Isolate E2E configuration and decrypt it in Bitrise by kieran-osgood-shopify · Pull Request #582 · Shopify/checkout-kit

kieran-osgood-shopify · 2026-08-05T09:43:37Z

Stack Context

This PR is two phased with #582 to achieve: Local and E2E runs will now always run the same configs - no drift.

#580 generate .env from .ejson
#582 generate e2e/.env from ejson, use the e2e/.env in Bitrise, meaning we can delete all the secrets in the bitrise UI as they're sourced from ejson now, and developers can have the exact config of bitrise locally

What?

Configure E2E sample builds from e2e/.env rather than whichever demo store is active in the root .env.
Ignore stale generated sample configuration when preparing an E2E build.
Replace Bitrise storefront secrets with one EJSON_PRIVATE_KEY secret.
Install the pinned ejson2env release in Bitrise, replace unexpected versions with a warning, and verify the archive against committed checksums.
Split setup documentation clearly between Shopify employees and external contributors.

Why?

The E2E sample apps could be built from the developer's demo configuration. That allowed tests to target the wrong storefront and inherit stale buyer identity values. Using e2e/.env for CI builds makes the selected store deterministic and keeps local demo work independent.

Bitrise now decrypts the same committed storefront source developers use instead of maintaining storefront secrets that can drift independently. BrowserStack credentials remain separate Bitrise secrets.

How to test

dev up
You should now see a

kieran-osgood-shopify · 2026-08-05T09:44:08Z

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

Build E2E apps from e2e/.env, not the demo store #583
Isolate E2E configuration and decrypt it in Bitrise #582 👈 (View in Graphite)
Generate env files from EJSON with local overrides #580 : 1 other dependent PR (#581 )
Promote checkout-guest to run on Swift/Kotlin #561 : 2 other dependent PRs (#562 , #599 )
Promote cart-hardcoded-buyer-identity test to run on swift/kotlin #560
feat(e2e): add the present-and-close checkout test on all four targets #559
Add local maestro runner - Run cart control-link on kotlin/swift #558
Replace the E2E suite cross product with Maestro tags in CI #557
feat(e2e): select tests by Maestro tag instead of scenario flags #556
feat(e2e): add an E2EController to each sample app #555
Add the E2E control link parser to all four sample apps #554
Add sample app test seams and run them in CI #553
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

kieran-osgood-shopify · 2026-08-21T11:57:52Z

+e2e_install_ejson_key() {
+  local keydir public_keys public_key rendered
+
+  : "${EJSON_PRIVATE_KEY:?EJSON_PRIVATE_KEY is required. Check https://app.bitrise.io/app/f51f9054-053e-40f1-81e9-ae727567ae76/workflow_editor#!/secrets and enable Expose for pull requests.}"


this is already set but is a guard incase we start up another pipeline

bitrise · 2026-08-21T12:22:24Z

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
React Native	Install with Tophat
Swift	Install with Tophat
Kotlin	Install with Tophat

Checkout Kit E2E results

Status	Suite	Target	Platform	OS version tag	Device
✅	`react-native-ios`	react-native	ios	latest	iPhone 15 iOS 27 Beta
✅	`react-native-android`	react-native	android	latest	Google Pixel 9 Android 17.0
✅	`kotlin-android`	kotlin	android	latest	Google Pixel 9 Android 17.0
✅	`swift-ios`	swift	ios	latest	iPhone 15 iOS 27 Beta

Bitrise held nine project secrets that had to stay aligned with what the suite reads. It now holds EJSON_PRIVATE_KEY only. bitrise_ci_helpers installs a pinned ejson2env, verifies its checksum, writes the key into a keydir, and runs generate_env_files, so CI decrypts the same committed files a developer does. The key reaches the keydir through a redirect and the credentials reach envman through a file, so neither enters an argument list or the build log. Installing the key is idempotent, because the mode it sets makes the file unwritable. e2e-execute-browserstack-run builds no app, so it exports the account credentials itself; every other workflow gets them through a sample app build. The docs stop describing prompts that no longer exist and say plainly which audience does what: employees run `dev secrets edit`, external contributors copy .env.example and keep their file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Assisted-By: devx/252dfd24-6c25-4bb4-8463-27702ec564eb

The E2E suite read its own e2e/.env for Maestro, but the sample apps it drives were still configured from the repo-root .env. That file comes from config/secrets/demo.ejson, which a developer may point at their own shop, so a suite run tested whichever store happened to be set up for manual work. scripts/setup_storefront_env takes --env-file, and e2e_configure_storefront passes e2e/.env. The four generated platform config files are shared, so the last run still wins, but nothing on the E2E path reads the demo store now. It also takes --ignore-generated. The script reads the files it generates as a value source, so a developer who lost .env keeps their store. That inheritance is wrong for the suite: on a workspace that already built the demo app those files hold the demo store and a Canadian address. e2e.ejson carries no address, so the United States defaults decide it instead. That last part is flake B2 returning by a new route. The original fix relied on CI holding no address values at all, which encrypted config changed. Two tests hold it now: scripts/test_setup_storefront_env covers the flag, and the new e2e/scripts/test_bitrise_ci_helpers asserts the argv the CI path builds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Assisted-By: devx/252dfd24-6c25-4bb4-8463-27702ec564eb

…ions

github-actions Bot added the #gsd:50662 Rebase Checkout Kit on UCP label Aug 5, 2026

This was referenced Aug 5, 2026

Store storefront config in encrypted ejson files #577

Merged

Pin the Apple Pay merchant identifier per sample app #578

Merged

Introduce .env.local as override layer on .env #579

Closed

This was referenced Aug 5, 2026

Generate env files from EJSON with local overrides #580

Open

Read E2E credentials from e2e/.env instead of the root .env #581

Closed

Build E2E apps from e2e/.env, not the demo store #583

Closed

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from 76f072a to ce17650 Compare August 5, 2026 11:06

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-run-maestro-e2e-env branch from bebc4d0 to 1dc2560 Compare August 5, 2026 11:06

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from ce17650 to 88b6724 Compare August 5, 2026 11:35

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-run-maestro-e2e-env branch 2 times, most recently from 39b95df to a8cf7ad Compare August 5, 2026 11:45

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from 88b6724 to a2af77b Compare August 5, 2026 11:45

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-run-maestro-e2e-env branch from a8cf7ad to b2235cf Compare August 5, 2026 12:33

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from a2af77b to 22eb2d4 Compare August 5, 2026 12:33

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-run-maestro-e2e-env branch from b2235cf to 84842c5 Compare August 6, 2026 15:48

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch 3 times, most recently from f21da07 to cb34ba1 Compare August 7, 2026 11:05

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-run-maestro-e2e-env branch 2 times, most recently from bdd7527 to 23d353a Compare August 7, 2026 11:28

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch 2 times, most recently from b76b5f1 to 4d50b40 Compare August 7, 2026 13:51

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-run-maestro-e2e-env branch 2 times, most recently from 3466ca1 to ef1f3ac Compare August 7, 2026 14:15

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch 2 times, most recently from 8b654b6 to eebdd2b Compare August 7, 2026 15:41

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-run-maestro-e2e-env branch from ef1f3ac to 9b59e1e Compare August 7, 2026 15:41

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from eebdd2b to a2b3bad Compare August 10, 2026 09:08

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-generate-env-files branch from 1910669 to d28dfce Compare August 12, 2026 14:54

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch 2 times, most recently from 4f9fde7 to c24dfc7 Compare August 14, 2026 14:35

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-generate-env-files branch from d28dfce to 329ae4f Compare August 14, 2026 14:35

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from c24dfc7 to 23fb5cd Compare August 14, 2026 16:24

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-generate-env-files branch from 329ae4f to f0bbb0f Compare August 14, 2026 16:24

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from 23fb5cd to 07e0611 Compare August 17, 2026 12:51

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-generate-env-files branch 2 times, most recently from 854b848 to 9039d2b Compare August 17, 2026 13:13

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch 2 times, most recently from 14afe22 to d13eb64 Compare August 18, 2026 09:27

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-generate-env-files branch from 0cfc1a6 to cfd107d Compare August 20, 2026 18:09

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch 2 times, most recently from 4faceeb to 979c54d Compare August 21, 2026 08:15

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-generate-env-files branch from cfd107d to e017ab2 Compare August 21, 2026 10:59

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from 979c54d to 218cc1d Compare August 21, 2026 10:59

kieran-osgood-shopify changed the base branch from kieran-osgood/ejson-generate-env-files to graphite-base/582 August 21, 2026 11:17

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from 218cc1d to bcc6d14 Compare August 21, 2026 11:47

kieran-osgood-shopify force-pushed the graphite-base/582 branch from e017ab2 to ee691bc Compare August 21, 2026 11:47

kieran-osgood-shopify changed the base branch from graphite-base/582 to kieran-osgood/ejson-generate-env-files August 21, 2026 11:47

kieran-osgood-shopify commented Aug 21, 2026

View reviewed changes

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from bcc6d14 to 2be764e Compare August 21, 2026 12:02

kieran-osgood-shopify marked this pull request as ready for review August 21, 2026 12:02

kieran-osgood-shopify requested a review from a team as a code owner August 21, 2026 12:02

kieran-osgood-shopify and others added 3 commits August 21, 2026 13:23

Remove test_bitrise_ci_helpers and PR 583's storefront-env test addit…

fc1b78e

…ions

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-ci-and-docs branch from 2be764e to fc1b78e Compare August 21, 2026 12:23

kieran-osgood-shopify force-pushed the kieran-osgood/ejson-generate-env-files branch from ee691bc to aa596d1 Compare August 21, 2026 12:23

Navigation Menu

Uh oh!

Isolate E2E configuration and decrypt it in Bitrise - #582

Isolate E2E configuration and decrypt it in Bitrise#582
kieran-osgood-shopify wants to merge 3 commits into
kieran-osgood/ejson-generate-env-filesfrom
kieran-osgood/ejson-ci-and-docs

kieran-osgood-shopify commented Aug 5, 2026 •

edited

Loading

Uh oh!

kieran-osgood-shopify commented Aug 5, 2026 •

edited

Loading

Uh oh!

kieran-osgood-shopify Aug 21, 2026

Uh oh!

bitrise Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kieran-osgood-shopify commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Stack Context

What?

Why?

How to test

Uh oh!

kieran-osgood-shopify commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kieran-osgood-shopify Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

bitrise Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Install this build

Checkout Kit E2E results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kieran-osgood-shopify commented Aug 5, 2026 •

edited

Loading

kieran-osgood-shopify commented Aug 5, 2026 •

edited

Loading

bitrise Bot commented Aug 21, 2026 •

edited

Loading