519293d4d0
ci: gate per-PR OTA on the fork guard, not author_association
...
The author_association check skipped the job for private org members:
the pull_request webhook payload exposes only the public-safe association,
which downgrades a private member to CONTRIBUTOR/NONE, so MEMBER never
matched and no staff PR could publish.
Drop that clause and rely on the fork guard alone. A branch can only exist
in this repo if someone with write access pushed it, so an outside
contributor (fork-only) never runs this job; same-repo PRs are staff-
authored. This matches the fork-guard gate the other jobs in this workflow
already use.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-22 16:02:15 -07:00
c5093818ae
ci: publish OTA bundles to denis (S3) + automatic per-PR previews
...
Rewire OTA publishing off the legacy ota1 box onto the S3-backed denis
service, in two places:
- Prod path (bundle-deploy-eas-update.yml): dual-write the exported bundle
to denis via `denis publish` alongside the existing ota1 upload, under the
identical `!includes-changes && !version-changed` gate. Assumes the
main-only `denis-ci-publish` role via OIDC (id-token: write). Both paths
must succeed; they are removed together once denis is the sole origin.
- Per-PR previews (pull-request-commit.yml): replace the `@github-actions ota`
comment trigger (pull-request-comment.yml, deleted) with an automatic job
that fires on pull_request. Gated to same-repo PRs
(head.repo.full_name == github.repository) authored by a
MEMBER/OWNER/COLLABORATOR, so a fork or external contributor can never run
with the publish role or repo secrets in scope. Publishes to the
`pull-request-<N>` channel under the PR-scoped `denis-ci-publish-pr` role,
further narrowed by an inline session policy to `pr/<N>/*`.
- setup-denis composite action: mint a short-lived github-app token
(contents:read on private tango), download + verify the pinned
denis release binary, put it on PATH.
denis release tag is a single `DENIS_RELEASE_TAG` env per workflow.
ROAST_SKIP: pre-commit roast flags setup-denis verifying the binary against
a checksum from the same tango release (no independent digest anchor).
Reviewed and accepted: exploitation requires compromising the private tango
release itself, and the marginal integrity gain is not worth pinning a digest
that must be bumped on every denis roll.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-22 12:50:12 -07:00
7d4b91dd38
Bump the actions group with 4 updates ( #11202 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 05:09:01 -07:00
3eab767e89
Bump actions/setup-node from 6.4.0 to 7.0.0 ( #11203 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 05:08:41 -07:00
0fb7251c64
Add nightly Maestro E2E workflow ( #11181 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-20 07:42:53 -07:00
c4e80b4456
Fix Android release asset upload ( #11174 )
2026-07-20 07:42:35 -07:00
21d53ce0f8
Split mobile build/submit pipelines and de-duplicate OTA workflow ( #11133 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-20 07:07:30 -07:00
783dfe2a12
Cache main bundle stats for PR checks ( #11172 )
2026-07-17 07:28:08 +03:00
007c21fa8e
Add moduleSuffixes to tsconfig ( #11146 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-16 12:47:53 -07:00
f9384e44c7
Bump expected cocoapods version to match latest macos-26 runner image ( #11171 )
2026-07-16 09:33:07 -07:00
19872124bf
Bump the actions group with 6 updates ( #11148 )
2026-07-13 23:48:14 +03:00
03ccd96661
Force native builds when package.json version changes in OTA deploy ( #11061 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-07-07 05:31:37 -07:00
640662d57c
Fix zizmor findings in build workflows ( #11046 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-07 04:20:50 -07:00
52e8051fa3
Bump the actions group with 5 updates ( #11076 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 04:19:38 -07:00
86c1cbbc95
Bump actions/cache from 5.0.5 to 6.1.0 ( #11078 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 04:18:26 -07:00
545fec82fb
Bump dcarbone/install-jq-action from 3.2.0 to 4.0.1 ( #11077 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-07 04:17:43 -07:00
133476e0cd
Update advanced search suggestions ( #11036 )
2026-06-30 14:26:50 -07:00
5e7343b0d2
Fix yaml syntax in pull-request-commit.yml ( #11037 )
2026-06-30 14:15:28 -07:00
57dc53fbf5
Add "fingerprint changed" label to PRs with native changes ( #10742 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-30 15:19:24 -05:00
de51ceb577
Bump actions/checkout from 6.0.3 to 7.0.0 ( #11022 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-30 14:20:43 -05:00
eb755bc31d
Bump the actions group with 3 updates ( #11021 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-30 13:51:58 -05:00
44f6a98f59
Use latest fingerprint-native action ( #11016 )
2026-06-30 13:40:37 -05:00
75e2c40ba4
Use correct param name for setup-bundletool action ( #11020 )
2026-06-30 00:56:44 -07:00
a5ed41fa0f
Fix CI - grant workflows permission for internal sync push ( #11010 )
2026-06-29 16:30:01 +03:00
fcbd23e7db
Bump actions/download-artifact from 7.0.0 to 8.0.1 ( #10971 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-26 07:40:12 -07:00
f3978d1a1f
Fix internal repo sync broken by actions/checkout v6 bump ( #10933 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-24 11:38:44 -05:00
4308d75e49
Add TestFlight group selection to iOS build workflow ( #10979 )
2026-06-24 10:52:58 -04:00
dd452a4336
Fix nightly build workflow ( #10943 )
...
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-18 10:13:41 -05:00
6f916902e7
Add nightly iOS/Android build workflow ( #10940 )
...
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-17 17:53:08 -05:00
d10137fd78
Simplify Android build: bundletool + eas submit ( #9855 )
...
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
Co-authored-by: Eric Bailey <git@esb.lol >
2026-06-17 16:42:55 -05:00
6af477bcc2
Replace setup-cocoapods action with inline version assert ( #10932 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-17 02:51:59 -07:00
b8a6a8c8ce
Pin every action to latest SHA ( #10779 )
...
Co-authored-by: Eric Bailey <git@esb.lol >
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-06-16 14:35:19 -05:00
6c04170734
Replace broken @claude workflow with Bedrock-based claude-review/mention ( #10880 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-06-11 21:36:10 -07:00
f321122656
use opus 4.8 in github claude ( #10837 )
2026-06-10 01:55:03 -07:00
6d468c8ca4
[CI] Remove Wandalen/wretry.action, call pnpm install directly ( #10745 )
2026-06-05 22:49:02 +03:00
f99837040e
Compile i18n before running lint ( #10711 )
2026-06-03 13:21:13 -07:00
84d1785e12
Enable ESLint errors and suppress existing violations ( #10490 )
2026-06-03 11:27:44 -07:00
d08ab487d8
Bump actions/create-github-app-token from 1 to 3 ( #10691 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-02 11:57:43 -07:00
a2c8b47b87
Bump marocchino/sticky-pull-request-comment from 2 to 3 ( #10692 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-02 11:56:46 -07:00
8e5ac6790f
Bump slackapi/slack-github-action from 2.1.1 to 3.0.3 ( #10693 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-02 11:55:39 -07:00
53fa6b2493
ci: add dependabot config with 7-day cooldown ( #10475 )
...
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-06-02 11:04:28 -07:00
dfa82904ec
Run GitHub actions in parallel ( #10509 )
...
Co-authored-by: Eric Bailey <git@esb.lol >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-02 12:24:55 -05:00
bdbf31a254
Use expo/expo-github-action v9 ( #10689 )
2026-06-02 09:47:22 -07:00
806f31dc93
Use pnpm to handle node/pnpm versions in Dockerfile ( #10642 )
2026-05-29 05:40:24 -07:00
c21c031e74
[pnpm] Attempt to remove eas-cli from devDeps ( #10589 )
2026-05-22 09:17:12 -07:00
7fe2f892f6
Revert "Skip installing expo cli in CI ( #10566 )" ( #10568 )
2026-05-20 21:30:53 +03:00
b73f9110e5
Skip installing expo cli in CI ( #10566 )
2026-05-20 09:50:44 -07:00
3d4ba946b3
[pnpm] Fix CI attempt 5 ( #10567 )
2026-05-20 09:33:02 -07:00
4908816253
[pnpm] Fix CI attempt 4 ( #10565 )
2026-05-20 08:58:55 -07:00
70a1a665ed
Fix eas invocation for GitHub Actions ( #10555 )
2026-05-20 03:52:35 -07:00
Austin McKinley