Xcode Cloud

Create a Mellon token for one project, environment, and Apple surface. Use a short expiration such as 30 days. Add these Xcode Cloud environment variables:

Install Mellon and run your existing configuration generator from ci_scripts/ci_post_clone.sh:

1234567891011#!/bin/sh
set -eu

curl -fsSL https://<your-mellon-host>/install.sh | sh
export PATH="$HOME/.mellon/bin:$PATH"

mellon run \
  --project <project> \
  --env <environment> \
  --surface <apple-surface> \
  -- ./scripts/configure-xcode.sh

The configuration script receives the secrets as environment variables. Mellon filters the script output. The script must not print the environment or enable shell tracing.

Xcode Cloud does not preserve exports from a post-clone process for later build processes. Use the configuration script to generate the file format that your Xcode project already consumes. Store generated plaintext only in the temporary Xcode Cloud workspace. Do not commit it.

Rotate the Xcode Cloud secret before the token expires. Delete the old token from Mellon after a successful build.