From 5814cd2ebc8871957410fc92c5020b2f1d5ee388 Mon Sep 17 00:00:00 2001 From: Gio Lodi Date: Mon, 10 Aug 2026 13:18:27 +1000 Subject: [PATCH 1/2] Install secrets only in jobs that build the app `configure_apply` decrypts a single file, `Secrets.swift`, and its only consumer is the `GenerateCredentials.sh` Xcode build phase. The release-management and TestFlight-promotion jobs never invoke a compile, and take their App Store Connect, GitHub, and Slack credentials from Buildkite environment variables, so the decryption was dead weight there. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 --- .buildkite/commands/complete-code-freeze.sh | 3 --- .buildkite/commands/finalize-hotfix.sh | 3 --- .buildkite/commands/finalize-release.sh | 3 --- .buildkite/commands/gather-testflight-candidates.sh | 5 +---- .buildkite/commands/promote-build-to-public.sh | 5 +---- .buildkite/commands/promote-nightly.sh | 5 +---- .buildkite/release-pipelines/code-freeze.yml | 3 --- .buildkite/release-pipelines/new-beta-release.yml | 3 --- .buildkite/release-pipelines/new-hotfix.yml | 3 --- .buildkite/release-pipelines/publish-release.yml | 3 --- .buildkite/release-pipelines/update-app-store-strings.yml | 3 --- 11 files changed, 3 insertions(+), 36 deletions(-) diff --git a/.buildkite/commands/complete-code-freeze.sh b/.buildkite/commands/complete-code-freeze.sh index 9297d9e4d298..dccabcf320fa 100755 --- a/.buildkite/commands/complete-code-freeze.sh +++ b/.buildkite/commands/complete-code-freeze.sh @@ -14,8 +14,5 @@ source use-bot-for-git "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh" -echo '--- :closed_lock_with_key: Access secrets' -bundle exec fastlane run configure_apply - echo '--- :shipit: Complete code freeze' bundle exec fastlane complete_code_freeze skip_confirm:true diff --git a/.buildkite/commands/finalize-hotfix.sh b/.buildkite/commands/finalize-hotfix.sh index cb3be53d1d66..942410578b73 100755 --- a/.buildkite/commands/finalize-hotfix.sh +++ b/.buildkite/commands/finalize-hotfix.sh @@ -15,8 +15,5 @@ source use-bot-for-git echo '--- :ruby: Setup Ruby tools' install_gems -echo '--- :closed_lock_with_key: Access secrets' -bundle exec fastlane run configure_apply - echo '--- :shipit: Finalize hotfix' bundle exec fastlane finalize_hotfix_release skip_confirm:true diff --git a/.buildkite/commands/finalize-release.sh b/.buildkite/commands/finalize-release.sh index bbba37e01b8d..18ff3a002112 100755 --- a/.buildkite/commands/finalize-release.sh +++ b/.buildkite/commands/finalize-release.sh @@ -15,8 +15,5 @@ source use-bot-for-git echo '--- :ruby: Setup Ruby tools' install_gems -echo '--- :closed_lock_with_key: Access secrets' -bundle exec fastlane run configure_apply - echo '--- :shipit: Finalize release' bundle exec fastlane finalize_release skip_confirm:true diff --git a/.buildkite/commands/gather-testflight-candidates.sh b/.buildkite/commands/gather-testflight-candidates.sh index c7c2052b62c6..a8bd5eb696ab 100755 --- a/.buildkite/commands/gather-testflight-candidates.sh +++ b/.buildkite/commands/gather-testflight-candidates.sh @@ -1,13 +1,10 @@ #!/bin/bash -eu # Lists the nightly builds, opens the "choose a build" block step, and posts the -# candidate list to Slack. No build — just gems + secrets. +# candidate list to Slack. No build — just gems. echo "--- :rubygems: Setting up Gems" install_gems -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply - echo "--- :testflight: Gathering candidates and opening the block step" bundle exec fastlane gather_testflight_candidates diff --git a/.buildkite/commands/promote-build-to-public.sh b/.buildkite/commands/promote-build-to-public.sh index d7d510d10196..2fcea9d166d4 100755 --- a/.buildkite/commands/promote-build-to-public.sh +++ b/.buildkite/commands/promote-build-to-public.sh @@ -1,6 +1,6 @@ #!/bin/bash -eu -# Promotes the build chosen in the preceding block step to public beta. No build — just gems + secrets. +# Promotes the build chosen in the preceding block step to public beta. No build — just gems. # `build_to_promote` must stay in sync with PROMOTION_META_DATA_KEY in fastlane/lanes/promote.rb, # which is the key the gather lane writes the block-step select field under. @@ -14,8 +14,5 @@ fi echo "--- :rubygems: Setting up Gems" install_gems -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply - echo "--- :rocket: Promoting ${BUILD_CODE} to public beta" bundle exec fastlane promote_build build_code:"${BUILD_CODE}" diff --git a/.buildkite/commands/promote-nightly.sh b/.buildkite/commands/promote-nightly.sh index 76e15e7aa168..28c0586251f4 100755 --- a/.buildkite/commands/promote-nightly.sh +++ b/.buildkite/commands/promote-nightly.sh @@ -1,13 +1,10 @@ #!/bin/bash -eu -# Promotes the last build of the day to the nightly group. No build — just gems + secrets. +# Promotes the last build of the day to the nightly group. No build — just gems. echo "--- :rubygems: Setting up Gems" install_gems -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply - echo "--- :new_moon: Promoting last build of the day to nightly beta" # The lane refuses to run anywhere but trunk. bundle exec fastlane promote_nightly_build diff --git a/.buildkite/release-pipelines/code-freeze.yml b/.buildkite/release-pipelines/code-freeze.yml index e03a83cfbe41..43a93eb80064 100644 --- a/.buildkite/release-pipelines/code-freeze.yml +++ b/.buildkite/release-pipelines/code-freeze.yml @@ -18,9 +18,6 @@ steps: echo '--- :ruby: Setup Ruby tools' install_gems - echo '--- :closed_lock_with_key: Access secrets' - bundle exec fastlane run configure_apply - echo '--- :shipit: Run code freeze' bundle exec fastlane code_freeze version:"${RELEASE_VERSION}" skip_confirm:true retry: diff --git a/.buildkite/release-pipelines/new-beta-release.yml b/.buildkite/release-pipelines/new-beta-release.yml index 4835caaf293e..db065dbce699 100644 --- a/.buildkite/release-pipelines/new-beta-release.yml +++ b/.buildkite/release-pipelines/new-beta-release.yml @@ -19,9 +19,6 @@ steps: echo '--- :ruby: Setup Ruby tools' install_gems - echo '--- :closed_lock_with_key: Access secrets' - bundle exec fastlane run configure_apply - echo '--- :shipit: Deploy new beta' bundle exec fastlane new_beta_release skip_confirm:true retry: diff --git a/.buildkite/release-pipelines/new-hotfix.yml b/.buildkite/release-pipelines/new-hotfix.yml index ec8deef72852..d4a48fae2dc0 100644 --- a/.buildkite/release-pipelines/new-hotfix.yml +++ b/.buildkite/release-pipelines/new-hotfix.yml @@ -19,9 +19,6 @@ steps: echo '--- :ruby: Setup Ruby tools' install_gems - echo '--- :closed_lock_with_key: Access secrets' - bundle exec fastlane run configure_apply - echo '--- :shipit: Start new hotfix' bundle exec fastlane new_hotfix_release skip_confirm:true version:"$VERSION" retry: diff --git a/.buildkite/release-pipelines/publish-release.yml b/.buildkite/release-pipelines/publish-release.yml index 024c3f616f90..f25dfffbfeee 100644 --- a/.buildkite/release-pipelines/publish-release.yml +++ b/.buildkite/release-pipelines/publish-release.yml @@ -19,9 +19,6 @@ steps: echo '--- :ruby: Setup Ruby tools' install_gems - echo '--- :closed_lock_with_key: Access secrets' - bundle exec fastlane run configure_apply - echo '--- :package: Publish Release' bundle exec fastlane publish_release skip_confirm:true retry: diff --git a/.buildkite/release-pipelines/update-app-store-strings.yml b/.buildkite/release-pipelines/update-app-store-strings.yml index 83dc1a1bd6b5..1edfa69d0cb8 100644 --- a/.buildkite/release-pipelines/update-app-store-strings.yml +++ b/.buildkite/release-pipelines/update-app-store-strings.yml @@ -18,9 +18,6 @@ steps: echo '--- :ruby: Setup Ruby tools' install_gems - echo '--- :closed_lock_with_key: Access secrets' - bundle exec fastlane run configure_apply - echo '--- :shipit: Update relaese notes and other App Store metadata' bundle exec fastlane update_appstore_strings skip_confirm:true retry: From a46dcd094918496e41d1909ed5e5c1ac81af39e1 Mon Sep 17 00:00:00 2001 From: Gio Lodi Date: Mon, 10 Aug 2026 13:19:03 +1000 Subject: [PATCH 2/2] Extract the secrets install into a shared script The upcoming move to a8c-secrets then swaps one call site instead of six. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 5 --- .buildkite/commands/build-and-upload-testflight.sh | 3 +-- .buildkite/commands/build-for-testing.sh | 3 +-- .buildkite/commands/install-secrets.sh | 6 ++++++ .buildkite/commands/prototype-build-jetpack.sh | 3 +-- .buildkite/commands/prototype-build-wordpress.sh | 3 +-- .buildkite/commands/release-build-jetpack.sh | 3 +-- .buildkite/commands/release-build-wordpress.sh | 3 +-- 7 files changed, 12 insertions(+), 12 deletions(-) create mode 100755 .buildkite/commands/install-secrets.sh diff --git a/.buildkite/commands/build-and-upload-testflight.sh b/.buildkite/commands/build-and-upload-testflight.sh index d8d6ee04a81b..7a65810c4917 100755 --- a/.buildkite/commands/build-and-upload-testflight.sh +++ b/.buildkite/commands/build-and-upload-testflight.sh @@ -7,8 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh }" "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh" "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh" -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply +"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh" echo "--- :testflight: Building and uploading ${APP} to TestFlight" bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}" diff --git a/.buildkite/commands/build-for-testing.sh b/.buildkite/commands/build-for-testing.sh index 80fd7fae1e68..4350e855fed2 100755 --- a/.buildkite/commands/build-for-testing.sh +++ b/.buildkite/commands/build-for-testing.sh @@ -16,8 +16,7 @@ fi "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh" -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply +"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh" echo "--- :hammer_and_wrench: Building" bundle exec fastlane "build_${APP}_for_testing" diff --git a/.buildkite/commands/install-secrets.sh b/.buildkite/commands/install-secrets.sh new file mode 100755 index 000000000000..181f3e3267da --- /dev/null +++ b/.buildkite/commands/install-secrets.sh @@ -0,0 +1,6 @@ +#!/usr/bin/env bash + +set -euo pipefail + +echo "--- :closed_lock_with_key: Installing Secrets" +bundle exec fastlane run configure_apply diff --git a/.buildkite/commands/prototype-build-jetpack.sh b/.buildkite/commands/prototype-build-jetpack.sh index 8e91a0bdbfe8..621edef8bd75 100644 --- a/.buildkite/commands/prototype-build-jetpack.sh +++ b/.buildkite/commands/prototype-build-jetpack.sh @@ -7,8 +7,7 @@ fi "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh" "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh" -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply +"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh" echo "--- :hammer_and_wrench: Building" bundle exec fastlane build_and_upload_jetpack_prototype_build diff --git a/.buildkite/commands/prototype-build-wordpress.sh b/.buildkite/commands/prototype-build-wordpress.sh index 1798ddb780b8..9b649f5b636a 100644 --- a/.buildkite/commands/prototype-build-wordpress.sh +++ b/.buildkite/commands/prototype-build-wordpress.sh @@ -7,8 +7,7 @@ fi "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh" "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh" -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply +"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh" echo "--- :hammer_and_wrench: Building" bundle exec fastlane build_and_upload_wordpress_prototype_build diff --git a/.buildkite/commands/release-build-jetpack.sh b/.buildkite/commands/release-build-jetpack.sh index 0c8b3ad9f3e0..7de02454d910 100755 --- a/.buildkite/commands/release-build-jetpack.sh +++ b/.buildkite/commands/release-build-jetpack.sh @@ -3,8 +3,7 @@ "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh" "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh" -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply +"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh" echo "--- :hammer_and_wrench: Building" bundle exec fastlane build_and_upload_jetpack_for_app_store diff --git a/.buildkite/commands/release-build-wordpress.sh b/.buildkite/commands/release-build-wordpress.sh index 86326de30ba7..d8e92522c4d9 100755 --- a/.buildkite/commands/release-build-wordpress.sh +++ b/.buildkite/commands/release-build-wordpress.sh @@ -3,8 +3,7 @@ "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh" "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh" -echo "--- :closed_lock_with_key: Installing Secrets" -bundle exec fastlane run configure_apply +"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh" echo "--- :hammer_and_wrench: Building" bundle exec fastlane build_and_upload_app_store_connect \