diff --git a/.github/workflows/fork-ci.yml b/.github/workflows/fork-ci.yml index 2e50722418f..c27c9214aed 100644 --- a/.github/workflows/fork-ci.yml +++ b/.github/workflows/fork-ci.yml @@ -302,15 +302,20 @@ jobs: # mode=auto, not update: an OTA alone never reaches a phone when the # native runtime changed, so the fingerprint decides between an update # and a TestFlight build. iOS only, because Android has no keystore. + # release_branch must match: the mobile workflows check out that branch + # and verify the SHA is contained by it. Defaulting it to + # fork/integration there would reject every fork/dev SHA. gh workflow run mobile-eas-production.yml \ --repo "$GITHUB_REPOSITORY" \ --ref "$RELEASE_REF" \ -f mode=auto \ -f platform=ios \ -f sha="$GITHUB_SHA" \ + -f release_branch="$RELEASE_REF" \ -f message="${RELEASE_REF} ${GITHUB_SHA}" gh workflow run mobile-eas-development.yml \ --repo "$GITHUB_REPOSITORY" \ --ref "$RELEASE_REF" \ -f platform=ios \ - -f sha="$GITHUB_SHA" + -f sha="$GITHUB_SHA" \ + -f release_branch="$RELEASE_REF" diff --git a/.github/workflows/mobile-eas-development.yml b/.github/workflows/mobile-eas-development.yml index 485a0638fe3..8acfae77be8 100644 --- a/.github/workflows/mobile-eas-development.yml +++ b/.github/workflows/mobile-eas-development.yml @@ -21,7 +21,7 @@ on: required: false type: string sha: - description: "Exact fork/integration SHA (blank uses its current tip)" + description: "Exact release-branch SHA (blank uses that branch's current tip)" required: false type: string @@ -60,7 +60,7 @@ jobs: if: steps.expo-token.outputs.present == 'true' uses: actions/checkout@v6 with: - ref: fork/integration + ref: ${{ inputs.release_branch }} fetch-depth: 0 - name: Resolve approved integration source @@ -81,7 +81,7 @@ jobs: echo "sha=$target_sha" >> "$GITHUB_OUTPUT" - name: Overlay deploy tooling from workflow ref - if: steps.expo-token.outputs.present == 'true' && github.ref_name != 'fork/integration' + if: steps.expo-token.outputs.present == 'true' && github.ref_name != inputs.release_branch env: WORKFLOW_SHA: ${{ github.sha }} run: | diff --git a/.github/workflows/mobile-eas-production.yml b/.github/workflows/mobile-eas-production.yml index 2f93e5342ad..8cd4ae9a62c 100644 --- a/.github/workflows/mobile-eas-production.yml +++ b/.github/workflows/mobile-eas-production.yml @@ -40,9 +40,14 @@ on: required: false type: string sha: - description: "Exact fork/integration SHA (blank uses its current tip)" + description: "Exact release-branch SHA (blank uses that branch's current tip)" required: false type: string + release_branch: + description: "Release branch that must contain the SHA" + required: false + type: string + default: fork/integration concurrency: group: mobile-eas-production @@ -78,7 +83,7 @@ jobs: if: steps.expo-token.outputs.present == 'true' uses: actions/checkout@v6 with: - ref: fork/integration + ref: ${{ inputs.release_branch }} fetch-depth: 0 # No sparse-checkout here: it makes actions/checkout fetch with # --filter=blob:none, and eas-cli archives the project via @@ -108,7 +113,7 @@ jobs: # the deploy script + app.config runtime override from the workflow ref so # we can ship fixes without waiting for a full compose. - name: Overlay deploy tooling from workflow ref - if: steps.expo-token.outputs.present == 'true' && github.ref_name != 'fork/integration' + if: steps.expo-token.outputs.present == 'true' && github.ref_name != inputs.release_branch env: WORKFLOW_SHA: ${{ github.sha }} run: |