Remove sentry.properties secrets in favour of public values and an env-injected token

.aiexclude

@@ -31,7 +31,6 @@ build.log
 google-services.json
 google-upload-credentials.json
 firebase.secrets.json
-sentry.properties
 
 # Gradle files
 gradle.properties

.configure

@@ -13,16 +13,6 @@
       "destination": "WordPress/google-services.json",
       "encrypt": true
     },
-    {
-      "file": "android/WPAndroid/wordpress-sentry.properties",
-      "destination": "WordPress/src/wordpress/sentry.properties",
-      "encrypt": true
-    },
-    {
-      "file": "android/WPAndroid/jetpack-sentry.properties",
-      "destination": "WordPress/src/jetpack/sentry.properties",
-      "encrypt": true
-    },
     {
       "file": "android/debug.keystore",
       "destination": "~/.configure/wordpress-android/secrets/debug_a8c.keystore",
@@ -45,4 +35,4 @@
     }
   ],
   "file_dependencies": []
-}
+}

.gitignore

@@ -91,7 +91,6 @@ default.profraw
 /vendor
 /fastlane/promo_screenshots
 /fastlane/metadata/tmp
-sentry.properties
 
 WordPress/release.jks
 WordPress/debug.keystore

WordPress/build.gradle

@@ -1,4 +1,5 @@
 import io.sentry.android.gradle.extensions.InstrumentationFeature
+import io.sentry.android.gradle.tasks.SentryCliExecTask
 
 plugins {
     alias(libs.plugins.android.application)
@@ -64,7 +65,14 @@ static String pathForSmartFlankGcsPath(String app) {
     return "gs://fladle/wordpress-android/${app}/smart-flank/JUnitReport.xml"
 }
 
+// A secret-injection step that resolves to nothing exports an empty SENTRY_AUTH_TOKEN rather
+// than leaving it unset, so treat blank as missing — otherwise the guard below passes and
+// sentry-cli fails mid-upload with an opaque auth error.
+def sentryAuthToken = providers.environmentVariable("SENTRY_AUTH_TOKEN").orNull?.trim() ?: null
+
 sentry {
+    authToken = sentryAuthToken
+
     tracingInstrumentation {
         enabled = true
         features = [InstrumentationFeature.DATABASE]
@@ -83,6 +91,17 @@ sentry {
     telemetry = false
 }
 
+tasks.withType(SentryCliExecTask).configureEach {
+    doFirst {
+        if (sentryAuthToken == null) {
+            throw new GradleException(
+                "SENTRY_AUTH_TOKEN is not set (or is blank). " +
+                    "Set it to upload debug files to Sentry."
+            )
+        }
+    }
+}
+
 allOpen {
     // allows mocking for classes w/o directly opening them for release builds
     annotation 'org.wordpress.android.testing.OpenClassAnnotation'

WordPress/src/jetpack/sentry.properties

@@ -0,0 +1,2 @@
+defaults.project=jetpack-android
+defaults.org=a8c

WordPress/src/wordpress/sentry.properties

@@ -0,0 +1,2 @@
+defaults.project=wordpress-android
+defaults.org=a8c

fastlane/lanes/build.rb

@@ -482,15 +482,14 @@ def upload_gutenberg_sourcemaps(app:, release_version:)
     # Load Sentry properties
     sentry_path = File.join(PROJECT_ROOT_FOLDER, 'WordPress', 'src', app.downcase, 'sentry.properties')
     sentry_properties = JavaProperties.load(sentry_path)
-    sentry_token = sentry_properties[:'auth.token']
     project_slug = sentry_properties[:'defaults.project']
     org_slug = sentry_properties[:'defaults.org']
 
     # Bundle and source map files are copied to a specific folder as part of the build process.
     bundle_source_map_path = File.join(PROJECT_ROOT_FOLDER, 'WordPress', 'build', 'react-native-bundle-source-map')
 
     sentry_upload_sourcemap(
-      auth_token: sentry_token,
+      auth_token: get_required_env('SENTRY_AUTH_TOKEN'),
       org_slug: org_slug,
       project_slug: project_slug,
       version: release_version,