Make native builds source-addressable

.github/workflows/build-submit-android.yml

@@ -14,6 +14,11 @@ on:
         type: boolean
         description: Submit the build to Google Play (disable to only produce the APK artifact)
         default: true
+      sourceRef:
+        type: string
+        description: Source ref to build; use a full commit SHA for immutable builds
+        required: false
+        default: ''
   workflow_call:
     inputs:
       profile:
@@ -29,6 +34,11 @@ on:
         description: Runner for the build job (defaults to Linux-x64-32core)
         required: false
         default: ''
+      sourceRef:
+        type: string
+        description: Source ref to build; use a full commit SHA for immutable builds
+        required: false
+        default: ''
     outputs:
       package-version:
         description: Version from package.json
@@ -36,6 +46,9 @@ on:
       version-code:
         description: Android version code
         value: ${{ jobs.build.outputs.version-code }}
+      source-sha:
+        description: Exact commit used for the build
+        value: ${{ jobs.build.outputs.source-sha }}
     secrets:
       EXPO_TOKEN:
         required: true
@@ -77,12 +90,20 @@ jobs:
     outputs:
       package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
       version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+      source-sha: ${{ steps.source.outputs.sha }}
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ inputs.sourceRef || github.sha }}
           fetch-depth: 5
 
+      - name: Resolve build source
+        id: source
+        run: |
+          echo "Building source: $(git rev-parse HEAD)"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: 🔧 Setup Expo project
         uses: ./.github/actions/setup-expo-project
         with:
@@ -153,6 +174,7 @@ jobs:
       - name: ⬇️ Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ needs.build.outputs.source-sha }}
           fetch-depth: 5
 
       - name: 🔧 Setup Expo project

.github/workflows/build-submit-ios.yml

@@ -23,6 +23,11 @@ on:
         description: TestFlight "What to Test" notes (only applied when a group is selected)
         required: false
         default: ''
+      sourceRef:
+        type: string
+        description: Source ref to build; use a full commit SHA for immutable builds
+        required: false
+        default: ''
   workflow_call:
     inputs:
       profile:
@@ -38,6 +43,11 @@ on:
         description: Runner for the build job (defaults to macos-26-xlarge)
         required: false
         default: ''
+      sourceRef:
+        type: string
+        description: Source ref to build; use a full commit SHA for immutable builds
+        required: false
+        default: ''
     outputs:
       package-version:
         description: Version from package.json
@@ -45,6 +55,9 @@ on:
       build-number:
         description: iOS build number
         value: ${{ jobs.build.outputs.build-number }}
+      source-sha:
+        description: Exact commit used for the build
+        value: ${{ jobs.build.outputs.source-sha }}
     secrets:
       EXPO_TOKEN:
         required: true
@@ -84,12 +97,20 @@ jobs:
     outputs:
       package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
       build-number: ${{ steps.ipa-build-number.outputs.build-number }}
+      source-sha: ${{ steps.source.outputs.sha }}
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ inputs.sourceRef || github.sha }}
           fetch-depth: 5
 
+      - name: Resolve build source
+        id: source
+        run: |
+          echo "Building source: $(git rev-parse HEAD)"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: 🔧 Setup Expo project
         uses: ./.github/actions/setup-expo-project
         with:
@@ -236,6 +257,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # eas submit reads the app config from the repo
+          ref: ${{ needs.build.outputs.source-sha }}
           fetch-depth: 5
 
       - name: 🔧 Setup Expo project