Stop reading ~/.secrets/global-api-keys; use env or fleet-secrets (OPS-818)

[jaywedgeworth22]

Summary

Updates the TestFlight shipping script (scripts/ios-fleet/ship-testflight.sh) to stop sourcing the Sentry auth token from the shared ~/.secrets/global-api-keys file. The token is now resolved from the environment, falling back to the fleet-secrets helper when it is installed.

Motivation

OPS-818 removes reliance on a global, machine-wide API key file. Previously the script grepped ~/.secrets/global-api-keys for SENTRY_AUTH_TOKEN, which meant the token had to be duplicated into a shared file on each machine. The new behavior aligns the script with the environment-variable or fleet secret-store pattern.

Changes

• load_sentry_auth behavior

  • If SENTRY_AUTH_TOKEN is already set in the environment, it is used as-is (unchanged behavior).
  • Otherwise, if the fleet-secrets command is available, the token is fetched via fleet-secrets get SENTRY_AUTH_TOKEN and exported.
  • The token is only assigned when a non-empty value is returned; failures or empty results leave the variable unset rather than exporting an empty value.
  • The ~/.secrets/global-api-keys lookup path has been removed entirely.
  • Carriage-return stripping is retained for compatibility with values pasted from other environments.

• Documentation in the script header

  • The comment describing where SENTRY_AUTH_TOKEN comes from now states "env or fleet-secrets get" instead of referencing the global API keys file.
  • The inline comment above load_sentry_auth reflects the new environment/fleet-secrets precedence.

Review Notes

The automated review flagged that reading SENTRY_AUTH_TOKEN from fleet-secrets get may conflict with Rule 66's two approved secret sources, which is worth confirming before merge. The review also noted that the task description provides limited context for validating the intended business logic.

[linear-code]

OPS-818

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

⚠️ 2 Kody Rule(s) were not evaluated

These rules declare that they need repository context beyond this diff, and the review could not retrieve it, so they were not judged on this pull request:

• Never move or delete existing app support.html URLs
• Prefer Sentry for new observability; do not add new Datadog RUM/APM surfaces

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

🤔 Insufficient Task Context

I found a task linked to this PR, but it only contains minimal information (title only, no description or acceptance criteria). To perform a meaningful business rules validation, I need more details.

🔍 What I need to validate:

• Business requirements and acceptance criteria
• Expected behavior and business rules
• Edge cases and constraints to consider

💡 How to improve the task context:

• Add a description to the linked ticket
• Include acceptance criteria or business rules
• Describe the expected behavior after the change

⚠️ Important:

A task title alone is not sufficient to determine whether the implementation is correct or complete.

---

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.

[kody-ai]

Found critical issues please review the requested changes

• SENTRY_AUTH_TOKEN is read from fleet-secrets get, which is not one of Rule 66's two approved secret sources.

Stale Kody rule text (still lists the flat ~/.secrets file as an approved source); contradicts owner ruling OPS-818. Findings answered in the threads.