Split production native build and submit into per-platform, per-phase jobs

Build (build stage) runs eas build per platform and passes the build id to the
submit job via a dotenv artifact; submit (deploy stage) ships that build and
records the fingerprint marker only on success. Submit is gated to develop only,
so the validation branch builds without pushing to the stores. Also set
changesNotSentForReview on the production Android submit profile.

Author: aapeliv

app/.gitlab-ci.yml

@@ -1059,42 +1059,94 @@ deploy:mobile-ota-staging:
 # native counterpart to the OTA publish below. A signed OTA only applies to an
 # installed build whose runtimeVersion (Expo fingerprint) matches, so a native dep
 # / app.config.js / Expo SDK change (the ~5% case OTA can't serve) needs a fresh
-# store build carrying the new fingerprint. scripts/production-build.sh builds on
-# EAS and auto-submits:
+# store build carrying the new fingerprint; pure JS/TS changes ship over the air.
+#
+# Split per platform and per phase: the `build` phase builds on EAS
+# (scripts/production-build.sh, fingerprint-gated, emitting the build id to a
+# dotenv artifact), and the `deploy` phase submits that build
+# (scripts/production-submit.sh):
 #   iOS     -> App Store Connect (lands in TestFlight + as an available build; it
 #              is NOT submitted for App Store review and no release notes change —
 #              do that by hand in App Store Connect).
 #   Android -> the Play *internal* testing track (submit profile `production`,
 #              track: internal); promote to public production by hand in the Play
 #              Console.
-# Neither path makes anything public on its own. It no-ops when the freshly
-# computed fingerprint matches the last-built app, recorded per platform under
-# s3://$AWS_PREVIEW_BUCKET/production-builds/. Requires the EXPO_TOKEN CI variable.
-build:production-native:
-  needs: ["protos"]
-  stage: build
+# Neither path makes anything public on its own. The build no-ops (and the submit
+# in turn) when the freshly computed fingerprint matches the last-submitted app,
+# recorded per platform under s3://$AWS_PREVIEW_BUCKET/production-builds/. Requires
+# the EXPO_TOKEN CI variable.
+.production-native:
   image: node:22
   inherit:
     default: false
+  before_script:
+    - apt-get update -qq && apt-get install -y --no-install-recommends awscli curl
+  rules:
+    - if: ($BUILD_MOBILE == "true") && ($CI_COMMIT_BRANCH == $RELEASE_BRANCH)
+    # TEMP: run on this branch to validate the pipeline; revert before merge.
+    - if: $CI_COMMIT_BRANCH == "mobile/v1.1.20"
+
+build:production-native-ios:
+  extends: .production-native
+  needs: ["protos"]
+  stage: build
   variables:
     # Compute the fingerprint as the production variant so it matches the EAS build
     # (app.config.js branches on APP_VARIANT) and the OTA publish job's fingerprint.
     APP_VARIANT: production
-  before_script:
-    - apt-get update -qq && apt-get install -y --no-install-recommends awscli curl
   script:
     - cd app/mobile
     - npm ci
     - npm run build:protos
     - npm install -g eas-cli
-    # Separate lines (not a loop) so an iOS failure fails the job instead of being
-    # masked by a later Android success.
     - bash scripts/production-build.sh ios
+  artifacts:
+    reports:
+      dotenv: app/mobile/native-build-ios.env
+
+build:production-native-android:
+  extends: .production-native
+  needs: ["protos"]
+  stage: build
+  variables:
+    APP_VARIANT: production
+  script:
+    - cd app/mobile
+    - npm ci
+    - npm run build:protos
+    - npm install -g eas-cli
     - bash scripts/production-build.sh android
+  artifacts:
+    reports:
+      dotenv: app/mobile/native-build-android.env
+
+deploy:production-native-ios:
+  extends: .production-native
+  needs: ["build:production-native-ios"]
+  stage: deploy
+  script:
+    - cd app/mobile
+    - npm ci
+    - npm install -g eas-cli
+    - bash scripts/production-submit.sh ios
+  # Submit only on the real release branch — disabled on the temp validation branch
+  # so we build (above) without pushing anything to the stores yet.
+  rules:
+    - if: ($BUILD_MOBILE == "true") && ($CI_COMMIT_BRANCH == $RELEASE_BRANCH)
+
+deploy:production-native-android:
+  extends: .production-native
+  needs: ["build:production-native-android"]
+  stage: deploy
+  script:
+    - cd app/mobile
+    - npm ci
+    - npm install -g eas-cli
+    - bash scripts/production-submit.sh android
+  # Submit only on the real release branch — disabled on the temp validation branch
+  # so we build (above) without pushing anything to the stores yet.
   rules:
     - if: ($BUILD_MOBILE == "true") && ($CI_COMMIT_BRANCH == $RELEASE_BRANCH)
-    # TEMP: run on this branch to validate the pipeline; revert before merge.
-    - if: $CI_COMMIT_BRANCH == "mobile/v1.1.20"
 
 # ─── Production native OTA publish (decoupled from the backend/web deploy) ───
 #

app/mobile/eas.json

@@ -70,7 +70,8 @@
       },
       "android": {
         "track": "internal",
-        "releaseStatus": "completed"
+        "releaseStatus": "completed",
+        "changesNotSentForReview": true
       }
     },
     "devtool": {

app/mobile/scripts/production-build.sh

@@ -1,28 +1,20 @@
 #!/usr/bin/env bash
-# Rebuild and submit the production store app on EAS when its fingerprint changes.
+# Build the production store app on EAS when its fingerprint changes (build phase).
+# Submitting the build to the stores happens separately in production-submit.sh
+# (deploy phase). We emit the EAS build id and the fingerprint to a dotenv artifact
+# so the submit job knows what to ship and which fingerprint to record on success.
 #
 # A signed OTA only applies to an installed build whose runtimeVersion (the Expo
-# fingerprint) matches it. So when a native change moves the production
-# fingerprint — a new native module, an app.config.js change, or an Expo SDK bump
-# — we need a fresh store build carrying it before an OTA on that fingerprint can
-# land; pure JS/TS changes ship over the air. We record the last-built fingerprint
-# per platform in S3 and compare; on a change we build and auto-submit, recording
-# the marker only once that succeeds so a failed build is retried.
-#
-#   iOS:     eas build --auto-submit -> App Store Connect. The build lands in
-#            TestFlight and as an available build; it is NOT submitted for App
-#            Store review and no release notes are changed — do that by hand.
-#   Android: eas build --auto-submit -> the Play *internal* testing track (the
-#            `production` submit profile sets track: internal). Promote to the
-#            public production track by hand in the Play Console.
-#
-# Neither platform makes anything public on its own.
+# fingerprint) matches it, so when a native change moves the production fingerprint
+# we cut a fresh store build; pure JS/TS changes ship over the air. We compare the
+# fingerprint against the last-submitted marker in S3 and skip the build (leaving
+# EAS_BUILD_ID empty) when it is unchanged.
 #
 # Usage: production-build.sh <ios|android>
-# Env:   EXPO_TOKEN          EAS auth (build + submit scope)
+# Env:   EXPO_TOKEN          EAS auth (build scope)
 #        AWS_PREVIEW_BUCKET  the couchers-dev-assets bucket (holds the markers)
 #        plus the AWS creds the aws CLI reads from the environment
-# Run from app/mobile (eas.json, the project, and node_modules must be present).
+# Run from app/mobile. Writes native-build-<platform>.env (a dotenv artifact).
 set -euo pipefail
 
 PLATFORM="${1:?usage: production-build.sh <ios|android>}"
@@ -35,6 +27,7 @@ case "$PLATFORM" in
 esac
 
 MARKER="s3://${AWS_PREVIEW_BUCKET}/production-builds/${PLATFORM}.fingerprint"
+DOTENV="native-build-${PLATFORM}.env"
 
 # Read a single JSON field from stdin with node (no jq in the node:22 image).
 json_field() { node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s);process.stdout.write(String(eval("j"+process.argv[1])??""))})' "$1"; }
@@ -43,22 +36,26 @@ json_field() { node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{
 # and the OTA publish job bakes into the manifest. APP_VARIANT=production (set by
 # the job) selects the production bundle id / scheme / signed updates config.
 CURRENT="$(npx expo-updates fingerprint:generate --platform "$PLATFORM" 2>/dev/null | json_field '.hash')"
-echo "current $PLATFORM fingerprint:    $CURRENT"
+echo "current $PLATFORM fingerprint:        $CURRENT"
+
+# The submit job records the marker once it succeeds, so hand it the fingerprint.
+echo "EAS_FINGERPRINT=$CURRENT" > "$DOTENV"
 
 PREVIOUS="$(aws s3 cp "$MARKER" - 2>/dev/null || true)"
-echo "last-built $PLATFORM fingerprint: ${PREVIOUS:-<none>}"
+echo "last-submitted $PLATFORM fingerprint: ${PREVIOUS:-<none>}"
 
 if [ -n "$PREVIOUS" ] && [ "$PREVIOUS" = "$CURRENT" ]; then
-  echo "Fingerprint unchanged for $PLATFORM — the live production build still matches, skipping."
+  echo "Fingerprint unchanged for $PLATFORM — the live production build still matches, skipping build."
+  echo "EAS_BUILD_ID=" >> "$DOTENV"
   exit 0
 fi
 
-echo "Fingerprint changed for $PLATFORM — building and submitting a new production app."
-# --auto-submit uses the submit profile named like the build profile (production):
-# iOS -> App Store Connect, Android -> the internal track.
-eas build --platform "$PLATFORM" --profile production --auto-submit --non-interactive
-
-# Record the new fingerprint only after a successful build+submit, so a failure is
-# retried on the next pipeline instead of being marked done.
-printf '%s' "$CURRENT" | aws s3 cp - "$MARKER"
-echo "Recorded $PLATFORM fingerprint $CURRENT — production build is up to date."
+echo "Fingerprint changed for $PLATFORM — building a new production app on EAS."
+BUILD_JSON="$(eas build --platform "$PLATFORM" --profile production --non-interactive --json)"
+BUILD_ID="$(printf '%s' "$BUILD_JSON" | json_field '[0].id')"
+[ -n "$BUILD_ID" ] || {
+  echo "could not determine the EAS build id from the build output" >&2
+  exit 1
+}
+echo "EAS_BUILD_ID=$BUILD_ID" >> "$DOTENV"
+echo "Built $PLATFORM production app: $BUILD_ID"

app/mobile/scripts/production-submit.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Submit a production store app build to the stores (deploy phase). Reads the EAS
+# build id and fingerprint that production-build.sh emitted into the dotenv
+# artifact; an empty build id means the build was skipped (fingerprint unchanged)
+# and there is nothing to submit. The fingerprint marker is recorded only after a
+# successful submit, so a failed submit is retried (rebuilt) on the next pipeline.
+#
+#   iOS:     eas submit -> App Store Connect. The build lands in TestFlight and as
+#            an available build; it is NOT submitted for App Store review and no
+#            release notes change — do that by hand in App Store Connect.
+#   Android: eas submit -> the Play *internal* testing track (the `production`
+#            submit profile sets track: internal). Promote to the public production
+#            track by hand in the Play Console.
+#
+# Neither platform makes anything public on its own.
+#
+# Usage: production-submit.sh <ios|android>
+# Env:   EXPO_TOKEN          EAS auth (submit scope)
+#        EAS_BUILD_ID        from the build job's dotenv (empty => nothing to submit)
+#        EAS_FINGERPRINT     from the build job's dotenv (recorded on success)
+#        AWS_PREVIEW_BUCKET  the couchers-dev-assets bucket (holds the markers)
+#        plus the AWS creds the aws CLI reads from the environment
+# Run from app/mobile (eas.json must be present).
+set -euo pipefail
+
+PLATFORM="${1:?usage: production-submit.sh <ios|android>}"
+case "$PLATFORM" in
+  ios | android) ;;
+  *)
+    echo "platform must be ios or android (got $PLATFORM)" >&2
+    exit 1
+    ;;
+esac
+
+if [ -z "${EAS_BUILD_ID:-}" ]; then
+  echo "No new $PLATFORM build (fingerprint unchanged) — nothing to submit."
+  exit 0
+fi
+
+echo "Submitting $PLATFORM build $EAS_BUILD_ID."
+eas submit --platform "$PLATFORM" --profile production --id "$EAS_BUILD_ID" --non-interactive
+
+# Record the fingerprint only after a successful submit, so a failure is retried on
+# the next pipeline instead of being marked done.
+MARKER="s3://${AWS_PREVIEW_BUCKET}/production-builds/${PLATFORM}.fingerprint"
+printf '%s' "$EAS_FINGERPRINT" | aws s3 cp - "$MARKER"
+echo "Recorded $PLATFORM fingerprint $EAS_FINGERPRINT — production build is up to date."