Release to Staging v2.9.28 - 2026-08-07 #422
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: RN SDK Test App CI | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| paths: | |
| - "packages/rn-sdk/**" | |
| - "packages/rn-sdk-test-app/**" | |
| - "packages/kmp-sdk/**" | |
| - "packages/self-sdk-swift/**" | |
| - ".github/workflows/rn-sdk-test-app-ci.yml" | |
| - ".github/actions/**" | |
| - ".github/CI_FORCE_RUN" | |
| push: | |
| branches: [dev, staging, main] | |
| paths: | |
| - "packages/rn-sdk/**" | |
| - "packages/rn-sdk-test-app/**" | |
| - "packages/kmp-sdk/**" | |
| - "packages/self-sdk-swift/**" | |
| - ".github/workflows/rn-sdk-test-app-ci.yml" | |
| - ".github/actions/**" | |
| - ".github/CI_FORCE_RUN" | |
| jobs: | |
| types: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install dependencies | |
| uses: ./.github/actions/pnpm-install | |
| - name: Check for nested require() in tests | |
| uses: ./.github/actions/check-nested-requires | |
| with: | |
| paths: | | |
| packages/rn-sdk/src/__tests__/ | |
| - name: Cache Turbo | |
| uses: ./.github/actions/cache-turbo | |
| with: | |
| key-prefix: rn-sdk-test-app-types | |
| - name: Build webview-app and dependencies | |
| run: pnpm exec turbo run build --filter="@selfxyz/webview-app" | |
| - name: Typecheck rn-sdk | |
| run: pnpm --filter @selfxyz/rn-sdk typecheck | |
| - name: Test rn-sdk | |
| run: pnpm --filter @selfxyz/rn-sdk test | |
| - name: Build rn-sdk types | |
| run: pnpm --filter @selfxyz/rn-sdk exec tsup | |
| - name: Typecheck rn-sdk-test-app | |
| run: pnpm --filter @selfxyz/rn-sdk-test-app types | |
| android-build: | |
| # Fork PRs cannot access the self-sdk-dist token (generate-github-token / SELF_SDK_DIST_TOKEN), | |
| # so the private AARs (xyz.self.sdk:nfc/:ocr/:shared) never resolve — skip rather than fail red. | |
| if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install dependencies | |
| uses: ./.github/actions/pnpm-install | |
| - name: Setup Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Generate debug keystore | |
| run: | | |
| KEYSTORE_PATH="packages/rn-sdk-test-app/android/app/debug.keystore" | |
| if keytool -list -keystore "$KEYSTORE_PATH" -storepass android -alias androiddebugkey >/dev/null 2>&1; then | |
| echo "Using existing debug keystore at $KEYSTORE_PATH" | |
| else | |
| keytool -genkeypair -v -keystore "$KEYSTORE_PATH" \ | |
| -alias androiddebugkey -keyalg RSA -keysize 2048 -validity 10000 \ | |
| -storepass android -keypass android \ | |
| -dname "CN=Android Debug,O=Android,C=US" | |
| fi | |
| - name: Generate GitHub token (read:packages for self-sdk-dist) | |
| if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false }} | |
| uses: ./.github/actions/generate-github-token | |
| id: github-token | |
| with: | |
| app-id: ${{ vars.GH_WORKFLOWS_CROSS_ACCESS_ID }} | |
| private-key: ${{ secrets.GH_WORKFLOWS_CROSS_ACCESS_KEY }} | |
| - name: Build Android debug APK | |
| env: | |
| # Resolve the self-sdk-native AARs (xyz.self.sdk:nfc / :ocr / :shared, 0.1.3) from the | |
| # private self-sdk-dist Maven — the test app's android/build.gradle activates that repo | |
| # only when this token is present (falls back to mavenLocal otherwise). | |
| # Auth for the private self-sdk-dist GitHub Packages Maven. Prefer a dedicated repo | |
| # secret (a PAT with read:packages on self-sdk-dist) so the test app doesn't depend on | |
| # the org App having package access; fall back to the App installation token. | |
| # GitHub Packages accepts "x-access-token" as the username for either token type. | |
| SELF_SDK_GITHUB_USER: x-access-token | |
| SELF_SDK_GITHUB_TOKEN: ${{ secrets.SELF_SDK_DIST_TOKEN || steps.github-token.outputs.token }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| chmod +x packages/rn-sdk-test-app/android/gradlew | |
| cd packages/rn-sdk-test-app/android | |
| # The self-sdk-dist GitHub Packages Maven occasionally returns a transient HTTP 500, | |
| # and Gradle disables the whole repo for the rest of that invocation once one lookup | |
| # fails — turning a blip into a hard failure across nfc/ocr/shared. Retry the build in a | |
| # fresh Gradle process (which re-enables the repo) before giving up. | |
| for attempt in 1 2 3; do | |
| echo "Gradle assembleDebug attempt ${attempt}/3..." | |
| if ./gradlew assembleDebug --quiet --parallel --build-cache --no-configuration-cache; then | |
| exit 0 | |
| fi | |
| echo "assembleDebug failed on attempt ${attempt}." | |
| if [ "${attempt}" -lt 3 ]; then | |
| echo "Retrying in 15s..." | |
| sleep 15 | |
| fi | |
| done | |
| echo "assembleDebug failed after 3 attempts." >&2 | |
| exit 1 | |
| ios-build: | |
| if: | | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event_name == 'push' && contains(fromJSON('["refs/heads/staging","refs/heads/main"]'), github.ref)) || | |
| (github.event_name == 'pull_request' && contains(fromJSON('["staging","main"]'), github.base_ref)) || | |
| (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'test-ios')) | |
| runs-on: namespace-profile-apple-silicon-6cpu | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Generate token for private dependencies | |
| uses: ./.github/actions/generate-github-token | |
| id: github-token | |
| with: | |
| app-id: ${{ vars.GH_WORKFLOWS_CROSS_ACCESS_ID }} | |
| private-key: ${{ secrets.GH_WORKFLOWS_CROSS_ACCESS_KEY }} | |
| configure-netrc: "true" | |
| - name: Configure git for HTTPS dependency fetch | |
| run: git config --global url."https://github.com/".insteadOf "git@github.com:" | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Install dependencies | |
| uses: ./.github/actions/pnpm-install | |
| - name: Build common | |
| run: pnpm --filter @selfxyz/common build | |
| - name: Build mobile-sdk-alpha iOS artifacts | |
| run: pnpm --filter @selfxyz/mobile-sdk-alpha build:ios | |
| - name: Build mobile-sdk-alpha TypeScript bundle | |
| run: pnpm --filter @selfxyz/mobile-sdk-alpha build:ts-only | |
| - name: Build webview-bridge | |
| run: pnpm --filter @selfxyz/webview-bridge build | |
| - name: Build webview-app | |
| run: pnpm --filter @selfxyz/webview-app build | |
| - name: Build rn-sdk (includes asset copy) | |
| run: pnpm --filter @selfxyz/rn-sdk build | |
| - name: Install CocoaPods dependencies | |
| working-directory: packages/rn-sdk-test-app/ios | |
| env: | |
| RCT_BUILD_HERMES_FROM_SOURCE: "false" | |
| run: pod install | |
| - name: Find iOS Simulator | |
| id: sim | |
| uses: ./.github/actions/find-ios-simulator | |
| - name: Build iOS app | |
| working-directory: packages/rn-sdk-test-app/ios | |
| run: | | |
| xcodebuild -workspace SelfRNTestApp.xcworkspace \ | |
| -scheme SelfRNTestApp \ | |
| -sdk iphonesimulator \ | |
| -destination "id=${{ steps.sim.outputs.id }}" \ | |
| ONLY_ACTIVE_ARCH=YES \ | |
| build |