build-time-secret-injectionlisted

# Build-time Secret Injection (Apple-platform) ## When to invoke Any task that introduces or wires values which are: - Technically **app-public** once the app ships (embedded in `Info.plist`, visible in shipped binary, observable in network traffic), AND - **Pre-launch sensitive** (committed to public repo before ship = ad-fraud reconnaissance window, convention violation among collaborators, or fingerprinting of unreleased product) Examples: - AdMob App ID + Banner / Interstitial / Rewarded Unit IDs - ASC API `.p8` key, key-id, issuer ID, ASC numeric app-id - Any third-party SDK app key (Firebase, RevenueCat, etc.) where the convention is "hold until ship" Do NOT invoke for: - True per-deploy secrets (signing certs, CloudKit production API keys, push notification keys) — those have stricter patterns (see [[apple-public-repo-security]]) - Values genuinely public from day 1 (bundle IDs, CKContainer IDs, IAP product IDs, marketing URLs) ## The pattern (locked 2026-06-03) ### Two storage layers, one mechanism per layer **Layer 1 — Build-time secrets (consumed by Xcode build process)** ``` Tuist/ ├── <Domain>.xcconfig # gitignored, real values ├── <Domain>.xcconfig.example # committed, sandbox values + structure ├── Signing.xcconfig # existing precedent (gitignored) └── Signing.xcconfig.example # existing precedent (committed) ``` - xcconfig holds `KEY = VALUE` pairs - `Project.swift` declares per-target `settings(configurations: