Note: maked this as a draft to investigate the following issues:

• Flatpaks ship a /app/manifest.json file with the build manifest. This PR uses the manifest to integrate services, which would ship to everyone the client ids and hashes.
• There might be a better way to do that using the Flatpak GitHub action instead. Needs investigation.
• flatpak-builder probably need to be adjusted to handle this use-case

Relevant flatpak-builder pull request: flatpak/flatpak-builder#406

Just an update message to tell the actual situation:

• Add 'secret-opts' option to manifest flatpak/flatpak-builder#408 was merged.
• So it's included since the version 1.1.2 of flatpak-builder.
• @GeorgesStavracas himself as lobbied Fedora to get the newer version on Fedora 34.
• So the next stable version of flatpak-builder is now in 34's repo. Check here.
• Since the new package is in the repo since a while, flatpak-actions image should now include the new version of flatpak-builder.

So this PR just need to be updated with the brand new secret-opts.

Yup, I've been trying to do that on https://github.com/GeorgesStavracas/obs-studio/tree/gbsneto/flatpak-services but I've found that the Flatpak action didn't include flatpak-builder 1.2 yet. I've been annoying Bilal about it, let's see how it goes now 🙂

I could confirm this is working by pushing these commits to the master branch of my fork, and adding bogus secrets that would purposefully fail the build. You can verify here that the Flatpak build also failed with:

/run/build/obs/UI/auth-twitch.cpp: In member function ‘bool TwitchAuth::MakeApiRequest(const char*, json11::Json&)’:
/run/build/obs/_flatpak_build/UI/ui-config.h:21:25: error: unable to find numeric literal operator ‘operator""xbadc0ffee’
   21 | #define TWITCH_HASH     0x***
      |                         ^~~~~~~~~~~~~

This is sufficient to verify that the secrets are properly propagated to the build system through secret-opts.

This was LGTMed on Discord, thanks Rodney!