infra(all): Introduce generic script for integration tests

scripts/repo.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# USAGE: ./repo.sh <subcommand> [args...]
+#
+# EXAMPLE: ./repo.sh tests decrypt --json ./scripts/secrets/AI.json
+#
+# Wraps around the local "repo" swift package, and facilitates calls to it.
+# The main purpose of this is to make calling "repo" easier, as you typically
+# need to call "swift run" with the package path.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ $# -eq 0 ]]; then
+ cat 1>&2 <<EOF
+OVERVIEW: Small script for running repo commands.
+
+ Repo commands live under the scripts/repo swift package.
+
+USAGE: $0 <subcommand> [args...]
+EOF
+ exit 1
+fi
+
+swift run --package-path "${ROOT}/repo" "$@"

scripts/repo/Package.swift

@@ -0,0 +1,50 @@
+// swift-tools-version:6.0
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
+/*
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import PackageDescription
+
+/// Package containing CLI executables for our larger scripts that are a bit harder to follow in
+/// bash form, or that need more advanced flag/optional requirements.
+let package = Package(
+ name: "RepoScripts",
+ platforms: [.macOS(.v15)],
+ products: [
+ .executable(name: "tests", targets: ["Tests"]),
+ ],
+ dependencies: [
+ .package(url: "https://github.com/apple/swift-argument-parser", exact: "1.6.2"),
+ .package(url: "https://github.com/apple/swift-log", exact: "1.6.2"),
+ ],
+ targets: [
+ .executableTarget(
+ name: "Tests",
+ dependencies: [
+ .product(name: "ArgumentParser", package: "swift-argument-parser"),
+ .product(name: "Logging", package: "swift-log"),
+ .byName(name: "Util"),
+ ]
+ ),
+ .target(
+ name: "Util",
+ dependencies: [
+ .product(name: "Logging", package: "swift-log"),
+ ]
+ ),
+ ]
+)

scripts/repo/README.md

@@ -0,0 +1,13 @@
+# Firebase Apple repo commands
+
+This project includes commands that are too long and complicated to properly
+maintain in a bash script, or that have unique option/flag constraints that
+are better represented in a swift project.
+
+## Tests
+
+Commands for interacting with integration tests in the repo.
+
+```sh
+./scripts/repo.sh tests --help
+```

scripts/repo/Sources/Tests/Decrypt.swift

@@ -0,0 +1,183 @@
+/*
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import ArgumentParser
+import Foundation
+import Logging
+import Util
+
+extension Tests {
+ /// Command for decrypting the secret files needed for a test run.
+ struct Decrypt: ParsableCommand {
+ nonisolated(unsafe) static var configuration = CommandConfiguration(
+ abstract: "Decrypt the secret files for a test run.",
+ usage: """
+ tests decrypt [--json] [--overwrite] [<json-file>]
+ tests decrypt [--password <password>] [--overwrite] [<secret-files> ...]
+
+ tests decrypt --json secret_files.json
+ tests decrypt --json --overwrite secret_files.json
+ tests decrypt --password "super_secret" \\
+ scripts/gha-encrypted/FirebaseAI/TestApp-GoogleService-Info.plist.gpg:FirebaseAI/Tests/TestApp/Resources/GoogleService-Info.plist \\
+ scripts/gha-encrypted/FirebaseAI/TestApp-GoogleService-Info-Spark.plist.gpg:FirebaseAI/Tests/TestApp/Resources/GoogleService-Info-Spark.plist
+ """,
+ discussion: """
+ The happy path usage is saving the secret passphrase in the environment variable \
+ 'secrets_passphrase', and passing a json file to the command. Although, you can also \
+ pass everything inline via options.
+
+ When using a json file, it's expected that the json file is an array of json elements \
+ in the format of:
+ { encrypted: <path-to-encrypted-file>, destination: <where-to-output-decrypted-file> }
+ """,
+ )
+
+ @Argument(
+ help: """
+ An array of secret files to decrypt. \
+ The files should be in the format "encrypted:destination", where "encrypted" is a path to \
+ the encrypted file and "destination" is a path to where the decrypted file should be saved.
+ """
+ )
+ var secretFiles: [String] = []
+
+ @Option(
+ help: """
+ The secret to use when decrypting the files. \
+ Defaults to the environment variable 'secrets_passphrase'.
+ """
+ )
+ var password: String = ""
+
+ @Flag(help: "Overwrite existing decrypted secret files.")
+ var overwrite: Bool = false
+
+ @Flag(
+ help: """
+ Use a json file of secret file mappings instead. \
+ When this flag is enabled, <secret-files> should be a single json file.
+ """
+ )
+ var json: Bool = false
+
+ /// The parsed version of ``secretFiles``.
+ ///
+ /// Only populated after `validate()` runs.
+ var files: [SecretFile] = []
+
+ static let log = Logger(label: "Tests::Decrypt")
+ private var log: Logger { Decrypt.log }
+
+ mutating func validate() throws {
+ try validatePassword()
+
+ if json {
+ try validateJSON()
+ } else {
+ try validateFileString()
+ }
+
+ if !overwrite {
+ log.info("Overwrite is disabled, so we're skipping generation for existing files.")
+ files = files.filter { file in
+ let keep = !FileManager.default.fileExists(atPath: file.destination)
+ if !keep {
+ log.debug(
+ "Skipping generation for existing file",
+ metadata: ["destination": "\(file.destination)"]
+ )
+ }
+ return keep
+ }
+ }
+
+ for file in files {
+ guard FileManager.default.fileExists(atPath: file.encrypted) else {
+ throw ValidationError("Encrypted secret file does not exist: \(file.encrypted)")
+ }
+ }
+ }
+
+ private mutating func validatePassword() throws {
+ if password.isEmpty {
+ // when a password isn't provided, try to load one from the environment variable
+ guard
+ let secrets_passphrase = ProcessInfo.processInfo.environment["secrets_passphrase"]
+ else {
+ throw ValidationError(
+ "Either provide a passphrase via the password option or set the environvment variable 'secrets_passphrase' to the passphrase."
+ )
+ }
+ password = secrets_passphrase
+ }
+ }
+
+ private mutating func validateJSON() throws {
+ guard let jsonPath = secretFiles.first else {
+ throw ValidationError("Missing path to json file for secret files")
+ }
+
+ let fileURL = URL(
+ filePath: jsonPath, directoryHint: .notDirectory,
+ relativeTo: URL.currentDirectory()
+ )
+
+ files = try SecretFile.parseArrayFrom(file: fileURL)
+ guard !files.isEmpty else {
+ throw ValidationError("Missing secret files in json file: \(jsonPath)")
+ }
+ }
+
+ private mutating func validateFileString() throws {
+ guard !secretFiles.isEmpty else {
+ throw ValidationError("Missing paths to secret files")
+ }
+ for string in secretFiles {
+ try files.append(SecretFile(string: string))
+ }
+ }
+
+ mutating func run() throws {
+ log.info("Decrypting files...")
+
+ for file in files {
+ let gpg = Process("gpg", inheritEnvironment: true)
+ let result = try gpg.runWithSignals([
+ "--quiet",
+ "--batch",
+ "--yes",
+ "--decrypt",
+ "--passphrase=\(password)",
+ "--output",
+ file.destination,
+ file.encrypted,
+ ])
+
+ guard result == 0 else {
+ log.error("Failed to decrypt file", metadata: ["file": "\(file.encrypted)"])
+ throw ExitCode(result)
+ }
+
+ log.debug(
+ "File encrypted",
+ metadata: ["file": "\(file.encrypted)", "destination": "\(file.destination)"]
+ )
+ }
+
+ log.info("Files decrypted")
+ }
+ }
+}

scripts/repo/Sources/Tests/SecretFile.swift

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import ArgumentParser
+import Foundation
+
+/// A representation of a secret file, which should be decrypted for an integration test.
+struct SecretFile: Codable {
+ /// A relative path to the encrypted file.
+ let encrypted: String
+
+ /// A relative path to where the decrypted file should be output to.
+ let destination: String
+}
+
+extension SecretFile {
+ /// Parses a `SecretFile` from a string.
+ ///
+ /// The string should be in the format of "encrypted:destination".
+ /// If it's not, then a `ValidationError`will be thrown.
+ ///
+ /// - Parameters:
+ /// - string: A string in the format of "encrypted:destination".
+ init(string: String) throws {
+ let splits = string.split(separator: ":")
+ guard splits.count == 2 else {
+ throw ValidationError(
+ "Invalid secret file format. Format should be \"encrypted:destination\". Cause: \(string)"
+ )
+ }
+ encrypted = String(splits[0])
+ destination = String(splits[1])
+ }
+
+ /// Parses an array of `SecretFile` from a JSON file.
+ ///
+ /// It's expected that the secrets are encoded in the JSON file in the format of:
+ /// ```json
+ /// [
+ /// {
+ /// "encrypted": "path-to-encrypted-file",
+ /// "destination": "where-to-output-decrypted-file"
+ /// }
+ /// ]
+ /// ```
+ ///
+ /// - Parameters:
+ /// - file: The URL of a JSON file which contains an array of `SecretFile`,
+ /// encoded as JSON.
+ static func parseArrayFrom(file: URL) throws -> [SecretFile] {
+ do {
+ let data = try Data(contentsOf: file)
+ return try JSONDecoder().decode([SecretFile].self, from: data)
+ } catch {
+ throw ValidationError(
+ "Failed to load secret files from json file. Cause: \(error.localizedDescription)"
+ )
+ }
+ }
+}