Adopt a8c-secrets for encrypted secrets by mokagio · Pull Request #4731 · Automattic/pocket-casts-ios

mokagio · 2026-07-11T05:22:21Z

What it does

Replaces mobile-secrets/.configure with a8c-secrets. Context: paaHJt-96q-p2

How to test

Automattic contributors only

Checkout this branch
Notice that .configure and .configure-files/ now appear as new, untracked files in the repo. Delete them. rm -rf .configure .configure-files
Set up a8c-secrets following the instructions on the repository. You can find the dev key our internal secrets store searching for a8c-secrets - pocket-casts-ios - dev private key
Run bundle exec fastlane configure_secrets
Verify the app builds alright.

Prevents EOL normalization from corrupting the encrypted ciphertext and suppresses meaningless text diffs on the encrypted blobs. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The three remaining `configure` secrets, re-encrypted with `age` so they can be consumed via `a8c-secrets decrypt`. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Point the Xcode build settings, `Makefile`, build-phase scripts, and Buildkite steps at the `a8c-secrets` decrypted directory (`~/.a8c-secrets/pocket-casts-ios@github.com@automattic/`) and replace every `configure_apply` call with `a8c-secrets decrypt`. Remove the now-unused `.configure`/`.configure-files` release-toolkit secret store. CI dependency: Buildkite agents must have the `a8c-secrets` binary on `PATH` and `A8C_SECRETS_IDENTITY` set for the decrypt step to succeed. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Extract the repeated "install secrets" step into `.buildkite/commands/install-secrets.sh`, matching the wcios convention: it installs the `a8c-secrets` binary, puts it on `PATH`, and runs the new `configure_secrets` fastlane lane (guard + `a8c-secrets decrypt`), all in one process. `shared_setup.sh` and the release pipelines call the script instead of inlining the decrypt. Installing the binary here is what lets CI agents run the decrypt at all — the previous inline `a8c-secrets decrypt` assumed a binary the agents don't ship. Drop the redundant `before_all` decrypt: the parent build lane won't have `~/.local/bin` on `PATH`, and secrets are already on disk from install-secrets. Agents still need `A8C_SECRETS_IDENTITY` set in Buildkite for decrypt to succeed. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Ask the tool for the decrypted file location instead of hardcoding the `a8c-secrets` directory layout, so `upload_dsyms` keeps working if the path convention changes. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

--- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Replaces a shell `command -v` probe with fastlane's own cross-platform binary lookup. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Route developers through the single fastlane lane instead of a raw `a8c-secrets decrypt`, so a first run also gets the binary preflight check. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mokagio · 2026-07-11T23:07:58Z

+  #
+  lane :configure_secrets do
+    unless FastlaneCore::CommandExecutor.which('a8c-secrets')
+      UI.user_error!('`a8c-secrets` was not found on your PATH. See https://github.com/Automattic/a8c-secrets for installation and usage instructions.')


Earlier iterations had more detailed instructions. Apart from being uglier to look at in code, they seemed like a liability. Better to use the project's README.md as the single source of truth.

mokagio · 2026-07-11T23:25:36Z

 "$(dirname "${BASH_SOURCE[0]}")/shared_setup.sh"

-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
-


Notice the removal of the decrypt call because now it runs as part of the shared setup script.

mokagio · 2026-07-11T23:43:30Z

+FIREBASE_SECRETS_PATH = $(A8C_SECRETS_DIR)/GoogleService-Info.plist
+SECRETS_PATH = $(A8C_SECRETS_DIR)/pocket_casts_credentials.json
+GOOGLE_SIGN_IN_SECRETS_PATH = $(A8C_SECRETS_DIR)/GoogleSignIn.txt


These pointed to ~/.configure/... before. DRYed them here. While we can't rely on a8c-secrets which at this level (and setting up an aggregate target + build phase to run it seems a bit too much) at least we can centralize the place where the path is hardcoded.

Copilot

Pull request overview

Migrates the iOS app’s secret management from the legacy mobile-secrets/.configure flow to a8c-secrets, updating local build configuration, Fastlane automation, and Buildkite pipelines to decrypt and consume secrets from the new location.

Changes:

Introduces a configure_secrets Fastlane lane and wires it into before_all to ensure secrets are decrypted for lanes that need them.
Moves Xcode secret path build settings into config/PocketCasts.base.xcconfig (pointing at ~/.a8c-secrets/...) and updates scripts/messages accordingly.
Updates Buildkite pipelines to run a new install-secrets.sh helper instead of configure_apply, and removes the legacy .configure/.configure-files artifacts from the repo.

Reviewed changes

Copilot reviewed 26 out of 35 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/build-phases/generate-credentials.sh	Updates guidance for missing secrets; continues generating credentials/GoogleService plist from decrypted secrets.
podcasts/Credentials/replace_secrets.rb	Updates failure guidance to point to the new secrets lane.
podcasts.xcodeproj/project.pbxproj	Removes hardcoded `.configure` secrets paths from build settings.
Makefile	Updates dSYM upload to locate Firebase plist via `a8c-secrets which`.
fastlane/Fastfile	Adds `configure_secrets` lane and runs it from `before_all`.
config/PocketCasts.base.xcconfig	Defines `A8C_SECRETS_DIR` and related secret path build settings.
.gitignore	Removes legacy `.configure-files` ignore rules.
.github/CODEOWNERS	Updates secrets ownership path to `.a8c-secrets/`.
.gitattributes	Treats `.a8c-secrets/*/.age` as binary.
.configure-files/fastlane_match_pwd.txt.enc	Removes legacy encrypted secret artifact from repo.
.configure	Removes legacy mobile-secrets configuration file from repo.
.buildkite/release-pipelines/*	Switches pipelines to use the new secrets installation helper.
.buildkite/commands/*.sh	Routes shared setup/release steps through `install-secrets.sh` and removes old `configure_apply` calls.
.buildkite/commands/install-secrets.sh	New helper to install `a8c-secrets` and run `fastlane configure_secrets`.
.a8c-secrets/repo-id	Adds repo identifier for `a8c-secrets`.
.a8c-secrets/keys.pub	Adds public age recipients (dev/ci).

+set -euo pipefail
+
+echo "--- :closed_lock_with_key: Installing Secrets"
+curl -fsSL https://raw.githubusercontent.com/Automattic/a8c-secrets/main/install.sh | bash


 if [ ! -f $SECRETS_PATH ]; then
-    echo "error: $SECRETS_PATH not found! Please run \`bundle exec fastlane run configure_apply\`."
+    echo "error: $SECRETS_PATH not found! Please run \`bundle exec fastlane configure_secrets\`."


pocketcasts · 2026-07-12T00:00:18Z

📲 You can test the changes from this Pull Request in Pocket Casts Prototype Build by scanning the QR code below to install the corresponding build.

	App Name	Pocket Casts Prototype Build
	Build Number	`16480`
	Version	`PR #4731`
	Bundle ID	`au.com.shiftyjelly.podcasts.prototype`
	Commit	`5004748`
	Installation URL	63bj7nueldc20

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

mokagio and others added 5 commits July 11, 2026 14:54

Remove unused fastlane_match_pwd.txt secret

56a6e47

Init a8c-secrets

cef431b

mokagio self-assigned this Jul 11, 2026

mokagio and others added 5 commits July 11, 2026 15:34

Shorten configure_secrets missing-binary error

8249d9e

--- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Use CommandExecutor.which for a8c-secrets check

db2e306

Replaces a shell `command -v` probe with fastlane's own cross-platform binary lookup. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mokagio mentioned this pull request Jul 11, 2026

[Spike] Probe: can before_all decrypt in CI? #4732

Closed

mokagio commented Jul 11, 2026

View reviewed changes

mokagio added 2 commits July 12, 2026 09:10

Restore secrets decryption in fastlane before_all

d6abd6c

Avoid running configure_secrets twice

f41ef83

mokagio commented Jul 11, 2026

View reviewed changes

DRY a8c-secrets path via xcconfig

5004748

mokagio commented Jul 11, 2026

View reviewed changes

mokagio marked this pull request as ready for review July 11, 2026 23:48

mokagio requested a review from a team as a code owner July 11, 2026 23:48

Copilot AI review requested due to automatic review settings July 11, 2026 23:48

mokagio requested a review from a team as a code owner July 11, 2026 23:48

mokagio requested review from SergioEstevao and removed request for a team July 11, 2026 23:48

Copilot started reviewing on behalf of mokagio July 11, 2026 23:48 View session

mokagio added this to the 8.18 milestone Jul 11, 2026

mokagio added the [Type] Tooling Issues related to tooling: build tools, ruby, scripts, etc. label Jul 11, 2026

mokagio requested a review from kean July 11, 2026 23:49

Copilot AI reviewed Jul 11, 2026

View reviewed changes

Quote secrets path access in script

1090cce

mokagio mentioned this pull request Jul 12, 2026

Replace .configure secrets store with a8c-secrets woocommerce/woocommerce-ios#17521

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Adopt a8c-secrets for encrypted secrets#4731

Adopt a8c-secrets for encrypted secrets#4731
mokagio wants to merge 14 commits into
trunkfrom
ainfra-1541-adopt-the-solution-in-pocket-casts-ios

mokagio commented Jul 11, 2026 •

edited

Loading

Uh oh!

mokagio Jul 11, 2026

Uh oh!

mokagio Jul 11, 2026

Uh oh!

mokagio Jul 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

pocketcasts commented Jul 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mokagio commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What it does

How to test

Uh oh!

mokagio Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

pocketcasts commented Jul 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mokagio commented Jul 11, 2026 •

edited

Loading