Adopt a8c-secrets in WordPress iOS

.a8c-secrets/keys.pub

@@ -0,0 +1,4 @@
+# dev
+age1srcq3hl92ym9jk3ezj5prwhche3w8szc0cssy8t7afrkjmtkxu2qkjsdfn
+# ci
+age1a7xcr6qzwnzgcxq95sq33p58xdzsmful8w7mp2zktvuy5434yuss9rmv8f

.a8c-secrets/repo-id

@@ -0,0 +1 @@
+wordpress-ios@github.com@wordpress-mobile

.buildkite/commands/build-and-upload-testflight.sh

@@ -7,8 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh <wordpress|jetpack|reader>}"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
 
 echo "--- :testflight: Building and uploading ${APP} to TestFlight"
 bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}"

.buildkite/commands/build-for-testing.sh

@@ -16,8 +16,7 @@ fi
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane "build_${APP}_for_testing"

.buildkite/commands/complete-code-freeze.sh

@@ -14,8 +14,5 @@ source use-bot-for-git
 
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
-
 echo '--- :shipit: Complete code freeze'
 bundle exec fastlane complete_code_freeze skip_confirm:true

.buildkite/commands/finalize-hotfix.sh

@@ -15,8 +15,5 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
-
 echo '--- :shipit: Finalize hotfix'
 bundle exec fastlane finalize_hotfix_release skip_confirm:true

.buildkite/commands/finalize-release.sh

@@ -15,8 +15,5 @@ source use-bot-for-git
 echo '--- :ruby: Setup Ruby tools'
 install_gems
 
-echo '--- :closed_lock_with_key: Access secrets'
-bundle exec fastlane run configure_apply
-
 echo '--- :shipit: Finalize release'
 bundle exec fastlane finalize_release skip_confirm:true

.buildkite/commands/gather-testflight-candidates.sh

@@ -1,13 +1,10 @@
 #!/bin/bash -eu
 
 # Lists the nightly builds, opens the "choose a build" block step, and posts the
-# candidate list to Slack. No build — just gems + secrets.
+# candidate list to Slack. No build — just gems.
 
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
-
 echo "--- :testflight: Gathering candidates and opening the block step"
 bundle exec fastlane gather_testflight_candidates

.buildkite/commands/install-a8c-secrets.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# The `Decrypt Secrets` and `Generate Credentials` build phases resolve
+# `a8c-secrets` off PATH, so the export below has to survive in the caller's shell.
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  echo "This script must be sourced, not executed, because it exports PATH." >&2
+  exit 1
+fi
+
+set -euo pipefail
+
+echo "--- :closed_lock_with_key: Installing a8c-secrets"
+
+# `install_a8c-secrets_binary` comes from the a8c-ci-toolkit plugin. It pins the
+# a8c-secrets version and checks the download against a checksum vendored there.
+install_dir="$HOME/.local/bin"
+install_a8c-secrets_binary --install-dir "$install_dir"
+export PATH="$install_dir:$PATH"

.buildkite/commands/promote-build-to-public.sh

@@ -1,6 +1,6 @@
 #!/bin/bash -eu
 
-# Promotes the build chosen in the preceding block step to public beta. No build — just gems + secrets.
+# Promotes the build chosen in the preceding block step to public beta. No build — just gems.
 
 # `build_to_promote` must stay in sync with PROMOTION_META_DATA_KEY in fastlane/lanes/promote.rb,
 # which is the key the gather lane writes the block-step select field under.
@@ -14,8 +14,5 @@ fi
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
-
 echo "--- :rocket: Promoting ${BUILD_CODE} to public beta"
 bundle exec fastlane promote_build build_code:"${BUILD_CODE}"

.buildkite/commands/promote-nightly.sh

@@ -1,13 +1,10 @@
 #!/bin/bash -eu
 
-# Promotes the last build of the day to the nightly group. No build — just gems + secrets.
+# Promotes the last build of the day to the nightly group. No build — just gems.
 
 echo "--- :rubygems: Setting up Gems"
 install_gems
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
-
 echo "--- :new_moon: Promoting last build of the day to nightly beta"
 # The lane refuses to run anywhere but trunk.
 bundle exec fastlane promote_nightly_build

.buildkite/commands/prototype-build-jetpack.sh

@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_prototype_build

.buildkite/commands/prototype-build-wordpress.sh

@@ -7,8 +7,7 @@ fi
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_wordpress_prototype_build

.buildkite/commands/release-build-jetpack.sh

@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_jetpack_for_app_store

.buildkite/commands/release-build-wordpress.sh

@@ -3,8 +3,7 @@
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
 "$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"
 
-echo "--- :closed_lock_with_key: Installing Secrets"
-bundle exec fastlane run configure_apply
+source "$(dirname "${BASH_SOURCE[0]}")/install-a8c-secrets.sh"
 
 echo "--- :hammer_and_wrench: Building"
 bundle exec fastlane build_and_upload_app_store_connect \

.buildkite/release-pipelines/code-freeze.yml

@@ -18,9 +18,6 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
-
       echo '--- :shipit: Run code freeze'
       bundle exec fastlane code_freeze version:"${RELEASE_VERSION}" skip_confirm:true
     retry:

.buildkite/release-pipelines/new-beta-release.yml

@@ -19,9 +19,6 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
-
       echo '--- :shipit: Deploy new beta'
       bundle exec fastlane new_beta_release skip_confirm:true
     retry:

.buildkite/release-pipelines/new-hotfix.yml

@@ -19,9 +19,6 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
-
       echo '--- :shipit: Start new hotfix'
       bundle exec fastlane new_hotfix_release skip_confirm:true version:"$VERSION"
     retry:

.buildkite/release-pipelines/publish-release.yml

@@ -19,9 +19,6 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
-
       echo '--- :package: Publish Release'
       bundle exec fastlane publish_release skip_confirm:true
     retry:

.buildkite/release-pipelines/update-app-store-strings.yml

@@ -18,9 +18,6 @@ steps:
       echo '--- :ruby: Setup Ruby tools'
       install_gems
 
-      echo '--- :closed_lock_with_key: Access secrets'
-      bundle exec fastlane run configure_apply
-
       echo '--- :shipit: Update relaese notes and other App Store metadata'
       bundle exec fastlane update_appstore_strings skip_confirm:true
     retry:

.buildkite/shared-pipeline-vars

@@ -5,7 +5,7 @@
 
 # The ~> modifier is not currently used, but we check for it just in case
 XCODE_VERSION=$(sed -E 's/^~> ?//' .xcode-version)
-CI_TOOLKIT_PLUGIN_VERSION="6.1.1"
+CI_TOOLKIT_PLUGIN_VERSION="6.2.0"
 TEST_COLLECTOR_PLUGIN_VERSION="1.11.0"
 
 export IMAGE_ID="xcode-$XCODE_VERSION"

.gitattributes

@@ -1,4 +1,4 @@
 RELEASE-NOTES.txt merge=union
 *.strings diff=localizablestrings
 
-.configure-files/*.enc binary
+.a8c-secrets/*.age binary

.gitignore

@@ -85,10 +85,12 @@ Scripts/fastlane/
 # CI Artifacts Location
 Artifacts
 
-# All encrypted secrets should be stored under .configure-files
-# Everything without a .enc extension is ignored
-.configure-files/*
-!.configure-files/*.enc
+# a8c-secrets decrypts into ~/.a8c-secrets/<repo-id>/, outside the checkout.
+# In-repo, track only the repo id, the public keys, and the encrypted *.age blobs.
+.a8c-secrets/*
+!.a8c-secrets/repo-id
+!.a8c-secrets/keys.pub
+!.a8c-secrets/*.age
 
 # A file external contributors can have locally to provide their own credentials.
 # This file is created during the `rake init:oss` task, based on the Secrets-example.swift file.

CODEOWNERS

@@ -24,4 +24,4 @@ Dangerfile*           @wordpress-mobile/apps-infra-tooling
 .xcode-version        @wordpress-mobile/apps-infra-tooling
 
 # Secrets
-.configure-files/     @wordpress-mobile/apps-infra-tooling
+.a8c-secrets/         @wordpress-mobile/apps-infra-tooling