mobile: generate the OTA QR in the build job, keep the comment job pure

Generate the dev-launcher QR PNG in build:mobile-ota (npx qrcode, so it stays
out of the fingerprint sources) and upload it with the existing aws s3 cp in
preview:mobile-ota, next to the bundle. The PR-comment job no longer touches
S3 (no boto3) - it only assembles markdown referencing the hosted qr.png and
upserts the GitHub comment.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: aapeliv

app/.gitlab-ci.yml

@@ -865,6 +865,9 @@ build:mobile-ota:
         RV=$(npx expo-updates fingerprint:generate --platform "$P" 2>/dev/null | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(JSON.parse(s).hash))')
         echo "fingerprint($P) = $RV"
         node scripts/ota-stage.mjs --platform "$P" --runtime-version "$RV" --base-url "https://$CI_COMMIT_SHORT_SHA--ota.$PREVIEW_DOMAIN" --dist dist --out ota-out --expo-config ota-expo-config.json
+        # QR encodes the dev-launcher deep link so the PR comment can show a scannable image.
+        # npx (not a package.json dep) keeps it out of the fingerprint sources.
+        npx --yes qrcode -o "ota-out/$P/qr.png" "couchers-devtool://expo-development-client/?url=https%3A%2F%2F$CI_COMMIT_SHORT_SHA--ota.$PREVIEW_DOMAIN%2F$P%2Fmanifest" < /dev/null
       done
   artifacts:
     paths:
@@ -898,6 +901,7 @@ preview:mobile-ota:
         aws s3 cp "$D/manifest" "s3://$AWS_PREVIEW_BUCKET/ota/$CI_COMMIT_SHORT_SHA/$P/manifest" --content-type "$CT"
         aws s3 cp "$D/bundle.hbc" "s3://$AWS_PREVIEW_BUCKET/ota/$CI_COMMIT_SHORT_SHA/$P/bundle.hbc" --content-type application/javascript
         aws s3 cp "$D/assets/" "s3://$AWS_PREVIEW_BUCKET/ota/$CI_COMMIT_SHORT_SHA/$P/assets/" --recursive
+        aws s3 cp "$D/qr.png" "s3://$AWS_PREVIEW_BUCKET/ota/$CI_COMMIT_SHORT_SHA/$P/qr.png" --content-type image/png
         echo "Done $P. Manifest: https://$CI_COMMIT_SHORT_SHA--ota.$PREVIEW_DOMAIN/$P/manifest"
         echo "  deep link: couchers-devtool://expo-development-client/?url=https%3A%2F%2F$CI_COMMIT_SHORT_SHA--ota.$PREVIEW_DOMAIN%2F$P%2Fmanifest"
       done
@@ -925,7 +929,7 @@ preview:pr-comment:
   variables:
     OTA_PLATFORMS: "ios"
   script:
-    - pip install --quiet --no-cache-dir "qrcode[pil]" requests boto3
+    - pip install --quiet --no-cache-dir requests
     - python app/scripts/pr_preview_comment.py
   rules:
     - if: ($BUILD_MOBILE == "true") && ($CI_COMMIT_BRANCH == $RELEASE_BRANCH)

app/scripts/pr_preview_comment.py

@@ -1,20 +1,17 @@
 #!/usr/bin/env python3
 """Post (or update) a sticky preview comment on the GitHub PR for this pipeline.
 
-Runs in GitLab CI after the preview/upload jobs so every link it posts is already
-live. Currently surfaces the per-branch mobile Dev Tool OTA preview (QR + deep
-link); each preview is a section, so web/coverage/etc. can be appended as the
-pipeline grows. No-ops (exit 0) when there is no token or no open PR, so it never
-turns a pipeline red.
+Runs in GitLab CI after the upload jobs so every link it posts is already live.
+Each preview is a section, so web/coverage/etc. can be appended as the pipeline
+grows. The mobile QR PNG is generated and uploaded by the OTA build/upload jobs;
+this script only assembles markdown and talks to the GitHub API. No-ops (exit 0)
+when there is no token or no open PR, so it never turns a pipeline red.
 """
 
-import io
 import os
 import sys
 import urllib.parse
 
-import boto3
-import qrcode
 import requests
 
 MARKER = "<!-- couchers-preview-bot -->"
@@ -42,39 +39,21 @@ def deep_link(manifest_url):
     )
 
 
-def make_qr_png(data):
-    qr = qrcode.QRCode(
-        border=2, box_size=8, error_correction=qrcode.constants.ERROR_CORRECT_M
-    )
-    qr.add_data(data)
-    qr.make(fit=True)
-    buf = io.BytesIO()
-    qr.make_image(fill_color="black", back_color="white").save(buf, format="PNG")
-    return buf.getvalue()
-
-
-def mobile_ota_section(s3, bucket, short_sha, domain, platforms):
+def mobile_ota_section(short_sha, domain, platforms):
     lines = [
         "### Mobile Dev Tool preview",
         "",
         "Scan with your phone camera (or tap the deep link on the device) to open this "
         "branch in the installed **Dev Tool** dev client.",
     ]
     for platform in platforms:
-        manifest_url = f"https://{short_sha}--ota.{domain}/{platform}/manifest"
-        link = deep_link(manifest_url)
-        s3.put_object(
-            Bucket=bucket,
-            Key=f"ota/{short_sha}/{platform}/qr.png",
-            Body=make_qr_png(link),
-            ContentType="image/png",
-        )
-        qr_url = f"https://{short_sha}--ota.{domain}/{platform}/qr.png"
+        base = f"https://{short_sha}--ota.{domain}/{platform}"
+        link = deep_link(f"{base}/manifest")
         lines += [
             "",
             f"**{platform}**",
             "",
-            f'<img src="{qr_url}" alt="QR to open the {platform} build" width="180" height="180" />',
+            f'<img src="{base}/qr.png" alt="QR to open the {platform} build" width="180" height="180" />',
             "",
             "<details><summary>Deep link</summary>",
             "",
@@ -154,10 +133,7 @@ def main():
         print(f"No open PR for {sha} - skipping preview comment.")
         return
 
-    s3 = boto3.client("s3")
-    bucket = env("AWS_PREVIEW_BUCKET", required=True)
-
-    sections = [mobile_ota_section(s3, bucket, short_sha, domain, platforms)]
+    sections = [mobile_ota_section(short_sha, domain, platforms)]
     url = upsert_comment(repo, pr, build_body(sections, sha, pipeline_url), token)
     print(f"Posted preview comment to PR #{pr}: {url}")