Remove sentry.properties secrets in favour of public values and an env-injected token by mokagio · Pull Request #23189 · wordpress-mobile/WordPress-Android

mokagio · 2026-08-10T07:58:09Z

Pre-work to migrate from configure to a8c-secrets by only keeping those secrets that are actually needed. See https://linear.app/a8c/issue/AINFRA-2715.

Notice this moves the Sentry token injection from dev-level secrets to CI-level secrets, via env var. This is in line with our approach of having as few secrets as possible on dev machines.

Verified by unblocking a Prototype Build, even though it only exercised the fastlane path, leaving the Gradle one unverified.

AI-generated details

defaults.org and defaults.project in sentry.properties are public Sentry identifiers, not secrets.
auth.token is the only genuinely secret line, and it's CI-only.
So the per-app entries leave .configure, the flavor files get committed in plaintext, and the token comes from SENTRY_AUTH_TOKEN.

Why sentry.properties stays.
The Sentry Gradle plugin's extension exposes a single global org/projectName, but WordPress and Jetpack report to different Sentry projects.
The per-flavor sentry.properties lookup is the only mechanism that preserves that split, so the files stay — stripped of auth.token.
Only authToken moves to the DSL, since it's the same for both flavors.

Where the token comes from.
SENTRY_AUTH_TOKEN is injected by an agent-side environment hook on the Buildkite android queue.
Nothing in this repo sets it, so grepping for it turns up nothing.

fastlane's upload_gutenberg_sourcemaps was reading auth.token out of the same file; it now uses get_required_env('SENTRY_AUTH_TOKEN').

The Sentry DSN is untouched — it comes from secrets.properties (wp.sentry_dsn/jp.sentry_dsn), not from sentry.properties.

Testing

Prototype builds run on every PR and exercise both upload paths, so this PR's own CI is the test.

Wait for the 📲 Prototype Builds group.

Both steps pass.
uploadSentryProguardMappings… and sentryUploadSourceBundle… upload without a missing-token error.
Gutenberg source maps land in Sentry under a8c/wordpress-android and a8c/jetpack-android.

Locally, with SENTRY_AUTH_TOKEN unset:

Run CI=true ./gradlew :WordPress:uploadSentryProguardMappingsWordpressRelease.

It fails with the named GradleException, not a sentry-cli error.

`defaults.org`/`defaults.project` in `sentry.properties` aren't secrets — they're Sentry-public identifiers. `auth.token` is the only genuinely secret line, and it's CI-only (used to upload ProGuard mappings). The Sentry Gradle plugin extension only exposes a single global org/projectName/authToken (confirmed by decompiling sentry-android-gradle-plugin — no per-flavor DSL support), but WordPress and Jetpack need two different Sentry projects. Rather than collapsing everything into the DSL (which would lose that split), `sentry.properties` stays as the per-flavor resolution mechanism the plugin already supports (`src/wordpress/sentry.properties`, `src/jetpack/sentry.properties`) — just stripped of `auth.token` and committed in plaintext instead of encrypted via `.configure`. `authToken` alone moves to the DSL, sourced from `SENTRY_AUTH_TOKEN`, since that's the same for both flavors. Note: `sentry.properties` here never held the Sentry DSN (unlike pocket-casts-android) — that comes from `secrets.properties`' `wp.sentry_dsn`/`jp.sentry_dsn` via a separate prefixed-property mechanism, untouched by this change. Part of AINFRA-2715. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

`sentry.properties` no longer carries `auth.token` — the file is committed in plaintext now, and the token reaches CI through the Buildkite agent's environment hook. The lane kept reading the key from the file, so `auth_token` would have been `nil` on every release and beta upload. `defaults.org`/`defaults.project` still come from the file: they're public identifiers and per-flavor, so the Gradle DSL can't hold them. Part of AINFRA-2715. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`includeSourceContext` is on for CI builds too, producing `sentryUploadSourceBundle*` tasks that upload through sentry-cli and need the same token as the mapping upload. The guard only covered `uploadSentryProguardMappings*`, so a missing token surfaced as a sentry-cli error there instead of the named failure. Part of AINFRA-2715. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`fastlane/Fastfile` already defines `get_required_env`, and its own comment asks callers to use it instead of reading `ENV` directly. It's also how `wpios` and `wcios` pass this exact token to `sentry_upload_sourcemap`. Part of AINFRA-2715. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

wpmobilebot · 2026-08-10T08:08:31Z

📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Android
	Build Type	Debug
	Version	pr23189-f457a58
	Build Number	`1498`
	Application ID	`com.jetpack.android.prealpha`
	Commit	`f457a58`
	Installation URL	6k3e3g5j9cnpo

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

wpmobilebot · 2026-08-10T08:08:34Z

📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

	App Name	WordPress Android
	Build Type	Debug
	Version	pr23189-f457a58
	Build Number	`1498`
	Application ID	`org.wordpress.android.prealpha`
	Commit	`f457a58`
	Installation URL	5nqpc74skd0ng

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

mokagio · 2026-08-11T00:39:14Z

+tasks.matching {
+    it.name.startsWith("uploadSentryProguardMappings") || it.name.startsWith("sentryUploadSourceBundle")
+}.configureEach {
+    doFirst {
+        if (!sentryAuthToken.isPresent()) {
+            throw new GradleException(
+                "SENTRY_AUTH_TOKEN is not set. Export it to upload ProGuard mappings and source bundles."
+            )
+        }
+    }
+}


It's likely that the Sentry CLI has decent error handling for a missing SENTRY_AUTH_TOKEN, but is seemed good to fail early here in a similar way as we fail in fastlane.

mokagio · 2026-08-11T00:40:24Z

-      "file": "android/WPAndroid/jetpack-sentry.properties",
-      "destination": "WordPress/src/jetpack/sentry.properties",
-      "encrypt": true
-    },


Notice no sentry.properties entry was removed. I haven't followed up with the Git history but it seems likely to me that the file was there in the pre-Jetpack days and was not deleted at the time of the fork.

…r-of-public-values-and-env

Copilot

Pull request overview

This PR removes the Sentry auth token from per-flavor sentry.properties and shifts authentication to an environment-injected SENTRY_AUTH_TOKEN, keeping only public Sentry org/project identifiers in the repo. This aligns with reducing developer-machine secrets while preserving separate WordPress vs Jetpack Sentry projects.

Changes:

Add plaintext, per-flavor sentry.properties containing only defaults.org / defaults.project.
Configure Gradle Sentry plugin to read SENTRY_AUTH_TOKEN from the environment and fail early for upload tasks when unset.
Update Fastlane Gutenberg sourcemap upload to use SENTRY_AUTH_TOKEN instead of reading auth.token from properties; remove related .configure/ignore entries.

Reviewed changes

Copilot reviewed 7 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
WordPress/src/wordpress/sentry.properties	Adds public Sentry org/project identifiers for the WordPress flavor.
WordPress/src/jetpack/sentry.properties	Adds public Sentry org/project identifiers for the Jetpack flavor.
WordPress/build.gradle	Reads `SENTRY_AUTH_TOKEN` from env and wires it into Sentry Gradle uploads with a preflight check.
fastlane/lanes/build.rb	Switches sourcemap upload auth to use `SENTRY_AUTH_TOKEN`.
.gitignore	Stops ignoring `sentry.properties` so flavor files can be committed.
.configure-files/wordpress-sentry.properties.enc	Removes encrypted Sentry properties artifact from `.configure` flow.
.configure	Removes `.configure` entries that previously provisioned Sentry properties.
.aiexclude	Allows `sentry.properties` to be visible to AI tooling (no longer treated as secret).

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

    sentry_upload_sourcemap(
-      auth_token: sentry_token,
+      auth_token: get_required_env('SENTRY_AUTH_TOKEN'),
      org_slug: org_slug,


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Matching on a name prefix couples the guard to a plugin-internal naming convention. A future `io.sentry.android.gradle` bump that renames either upload task would silently stop matching, dropping the guard exactly where it is needed. `SentryCliExecTask` is the base of every task that shells out to `sentry-cli` with the auth token, so it covers the ProGuard mapping and source bundle uploads in one match and turns a rename into a compile error. Normalising the blank check where the token is read also keeps the bound `authToken` from disagreeing with the guard. Keeps this repo aligned with the same guard in `pocket-casts-android` and `dayone-android`. Part of [AINFRA-2715](https://linear.app/a8c/issue/AINFRA-2715). --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…r-of-public-values-and-env

wzieba

Added a few comments about readability

wzieba · 2026-08-11T06:43:07Z

+tasks.withType(SentryCliExecTask).configureEach {
+    doFirst {
+        if (sentryAuthToken == null) {
+            throw new GradleException(


Do we have to do this here and not on line 71? Is there any advantage to rely on SentryCliExecTask?

ah okay, I think I know why: you don't want to validate when just configuring the build (so it's possible to run build without secrets) but only fail on missing token when someone calls a Sentry task, makes sense

Co-authored-by: Wojciech Zięba <wojciech.zieba@protonmail.com>

…r-of-public-values-and-env

mokagio and others added 5 commits August 10, 2026 16:40

Remove per-app sentry.properties from .configure

3d76c98

mokagio self-assigned this Aug 10, 2026

mokagio commented Aug 11, 2026

View reviewed changes

mokagio marked this pull request as ready for review August 11, 2026 00:45

mokagio requested a review from a team as a code owner August 11, 2026 00:45

Copilot AI lite review requested due to automatic review settings August 11, 2026 00:45

Merge branch 'trunk' into ainfra-2715-remove-sentryproperties-in-favo…

a95a4be

…r-of-public-values-and-env

Copilot started reviewing on behalf of mokagio August 11, 2026 00:45 View session

Copilot AI reviewed Aug 11, 2026

View reviewed changes

Comment thread WordPress/build.gradle

Comment thread fastlane/lanes/build.rb

Comment on lines 491 to 493

sentry_upload_sourcemap(

auth_token: sentry_token,

auth_token: get_required_env('SENTRY_AUTH_TOKEN'),

org_slug: org_slug,

Potential fix for pull request finding

b01e9f3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

mokagio added the Tooling label Aug 11, 2026

mokagio added this to the 27.1 milestone Aug 11, 2026

mokagio enabled auto-merge (squash) August 11, 2026 00:51

mokagio disabled auto-merge August 11, 2026 00:51

mokagio enabled auto-merge (squash) August 11, 2026 00:51

mokagio and others added 2 commits August 11, 2026 16:23

Merge branch 'trunk' into ainfra-2715-remove-sentryproperties-in-favo…

4033f5c

…r-of-public-values-and-env

mokagio requested review from ParaskP7 and wzieba August 11, 2026 06:36

wzieba reviewed Aug 11, 2026

View reviewed changes

mokagio and others added 2 commits August 11, 2026 18:12

Clean up AI-generated comments

cadd35d

Co-authored-by: Wojciech Zięba <wojciech.zieba@protonmail.com>

Merge branch 'trunk' into ainfra-2715-remove-sentryproperties-in-favo…

ad10bcd

…r-of-public-values-and-env

mokagio requested a review from wzieba August 13, 2026 05:29

mokagio mentioned this pull request Aug 13, 2026

Use public Sentry org/project, env-injected token Automattic/pocket-casts-android#5708

Open

Merge branch 'trunk' into ainfra-2715-remove-sentryproperties-in-favo…

f457a58

…r-of-public-values-and-env

mokagio modified the milestones: 27.1, 27.2 Aug 14, 2026

Navigation Menu

Uh oh!

Remove sentry.properties secrets in favour of public values and an env-injected token - #23189

Remove sentry.properties secrets in favour of public values and an env-injected token#23189
mokagio wants to merge 12 commits into
trunkfrom
ainfra-2715-remove-sentryproperties-in-favor-of-public-values-and-env

mokagio commented Aug 10, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Aug 10, 2026 •

edited

Loading

Uh oh!

wpmobilebot commented Aug 10, 2026 •

edited

Loading

Uh oh!

mokagio Aug 11, 2026

Uh oh!

mokagio Aug 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

wzieba left a comment

Uh oh!

Uh oh!

Uh oh!

wzieba Aug 11, 2026

Uh oh!

wzieba Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

mokagio commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing

Uh oh!

wpmobilebot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mokagio Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

wzieba left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

wzieba Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

wzieba Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mokagio commented Aug 10, 2026 •

edited

Loading

wpmobilebot commented Aug 10, 2026 •

edited

Loading

wpmobilebot commented Aug 10, 2026 •

edited

Loading