From a3365ee74da96d1e05e07cc3f7f64bc20fecf6cd Mon Sep 17 00:00:00 2001 From: Jay Wedgeworth <12656028+jaywedgeworth22@users.noreply.github.com> Date: Sun, 18 Oct 2026 07:32:46 -0500 Subject: [PATCH] Stop reading ~/.secrets/global-api-keys; use env or fleet-secrets (OPS-818) Refs OPS-818. Nothing may read the flat handoff file any more: env first, then `fleet-secrets get NAME` where a Mac fallback is needed. Co-Authored-By: Claude Sonnet 5.5 --- scripts/ios-fleet/ship-testflight.sh | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/scripts/ios-fleet/ship-testflight.sh b/scripts/ios-fleet/ship-testflight.sh index b7fd1722..63cf0deb 100755 --- a/scripts/ios-fleet/ship-testflight.sh +++ b/scripts/ios-fleet/ship-testflight.sh @@ -78,7 +78,7 @@ # Secrets (never printed): # ~/.secrets/appstore-connect.env (ASC_KEY_ID, ASC_ISSUER_ID, ASC_KEY_PATH) # or Xcode-signed-in session for destination=upload export -# SENTRY_AUTH_TOKEN (dSYM + Size Analysis upload; env or ~/.secrets/global-api-keys) +# SENTRY_AUTH_TOKEN (dSYM + Size Analysis upload; env or `fleet-secrets get`) # SENTRY_DSN (injected into xcodebuild so Cocoa plist $(SENTRY_DSN) is set) # # Sentry after a successful archive (2026-09-01): @@ -206,16 +206,19 @@ sentry_project_for_app() { esac } -# Pull SENTRY_AUTH_TOKEN from the handoff file if the environment does not -# already have it. Names-only grep trap: extract into a var, never echo. +# Pull SENTRY_AUTH_TOKEN from the environment, else from `fleet-secrets get` +# when that helper is installed (Mac). Extract into a var, never echo. load_sentry_auth() { if [[ -n "${SENTRY_AUTH_TOKEN:-}" ]]; then return 0 fi - local keys="${HOME}/.secrets/global-api-keys" - if [[ -f "$keys" ]]; then - SENTRY_AUTH_TOKEN="$(grep -m1 '^SENTRY_AUTH_TOKEN=' "$keys" | cut -d= -f2- | tr -d '"' | tr -d '\r')" - export SENTRY_AUTH_TOKEN + if command -v fleet-secrets &>/dev/null; then + local token + token="$(fleet-secrets get SENTRY_AUTH_TOKEN 2>/dev/null | tr -d '\r')" || token="" + if [[ -n "$token" ]]; then + SENTRY_AUTH_TOKEN="$token" + export SENTRY_AUTH_TOKEN + fi fi }