feat(eas): force bun on EAS via custom build configs + 5-build release workflow (#1632)

.github/workflows/release.yml

@@ -1,9 +1,14 @@
-name: 🚀 Release (EAS Build + Submit)
+name: 🚀 Release (EAS build + submit)
 
-# Cloud EAS build + auto-submit for iOS, tvOS and Android on merge to main.
-# A manual approval gate (the `production` GitHub Environment) pauses the run
-# before any build/submit starts. Configure required reviewers on that
-# environment in repo Settings → Environments → production.
+# On merge to main (gated by the `production` GitHub Environment approval),
+# build all targets on EAS in parallel via custom bun build configs:
+#   1. iOS phone        → App Store (auto-submit)
+#   2. tvOS             → App Store (auto-submit)
+#   3. Android AAB      → Google Play (auto-submit)
+#   4. Android phone APK→ downloadable artifact
+#   5. Android TV APK   → downloadable artifact
+# Note: EAS queues builds based on your plan's concurrency; parallel jobs
+# here just submit them — EAS may still run them serially.
 
 concurrency:
   group: release-${{ github.ref }}
@@ -23,7 +28,7 @@ jobs:
       - name: ✅ Release approved
         run: echo "Release approved for ${{ github.sha }}"
 
-  release:
+  build:
     name: 🚀 ${{ matrix.name }}
     needs: approve
     runs-on: ubuntu-24.04
@@ -36,12 +41,25 @@ jobs:
           - name: 🍎 iOS
             platform: ios
             profile: production
+            submit: true
           - name: 📺 tvOS
             platform: ios
             profile: production_tv
-          - name: 🤖 Android
+            submit: true
+          - name: 🤖 Android AAB
             platform: android
             profile: production
+            submit: true
+          - name: 🤖 Android APK
+            platform: android
+            profile: production-apk
+            submit: false
+            artifact_name: streamyfin-android-phone-apk
+          - name: 📺 Android TV APK
+            platform: android
+            profile: production-apk-tv
+            submit: false
+            artifact_name: streamyfin-android-tv-apk
 
     steps:
       - name: 📥 Checkout code
@@ -76,10 +94,8 @@ jobs:
           token: ${{ secrets.EXPO_TOKEN }}
           eas-cache: true
 
-      # tvOS uses local credentials (EAS can't manage tvOS provisioning
-      # remotely, including the TopShelf extension target). Restore the
-      # gitignored credentials.json + cert + profiles from secrets so the
-      # cloud build can sign with `credentialsSource: local`.
+      # tvOS uses credentialsSource: local — restore the gitignored
+      # credentials.json + cert + provisioning profiles from secrets.
       - name: 🔐 Restore tvOS signing credentials
         if: matrix.profile == 'production_tv'
         env:
@@ -94,10 +110,14 @@ jobs:
           echo "$TVOS_APP_PROFILE_BASE64" | base64 -d > profiles/Streamyfin_tvOS_App_Store.mobileprovision
           echo "$TVOS_TOPSHELF_PROFILE_BASE64" | base64 -d > profiles/Streamyfin_TopShelf_tvOS_App_Store.mobileprovision
 
-      # iOS + tvOS submit upload to App Store Connect with an ASC API key.
-      # EAS reads it from EXPO_ASC_API_KEY_PATH / EXPO_ASC_KEY_ID /
-      # EXPO_ASC_ISSUER_ID (set on the build step below). Write the .p8,
-      # tolerating either raw-PEM or base64-encoded secret content.
+      # Android Play submit needs the Google Play service account JSON.
+      - name: 🔐 Restore Google Play service account
+        if: matrix.platform == 'android' && matrix.submit
+        env:
+          GOOGLE_SERVICE_ACCOUNT_KEY: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_KEY }}
+        run: printf '%s' "$GOOGLE_SERVICE_ACCOUNT_KEY" > google-service-account.json
+
+      # App Store Connect API key for iOS/tvOS submit (raw-PEM or base64).
       - name: 🔐 Restore App Store Connect API key
         if: matrix.platform == 'ios'
         env:
@@ -109,18 +129,11 @@ jobs:
             printf '%s' "$APPLE_KEY_CONTENT" | base64 -d > "$RUNNER_TEMP/asc_api_key.p8"
           fi
 
-      # Android submit needs a Google Play service account JSON. eas.json's
-      # submit.production.android.serviceAccountKeyPath points at this file.
-      - name: 🔐 Restore Google Play service account
-        if: matrix.platform == 'android'
-        env:
-          GOOGLE_SERVICE_ACCOUNT_KEY: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_KEY }}
-        run: printf '%s' "$GOOGLE_SERVICE_ACCOUNT_KEY" > google-service-account.json
-
+      # ── Submit builds: cloud build + auto-submit to the store ──
       - name: 🚀 Build & submit (${{ matrix.name }})
+        if: matrix.submit
         env:
           EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-          # Consumed by eas submit for iOS/tvOS; ignored for Android.
           EXPO_ASC_API_KEY_PATH: ${{ runner.temp }}/asc_api_key.p8
           EXPO_ASC_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
           EXPO_ASC_ISSUER_ID: ${{ secrets.APPLE_KEY_ISSUER_ID }}
@@ -129,4 +142,74 @@ jobs:
             --platform ${{ matrix.platform }} \
             --profile ${{ matrix.profile }} \
             --auto-submit \
-            --non-interactive
+            --non-interactive \
+            --wait
+
+      # ── Artifact builds: cloud build, then download + upload the APK ──
+      - name: 🏗️ Build artifact (${{ matrix.name }})
+        if: ${{ !matrix.submit }}
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+        run: |
+          eas build \
+            --platform ${{ matrix.platform }} \
+            --profile ${{ matrix.profile }} \
+            --non-interactive \
+            --wait \
+            --json > build-result.json
+          URL=$(node -e "const b=require('./build-result.json'); const x=Array.isArray(b)?b[0]:b; console.log(x.artifacts.applicationArchiveUrl)")
+          echo "Downloading artifact: $URL"
+          curl -fL "$URL" -o "${{ matrix.artifact_name }}.apk"
+
+      - name: 📤 Upload APK artifact (${{ matrix.name }})
+        if: ${{ !matrix.submit }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.artifact_name }}
+          path: ${{ matrix.artifact_name }}.apk
+          retention-days: 14
+
+  # Draft a GitHub Release with the two APKs attached. The tag comes from the
+  # merged-in app version (app.json → expo.version), NOT the auto-incremented
+  # build number — so cutting a release is a deliberate version bump via PR.
+  github-release:
+    name: 📦 Draft GitHub Release
+    needs: build
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - name: 📥 Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          show-progress: false
+
+      - name: 📦 Download APK artifacts from this run
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mkdir -p apks
+          gh run download ${{ github.run_id }} --name streamyfin-android-phone-apk --dir apks
+          gh run download ${{ github.run_id }} --name streamyfin-android-tv-apk --dir apks
+          ls -la apks
+
+      - name: 📝 Draft release (tag = app.json version, not auto-bumped)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION=$(node -e "console.log(require('./app.json').expo.version)")
+          TAG="v$VERSION"
+          echo "Release tag from merged app version: $TAG"
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG exists — updating APK assets"
+            gh release upload "$TAG" apks/*.apk --clobber
+          else
+            echo "Creating draft release $TAG"
+            gh release create "$TAG" \
+              --draft \
+              --generate-notes \
+              --title "$TAG" \
+              apks/*.apk
+          fi