Repository navigation
chore: stop bundling Config.plist, drop dead API records - #48
Merged
Merged
Conversation
…on Pro Config.plist sat in Copy Bundle Resources, so whatever key was on disk at archive time shipped inside the IPA (1.0's key was revoked 2026-08-19). The file stays on disk and gitignored for local dev; it is simply no longer a build input. - Drop the Resources build-phase entry (file reference kept). - Retire the placeholder-plist steps in ci.yml and ci_post_clone.sh; a clean checkout now builds without it. - ci_post_clone.sh keeps one gate: refuse any archive with FeatureFlags.tipsEnabled = true, since Tips has no safe key source yet. - New invariant: gotchas.yaml#config-plist-never-bundled, CLAUDE.md §3. - Pending Xcode change: SUPPORTS_MACCATALYST and the "Designed for iPhone/iPad" on Mac and Vision Pro destinations set to NO, plus Xcode's re-sort of the PBXBuildFile/PBXFileReference sections.
Savely 1.0 makes no network calls (Tips is flagged off), but Info.plist still declared an App Transport Security exception for openai.com, visible to App Review and at odds with the "Data Not Collected" privacy answers. ITSAppUsesNonExemptEncryption stays; it is load-bearing for upload. The leftover GoogleService-Info.plist was deleted locally (gitignored, never bundled). The Firebase project itself is still open, owner-only; see docs/plans/dead-api-records.md.
testPreviewFootage walks the seeded app at human pace (home, goal, expense, payday auto-move, goal again, trend, privacy, receipt) while `simctl io recordVideo` captures it, and prints BRAGMARK lines with timestamps and tap centers so an editor can cut scenes and draw touch indicators. It also answers the first-launch notification prompt.
4 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ci.ymlno longer writes a placeholder plist.ci_post_clone.shkeeps one gate: any Xcode Cloud archive withFeatureFlags.tipsEnabled = trueis refused, because Tips has no safe key source yet.openai.comATS exception removed fromInfo.plist.ITSAppUsesNonExemptEncryptionstays.testPreviewFootageadded to the store screenshot tour (the App Preview footage walk).brag-output*/is gitignored.gotchas.yaml#config-plist-never-bundled(also in CLAUDE.md §3).docs/xcode-cloud.mdis updated, and both plan docs are committed with their status.Why
1.1 housekeeping from
docs/plans/drop-bundled-config-plist.mdanddocs/plans/dead-api-records.md. The app makes no network calls, and the build should not ship paperwork that says otherwise.Test plan
xcodebuild test -scheme Savelyon iPhone 17 Pro, skipping SavelyUITests like CI. TEST SUCCEEDED, 102 passed, 0 failed.Savely.appcontains no Config.plist or GoogleService-Info.plist, and Info.plist has noNSAppTransportSecurity.swiftlint lint --strictclean.ci_post_clone.shdry-run: tips off + archive → exit 0; tips on + archive → exit 1 with the fix named; tips on + build → exit 0.Risks
OPENAI_API_KEYsecret configured. It's unused now and can be deleted.savely-5160eneeds to be confirmed dormant and deleted. Seedead-api-records.md§2.🤖 Generated with Claude Code