Skip to content

Use the same secrets file across WordPress, Jetpack, and Reader #25803

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mokagio wants to merge 13 commits into
base: trunk
Choose a base branch
from
Open

Use the same secrets file across WordPress, Jetpack, and Reader #25803

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
04991b8
Remove dead Google login credentials
mokagio Jul 18, 2026
78eab4e
Remove dead GoogleSignIn URL scheme entries
mokagio Jul 18, 2026
db82159
Move Sentry DSN definition from secrets to `Info.plist`
mokagio Jul 18, 2026
bbf8b86
Update DocsBot documentation links
mokagio Jul 18, 2026
d307d50
Move Docs Bot ID from secrets to Jetpack's `Info.plist`
mokagio Jul 18, 2026
f36f7c3
Read one secrets file for all app targets
mokagio Jul 18, 2026
50b23a6
Fix stale script path in credentials filelist
mokagio Jul 18, 2026
78ff447
Store the Sentry DSN without its scheme
mokagio Jul 18, 2026
75ac465
Slim down AI-generated comment
mokagio Jul 19, 2026
e04d3b5
Name the Sentry DSN key for its missing scheme
mokagio Jul 19, 2026
734d36f
Remove now-unused app-specific secrets
mokagio Jul 19, 2026
8aa1cf2
Drop the app prefix from the secrets file name
mokagio Jul 19, 2026
4224877
Merge branch 'trunk' into ainfra-2711-collapse-build-time-secrets-inj…
mokagio Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 1 addition & 21 deletions .configure
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,27 +5,7 @@
"files_to_copy": [
{
"file": "iOS/WPiOS/Secrets.swift",
"destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",
"encrypt": true
},
{
"file": "iOS/WPiOS/Secrets-Internal.swift",
"destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift",
"encrypt": true
},
{
"file": "iOS/WPiOS/Secrets-Alpha.swift",
"destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift",
"encrypt": true
},
{
"file": "iOS/JPiOS/Jetpack-Secrets.swift",
"destination": "~/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift",
"encrypt": true
},
{
"file": "iOS/Reader/Reader-Secrets.swift",
"destination": "~/.configure/wordpress-ios/secrets/Reader-Secrets.swift",
"destination": "~/.configure/wordpress-ios/secrets/Secrets.swift",
"encrypt": true
}
],
Expand Down
Binary file removed .configure-files/Jetpack-Secrets.swift.enc
View file
Open in desktop
Binary file not shown.
Binary file removed .configure-files/Reader-Secrets.swift.enc
View file
Open in desktop
Binary file not shown.
Binary file removed .configure-files/Secrets-Alpha.swift.enc
View file
Open in desktop
Binary file not shown.
Binary file removed .configure-files/Secrets-Internal.swift.enc
View file
Open in desktop
Binary file not shown.
24 changes: 0 additions & 24 deletions Modules/Sources/BuildSettingsKit/BuildSecrets.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,18 +10,6 @@ public struct BuildSecrets: Sendable {
}
}

public struct Google: Sendable {
public let clientId: String
public let schemeId: String
public let serverClientId: String

public init(clientId: String, schemeId: String, serverClientId: String) {
self.clientId = clientId
self.schemeId = schemeId
self.serverClientId = serverClientId
}
}

Comment on lines -13 to -24

@mokagio mokagio Jul 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Google login was removed recently, see #25644 and #25645. We don't need to track the credentials anymore.

public struct Zendesk: Sendable {
public let appId: String
public let url: String
Expand All @@ -35,27 +23,18 @@ public struct BuildSecrets: Sendable {
}

public let oauth: OAuth
public let google: Google
public let zendesk: Zendesk
public let sentryDSN: String
public let docsBotId: String
Comment on lines -40 to -41

@mokagio mokagio Jul 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both Sentry's DSN and Docs Bot identifier are designed to be public. The links to the respective documentation are in the new properties definitions below.

@mokagio mokagio Jul 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assumed Docs Bot is actually in use, but haven't verified it. From the code, I can see that it's Jetpack-only and behind a feature flag.

@jkmassel @crazytonyli if the flag is off and the integration no longer needed, I can create a follow up to delete it and it's code usages from the app.

Otherwise, maybe we could refine to use a String? instead. This way, when reading from Info.plist we can treat empty string values as nil (or remove the empty string key in the first place) and keep the code clearer. But... I might be getting ahead of myself.

public let encryptedLogsKey: String
public let debuggingKey: String

public init(
oauth: OAuth,
google: Google,
zendesk: Zendesk,
sentryDSN: String,
docsBotId: String,
encryptedLogsKey: String,
debuggingKey: String
) {
self.oauth = oauth
self.google = google
self.zendesk = zendesk
self.sentryDSN = sentryDSN
self.docsBotId = docsBotId
self.encryptedLogsKey = encryptedLogsKey
self.debuggingKey = debuggingKey
}
Expand All @@ -65,10 +44,7 @@ extension BuildSecrets {

public static let dummy = BuildSecrets(
oauth: .init(client: "", secret: ""),
google: .init(clientId: "", schemeId: "", serverClientId: ""),
zendesk: .init(appId: "", url: "", clientId: ""),
sentryDSN: "",
docsBotId: "",
encryptedLogsKey: "",
debuggingKey: ""
)
Expand Down
3 changes: 3 additions & 0 deletions Modules/Sources/BuildSettingsKit/BuildSettings+Live.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ extension BuildSettings {
zendeskSourcePlatform = bundle.infoValue(forKey: "WPZendeskSourcePlatform")
mobileAnnounceAppID = bundle.infoValue(forKey: "WPMobileAnnounceAppID")
authKeychainServiceName = bundle.infoValue(forKey: "WPAuthKeychainServiceName")
// The plist does not carry the URL scheme because the C preprocessor treats the `//` as a comment resulting in a truncated value.
sentryDSN = "https://" + bundle.infoValue(forKey: "WPSentryNoSchemeDSN")

@mokagio mokagio Jul 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tracked https://linear.app/a8c/issue/AINFRA-2713 to follow up on making the "no scheme" requirement clearer in the whole plist.

docsBotId = bundle.infoValue(forKey: "WPDocsBotId")
}
}

Expand Down
4 changes: 3 additions & 1 deletion Modules/Sources/BuildSettingsKit/BuildSettings+Preview.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,9 @@ extension BuildSettings {
),
zendeskSourcePlatform: "zen",
mobileAnnounceAppID: "1234567890",
authKeychainServiceName: "public-api.wordpress.com"
authKeychainServiceName: "public-api.wordpress.com",
sentryDSN: "",
docsBotId: ""
)
}

Expand Down
6 changes: 6 additions & 0 deletions Modules/Sources/BuildSettingsKit/BuildSettings.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,12 @@ public struct BuildSettings: Sendable {
public var zendeskSourcePlatform: String
public var mobileAnnounceAppID: String
public var authKeychainServiceName: String
/// See [Sentry: DSN utilization](https://docs.sentry.io/concepts/key-terms/dsn-explainer/#dsn-utilization)
public var sentryDSN: String
/// Empty outside Jetpack, the only app that presents the support chat bot.
///
/// See [DocsBot: Embeddable Chat Widget](https://docsbot.ai/documentation/developer/embeddable-chat-widget)
public var docsBotId: String

public struct ProductAboutDetails: Sendable {
public var blogURL: URL
Expand Down
35 changes: 8 additions & 27 deletions Scripts/BuildPhases/GenerateCredentials.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
#!/bin/bash -euo pipefail
#!/usr/bin/env bash

set -euo pipefail

# The Secrets File Sources
SECRETS_ROOT="${HOME}/.configure/wordpress-ios/secrets"
Expand Down Expand Up @@ -47,13 +49,8 @@ function ensure_is_in_input_files_list() {
fi
}

WORDPRESS_SECRETS_FILE="${SECRETS_ROOT}/WordPress-Secrets.swift"
ensure_is_in_input_files_list $WORDPRESS_SECRETS_FILE
JETPACK_SECRETS_FILE="${SECRETS_ROOT}/Jetpack-Secrets.swift"
ensure_is_in_input_files_list $JETPACK_SECRETS_FILE

READER_SECRETS_FILE="${SECRETS_ROOT}/Reader-Secrets.swift"
ensure_is_in_input_files_list $READER_SECRETS_FILE
SECRETS_FILE="${SECRETS_ROOT}/Secrets.swift"
ensure_is_in_input_files_list $SECRETS_FILE

LOCAL_SECRETS_FILE="${SRCROOT}/Credentials/Secrets.swift"
EXAMPLE_SECRETS_FILE="${SRCROOT}/Credentials/Secrets-example.swift"
Expand All @@ -63,26 +60,10 @@ ensure_is_in_input_files_list $EXAMPLE_SECRETS_FILE
SECRETS_DESTINATION_FILE="${SCRIPT_OUTPUT_FILE_0}"
mkdir -p "$(dirname "$SECRETS_DESTINATION_FILE")"

WORDPRESS_TARGETS=("WordPress" "WordPressShareExtension" "WordPressDraftActionExtension" "WordPressNotificationServiceExtension")
# If the WordPress Production Secrets are available for WordPress, use them
if [ -f "$WORDPRESS_SECRETS_FILE" ] && [[ " ${WORDPRESS_TARGETS[*]} " == *" $TARGET_NAME "* ]]; then
# WordPress, Jetpack, and Reader use all the same secrets at this time.
if [ -f "$SECRETS_FILE" ]; then
echo "Applying Production Secrets"
cp -v "$WORDPRESS_SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
exit 0
fi

JETPACK_TARGETS=("Jetpack" "JetpackStatsWidgets" "JetpackShareExtension" "JetpackDraftActionExtension" "JetpackNotificationServiceExtension")
# If the Jetpack Secrets are available and if we're building Jetpack use them
if [ -f "$JETPACK_SECRETS_FILE" ] && [[ " ${JETPACK_TARGETS[*]} " == *" $TARGET_NAME "* ]]; then
echo "Applying Jetpack Secrets"
cp -v "$JETPACK_SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
exit 0
fi

# If the Reader Secrets are available and if we're building Reader use them
if [ -f "$READER_SECRETS_FILE" ] && [ "${TARGET_NAME}" == "Reader" ]; then
echo "Applying Reader Secrets"
cp -v "$READER_SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
cp -v "$SECRETS_FILE" "${SECRETS_DESTINATION_FILE}"
exit 0
fi

Expand Down
8 changes: 2 additions & 6 deletions Scripts/BuildPhases/GenerateCredentials.xcfilelist
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,6 @@
# Lists of input files for the script that populates the app's secrets with the
# correct values for the current scheme and build configuration.
${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets.swift
${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Internal.swift
${HOME}/.configure/wordpress-ios/secrets/WordPress-Secrets-Alpha.swift
${HOME}/.configure/wordpress-ios/secrets/Jetpack-Secrets.swift
${HOME}/.configure/wordpress-ios/secrets/Reader-Secrets.swift
${HOME}/.configure/wordpress-ios/secrets/Secrets.swift

# Local Secrets file that external contributors can use to specify their own
# ClientID and Secrets. This file is created by the Rakefile when external
Expand All @@ -18,4 +14,4 @@ ${SRCROOT}/Credentials/Secrets-example.swift

# Add the script that uses this file as a source, so that, if the script
# changes, Xcode will run it again on the next build.
${SRCROOT}/../Scripts/BuildPhases/ApplyConfiguration.sh
${SRCROOT}/../Scripts/BuildPhases/GenerateCredentials.sh
Comment on lines -21 to +17

@mokagio mokagio Jul 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a little inconsistency that had gone unnoticed so far.

14 changes: 4 additions & 10 deletions Sources/Jetpack/Info.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -555,16 +555,6 @@
<string>jetpacknotificationmigration</string>
</array>
</dict>
<dict>
<key>CFBundleTypeRole</key>
<string>Editor</string>
<key>CFBundleURLName</key>
<string>GoogleSignIn</string>
<key>CFBundleURLSchemes</key>
<array>
<string>com.googleusercontent.apps.108380595987-qmh1rvuqi418cs6otokppnemo48288c9</string>
</array>
</dict>
</array>
<key>CFBundleVersion</key>
<string>$(CURRENT_PROJECT_VERSION)</string>
Expand Down Expand Up @@ -666,6 +656,8 @@
<string>jetpack.public-api.wordpress.com</string>
<key>WPBuildConfiguration</key>
<string>${WP_BUILD_CONFIGURATION}</string>
<key>WPDocsBotId</key>
<string>TqTdebbGjJeUjrmBIFjh/YbAMwiheXLs2Ue5j7elH</string>
<key>WPEventNamePrefix</key>
<string>jpios</string>
<key>WPExplatPlatform</key>
Expand All @@ -680,6 +672,8 @@
<string>jetpack.com/blog</string>
<key>WPPushNotificationAppID</key>
<string>${WP_PUSH_NOTIFICATION_APP_ID}</string>
<key>WPSentryNoSchemeDSN</key>
<string>ed059b31605743eb8cfb5034bc4a195c@o248881.ingest.sentry.io/5716771</string>
<key>WPZendeskSourcePlatform</key>
<string>mobile_-_jp_ios</string>
</dict>
Expand Down
4 changes: 4 additions & 0 deletions Sources/Reader/Info.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
<string>reader.public-api.wordpress.com</string>
<key>WPBuildConfiguration</key>
<string>${WP_BUILD_CONFIGURATION}</string>
<key>WPDocsBotId</key>
<string></string>
<key>WPEventNamePrefix</key>
<string>jpios</string>
<key>WPExplatPlatform</key>
Expand All @@ -33,6 +35,8 @@
<string>jetpack.com/blog</string>
<key>WPPushNotificationAppID</key>
<string>${WP_PUSH_NOTIFICATION_APP_ID}</string>
<key>WPSentryNoSchemeDSN</key>
<string>2a7b5c4f9d325dd2b93f0abff78cb9c1@o248881.ingest.us.sentry.io/4509160620621824</string>
<key>WPZendeskSourcePlatform</key>
<string>mobile_-_jp_ios</string>
</dict>
Expand Down
14 changes: 4 additions & 10 deletions Sources/WordPress/Info.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -481,16 +481,6 @@
<string>wordpressnotificationmigration</string>
</array>
</dict>
<dict>
<key>CFBundleTypeRole</key>
<string>Editor</string>
<key>CFBundleURLName</key>
<string>GoogleSignIn</string>
<key>CFBundleURLSchemes</key>
<array>
<string>com.googleusercontent.apps.108380595987-ujhrhknecrqli756i72gkcs4aaia6nhb</string>
</array>
</dict>
</array>
<key>CFBundleVersion</key>
<string>${VERSION_LONG}</string>
Expand Down Expand Up @@ -591,6 +581,8 @@
<string>public-api.wordpress.com</string>
<key>WPBuildConfiguration</key>
<string>${WP_BUILD_CONFIGURATION}</string>
<key>WPDocsBotId</key>
<string></string>
<key>WPEventNamePrefix</key>
<string>wpios</string>
<key>WPExplatPlatform</key>
Expand All @@ -605,6 +597,8 @@
<string>wordpress.org/news/</string>
<key>WPPushNotificationAppID</key>
<string>${WP_PUSH_NOTIFICATION_APP_ID}</string>
<key>WPSentryNoSchemeDSN</key>
<string>484d81126ac9483da3756876e80148ab@o248881.ingest.sentry.io/1438083</string>
<key>WPZendeskSourcePlatform</key>
<string>mobile_-_ios</string>
</dict>
Expand Down
7 changes: 0 additions & 7 deletions WordPress/Classes/System/ApiCredentials+BuildSecrets.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,18 +5,11 @@ extension ApiCredentials {
static func toSecrets() -> BuildSecrets {
BuildSecrets(
oauth: .init(client: client, secret: secret),
google: .init(
clientId: googleLoginClientId,
schemeId: googleLoginSchemeId,
serverClientId: googleLoginServerClientId
),
zendesk: .init(
appId: zendeskAppId,
url: zendeskUrl,
clientId: zendeskClientId
),
sentryDSN: sentryDSN,
docsBotId: docsBotId,
encryptedLogsKey: encryptedLogKey,
debuggingKey: debuggingKey
)
Expand Down
2 changes: 1 addition & 1 deletion WordPress/Classes/Utility/Logging/WPCrashLoggingProvider.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ struct WPCrashLoggingDataProvider: CrashLoggingDataProvider {

init(
contextManager: ContextManager = .shared,
sentryDSN: String = BuildSettings.current.secrets.sentryDSN
sentryDSN: String = BuildSettings.current.sentryDSN
) {
self.contextManager = contextManager
self.sentryDSN = sentryDSN
Expand Down
2 changes: 1 addition & 1 deletion WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewController.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ final class SupportChatBotViewController: UIViewController {
}

/// Creating DocsBotAI JavaScript code so we could tweak configuration from within Swift code
/// https://docsbot.ai/docs/embeddable-chat-widget
/// https://docsbot.ai/documentation/developer/embeddable-chat-widget
private func createDocsBotInitCode() -> String {
"""
(function() {
Expand Down
2 changes: 1 addition & 1 deletion WordPress/Classes/ViewRelated/Support/SupportChatBot/SupportChatBotViewModel.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ struct SupportChatBotViewModel {

init(
zendeskUtils: ZendeskUtilsProtocol = ZendeskUtils.sharedInstance,
docsBotId: String = BuildSettings.current.secrets.docsBotId
docsBotId: String = BuildSettings.current.docsBotId
) {
self.zendeskUtils = zendeskUtils
self.docsBotId = docsBotId
Expand Down
7 changes: 0 additions & 7 deletions WordPress/Credentials/Secrets-example.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,19 +7,12 @@ class ApiCredentials: NSObject {
static let client = "0"
static let secret = "your-secret-here"

// Google Login
static let googleLoginClientId = ""
static let googleLoginSchemeId = ""
static let googleLoginServerClientId = ""

// ZenDesk
static let zendeskAppId = ""
static let zendeskUrl = ""
static let zendeskClientId = ""

// Other Services
static let sentryDSN = ""
static let encryptedLogKey = ""
static let debuggingKey = ""
static let docsBotId = ""
}