Build-time Secret Injection (Apple-platform)

Tuist assumption: the Project.swift snippets below assume the app's .xcodeproj is generated by Tuist from a root-level Project.swift (Tuist's own convention keeps Tuist/ for Package.swift and shared helpers, not for Project.swift itself). A hand-maintained .xcodeproj needs no Project.swift step — see Non-Tuist projects below for the equivalent (an xcconfig referenced directly from the target's Build Settings → Configurations, instead of via Project.swift).

When to invoke

Any task that introduces or wires values which are:

• Technically app-public once the app ships (embedded in Info.plist, visible in shipped binary, observable in network traffic), AND
• Pre-launch sensitive (committed to public repo before ship = ad-fraud reconnaissance window, convention violation among collaborators, or fingerprinting of unreleased product)

Examples:

• AdMob App ID + Banner / Interstitial / Rewarded Unit IDs
• ASC API .p8 key, key-id, issuer ID, ASC numeric app-id
• Any third-party SDK app key (Firebase, RevenueCat, etc.) where the convention is "hold until ship"

Do NOT invoke for:

• True per-deploy secrets (signing certs, CloudKit production API keys, push notification keys) — those have stricter patterns (see apple-public-repo-security)
• Values genuinely public from day 1 (bundle IDs, CKContainer IDs, IAP product IDs, marketing URLs)