Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Move Fastlane secrets outside of repository #1011

Merged
merged 4 commits into from
Aug 2, 2021
Merged

Move Fastlane secrets outside of repository #1011

merged 4 commits into from
Aug 2, 2021

Conversation

mokagio
Copy link
Contributor

@mokagio mokagio commented Aug 2, 2021 •
edited
Loading

Similar to wordpress-mobile/WordPress-iOS#16780.

Moves the Fastlane-related secrets outside of the repository into ~/.configure/simplenote-macos/secrets/

To test locally, checkout this branch, run bundle exec run configure_apply and then inspect the content of ~/.configure/simplenote-macos/secrets/:

$ ls ~/.configure/simplenote-macos/secrets
app_store_connect_fastlane_api_key.json
google_cloud_keys.json

I also opened #999 to test these changes. It exercises each secret by:

  1. Calling match for each build configuration, to test the google_cloud_keys.json location
  2. Making a build and uploading it to TestFlight, to test the ASC API key JSON location. On the iOS pipelines, this fails because App Store Connect rejects builds that reuse build numbers. But for macOS, this doesn't happen, meaning the builds succeeds but you'll get an email saying there's an error in the binary.

Review

Only one developer required to review these changes, but anyone can perform the review.

Release

These changes do not require release notes.

@mokagio mokagio added the tooling Related to anything that supports the building & maintaining of the project. label Aug 2, 2021
mokagio
mokagio commented Aug 2, 2021
View reviewed changes
.configure
"encrypt": true
},
{
"file": "iOS/app_store_connect_fastlane_api_key.json",
"destination": ".configure-files/app_store_connect_fastlane_api_key.json",
"destination": "~/.configure/simplenote-macos/secrets/app_store_connect_fastlane_api_key.json",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At some point in the future, we'll add some kind of files_to_remove annotation to clean up the devs' local repo. See also https://github.com/woocommerce/woocommerce-ios/pull/4576/files#r670733139.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, this idea is also tracked in Automattic/configure#19

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excellent, thanks!

fastlane/Pluginfile
@@ -2,6 +2,6 @@
#
# Ensure this file is checked in to source control!

gem 'fastlane-plugin-wpmreleasetoolkit', git: 'https://github.com/wordpress-mobile/release-toolkit', tag: '0.18.1'
gem 'fastlane-plugin-wpmreleasetoolkit', '~> 1.3'
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now with SemVer 😄

fastlane/Matchfile
Comment on lines -1 to -4
# Store certs/profiles encrypted in Google Cloud
storage_mode("google_cloud")
google_cloud_bucket_name("a8c-fastlane-match")
google_cloud_keys_file(".configure-files/google_cloud_keys.json")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the noise in the diff. While I was on this file, I converted Ruby "" into '', which is the recommended syntax for strings that don't use interpolation.

@mokagio mokagio requested a review from a team August 2, 2021 10:53
@mokagio mokagio marked this pull request as ready for review August 2, 2021 10:53
@AliSoftware
Copy link
Contributor

Making a build and uploading it to TestFlight, to test the ASC API key JSON location. On the iOS pipelines, this fails because App Store Connect rejects builds that reuse build numbers. But for macOS, this doesn't happen, meaning the builds succeeds but you'll get an email saying there's an error in the binary.

Ohhh that's what this email was about! Was about to post a message in our Slack to warn about the Apple rejection, but now I see that it came from here and that there's nothing to worry about 👍

AliSoftware
AliSoftware approved these changes Aug 2, 2021
View reviewed changes
Copy link
Contributor

@AliSoftware AliSoftware left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good, and given you mentioned that you tested it in #999 already, I think it's ok to :shipit:

.configure
"encrypt": true
},
{
"file": "iOS/app_store_connect_fastlane_api_key.json",
"destination": ".configure-files/app_store_connect_fastlane_api_key.json",
"destination": "~/.configure/simplenote-macos/secrets/app_store_connect_fastlane_api_key.json",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, this idea is also tracked in Automattic/configure#19

@mokagio mokagio merged commit 27b1f6d into develop Aug 2, 2021
@mokagio mokagio deleted the move-fastlane-secrets-outside-repo branch August 2, 2021 23:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@AliSoftware AliSoftware AliSoftware approved these changes

Assignees
No one assigned
Labels
tooling Related to anything that supports the building & maintaining of the project.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@mokagio @AliSoftware