The author_association check skipped the job for private org members:
the pull_request webhook payload exposes only the public-safe association,
which downgrades a private member to CONTRIBUTOR/NONE, so MEMBER never
matched and no staff PR could publish.
Drop that clause and rely on the fork guard alone. A branch can only exist
in this repo if someone with write access pushed it, so an outside
contributor (fork-only) never runs this job; same-repo PRs are staff-
authored. This matches the fork-guard gate the other jobs in this workflow
already use.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rewire OTA publishing off the legacy ota1 box onto the S3-backed denis
service, in two places:
- Prod path (bundle-deploy-eas-update.yml): dual-write the exported bundle
to denis via `denis publish` alongside the existing ota1 upload, under the
identical `!includes-changes && !version-changed` gate. Assumes the
main-only `denis-ci-publish` role via OIDC (id-token: write). Both paths
must succeed; they are removed together once denis is the sole origin.
- Per-PR previews (pull-request-commit.yml): replace the `@github-actions ota`
comment trigger (pull-request-comment.yml, deleted) with an automatic job
that fires on pull_request. Gated to same-repo PRs
(head.repo.full_name == github.repository) authored by a
MEMBER/OWNER/COLLABORATOR, so a fork or external contributor can never run
with the publish role or repo secrets in scope. Publishes to the
`pull-request-<N>` channel under the PR-scoped `denis-ci-publish-pr` role,
further narrowed by an inline session policy to `pr/<N>/*`.
- setup-denis composite action: mint a short-lived github-app token
(contents:read on private tango), download + verify the pinned
denis release binary, put it on PATH.
denis release tag is a single `DENIS_RELEASE_TAG` env per workflow.
ROAST_SKIP: pre-commit roast flags setup-denis verifying the binary against
a checksum from the same tango release (no independent digest anchor).
Reviewed and accepted: exploitation requires compromising the private tango
release itself, and the marginal integrity gain is not worth pinning a digest
that must be bumped on every denis roll.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* use xlarge runner for macos build
* try and fix yarn cache
* update actions/cache for pods step
* use expo github action main rather than v8
* update all actions to the same
* use yarn cache where missing
* use custom github action for fingerprinting
* update pr workflow
* update names of workflows
* make a native change (testing)
* adjust the action
* Revert "make a native change (testing)"
This reverts commit 8db9835733.
* update bundle-deploy script
* test a prod build
* crazy depth
* manually set
* use prod default
* force prod
* revert test changes
* save cache after deploy
* revert testing
* simplify list logic further
more simplification
simplify by removing `isEmpty`
use `isFetchingNextPage` everywhere for clarity
change `isFetching` to `isFetchingNextPage` for clarity
remove some useless `useMemo`s
move `renderItem` and `keyExtractor` out of component
* clean bundle size check
* update deploy
* adjust
* adjust
* one test
* try now
* test it
* done
try that again 9
try that again 8
try that again 7
try that again 6
try that again 5
try that again 4
try that again 3
try that again 2
try that again
merge base 3
merge base 2
merge base
use latest main commit rather than tag
webpack diff analyzer
use cache v4
use cache
again...
blegh
blegh
try cache again
cache
try again
one more adjutment
adjust
okay again maybe
maybe now?
maybe now
oops again
oops
add diff comments
add open analyzer script
add webpack analyzer
Austin McKinley