ci: add preflight bundle checks + on-demand release workflow

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s

[CraigBuckmaster]

CI: preflight bundle checks + on-demand release workflow

Two workflow changes:

1. Preflight — extend test.yml

The existing test.yml runs tsc --noEmit and jest on every PR. Adds two steps at the end:

• npx expo-doctor@latest — dep version drift (catches things like "Reanimated 3.19.5 with SDK 54" before it reaches EAS)
• npx expo export --platform ios — full Metro bundle. Catches transitive-dep resolution failures (the class of bug that made PR fix: remove react-native-reanimated to resolve SDK 54 native-module crash #1492's reanimated removal fail at bundling only after a 20-minute EAS upload)

Both block merge if they fail. Runs on GitHub's free Linux runners — no EAS minutes consumed.

2. Release — new release.yml

Manual, on-demand iOS build + TestFlight submit.

Flow:

1. You bump app.jsonversion on master (or leave it — EAS auto-increments buildNumber)
2. Actions tab → "Release (iOS TestFlight)" → Run workflow
3. Preflight re-runs (defense in depth)
4. eas build --platform ios --profile production --wait runs
5. Approval gate: submit step is gated on testflight-submit GitHub Environment. You get a notification, click Approve in the Actions UI, submit runs.
6. Cleanup: .p8 file is deleted from the runner even on failure.
7. Tag step pushes v<version>-build<number> for traceability.

No auto-trigger. Never runs on push to master. Only when you dispatch it manually.

Setup steps required AFTER merge (cannot land without these)

The release workflow will fail to run until you complete these three setup steps. Preflight works immediately with no setup.

Step 1: Create the testflight-submit GitHub Environment

1. Go to Settings → Environments → New environment
2. Name: testflight-submit
3. Enable Required reviewers and add yourself (CraigBuckmaster)
4. Save

Step 2: Add the App Store Connect API key as a secret

Your eas.json references ./AuthKey_T42VNQ7V5Z.p8. We need its contents in a GitHub Secret, base64-encoded.

On your Windows machine, from the directory containing the .p8 file:

# PowerShell
[Convert]::ToBase64String([IO.File]::ReadAllBytes("AuthKey_T42VNQ7V5Z.p8"))

Or in Git Bash:

base64 -w0 AuthKey_T42VNQ7V5Z.p8

Copy the output. Then:

1. Go to Settings → Secrets and variables → Actions → New repository secret
2. Name: ASC_API_KEY_P8_B64
3. Value: paste the base64 string
4. Save

The workflow writes this back to disk at runtime, uses it, and deletes it in a cleanup step (runs even on failure).

Step 3: (Optional) First dry-run

Once the above is done, go to Actions → Release (iOS TestFlight) → Run workflow. Confirm the preflight and build jobs succeed. When it hits the submit step, you'll get the approval prompt. You can either approve (and ship a build) or cancel the workflow run (no submit).

What this does NOT do

• Does NOT auto-trigger on master push
• Does NOT bump app.json version automatically (manual bump before dispatch)
• Does NOT auto-generate release notes from merged PRs (could add later)
• Does NOT modify app.yml (the OTA-update workflow) — that decision deferred

Verification

Preflight: this PR itself will exercise the new preflight steps (the test workflow runs on every PR). If expo-doctor or expo export fail, this PR will show as red — and we'll know there's a pre-existing issue on master we didn't know about before.

[github-actions]

Test Results

✅ All tests passed

	Passed	Failed	Total
Tests	✅ 3418	❌ 0	3418
Suites	✅ 464	❌ 0	464

Coverage

Statements	Branches	Functions	Lines
—	—	—	—

⏱️ Duration: 81.1s