Skip to content

Extract the CI secrets install into a shared script #25884

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mokagio merged 3 commits into from
Aug 13, 2026
+15 −48
Merged

Extract the CI secrets install into a shared script #25884

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5814cd2
Install secrets only in jobs that build the app
mokagio Aug 10, 2026
a46dcd0
Extract the secrets install into a shared script
mokagio Aug 10, 2026
ba82261
Merge branch 'trunk' into mokagio/extract-ci-secrets-install
AliSoftware Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .buildkite/commands/build-and-upload-testflight.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ APP="${1:?Usage: build-and-upload-testflight.sh <wordpress|jetpack|reader>}"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

@AliSoftware AliSoftware Aug 13, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm on two minds about using this vs just hardcoding the path .buildkite/commands/install-secrets.sh here.

I like hardcoding because it avoids an (arguably small and inconsequential) shell-out, and also because I don't have to try to reason about the path while we know that those scripts are always ever going to be invoked by Buildkite itself, in a context where the $PWD is the repo's root.

That being said, in the context of this repo it seems that $(dirname "${BASH_SOURCE[0]}")/ was used everywhere in existing .sh scripts already, so I prefer we prioritize consistency like you did here.

But:

  • That makes me wonder if we would want to standardize that across repos (similar to the discussion we had about standardizing shared-pipeline-vars's way to read .xcode-version)
  • Even if we don't standardize (yet?) across repos, if we shouldn't use the occasion of this PR to DRY all those $(dirname "${BASH_SOURCE[0]}") done in multiple places in existing scripts into an intermediate SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}") at the top of each script then reference $SCRIPT_DIR/… instead in later lines of the script. Would not only avoid repetition, but also avoid spawning a shell invocation every time.

@iangmaia iangmaia Aug 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 on either doing SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}") or just hardcoding 👍
We can at least settle on something and do it from now on (and update it on PRs changing these areas).

@mokagio mokagio Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AliSoftware @iangmaia

(similar to the discussion we had about standardizing shared-pipeline-vars's way to read .xcode-version)

That's what immediately came to mind when I read the comment.

In that instance, we settled for hardcoding under the assumption that the path written that way would resolved in most repos.

Even if we don't standardize (yet?) across repos, if we shouldn't use the occasion of this PR to DRY all those $(dirname "${BASH_SOURCE[0]}") done in multiple places in existing scripts into an intermediate SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}") at the top of each script then reference $SCRIPT_DIR/… instead in later lines of the script. Would not only avoid repetition, but also avoid spawning a shell invocation every time.

I usually like moving in small incremental steps. But I have a feeling hardcoding is the solution that we feel would be simpler? At least, that's what the wording in the comments make me think, maybe I'm misreading... Assuming hardcoding is the desired end goal, we might as well ack it now and do the migration in one pass, if a bit bigger and slower.


echo "--- :testflight: Building and uploading ${APP} to TestFlight"
bundle exec fastlane build_and_upload_app_for_testflight app:"${APP}"
3 changes: 1 addition & 2 deletions .buildkite/commands/build-for-testing.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,7 @@ fi

"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane "build_${APP}_for_testing"
Expand Down
3 changes: 0 additions & 3 deletions .buildkite/commands/complete-code-freeze.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,5 @@ checkout_release_branch "$RELEASE_NUMBER"

"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :shipit: Complete code freeze'
bundle exec fastlane complete_code_freeze skip_confirm:true
3 changes: 0 additions & 3 deletions .buildkite/commands/finalize-hotfix.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,5 @@ checkout_release_branch "$RELEASE_NUMBER"
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :shipit: Finalize hotfix'
bundle exec fastlane finalize_hotfix_release skip_confirm:true
3 changes: 0 additions & 3 deletions .buildkite/commands/finalize-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,5 @@ checkout_release_branch "$RELEASE_NUMBER"
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :shipit: Finalize release'
bundle exec fastlane finalize_release skip_confirm:true
5 changes: 1 addition & 4 deletions .buildkite/commands/gather-testflight-candidates.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,10 @@
#!/bin/bash -eu

# Lists the nightly builds, opens the "choose a build" block step, and posts the
# candidate list to Slack. No build — just gems + secrets.
# candidate list to Slack. No build — just gems.

echo "--- :rubygems: Setting up Gems"
install_gems

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply

echo "--- :testflight: Gathering candidates and opening the block step"
bundle exec fastlane gather_testflight_candidates
6 changes: 6 additions & 0 deletions .buildkite/commands/install-secrets.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
#!/usr/bin/env bash

set -euo pipefail

@mokagio mokagio Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Admittedly, only set -e is used. But, it seems okay to leave the other one set.


echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
5 changes: 1 addition & 4 deletions .buildkite/commands/promote-build-to-public.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash -eu

# Promotes the build chosen in the preceding block step to public beta. No build — just gems + secrets.
# Promotes the build chosen in the preceding block step to public beta. No build — just gems.

# `build_to_promote` must stay in sync with PROMOTION_META_DATA_KEY in fastlane/lanes/promote.rb,
# which is the key the gather lane writes the block-step select field under.
Expand All @@ -14,8 +14,5 @@ fi
echo "--- :rubygems: Setting up Gems"
install_gems

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply

echo "--- :rocket: Promoting ${BUILD_CODE} to public beta"
bundle exec fastlane promote_build build_code:"${BUILD_CODE}"
5 changes: 1 addition & 4 deletions .buildkite/commands/promote-nightly.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,10 @@
#!/bin/bash -eu

# Promotes the last build of the day to the nightly group. No build — just gems + secrets.
# Promotes the last build of the day to the nightly group. No build — just gems.

echo "--- :rubygems: Setting up Gems"
install_gems

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply

echo "--- :new_moon: Promoting last build of the day to nightly beta"
# The lane refuses to run anywhere but trunk.
bundle exec fastlane promote_nightly_build
3 changes: 1 addition & 2 deletions .buildkite/commands/prototype-build-jetpack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ fi
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_jetpack_prototype_build
3 changes: 1 addition & 2 deletions .buildkite/commands/prototype-build-wordpress.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ fi
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_wordpress_prototype_build
3 changes: 1 addition & 2 deletions .buildkite/commands/release-build-jetpack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_jetpack_for_app_store
3 changes: 1 addition & 2 deletions .buildkite/commands/release-build-wordpress.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up.sh"
"$(dirname "${BASH_SOURCE[0]}")/shared-set-up-distribution.sh"

echo "--- :closed_lock_with_key: Installing Secrets"
bundle exec fastlane run configure_apply
"$(dirname "${BASH_SOURCE[0]}")/install-secrets.sh"

echo "--- :hammer_and_wrench: Building"
bundle exec fastlane build_and_upload_app_store_connect \
Expand Down
3 changes: 0 additions & 3 deletions .buildkite/release-pipelines/code-freeze.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :shipit: Run code freeze'
bundle exec fastlane code_freeze version:"${RELEASE_VERSION}" skip_confirm:true
retry:
Expand Down
3 changes: 0 additions & 3 deletions .buildkite/release-pipelines/new-beta-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,6 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :shipit: Deploy new beta'
bundle exec fastlane new_beta_release skip_confirm:true
retry:
Expand Down
3 changes: 0 additions & 3 deletions .buildkite/release-pipelines/new-hotfix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,6 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :shipit: Start new hotfix'
bundle exec fastlane new_hotfix_release skip_confirm:true version:"$VERSION"
retry:
Expand Down
3 changes: 0 additions & 3 deletions .buildkite/release-pipelines/publish-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,6 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :package: Publish Release'
bundle exec fastlane publish_release skip_confirm:true
retry:
Expand Down
3 changes: 0 additions & 3 deletions .buildkite/release-pipelines/update-app-store-strings.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@ steps:
echo '--- :ruby: Setup Ruby tools'
install_gems

echo '--- :closed_lock_with_key: Access secrets'
bundle exec fastlane run configure_apply

echo '--- :shipit: Update relaese notes and other App Store metadata'
bundle exec fastlane update_appstore_strings skip_confirm:true
retry:
Expand Down