Connect the mobile app to EAS and add the nightly TestFlight job - #2038
Conversation
Link apps/mobile to the EAS project @bb-team/bb-app (slug bb-app, project id in app.json), mark the app as using only exempt encryption, and give eas.json a production submit profile that reads the App Store Connect API key from a gitignored path. Pin eas-cli as a devDependency and add a nightly-mobile-ios job to the publish workflow that starts an EAS production build with --auto-submit after the npm nightly publish. Co-Authored-By: Claude <noreply@anthropic.com>
|
🚨 SLOP COP 🚨 · I am SlopCop. I am reviewing this pull request now. I will check security, code quality, performance, architecture, duplicate code, and the available end-to-end path. I will post one final review after the parallel checks finish. |
Co-Authored-By: Claude <noreply@anthropic.com>
| run: | | ||
| set -euo pipefail | ||
|
|
||
| args=(build --platform ios --profile "$EAS_PROFILE" --non-interactive --no-wait) |
There was a problem hiding this comment.
🚨 slopcop/review — The concurrency lock ends before the EAS build and submission finish.
--no-wait makes EAS return after it creates the remote requests. GitHub then marks this job complete and releases the mobile-ios-eas concurrency lock while EAS and TestFlight still run. A later workflow can queue another paid build, and a later build or submission failure leaves this workflow green.
Remove --no-wait, increase timeout-minutes, and keep the lock. If this workflow must run asynchronously, capture the EAS identifiers and add a job that waits for both final results.
There was a problem hiding this comment.
Fixed in 457f74f: dropped --no-wait, so the job holds the mobile-ios-eas lock and fails when the EAS build or the TestFlight upload fails; timeout-minutes is 150 to cover the EAS queues; the key file is removed on exit.
There was a problem hiding this comment.
🚨 SLOP COP 🚨 · review
Plain English summary: This pull request connects the iOS app to Expo's remote build service. It also adds a nightly path that starts a TestFlight upload. A later commit makes the same build available from the Actions page.
I found one release correctness issue.
- High: The EAS command uses
--no-wait. GitHub reports success and releases the concurrency lock before the remote build and TestFlight submission finish. A second run can overlap the first run. A later EAS failure also leaves the workflow green. The inline comment has the concrete fix.
The pull request changed from 559b885 to 636e358 during this review. I checked the new reusable workflow, and the finding still applies there.
Security checks found no high-risk secret or permission issue. The workflow uses trusted main code, pinned actions, read-only repository permission, a mode 0600 key file, and a Git ignore rule. A cleanup trap for the key file is useful optional hardening.
The architecture scan found no required refactor or duplicate version implementation. The pinned EAS CLI adds a large dependency tree to full workspace installs. That cost is real, but it also gives local and CI commands one locked version.
Validation passed for the frozen lockfile install, JSON and Expo configuration, formatting, the mobile type check, and 813 mobile tests. All GitHub checks are green. GitHub skipped the label-gated iOS simulator job. A browser test was not available because this native app does not include the web runtime dependencies. I did not start another paid EAS build.
SlopCop: with --no-wait the job went green and released its concurrency lock before EAS finished, so overlapping runs and remote failures went unnoticed. Wait for the result, raise the timeout, and remove the key file on exit. Co-Authored-By: Claude <noreply@anthropic.com>
What was wrong
The mobile app had no EAS project, no store credentials, and no release path. `app.json` had no `extra.eas.projectId`, `eas.json` had an empty submit profile, and the nightly publish workflow built desktop only. Nothing could reach TestFlight.
What changed
Out of band (not in the diff): EAS holds the iOS distribution certificate, App Store provisioning profile, and APNs push key; the `EXPO_TOKEN` (robot, Developer role on `bb-team`) and `ASC_API_KEY_P8` repo secrets are set.
How you verified
Fixes #