From 1f42f396c7c8d7884dc3f9049387d83670db17bc Mon Sep 17 00:00:00 2001
From: "omegent-app[bot]" <306514130+omegent-app[bot]@users.noreply.github.com>
Date: Thu, 6 Aug 2026 05:32:31 +0000
Subject: [PATCH] fix(mobile): accept a release branch other than
 fork/integration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first fork/dev merge dispatched mobile releases and EAS production failed
at "Resolve approved integration source". Both mobile workflows check out a
hardcoded `ref: fork/integration` and then assert the requested SHA is an
ancestor of that checkout. A fork/dev SHA is not contained by fork/integration,
so the assertion rejected it.

Add a release_branch input defaulting to fork/integration, use it for the
checkout, and compare the overlay condition against it instead of the literal.
Defaulting preserves today's behaviour for any manual dispatch that omits it.

fork-ci.yml passes release_branch alongside the ref it already passed. Passing
one without the other is the trap: the workflow file would come from fork/dev
while the product checkout stayed on fork/integration, which is exactly the
failure above.

This is the same hardcoding as the dispatch side fixed in #343 — it was simply
one workflow further along, and only observable once a real fork/dev merge
dispatched a release.

Co-authored-by: Patrick Roza <42661+patroza@users.noreply.github.com>
---
 .github/workflows/fork-ci.yml                |  7 ++++++-
 .github/workflows/mobile-eas-development.yml |  6 +++---
 .github/workflows/mobile-eas-production.yml  | 11 ++++++++---
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/fork-ci.yml b/.github/workflows/fork-ci.yml
index 2e50722418f..c27c9214aed 100644
--- a/.github/workflows/fork-ci.yml
+++ b/.github/workflows/fork-ci.yml
@@ -302,15 +302,20 @@ jobs:
           # mode=auto, not update: an OTA alone never reaches a phone when the
           # native runtime changed, so the fingerprint decides between an update
           # and a TestFlight build. iOS only, because Android has no keystore.
+          # release_branch must match: the mobile workflows check out that branch
+          # and verify the SHA is contained by it. Defaulting it to
+          # fork/integration there would reject every fork/dev SHA.
           gh workflow run mobile-eas-production.yml \
             --repo "$GITHUB_REPOSITORY" \
             --ref "$RELEASE_REF" \
             -f mode=auto \
             -f platform=ios \
             -f sha="$GITHUB_SHA" \
+            -f release_branch="$RELEASE_REF" \
             -f message="${RELEASE_REF} ${GITHUB_SHA}"
           gh workflow run mobile-eas-development.yml \
             --repo "$GITHUB_REPOSITORY" \
             --ref "$RELEASE_REF" \
             -f platform=ios \
-            -f sha="$GITHUB_SHA"
+            -f sha="$GITHUB_SHA" \
+            -f release_branch="$RELEASE_REF"
diff --git a/.github/workflows/mobile-eas-development.yml b/.github/workflows/mobile-eas-development.yml
index 485a0638fe3..8acfae77be8 100644
--- a/.github/workflows/mobile-eas-development.yml
+++ b/.github/workflows/mobile-eas-development.yml
@@ -21,7 +21,7 @@ on:
         required: false
         type: string
       sha:
-        description: "Exact fork/integration SHA (blank uses its current tip)"
+        description: "Exact release-branch SHA (blank uses that branch's current tip)"
         required: false
         type: string
 
@@ -60,7 +60,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true'
         uses: actions/checkout@v6
         with:
-          ref: fork/integration
+          ref: ${{ inputs.release_branch }}
           fetch-depth: 0
 
       - name: Resolve approved integration source
@@ -81,7 +81,7 @@ jobs:
           echo "sha=$target_sha" >> "$GITHUB_OUTPUT"
 
       - name: Overlay deploy tooling from workflow ref
-        if: steps.expo-token.outputs.present == 'true' && github.ref_name != 'fork/integration'
+        if: steps.expo-token.outputs.present == 'true' && github.ref_name != inputs.release_branch
         env:
           WORKFLOW_SHA: ${{ github.sha }}
         run: |
diff --git a/.github/workflows/mobile-eas-production.yml b/.github/workflows/mobile-eas-production.yml
index 2f93e5342ad..8cd4ae9a62c 100644
--- a/.github/workflows/mobile-eas-production.yml
+++ b/.github/workflows/mobile-eas-production.yml
@@ -40,9 +40,14 @@ on:
         required: false
         type: string
       sha:
-        description: "Exact fork/integration SHA (blank uses its current tip)"
+        description: "Exact release-branch SHA (blank uses that branch's current tip)"
         required: false
         type: string
+      release_branch:
+        description: "Release branch that must contain the SHA"
+        required: false
+        type: string
+        default: fork/integration
 
 concurrency:
   group: mobile-eas-production
@@ -78,7 +83,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true'
         uses: actions/checkout@v6
         with:
-          ref: fork/integration
+          ref: ${{ inputs.release_branch }}
           fetch-depth: 0
           # No sparse-checkout here: it makes actions/checkout fetch with
           # --filter=blob:none, and eas-cli archives the project via
@@ -108,7 +113,7 @@ jobs:
       # the deploy script + app.config runtime override from the workflow ref so
       # we can ship fixes without waiting for a full compose.
       - name: Overlay deploy tooling from workflow ref
-        if: steps.expo-token.outputs.present == 'true' && github.ref_name != 'fork/integration'
+        if: steps.expo-token.outputs.present == 'true' && github.ref_name != inputs.release_branch
         env:
           WORKFLOW_SHA: ${{ github.sha }}
         run: |