Skip to content
Open
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 72 additions & 0 deletions .fingerprintignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
# Ignore files that don't affect native compatibility

# Development and build artifacts
node_modules/**/*
.expo/**/*
.git/**/*
*.log
.DS_Store

# Documentation and non-native files
README.md
CONTRIBUTING.md
*.md
docs/**/*

# Test files
**/*.test.ts
**/*.test.tsx
**/__tests__/**/*
jest.config.ts
jest.setup.ts

# Linting and formatting
.eslintrc.*
.prettierrc.*
eslint.config.mjs

# Environment and config files that don't affect native
.env*
.nvmrc
yarn.lock
package-lock.json

# Scripts that don't affect native build
scripts/**/*
!scripts/check-runtime-compatibility.js

# GitHub workflows (except our PR preview)
.github/workflows/**/*
!.github/workflows/pr-preview.yml

# Patches and temporary files
patches/**/*
*.patch
*.tmp

# IDE and editor files
.vscode/**/*
.idea/**/*
*.swp
*.swo

# React Native Metro cache
.metro-health-check*

# Expo development
.expo-shared/**/*

# TypeScript build artifacts
*.tsbuildinfo

# Reassure performance tests
reassure-tests.sh

# Keep important native-affecting files by explicitly not ignoring them:
# - app.config.ts (affects native config)
# - eas.json (affects builds)
# - package.json (affects dependencies)
# - plugins/ (affects native code)
# - ios/ and android/ directories
# - babel.config.js (affects transforms)
# - metro.config.js (affects bundling)
314 changes: 314 additions & 0 deletions .github/workflows/pr-preview.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,314 @@
name: PR Preview

on:
pull_request:
types: [opened, synchronize, reopened]

jobs:
check-compatibility:
name: Check Update Compatibility
runs-on: ubuntu-latest
outputs:
can_create_update: ${{ steps.check-runtime.outputs.can_create_update }}
current_fingerprint: ${{ steps.check-runtime.outputs.current_fingerprint }}
preview_fingerprint: ${{ steps.check-runtime.outputs.preview_fingerprint }}

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup node
uses: actions/setup-node@v4
with:
node-version-file: .nvmrc
cache: "yarn"
cache-dependency-path: yarn.lock
env:
SKIP_YARN_COREPACK_CHECK: "1"

- run: corepack enable

- name: Install dependencies
run: yarn install

# Need this here because the "Setup EAS" setup will execute npx expo config and will need the "build" folder of the plugin to be there
- name: Build iOS notification extension plugin
run: yarn plugins:build:notification-service-extension

- name: Setup EAS
uses: expo/expo-github-action@v8
with:
eas-version: latest
token: ${{ secrets.EXPO_TOKEN }}
packager: yarn

- name: Check fingerprint compatibility
id: check-runtime
run: node scripts/check-runtime-compatibility.js

create-update:
name: Create EAS Update
runs-on: ubuntu-latest
needs: check-compatibility
if: needs.check-compatibility.outputs.can_create_update == 'true'
permissions:
contents: read
pull-requests: write

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup node
uses: actions/setup-node@v4
with:
node-version-file: .nvmrc
cache: "yarn"
cache-dependency-path: yarn.lock
env:
SKIP_YARN_COREPACK_CHECK: "1"

- run: corepack enable

- name: Install dependencies
run: yarn install

- name: Setup EAS
uses: expo/expo-github-action@v8
with:
eas-version: latest
token: ${{ secrets.EXPO_TOKEN }}
packager: yarn
eas-cache: true
patch-watchers: true

- name: Create PR preview update
uses: expo/expo-github-action/preview@v8
with:
command: eas update --branch=pr-${{ github.event.number }} --message="PR #${{ github.event.number }}: ${{ github.event.pull_request.title }}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Security risk: untrusted PR title in update command
Using ${{ github.event.pull_request.title }} directly in the eas update --message flag can lead to command-injection. Pass the title via an environment variable or properly escape/sanitize it.

🤖 Prompt for AI Agents
In .github/workflows/pr-preview.yml at line 92, the PR title is directly used in
the eas update command message, which poses a command injection risk. To fix
this, avoid inserting the raw PR title directly in the command string; instead,
assign the PR title to an environment variable and reference that variable in
the command, or sanitize/escape the title properly before usage to prevent
injection vulnerabilities.

env:
EXPO_ENV: preview

create-build:
name: Create EAS Build for Native Changes
runs-on: ubuntu-latest
needs: check-compatibility
if: needs.check-compatibility.outputs.can_create_update == 'false'

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup node
uses: actions/setup-node@v4
with:
node-version-file: .nvmrc
cache: "yarn"
cache-dependency-path: yarn.lock

- name: Setup EAS
uses: expo/expo-github-action@v8
with:
expo-version: latest
eas-version: latest
token: ${{ secrets.EXPO_TOKEN }}

- name: Install dependencies
run: yarn install --frozen-lockfile

- name: Create EAS Build
run: |
# Create build with PR-specific message
eas build --platform ios --profile preview --non-interactive --message "PR #${{ github.event.number }}: ${{ github.event.pull_request.title }}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Security vulnerability: Untrusted input in shell command.

Using github.event.pull_request.title directly in shell commands poses a security risk as it can contain malicious content that could be executed.

Apply this diff to fix the security issue:

       - name: Create EAS Build
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_NUMBER: ${{ github.event.number }}
         run: |
           # Create build with PR-specific message
-          eas build --platform ios --profile preview --non-interactive --message "PR #${{ github.event.number }}: ${{ github.event.pull_request.title }}"
+          eas build --platform ios --profile preview --non-interactive --message "PR #${PR_NUMBER}: ${PR_TITLE}"

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 actionlint (1.7.7)

120-120: "github.event.pull_request.title" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions for more details

(expression)

🤖 Prompt for AI Agents
In .github/workflows/pr-preview.yml around lines 120 to 123, the shell command
uses the untrusted input github.event.pull_request.title directly, which can
lead to command injection vulnerabilities. To fix this, sanitize or escape the
pull request title before including it in the shell command, or use GitHub
Actions built-in mechanisms to safely pass this value as an environment variable
or argument without direct shell interpolation.

- name: Comment on PR - Build Started
uses: actions/github-script@v7
with:
script: |
const body = `## 🏗️ New Build Started

⏳ **Creating new preview build** for native changes...

### 📊 Build Details
- **Platform:** iOS
- **Profile:** preview
- **Reason:** Native changes detected in PR #${{ github.event.number }}
- **Message:** "${{ github.event.pull_request.title }}"

### ⏱️ Expected Timeline
- **Build time:** ~10-15 minutes
- **TestFlight processing:** ~5-10 minutes
- **Total:** ~15-25 minutes

### 🔔 What's Next
1. **Build will appear in EAS dashboard** when complete
2. **New build will be submitted to TestFlight** automatically
3. **You'll get a notification** when ready for testing
4. **Update your preview app** before testing this PR

---
*You can track build progress in the [EAS dashboard](https://expo.dev/accounts/ephemera/projects/convos/builds).*`;

github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});

Comment on lines +127 to +208

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Security vulnerability: Untrusted input in inline script.

The PR title is used directly in the JavaScript code without proper escaping, which could lead to script injection attacks.

Apply this diff to fix the security issue:

       - name: Comment on PR - Build Started
         uses: actions/github-script@v7
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_NUMBER: ${{ github.event.number }}
         with:
           script: |
+            const prTitle = process.env.PR_TITLE;
+            const prNumber = process.env.PR_NUMBER;
             const body = `## 🏗️ New Build Started
 
             ⏳ **Creating new preview build** for native changes...
 
             ### 📊 Build Details
             - **Platform:** iOS
             - **Profile:** preview
-            - **Reason:** Native changes detected in PR #${{ github.event.number }}
-            - **Message:** "${{ github.event.pull_request.title }}"
+            - **Reason:** Native changes detected in PR #${prNumber}
+            - **Message:** "${prTitle}"
 
             ### ⏱️ Expected Timeline
             - **Build time:** ~10-15 minutes
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
script: |
const body = `## 🏗️ New Build Started
⏳ **Creating new preview build** for native changes...
### 📊 Build Details
- **Platform:** iOS
- **Profile:** preview
- **Reason:** Native changes detected in PR #${{ github.event.number }}
- **Message:** "${{ github.event.pull_request.title }}"
### ⏱️ Expected Timeline
- **Build time:** ~10-15 minutes
- **TestFlight processing:** ~5-10 minutes
- **Total:** ~15-25 minutes
### 🔔 What's Next
1. **Build will appear in EAS dashboard** when complete
2. **New build will be submitted to TestFlight** automatically
3. **You'll get a notification** when ready for testing
4. **Update your preview app** before testing this PR
---
*You can track build progress in the [EAS dashboard](https://expo.dev/accounts/ephemera/projects/convos/builds).*`;
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});
- name: Comment on PR - Build Started
uses: actions/github-script@v7
env:
PR_TITLE: ${{ github.event.pull_request.title }}
PR_NUMBER: ${{ github.event.number }}
with:
script: |
const prTitle = process.env.PR_TITLE;
const prNumber = process.env.PR_NUMBER;
const body = `## 🏗️ New Build Started
⏳ **Creating new preview build** for native changes...
### 📊 Build Details
- **Platform:** iOS
- **Profile:** preview
- **Reason:** Native changes detected in PR #${prNumber}
- **Message:** "${prTitle}"
### ⏱️ Expected Timeline
- **Build time:** ~10-15 minutes
- **TestFlight processing:** ~5-10 minutes
- **Total:** ~15-25 minutes
### 🔔 What's Next
1. **Build will appear in EAS dashboard** when complete
2. **New build will be submitted to TestFlight** automatically
3. **You'll get a notification** when ready for testing
4. **Update your preview app** before testing this PR
---
*You can track build progress in the [EAS dashboard](https://expo.dev/accounts/ephemera/projects/convos/builds).*`;
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});
🧰 Tools
🪛 actionlint (1.7.7)

127-127: "github.event.pull_request.title" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions for more details

(expression)

🤖 Prompt for AI Agents
In .github/workflows/pr-preview.yml around lines 127 to 158, the PR title is
directly embedded in the JavaScript string without escaping, which risks script
injection. To fix this, sanitize or escape the PR title before including it in
the body string to ensure any special characters are neutralized and cannot
break out of the string context. Use a proper escaping function or method to
safely insert the PR title into the comment body.

- name: Comment on PR about build
uses: actions/github-script@v7
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: `🔨 **Native Changes Detected - Creating New Build**

This PR contains native changes that require a new build. A preview build is being created now.

**Runtime Versions:**
- PR Fingerprint: \`${{ needs.check-compatibility.outputs.current_fingerprint }}\`
- Latest Preview Build: \`${{ needs.check-compatibility.outputs.preview_fingerprint }}\`

**What's happening:**
- ⏳ Creating new iOS preview build (this takes ~10-15 minutes)
- 📱 Build will be available on TestFlight internal testing
- 🔄 You'll get a notification when the build is ready

**To test this PR:**
1. Wait for the build to complete
2. Update your TestFlight app to the latest preview build
3. The new build will include your changes

**Build started at:** ${new Date().toLocaleString()}`
})

Comment on lines +211 to +212

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Security risk: untrusted PR title in build command
The eas build ... --message "PR #${{ github.event.number }}: ${{ github.event.pull_request.title }}" invocation interpolates untrusted input. Use env vars or escape the title to avoid injection.

🤖 Prompt for AI Agents
In .github/workflows/pr-preview.yml at lines 211-212, the eas build command uses
the untrusted PR title directly in the --message argument, which risks command
injection. To fix this, avoid direct interpolation of the PR title in the
command line; instead, assign the PR title to a GitHub Actions environment
variable with proper escaping or sanitization, then reference that variable
safely in the eas build command to prevent injection vulnerabilities.

- name: Comment on PR when build completes
if: success()
uses: actions/github-script@v7
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: `✅ **Preview Build Complete!**

The new preview build for this PR is ready.

**To test:**
1. Open TestFlight on your device
2. Update to the latest "Convos Preview" build
3. The build includes the changes from this PR

**Build completed at:** ${new Date().toLocaleString()}

Note: It may take a few minutes for the build to appear in TestFlight.`
})

- name: Comment on PR if build fails
if: failure()
uses: actions/github-script@v7
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: `❌ **Preview Build Failed**

The preview build for this PR failed to create.

**To investigate:**
1. Check the [workflow logs](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
2. Look for build errors in the EAS dashboard

**Common causes:**
- Build configuration issues
- Native dependency conflicts
- Code signing problems

**Build failed at:** ${new Date().toLocaleString()}`
})

- name: Comment on PR - EAS Update
if: steps.check-compatibility.outputs.can_create_update == 'true'
Comment thread
macroscopeapp[bot] marked this conversation as resolved.
Outdated
uses: actions/github-script@v7
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
with:
script: |
const currentFingerprint = '${{ steps.check-compatibility.outputs.current_fingerprint }}';
const previewFingerprint = '${{ steps.check-compatibility.outputs.preview_fingerprint }}';

const body = `## 📱 PR Preview Ready (EAS Update)

✅ **Compatible with current preview builds** - No native changes detected

### 🔄 How to Test
1. **Open the Convos Preview app** (must be on latest preview build)
2. **Long press anywhere** to open debug menu
3. **Tap "Updates Menu"** → **"Switch to PR Branch (Smart)"**
4. **Enter PR number:** \`${context.issue.number}\`
5. **Tap "Check & Switch"** - it will verify compatibility first

### 📊 Technical Details
- **Update Type:** EAS Update (JavaScript-only changes)
- **Runtime Version:** \`${currentFingerprint}\`
- **Compatible with builds:** \`${previewFingerprint}\`
- **Branch:** \`pr-${context.issue.number}\`

### ⚠️ Important Notes
- Only works with **preview builds** that have runtime version \`${previewFingerprint}\`
- The debug menu will **automatically check compatibility** before switching
- If you're on an older build, you'll see a warning message

---
*This update was created automatically because no native changes were detected.*`;

github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});

- name: Comment on PR - EAS Build Required
if: steps.check-compatibility.outputs.can_create_update == 'false'
uses: actions/github-script@v7
with:
script: |
const currentFingerprint = '${{ steps.check-compatibility.outputs.current_fingerprint }}';
const previewFingerprint = '${{ steps.check-compatibility.outputs.preview_fingerprint }}';

const body = `## 🔨 PR Preview Requires New Build

⚠️ **Native changes detected** - EAS Update not compatible

### 🏗️ What's Happening
This PR contains native changes (new dependencies, config changes, etc.) that require a new build.

### 📊 Technical Details
- **Current PR fingerprint:** \`${currentFingerprint}\`
- **Latest preview build:** \`${previewFingerprint}\`
- **Compatibility:** ❌ **Incompatible** (different runtime versions)

### 🚀 Next Steps
1. **Wait for new build** - A new preview build will be created automatically
2. **Check TestFlight** - New build will appear in TestFlight when ready
3. **Update your app** - Install the new build before testing this PR

### ⚠️ Important for Testers
- **Don't try to switch to this PR** in the debug menu with old builds
- **It will crash** because of runtime version mismatch
- **Wait for the new build** notification

---
*This PR requires a new build because it contains native changes.*`;

github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: body
});
Loading