Adopt a8c-secrets in WordPress iOS

.buildkite/commands/build-and-upload-testflight.sh

@@ -7,8 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh <wordpress|jetpack|reader>}"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :testflight: Building and uploading ${APP} to TestFlight"
 bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}"

.buildkite/commands/build-for-testing.sh

@@ -16,12 +16,7 @@ fi
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane "build_${APP}_for_testing"

.buildkite/commands/complete-code-freeze.sh

@@ -14,8 +14,7 @@ source use-bot-for-git
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Complete code freeze'
 bundle exec fastlane complete_code_freeze skip_confirm:true

.buildkite/commands/finalize-hotfix.sh

@@ -15,8 +15,7 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Finalize hotfix'
 bundle exec fastlane finalize_hotfix_release skip_confirm:true

.buildkite/commands/finalize-release.sh

@@ -15,8 +15,7 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo '--- :shipit: Finalize release'
 bundle exec fastlane finalize_release skip_confirm:true

.buildkite/commands/gather-testflight-candidates.sh

@@ -6,8 +6,7 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :testflight: Gathering candidates and opening the block step"
 bundle exec fastlane gather_testflight_candidates

.buildkite/commands/install-secrets.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "--- :closed_lock_with_key: Installing Secrets"
+bundle exec fastlane run configure_apply

.buildkite/commands/lint-localized-strings-format.sh

@@ -4,8 +4,4 @@ if "$(dirname "${BASH_SOURCE[0]}")/should-skip-job.sh" --job-type localization;
   exit 0
 fi
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 lint_localized_strings_format

.buildkite/commands/promote-build-to-public.sh

@@ -14,8 +14,7 @@ fi
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :rocket: Promoting ${BUILD_CODE} to public beta"
 bundle exec fastlane promote_build build_code:"${BUILD_CODE}"

.buildkite/commands/promote-nightly.sh

@@ -5,8 +5,7 @@
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :new_moon: Promoting last build of the day to nightly beta"
 # The lane refuses to run anywhere but trunk.

.buildkite/commands/prototype-build-jetpack.sh

@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_prototype_build

.buildkite/commands/prototype-build-wordpress.sh

@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_wordpress_prototype_build

.buildkite/commands/release-build-jetpack.sh

@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_for_app_store

.buildkite/commands/release-build-wordpress.sh

@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_app_store_connect \

.buildkite/commands/verify-strings-catalog.sh

@@ -11,10 +11,6 @@ fi
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :writing_hand: Copy Files"
-mkdir -pv ~/.configure/wordpress-ios/secrets
-cp -v fastlane/env/project.env-example ~/.configure/wordpress-ios/secrets/project.env
-
 echo "--- :package: Generate Localizable.xcstrings from source"
 bundle exec fastlane ios generate_strings_catalog
 

.buildkite/release-pipelines/code-freeze.yml

@@ -18,8 +18,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Run code freeze'
       bundle exec fastlane code_freeze version:"${RELEASE_VERSION}" skip_confirm:true

.buildkite/release-pipelines/new-beta-release.yml

@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Deploy new beta'
       bundle exec fastlane new_beta_release skip_confirm:true

.buildkite/release-pipelines/new-hotfix.yml

@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Start new hotfix'
       bundle exec fastlane new_hotfix_release skip_confirm:true version:"$VERSION"

.buildkite/release-pipelines/publish-release.yml

@@ -19,8 +19,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :package: Publish Release'
       bundle exec fastlane publish_release skip_confirm:true

.buildkite/release-pipelines/update-app-store-strings.yml

@@ -18,8 +18,7 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
+      .buildkite/commands/install-secrets.sh
 
       echo '--- :shipit: Update relaese notes and other App Store metadata'
       bundle exec fastlane update_appstore_strings skip_confirm:true

.configure

@@ -3,11 +3,6 @@
   "branch": "trunk",
   "pinned_hash": "6baf4e086398ddf8141d7132e557703a715fafd2",
   "files_to_copy": [
-    {
-      "file": "iOS/WPiOS/project.env",
-      "destination": "~/.configure/wordpress-ios/secrets/project.env",
-      "encrypt": true
-    },
     {
       "file": "iOS/WPiOS/Secrets.swift",
       "destination": "~/.configure/wordpress-ios/secrets/WordPress-Secrets.swift",

fastlane/Fastfile

@@ -5,6 +5,8 @@ fastlane_require 'dotenv'
 fastlane_require 'open-uri'
 fastlane_require 'git'
 
+require_relative 'lanes/xcconfig_helper'
+
 UI.user_error!('Please run fastlane via `bundle exec`') unless FastlaneCore::Helper.bundler?
 
 ########################################################################
@@ -27,8 +29,6 @@ BETA_APP_DESCRIPTION_PATH_READER = File.join(PROJECT_ROOT_FOLDER, 'fastlane', 'r
 # Env file paths to load
 ENV_FILE_NAME = '.wpios-env.default'
 USER_ENV_FILE_PATH = File.join(Dir.home, ENV_FILE_NAME)
-SECRETS_DIR = File.join(Dir.home, '.configure', 'wordpress-ios', 'secrets')
-PROJECT_ENV_FILE_PATH = File.join(SECRETS_DIR, 'project.env')
 
 WORDPRESS_BUNDLE_IDENTIFIER = 'org.wordpress'
 WORDPRESS_EXTENSIONS_BUNDLE_IDENTIFIERS = %w[
@@ -54,10 +54,13 @@ ALL_READER_BUNDLE_IDENTIFIERS = [READER_BUNDLE_IDENTIFIER].freeze
 
 # Environment Variables — used by lanes but also potentially actions
 Dotenv.load(USER_ENV_FILE_PATH)
-Dotenv.load(PROJECT_ENV_FILE_PATH)
 GITHUB_REPO = 'wordpress-mobile/wordpress-iOS'
 DEFAULT_BRANCH = 'trunk'
 PUBLIC_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Version.public.xcconfig')
+ALPHA_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Common.alpha.xcconfig')
+RELEASE_CONFIG_FILE = File.join(PROJECT_ROOT_FOLDER, 'config', 'Common.release.xcconfig')
+INTERNAL_TEAM_ID = XcconfigHelper.fetch(path: ALPHA_CONFIG_FILE, key: 'DEVELOPMENT_TEAM')
+EXTERNAL_TEAM_ID = XcconfigHelper.fetch(path: RELEASE_CONFIG_FILE, key: 'DEVELOPMENT_TEAM')
 ENV['FASTLANE_WWDR_USE_HTTP1_AND_RETRIES'] = 'true'
 
 # Fastlane's `git_branch` action and its relevant helpers use environment variables to modify the output.
@@ -197,10 +200,6 @@ before_all do |lane|
     example_path = 'fastlane/env/user.env-example '
     UI.user_error! "#{ENV_FILE_NAME} not found: Please copy #{example_path} to #{USER_ENV_FILE_PATH} and fill in the values."
   end
-
-  unless File.file?(PROJECT_ENV_FILE_PATH)
-    UI.user_error!("project.env not found at #{PROJECT_ENV_FILE_PATH}: Make sure your configuration is up to date with `rake dependencies`")
-  end
 end
 
 def compute_release_branch_name(options:, version: release_version_current)

fastlane/lanes/build.rb

@@ -168,7 +168,7 @@
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_WORDPRESS,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'app-store' }
     )
 
@@ -234,7 +234,7 @@
       scheme: 'Jetpack',
       workspace: WORKSPACE_PATH,
       clean: true,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_JETPACK,
       derived_data_path: DERIVED_DATA_PATH,
@@ -283,7 +283,7 @@
       scheme: 'Reader',
       workspace: WORKSPACE_PATH,
       clean: true,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: APP_STORE_CONNECT_BUILD_NAME_READER,
       derived_data_path: DERIVED_DATA_PATH,
@@ -373,7 +373,7 @@
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: output_name,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+      export_team_id: EXTERNAL_TEAM_ID,
       xcargs: { VERSION_LONG: build_code },
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'app-store' }
     )
@@ -486,7 +486,7 @@ def build_and_upload_prototype_build(scheme:, output_app_name:, firebase_app_con
       output_directory: BUILD_PRODUCTS_PATH,
       output_name: output_app_name,
       derived_data_path: DERIVED_DATA_PATH,
-      export_team_id: ENV.fetch('INT_EXPORT_TEAM_ID', nil),
+      export_team_id: INTERNAL_TEAM_ID,
       export_method: 'enterprise',
       export_options: { **COMMON_EXPORT_OPTIONS, method: 'enterprise' }
     )
@@ -516,7 +516,6 @@ def upload_build_to_testflight(ipa_path:, whats_new_path:, distribution_groups:,
     distribute_external = distribution_groups.empty? == false
 
     upload_to_testflight(
-      team_id: get_required_env('FASTLANE_ITC_TEAM_ID'),
       api_key: app_store_connect_api_key,
       ipa: ipa_path,
       beta_app_description: File.read(beta_app_description_path),

fastlane/lanes/codesign.rb

@@ -131,7 +131,7 @@ def update_code_signing_enterprise(readonly:, app_identifiers:)
   update_code_signing(
     type: 'enterprise',
     # Enterprise builds belong to the "internal" team
-    team_id: get_required_env('INT_EXPORT_TEAM_ID'),
+    team_id: INTERNAL_TEAM_ID,
     readonly: readonly,
     app_identifiers: app_identifiers,
     api_key: nil
@@ -142,7 +142,7 @@ def update_code_signing_app_store(readonly:, app_identifiers:)
   update_code_signing(
     type: 'appstore',
     # App Store builds belong to the "external" team
-    team_id: get_required_env('EXT_EXPORT_TEAM_ID'),
+    team_id: EXTERNAL_TEAM_ID,
     readonly: readonly,
     app_identifiers: app_identifiers,
     api_key: app_store_connect_api_key

fastlane/lanes/promote.rb

@@ -208,7 +208,6 @@ def promote_existing_build_to_groups(app:, app_version:, build_code:, changelog:
 
   upload_to_testflight(
     api_key: app_store_connect_api_key,
-    team_id: get_required_env('FASTLANE_ITC_TEAM_ID'),
     app_identifier: app[:identifier],
     app_platform: 'ios',
     app_version: app_version,

fastlane/lanes/xcconfig_helper.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'xcodeproj'
+
+# Reads build settings out of `.xcconfig` files, so that values the Xcode project already declares don't
+# need to be duplicated in fastlane's environment.
+module XcconfigHelper
+  module_function
+
+  class Error < StandardError
+  end
+
+  # Returns the value of `key`, resolving `#include`s and raising unless it's a non-empty string.
+  #
+  # @param path [String] Path to the `.xcconfig` file to read.
+  # @param key [String] Name of the build setting, e.g. `DEVELOPMENT_TEAM`.
+  #
+  def fetch(path:, key:)
+    raise Error, "No such xcconfig file: #{path}" unless File.file?(path)
+
+    # `to_hash` resolves `#include`d files, unlike `attributes`, which only sees the ones set in `path`.
+    value = Xcodeproj::Config.new(path).to_hash[key]
+
+    raise Error, "Build setting '#{key}' not found in #{path}" if value.nil?
+    raise Error, "Build setting '#{key}' is empty in #{path}" if value.empty?
+
+    value
+  end
+end