build-mobile.yml

# Production mobile binaries are compiled on GitHub runners with EAS Build's local engine.
# EAS remains the credential store and, when requested, uploads the signed artifacts to the stores.

name: Build Mobile

on:
  workflow_call:
    inputs:
      ref:
        description: Git ref to build
        type: string
        required: false
        default: ""
      brand_id:
        description: Brand id for isolated artifact names
        type: string
        required: false
        default: ""
      delivery_descriptor_sha256:
        description: Expected SHA-256 of the committed brand delivery matrix
        type: string
        required: false
        default: ""
      rendered_artifact:
        description: Pre-rendered brand/config artifact from the matrix workflow
        type: string
        required: false
        default: ""
      submit:
        description: Upload to TestFlight and Google Play internal testing
        type: boolean
        required: false
        default: false
      release_environment:
        description: GitHub environment that owns build, signing, and store credentials
        type: string
        required: false
        default: release
  workflow_dispatch:
    inputs:
      submit:
        description: Upload the completed builds to TestFlight and Google Play internal testing
        type: boolean
        required: true
        default: false

concurrency:
  group: build-mobile-production-${{ inputs.brand_id || 'linkcode' }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  MOBILE_DIR: apps/mobile
  NODE_OPTIONS: --max-old-space-size=4096

jobs:
  preflight:
    name: Validate release request
    runs-on: ${{ vars.CI_RUNNER_LINUX || 'ubuntu-latest' }}
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Check submit configuration
        if: ${{ inputs.submit && inputs.rendered_artifact == '' }}
        run: |
          asc_app_id="$(jq -r '.submit.production.ios.ascAppId // empty' apps/mobile/eas.json)"
          if [ -z "$asc_app_id" ]; then
            echo "::error::Set submit.production.ios.ascAppId in apps/mobile/eas.json before enabling submit"
            exit 1
          fi

  # Store builds always sign, so the immutable config bundle is unconditionally required. This
  # job downloads one release-input descriptor and renders both platform modules from the exact
  # publisher/source commits it binds.
  render-config:
    name: Render immutable config
    needs: preflight
    if: ${{ inputs.rendered_artifact == '' }}
    runs-on: ${{ vars.CI_RUNNER_LINUX || 'ubuntu-latest' }}
    timeout-minutes: 20
    environment: ${{ inputs.release_environment || 'release' }}
    steps:
      - name: Validate config repositories
        id: repositories
        env:
          CONFIG_PUBLISHER_REPO: ${{ vars.CONFIG_PUBLISHER_REPO }}
          CONFIG_SOURCE_REPO: ${{ vars.CONFIG_SOURCE_REPO }}
        run: |
          set -euo pipefail
          validate_repository() {
            local name="$1" value="$2" prefix="$3"
            if [ -z "$value" ]; then
              echo "::error::$name is required in the protected release environment"
              exit 1
            fi
            if [[ ! "$value" =~ ^([A-Za-z0-9][A-Za-z0-9-]{0,38})/([A-Za-z0-9][A-Za-z0-9._-]{0,99})$ ]]; then
              echo "::error::$name must use canonical owner/repository syntax"
              exit 1
            fi
            if [ "${BASH_REMATCH[1]}" != arcboxlabs ]; then
              echo "::error::$name owner must be arcboxlabs"
              exit 1
            fi
            printf '%s-full=%s\n%s-name=%s\n' "$prefix" "$value" "$prefix" "${BASH_REMATCH[2]}" >> "$GITHUB_OUTPUT"
          }
          validate_repository CONFIG_PUBLISHER_REPO "$CONFIG_PUBLISHER_REPO" publisher
          validate_repository CONFIG_SOURCE_REPO "$CONFIG_SOURCE_REPO" source
          if [ "$CONFIG_PUBLISHER_REPO" = "$CONFIG_SOURCE_REPO" ]; then
            echo "::error::CONFIG_PUBLISHER_REPO and CONFIG_SOURCE_REPO must identify different repositories"
            exit 1
          fi

      - name: Require organization App credentials
        env:
          BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
          BOT_APP_PRIVATE_KEY: ${{ secrets.BOT_APP_PRIVATE_KEY }}
        run: |
          if [ -z "$BOT_APP_ID" ] || [ -z "$BOT_APP_PRIVATE_KEY" ]; then
            echo "::error::BOT_APP_ID and BOT_APP_PRIVATE_KEY must be available so config rendering can read the selected publisher and source repositories"
            exit 1
          fi

      - name: Mint publisher read token
        id: publisher-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          owner: arcboxlabs
          repositories: ${{ steps.repositories.outputs.publisher-name }}
          permission-contents: read

      - name: Mint config source read token
        id: source-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          owner: arcboxlabs
          repositories: ${{ steps.repositories.outputs.source-name }}
          permission-contents: read

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.ref || github.ref }}
          persist-credentials: false

      - name: Setup EAS
        uses: ./.github/actions/setup-eas

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Render config bundles
        uses: ./.github/actions/render-release-config
        with:
          app: mobile
          release-inputs-url: https://config.linkcode.ai/release/v1/linkcode/stable.json
          publisher-repository: ${{ steps.repositories.outputs.publisher-full }}
          publisher-token: ${{ steps.publisher-token.outputs.token }}
          source-repository: ${{ steps.repositories.outputs.source-full }}
          source-token: ${{ steps.source-token.outputs.token }}

      - name: Upload generated config modules
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: mobile-config-modules
          path: apps/mobile/src/runtime/config/bundled.generated.*.ts
          if-no-files-found: error
          retention-days: 1

  build:
    name: Build ${{ matrix.platform }}
    needs: [preflight, render-config]
    if: ${{ !cancelled() && needs.preflight.result == 'success' && (needs.render-config.result == 'success' || needs.render-config.result == 'skipped') }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 120
    environment: ${{ inputs.release_environment || 'release' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: android
            extension: aab
            os: ${{ vars.CI_RUNNER_LINUX || 'ubuntu-latest' }}
          - platform: ios
            extension: ipa
            os: ${{ vars.CI_RUNNER_MACOS || 'macos-26' }}

    steps:
      - name: Check release configuration
        shell: bash
        env:
          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_DSN_MOBILE: ${{ secrets.SENTRY_DSN_MOBILE }}
          POSTHOG_PROJECT_TOKEN: ${{ secrets.POSTHOG_PROJECT_TOKEN }}
          POSTHOG_HOST: ${{ vars.POSTHOG_HOST }}
        run: |
          set -euo pipefail
          missing=false
          for variable in EXPO_TOKEN SENTRY_AUTH_TOKEN SENTRY_DSN_MOBILE POSTHOG_PROJECT_TOKEN POSTHOG_HOST; do
            if [ -z "${!variable}" ]; then
              echo "::error::Missing GitHub Actions secret or variable: ${variable}"
              missing=true
            fi
          done
          if [ "$missing" = true ]; then
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Setup EAS
        uses: ./.github/actions/setup-eas

      - name: Setup Java
        if: ${{ matrix.platform == 'android' }}
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
        with:
          distribution: temurin
          java-version: 17

      - name: Verify native toolchain
        shell: bash
        run: |
          set -euo pipefail
          if [ "${{ matrix.platform }}" = ios ]; then
            xcodebuild -version
            pod --version
            fastlane --version
            read -r _ xcode_version < <(xcodebuild -version)
            xcode_major="${xcode_version%%.*}"
            if [ "$xcode_major" -lt 26 ]; then
              echo "::error::Xcode 26 or newer is required; found ${xcode_version}"
              exit 1
            fi
          else
            java -version
            if [ -z "${ANDROID_HOME:-}" ] || [ ! -d "$ANDROID_HOME" ]; then
              echo "::error::ANDROID_HOME does not point to an installed Android SDK"
              exit 1
            fi
          fi

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # The exact modules rendered by render-config; .easignore lets them into the EAS project
      # archive, and the eas-build-pre-install hook re-verifies them inside that archive.
      - name: Fetch generated config modules
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ${{ inputs.rendered_artifact || 'mobile-config-modules' }}
          path: ${{ inputs.rendered_artifact != '' && '.' || 'apps/mobile/src/runtime/config' }}

      - name: Verify release config modules
        run: pnpm -F @linkcode/mobile config:verify-release

      - name: Build signed artifact locally
        working-directory: ${{ env.MOBILE_DIR }}
        env:
          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
          EXPO_PUBLIC_SENTRY_DSN: ${{ secrets.SENTRY_DSN_MOBILE }}
          EXPO_PUBLIC_POSTHOG_PROJECT_TOKEN: ${{ secrets.POSTHOG_PROJECT_TOKEN }}
          EXPO_PUBLIC_POSTHOG_HOST: ${{ vars.POSTHOG_HOST }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        run: eas build --local --platform "${{ matrix.platform }}" --profile production --output "$RUNNER_TEMP/linkcode-${{ matrix.platform }}.${{ matrix.extension }}" --non-interactive

      - name: Write artifact provenance
        if: ${{ inputs.rendered_artifact != '' }}
        run: |
          pnpm exec tsx packages/foundation/common/src/node/release-artifact-cli.mts \
            --artifact-root "$RUNNER_TEMP" \
            --artifact "linkcode-${{ matrix.platform }}.${{ matrix.extension }}" \
            --bundle "apps/mobile/src/runtime/config/bundled.generated.${{ matrix.platform }}.ts" \
            --brand-identity "apps/mobile/generated/brand-identity.${{ matrix.platform }}.json" \
            --brand-manifest release-inputs/brands.manifest.yaml \
            --client-git-sha '${{ inputs.ref }}' \
            --delivery-descriptor release-inputs/brand-build-matrix.json \
            --expected-delivery-sha256 '${{ inputs.delivery_descriptor_sha256 }}' \
            --release-manifest "release-inputs/release-manifest.${{ matrix.platform }}.json" \
            --compliance "release-inputs/compliance.${{ matrix.platform }}.json" \
            --out "release-provenance.${{ matrix.platform }}.json" \
            --signed

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ inputs.brand_id != '' && format('mobile-{0}-{1}', inputs.brand_id, matrix.platform) || format('mobile-{0}', matrix.platform) }}
          path: |
            ${{ runner.temp }}/linkcode-${{ matrix.platform }}.${{ matrix.extension }}
            ${{ runner.temp }}/release-provenance.${{ matrix.platform }}.json
          if-no-files-found: error
          retention-days: 7

  submit:
    name: Submit ${{ matrix.platform }}
    if: ${{ inputs.submit }}
    needs: build
    runs-on: ${{ vars.CI_RUNNER_LINUX || 'ubuntu-latest' }}
    timeout-minutes: 30
    environment: ${{ inputs.release_environment || 'release' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: ios
            extension: ipa

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: ${{ inputs.ref || github.ref }}

      - name: Setup EAS
        uses: ./.github/actions/setup-eas

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Download artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: ${{ inputs.brand_id != '' && format('mobile-{0}-{1}', inputs.brand_id, matrix.platform) || format('mobile-{0}', matrix.platform) }}
          path: ${{ runner.temp }}

      - name: Submit artifact
        working-directory: ${{ env.MOBILE_DIR }}
        env:
          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
        run: eas submit --platform "${{ matrix.platform }}" --profile production --path "$RUNNER_TEMP/linkcode-${{ matrix.platform }}.${{ matrix.extension }}" --non-interactive --wait