletion CODEOWNERS
Original file line number Diff line number Diff line change
Expand Up @@ -24,4 +24,4 @@ Dangerfile* @wordpress-mobile/apps-infra-tooling
.xcode-version @wordpress-mobile/apps-infra-tooling

# Secrets
.configure-files/ @wordpress-mobile/apps-infra-tooling
.a8c-secrets/ @wordpress-mobile/apps-infra-tooling
19 changes: 5 additions & 14 deletions Rakefile
Original file line number Diff line number Diff line change
Expand Up @@ -77,20 +77,11 @@ namespace :dependencies do

namespace :credentials do
task :apply do
next unless Dir.exist?(File.join(Dir.home, '.mobile-secrets/.git')) || ENV.key?('CONFIGURE_ENCRYPTION_KEY')

# The string is indented all the way to the left to avoid padding when printed in the terminal
command = %(
FASTLANE_SKIP_UPDATE_CHECK=1 \
FASTLANE_HIDE_CHANGELOG=1 \
FASTLANE_HIDE_PLUGINS_TABLE=1 \
FASTLANE_ENV_PRINTER=1 \
FASTLANE_SKIP_ACTION_SUMMARY=1 \
FASTLANE_HIDE_TIMESTAMP=1 \
bundle exec fastlane run configure_apply force:true
)

sh(command)
# Skip when a8c-secrets isn't installed so open-source builds — which fall back
# to the templated credentials — don't fail here.
next unless system('command -v a8c-secrets > /dev/null 2>&1')

sh('FASTLANE_SKIP_UPDATE_CHECK=1 bundle exec fastlane configure_secrets')
end
end

Expand Down
4 changes: 2 additions & 2 deletions Scripts/BuildPhases/GenerateCredentials.sh
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/bin/bash -euo pipefail

# The Secrets File Sources
SECRETS_ROOT="${HOME}/.configure/wordpress-ios/secrets"
SECRETS_ROOT="${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile"

# To help the Xcode build system optimize the build, we want to ensure each of
# the secrets we want to copy is defined as an input file for the run script
Expand Down Expand Up @@ -105,7 +105,7 @@ fi
# resort, unless building for Release.

COULD_NOT_FIND_SECRET_MSG="Could not find secrets file at ${SECRETS_DESTINATION_FILE}. This is likely due to the source secrets being missing from ${SECRETS_ROOT}"
INTERNAL_CONTRIBUTOR_MSG="If you are an internal contributor, run \`bundle exec fastlane run configure_apply\` to update your secrets and try again"
INTERNAL_CONTRIBUTOR_MSG="If you are an internal contributor, run \`bundle exec fastlane configure_secrets\` to update your secrets and try again"
EXTERNAL_CONTRIBUTOR_MSG="If you are an external contributor, run \`bundle exec rake init:oss\` to set up and use your own credentials"

case $CONFIGURATION in
Expand Down
8 changes: 3 additions & 5 deletions Scripts/BuildPhases/GenerateCredentials.xcfilelist
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
# Lists of input files for the script that populates the app's secrets with the
# correct values for the current scheme and build configuration.
${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets.swift
${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift
${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift
${HOME}/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift
${HOME}/.configure/wordpress-ios/secrets/Reader-Secrets.swift
${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/WordPress-Secrets.swift
${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/Jetpack-Secrets.swift
${HOME}/.a8c-secrets/wordpress-ios@github.com@wordpress-mobile/Reader-Secrets.swift
Comment on lines -3 to +5

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it intentional that the 3 .swift files that were previously split per configuration (Secrets/Secrets-Internal/Secrets-Alpha) for the WordPress target are now unified into a single one, not making the distinction anymore?

I looked at the current 3 files in our ~/.mobile-secrets (the ones used by configure_apply currently) and their content seem to be distinct for all 3:

  • Mostly the same between Secrets.swift and Secrets-Alpha.swift… except a different SentryDSN
  • Different SentryDSN but also different ClientID for Internal

So in practice this migration to have a single WordPress-Secrets.swift file for all 3 Xcode configurations of the WordPress target changes this behavior. Just wanted to check if this was intentional and had been discussed with the team (e.g. we wouldn't want crashes from Internal and Alpha to be reported in the same Sentry project as prod)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok reading the current content of the GenerateCredentials.sh script file I see that maybe the Secrets-Internal and Secrets-Alpha files were in practice never used (never copied by the script in the first place)? Or am I missing something? Or maybe this has been the case for ages and we never cleaned things up?
(I couldn't find a mention of this important gotcha in the PR description, so asking here so we can confirm a common understanding to be sure)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We no longer need any of the differentiated secrets files – everything can use the same credentials.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We no longer need any of the differentiated secrets files – everything can use the same credentials.

Consolidation to a single secret file felt like a bigger change than what this PR ought to hold. I reverted this to draft and opened #25803 to work on it.


# Local Secrets file that external contributors can use to specify their own
# ClientID and Secrets. This file is created by the Rakefile when external
Expand Down
Loading