DRY secrets paths via xcconfig

[mokagio]

See AINFRA-2775, under AINFRA-1541.

I was looking at #4731 to get it ready for a new round of review and grew overwhelmed by the various changes and the open question of how it should flow in CI vs local (when and how to call the decrypt?) and for internal vs external contributors.

As such, I've decided to extract the parts that are already good in dedicated PRs, and to rework the remainder in isolation.

This PR DRYs the build settings configuration to the paths of the secret files used at build time

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Claude finished @mokagio's task in 4m 39s —— View job

---

PR Review: DRY secrets paths via xcconfig

• Read the diff (config/PocketCasts.base.xcconfig, podcasts.xcodeproj/project.pbxproj)
• Trace where the removed build settings were defined and who consumes them
• Verify the settings still resolve for every target/build phase that needs them
• Post review

---

Verdict: LGTM — this is a safe, well-scoped DRY refactor. ✅

I traced each removed setting to confirm nothing breaks. The key mechanism is that config/PocketCasts.{staging,prototype,debug,release}.xcconfig are attached at the PBXProject level (config list BDBD53E717019B290048C8C5, e.g. podcasts.xcodeproj/project.pbxproj:9202), and each of those #include "PocketCasts.base.xcconfig". Project-level build settings are inherited by every target unless overridden, so moving these into base.xcconfig keeps them available everywhere they were before. This is the same pattern already used for DEVELOPMENT_TEAM, MARKETING_VERSION, and PRODUCT_BUNDLE_IDENTIFIER_ROOT, so it's consistent with the existing setup.

Per-setting confirmation:

Setting	Was defined on	Consumed by	Still resolves?
SECRETS_PATH	podcasts project-level configs (had the xcconfig)	scripts/build-phases/generate-credentials.sh (runs under the PreBuildActions aggregate target)	✅ project-level → inherited by aggregate target
FIREBASE_SECRETS_PATH	podcasts project-level configs	generate-credentials.sh	✅ same
GOOGLE_SIGN_IN_SECRETS_PATH	podcasts app target configs + PreBuildActions aggregate configs (no xcconfig on either)	scripts/build-phases/post-build-update-plist.sh (Modify Plist phase on the podcasts app target)	✅ now comes from project-level inheritance

Notably, the GOOGLE_SIGN_IN_SECRETS_PATH copies that lived on the PreBuildActions aggregate target were effectively redundant — none of that target's phases (GenerateCredentials, L10n, Colors, SwiftLint) read it — so removing them is pure cleanup. The only real consumer, post-build-update-plist.sh, runs on the podcasts app target, which inherits the value from the project-level xcconfig. All removed values were byte-for-byte identical to what base.xcconfig now defines, so there's no behavioral change.

Extra nits (all optional, non-blocking):

• Nice touch: the SECRETS_DIR intermediate variable removes the repeated path prefix — good call.
• External contributors: generate-credentials.sh short-circuits on LocalApiCredentials.swift before touching $SECRETS_PATH, so defining these paths unconditionally at project level doesn't affect the local-secrets flow.
• Verification I couldn't run: this environment is Linux with no Xcode, so I couldn't run an actual build to confirm the settings resolve at build time. Worth a quick local make build_staging (and ideally a Prototype/Release archive) to double-check the PreBuildActions env and the Modify Plist post-build phase still pick up the paths, since those are the two spots relying on inheritance rather than a direct definition.
  · ainfra-2775-a8c-secrets-prep-in-pocket-casts-ios-dry-xcconfig

[AliSoftware]

This SECRETS_PATH is quite a generic variable name for something specific to pocket_casts_credentials.json, and makes it not clear to distinguish from this SECRET_PATH not meaning "the path to the secrets folder" (which is what SECRET_DIR is for) or from this being any other secret file (like GoogleService-Info.plist or any other).

I'd thus recommend to rename the variable to something more explicit, like PC_CREDENTIALS_JSON_PATH or something.

(Maybe that's something you only had in mind for a separate, follow-up PR, though? 🤷 )

[AliSoftware]

Whoops I didn't realize auto-merge was on. I guess follow-up PR it will be, then 🙃

[mokagio]

We'll touch this file again when changing to a8c-secrets. I'll try to remember.

[mokagio]

I'll try to remember.

Actually, that's a recipe for failure. Handed it over to an agent...

[mokagio]

Good call — done in #4868, as CREDENTIALS_JSON_PATH.

I skipped the PC_ prefix: these build settings are Pocket Casts-only, so it'd be redundant here.

Posted by Claude Code (Opus 5) on behalf of @mokagio with approval.