From 4fd7e046bef397d1be91e3fc10c49eaecc62e8d0 Mon Sep 17 00:00:00 2001
From: Brandon McAnsh <git@bmcreations.dev>
Date: Wed, 14 Oct 2026 17:29:00 -0400
Subject: [PATCH] fix(build): generate GoogleService-Info.plist into the app
 bundle

The Generate Google phase wrote the populated plist over the tracked
template in Flipcash/Supporting Files, so every build left that file
modified. It now runs after Resources and writes straight to
$TARGET_BUILD_DIR/$UNLOCALIZED_RESOURCES_FOLDER_PATH, and the template
is gone.

The template has to go rather than stay as a placeholder: the Flipcash
folder is a synchronized group, so Resources would copy it to the same
bundle path the script now declares as output. The path is also in
.gitignore and the target's membership exceptions, so a stale copy left
in an existing checkout is neither listed as untracked nor bundled.

The pre-commit blocklist now skips deletions, which it rejected along
with additions; removing a file cannot leak its contents.
---
 .gitignore                                    |  2 +
 Code.xcodeproj/project.pbxproj                |  7 ++--
 .../Supporting Files/GoogleService-Info.plist | 38 -------------------
 Scripts/git-hooks/pre-commit                  |  3 +-
 4 files changed, 8 insertions(+), 42 deletions(-)
 delete mode 100644 Flipcash/Supporting Files/GoogleService-Info.plist

diff --git a/.gitignore b/.gitignore
index b192b29a9..97a324107 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,6 @@
 ## Private assets
+# Generated into the app bundle by Scripts/gengoogle; a copy here is stale.
+Flipcash/Supporting Files/GoogleService-Info.plist
 Configurations/secrets.local.xcconfig
 ci_scripts/ci_post_xcodebuild.sh
 .env
diff --git a/Code.xcodeproj/project.pbxproj b/Code.xcodeproj/project.pbxproj
index 9e966b410..d73833c10 100644
--- a/Code.xcodeproj/project.pbxproj
+++ b/Code.xcodeproj/project.pbxproj
@@ -148,6 +148,7 @@
 			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
 			membershipExceptions = (
 				"Supporting Files/apple-app-site-association",
+				"Supporting Files/GoogleService-Info.plist",
 				"Supporting Files/Info.plist",
 			);
 			target = 9A516F792D9B12E800AF478B /* Flipcash */;
@@ -417,10 +418,10 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 9A516F9B2D9B12EA00AF478B /* Build configuration list for PBXNativeTarget "Flipcash" */;
 			buildPhases = (
-				9ADEF1CD2DD516A5001B260A /* Generate Google */,
 				9A516F762D9B12E800AF478B /* Sources */,
 				9A516F772D9B12E800AF478B /* Frameworks */,
 				9A516F782D9B12E800AF478B /* Resources */,
+				9ADEF1CD2DD516A5001B260A /* Generate Google */,
 				4C7D70022FC8892D0091C7A4 /* Embed Foundation Extensions */,
 			);
 			buildRules = (
@@ -656,11 +657,11 @@
 			outputFileListPaths = (
 			);
 			outputPaths = (
-				"$(SOURCE_ROOT)/Flipcash/Supporting Files/GoogleService-Info.plist",
+				"$(TARGET_BUILD_DIR)/$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/GoogleService-Info.plist",
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "cd \"$SOURCE_ROOT/Scripts\"\n\n./gengoogle \"$SOURCE_ROOT/Flipcash/Supporting Files/GoogleService-Info.plist\" \"FG_\"\n";
+			shellScript = "cd \"$SOURCE_ROOT/Scripts\"\n\n./gengoogle \"$TARGET_BUILD_DIR/$UNLOCALIZED_RESOURCES_FOLDER_PATH/GoogleService-Info.plist\" \"FG_\"\n";
 		};
 /* End PBXShellScriptBuildPhase section */
 
diff --git a/Flipcash/Supporting Files/GoogleService-Info.plist b/Flipcash/Supporting Files/GoogleService-Info.plist
deleted file mode 100644
index a33159571..000000000
--- a/Flipcash/Supporting Files/GoogleService-Info.plist	
+++ /dev/null
@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CLIENT_ID</key>
-	<string></string>
-	<key>REVERSED_CLIENT_ID</key>
-	<string></string>
-	<key>API_KEY</key>
-	<string></string>
-	<key>GCM_SENDER_ID</key>
-	<string></string>
-	<key>PLIST_VERSION</key>
-	<string></string>
-	<key>BUNDLE_ID</key>
-	<string></string>
-	<key>PROJECT_ID</key>
-	<string></string>
-	<key>STORAGE_BUCKET</key>
-	<string></string>
-	<key>IS_ADS_ENABLED</key>
-	<false/>
-	<key>IS_ANALYTICS_ENABLED</key>
-	<false/>
-	<key>IS_APPINVITE_ENABLED</key>
-	<false/>
-	<key>IS_GCM_ENABLED</key>
-	<false/>
-	<key>IS_SIGNIN_ENABLED</key>
-	<false/>
-	<key>FirebaseAppDelegateProxyEnabled</key>
-	<false/>
-	<key>GoogleUtilitiesAppDelegateProxyEnabled</key>
-	<false/>
-	<key>GOOGLE_APP_ID</key>
-	<string></string>
-</dict>
-</plist>
diff --git a/Scripts/git-hooks/pre-commit b/Scripts/git-hooks/pre-commit
index b3974f3fc..946c0e46d 100755
--- a/Scripts/git-hooks/pre-commit
+++ b/Scripts/git-hooks/pre-commit
@@ -3,6 +3,7 @@
 # CI scripts, or any file that flips between dummy/real values per local
 # environment. Most of these are gitignored, but `git add -f` bypasses
 # .gitignore and would silently commit secrets; this hook is the safety net.
+# Deletions pass: removing a file cannot leak its contents.
 
 set -e
 
@@ -48,7 +49,7 @@ while IFS= read -r -d '' staged_path; do
             $pattern) block "$staged_path" ;;
         esac
     done
-done < <(git diff --cached --name-only -z)
+done < <(git diff --cached --name-only --diff-filter=d -z)
 
 # Contract pins: FlipcashAPI/Package.swift pins each contract package with an
 # exact version, and the workspace Package.resolved has to record the same one.