feat(settings): show Actions run number for CI builds, hide store build number

CI builds now display `version · commit · #run` so anyone can map a
sideloaded build back to its Actions run (artifacts + logs) without
Expo access. Store builds show the bare version - TestFlight already
surfaces the build number to testers.

Signed CI iOS builds move to a dedicated `ci` EAS profile (extends
production, autoIncrement off) so they stop inflating the store build
counter (counter was at 241 while the last TestFlight upload was 92).

.github/renovate.json

@@ -44,22 +44,42 @@
       ]
     }
   },
-  "lockFileMaintenance": {
-    "vulnerabilityAlerts": {
-      "enabled": true,
-      "addLabels": ["security", "vulnerability"],
-      "assigneesFromCodeOwners": true,
-      "commitMessageSuffix": " [SECURITY]"
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "addLabels": ["security", "vulnerability"],
+    "assigneesFromCodeOwners": true,
+    "commitMessageSuffix": " [SECURITY]"
+  },
+  "packageRules": [
+    {
+      "description": "Expo SDK coherence: expo, react, react-native and Expo-managed modules are pinned by the Expo SDK and must move together (via `expo install --fix`), so do not raise individual update PRs — group them and require manual approval from the Dependency Dashboard",
+      "matchPackageNames": [
+        "expo",
+        "react",
+        "react-dom",
+        "react-native",
+        "react-native-web",
+        "expo-*",
+        "@expo/*"
+      ],
+      "groupName": "Expo SDK",
+      "dependencyDashboardApproval": true
     },
-    "packageRules": [
-      {
-        "description": "Group minor and patch GitHub Action updates into a single PR",
-        "matchManagers": ["github-actions"],
-        "groupName": "CI dependencies",
-        "groupSlug": "ci-deps",
-        "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
-        "automerge": true
-      }
-    ]
-  }
+    {
+      "description": "Group minor and patch GitHub Action updates into a single PR",
+      "matchManagers": ["github-actions"],
+      "groupName": "CI dependencies",
+      "groupSlug": "ci-deps",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "automerge": true
+    },
+    {
+      "description": "androidx and other Google-hosted Maven packages resolve from Google's Maven repository (not Maven Central)",
+      "matchDatasources": ["maven"],
+      "registryUrls": [
+        "https://dl.google.com/dl/android/maven2/",
+        "https://repo.maven.apache.org/maven2/"
+      ]
+    }
+  ]
 }

.github/workflows/build-apps.yml

@@ -11,6 +11,15 @@ on:
   push:
     branches: [develop, master]
 
+# Exposed to `expo prebuild` (app.config.js → extra.build) so Settings can show the
+# branch + commit + Actions run a CI build was made from. EAS cloud builds use
+# EAS_BUILD_* instead. The run number maps a sideloaded build back to its Actions
+# run (artifacts + logs) without needing Expo access.
+env:
+  EXPO_PUBLIC_GIT_BRANCH: ${{ github.head_ref || github.ref_name }}
+  EXPO_PUBLIC_GIT_COMMIT: ${{ github.sha }}
+  EXPO_PUBLIC_GIT_RUN_NUMBER: ${{ github.run_number }}
+
 jobs:
   build-android-phone:
     if: (!contains(github.event.head_commit.message, '[skip ci]'))
@@ -222,7 +231,7 @@ jobs:
           xcode-version: "26.5"
 
       - name: 🏗️ Setup EAS
-        uses: expo/expo-github-action@b184ff86a3c926240f1b6db41764c83a01c02eef # main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # main
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}
@@ -231,7 +240,9 @@ jobs:
       - name: 🚀 Build iOS app
         env:
           EXPO_TV: 0
-        run: eas build -p ios --local --non-interactive
+        # `ci` profile (extends production, autoIncrement off): keeps CI builds out of
+        # the production version tier and stops them inflating the store build counter.
+        run: eas build -p ios --local --non-interactive --profile ci
 
       - name: 📅 Set date tag
         run: echo "DATE_TAG=$(date +%d-%m-%Y_%H-%M-%S)" >> $GITHUB_ENV
@@ -347,7 +358,7 @@ jobs:
           xcode-version: "26.5"
 
       - name: 🏗️ Setup EAS
-        uses: expo/expo-github-action@b184ff86a3c926240f1b6db41764c83a01c02eef # main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # main
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}
@@ -356,7 +367,7 @@ jobs:
       - name: 🚀 Build iOS app
         env:
           EXPO_TV: 1
-        run: eas build -p ios --local --non-interactive
+        run: eas build -p ios --local --non-interactive --profile ci_tv
 
       - name: 📅 Set date tag
         run: echo "DATE_TAG=$(date +%d-%m-%Y_%H-%M-%S)" >> $GITHUB_ENV

.github/workflows/ci-codeql.yml

@@ -27,13 +27,13 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: 🏁 Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           queries: +security-extended,security-and-quality
 
       - name: 🛠️ Autobuild
-        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
       - name: 🧪 Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/release.yml

@@ -88,7 +88,7 @@ jobs:
           bun run submodule-reload
 
       - name: 🏗️ Setup EAS
-        uses: expo/expo-github-action@b184ff86a3c926240f1b6db41764c83a01c02eef # main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # main
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}

.github/workflows/trivy-scan.yml

@@ -54,7 +54,7 @@ jobs:
           output: trivy-results.sarif
 
       - name: 📤 Upload results to code scanning
-        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: trivy-results.sarif
           category: trivy-fs

app.config.js

@@ -1,3 +1,47 @@
+const { execFileSync } = require("node:child_process");
+
+// Build metadata, injected into `extra.build` and read at runtime via
+// expo-constants (see utils/version.ts). Sources in priority order:
+// EAS cloud build → GitHub Actions → explicit EXPO_PUBLIC_* → local git → null.
+const git = (args) => {
+  try {
+    return execFileSync("git", args, { stdio: ["ignore", "pipe", "ignore"] })
+      .toString()
+      .trim();
+  } catch {
+    return null;
+  }
+};
+
+const buildMeta = {
+  commit:
+    (
+      process.env.EAS_BUILD_GIT_COMMIT_HASH ||
+      process.env.GITHUB_SHA ||
+      process.env.EXPO_PUBLIC_GIT_COMMIT ||
+      git(["rev-parse", "HEAD"]) ||
+      ""
+    ).slice(0, 7) || null,
+  branch:
+    process.env.EAS_BUILD_GIT_BRANCH ||
+    process.env.GITHUB_HEAD_REF ||
+    process.env.GITHUB_REF_NAME ||
+    process.env.EXPO_PUBLIC_GIT_BRANCH ||
+    git(["rev-parse", "--abbrev-ref", "HEAD"]) ||
+    null,
+  profile:
+    process.env.EAS_BUILD_PROFILE ||
+    process.env.EXPO_PUBLIC_BUILD_PROFILE ||
+    null,
+  // GitHub Actions run number (#2098) — lets anyone map a sideloaded CI build back
+  // to its Actions run (artifacts + logs) without Expo access. Null outside CI.
+  runNumber:
+    process.env.GITHUB_RUN_NUMBER ||
+    process.env.EXPO_PUBLIC_GIT_RUN_NUMBER ||
+    null,
+  builtAt: new Date().toISOString(),
+};
+
 module.exports = ({ config }) => {
   if (process.env.EXPO_TV !== "1") {
     config.plugins.push("expo-background-task");
@@ -22,6 +66,8 @@ module.exports = ({ config }) => {
     androidConfig.googleServicesFile = process.env.GOOGLE_SERVICES_JSON;
   }
 
+  config.extra = { ...config.extra, build: buildMeta };
+
   return {
     ...(Object.keys(androidConfig).length > 0 && { android: androidConfig }),
     ...config,

components/SaveAccountModal.tsx

@@ -69,17 +69,23 @@ export const SaveAccountModal: React.FC<SaveAccountModalProps> = ({
     [isAndroid],
   );
 
+  const isPresentedRef = useRef(false);
+
   useEffect(() => {
     if (visible) {
       bottomSheetModalRef.current?.present();
-    } else {
+    } else if (isPresentedRef.current) {
       bottomSheetModalRef.current?.dismiss();
+      isPresentedRef.current = false;
     }
   }, [visible]);
 
   const handleSheetChanges = useCallback(
     (index: number) => {
-      if (index === -1) {
+      if (index >= 0) {
+        isPresentedRef.current = true;
+      } else if (index === -1 && isPresentedRef.current) {
+        isPresentedRef.current = false;
         resetState();
         onClose();
       }

components/settings/UserInfo.tsx

@@ -1,8 +1,8 @@
-import * as Application from "expo-application";
 import { useAtom } from "jotai";
 import { useTranslation } from "react-i18next";
 import { View, type ViewProps } from "react-native";
 import { apiAtom, userAtom } from "@/providers/JellyfinProvider";
+import { getVersionInfo } from "@/utils/version";
 import { ListGroup } from "../list/ListGroup";
 import { ListItem } from "../list/ListItem";
 
@@ -13,10 +13,9 @@ export const UserInfo: React.FC<Props> = ({ ...props }) => {
   const [user] = useAtom(userAtom);
   const { t } = useTranslation();
 
-  const version =
-    Application?.nativeApplicationVersion ||
-    Application?.nativeBuildVersion ||
-    "N/A";
+  // Graduated build identifier — see utils/version.ts:
+  // dev → "0.54.1 · branch · commit", develop/CI → "0.54.1 · commit · #run", production → "0.54.1".
+  const { display: version } = getVersionInfo();
 
   return (
     <View {...props}>

eas.json

@@ -97,6 +97,14 @@
         "credentialsSource": "local",
         "config": "ios-production.yml"
       }
+    },
+    "ci": {
+      "extends": "production",
+      "autoIncrement": false
+    },
+    "ci_tv": {
+      "extends": "production_tv",
+      "autoIncrement": false
     }
   },
   "submit": {

providers/JellyfinProvider.tsx

@@ -40,6 +40,7 @@ import {
 } from "@/utils/secureCredentials";
 import { store } from "@/utils/store";
 import { clearTVDiscoverySafely } from "@/utils/tvDiscovery/sync";
+import { APP_VERSION } from "@/utils/version";
 
 interface Server {
   address: string;
@@ -53,7 +54,7 @@ const initialApi = (() => {
       const id = getOrSetDeviceId();
       const deviceName = getDeviceNameSync();
       const jellyfinInstance = new Jellyfin({
-        clientInfo: { name: "Streamyfin", version: "0.54.1" },
+        clientInfo: { name: "Streamyfin", version: APP_VERSION },
         deviceInfo: {
           name: deviceName,
           id,
@@ -135,7 +136,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
       const id = getOrSetDeviceId();
       const deviceName = getDeviceNameSync();
       return new Jellyfin({
-        clientInfo: { name: "Streamyfin", version: "0.54.1" },
+        clientInfo: { name: "Streamyfin", version: APP_VERSION },
         deviceInfo: {
           name: deviceName,
           id,
@@ -169,7 +170,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     return {
       authorization: `MediaBrowser Client="Streamyfin", Device=${
         Platform.OS === "android" ? "Android" : "iOS"
-      }, DeviceId="${deviceId}", Version="0.54.1"`,
+      }, DeviceId="${deviceId}", Version="${APP_VERSION}"`,
     };
   }, [deviceId]);
 

utils/version.ts

@@ -0,0 +1,94 @@
+import * as Application from "expo-application";
+import Constants from "expo-constants";
+
+/** Raw marketing version (app.json `version`), e.g. "0.54.1". Exposed so the Jellyfin
+ * clientInfo auto-tracks the app version instead of a hardcoded string. */
+export const APP_VERSION = Application.nativeApplicationVersion ?? "unknown";
+
+/** Build metadata injected at build time by `app.config.js` into `extra.build`. */
+export interface BuildMeta {
+  commit?: string | null;
+  branch?: string | null;
+  profile?: string | null;
+  runNumber?: string | null;
+  builtAt?: string | null;
+}
+
+export interface VersionInfo {
+  /** Marketing version (CFBundleShortVersionString / android versionName), e.g. "0.54.1". */
+  version: string | null;
+  /** Build number (CFBundleVersion / versionCode), e.g. "42". */
+  build: string | null;
+  /** Short git commit the build was made from, e.g. "a1b2c3d". */
+  commit: string | null;
+  /** Git branch the build was made from, e.g. "develop". */
+  branch: string | null;
+  /** EAS build profile, e.g. "production", "ci", "preview", or null for local. */
+  profile: string | null;
+  /** GitHub Actions run number the build came from, e.g. "2098". Null outside CI. */
+  runNumber: string | null;
+  isDev: boolean;
+  isProduction: boolean;
+  /** Graduated label for the Settings "App version" row (see tiering below). */
+  display: string;
+}
+
+/**
+ * Resolve a graduated version string for Settings.
+ *
+ * Tiering (most → least detailed):
+ *  - dev / local build   → `version · branch · commit`     (full context for debugging)
+ *  - develop / CI / preview → `version · commit · #run`     (pin the exact source; the
+ *      Actions run number maps the build to its run — artifacts + logs — without
+ *      Expo access)
+ *  - production (store / TestFlight) → `version`             (build number intentionally
+ *      not shown: TestFlight already displays it to testers, and the commit pins the
+ *      binary better)
+ */
+export function getVersionInfo(): VersionInfo {
+  // Read native/config values defensively — a version string must never crash Settings
+  // (e.g. a dev build whose native expo-constants is out of sync with the JS).
+  const read = <T>(fn: () => T): T | null => {
+    try {
+      return fn() ?? null;
+    } catch {
+      return null;
+    }
+  };
+
+  const version = read(() => Application.nativeApplicationVersion);
+  const build = read(() => Application.nativeBuildVersion);
+  const meta = (read(() => Constants.expoConfig?.extra?.build) ??
+    {}) as BuildMeta;
+  const commit = meta.commit ?? null;
+  const branch = meta.branch ?? null;
+  const profile = meta.profile ?? null;
+  const runNumber = meta.runNumber ?? null;
+  const isDev = __DEV__ === true;
+  const isProduction =
+    typeof profile === "string" && profile.startsWith("production");
+
+  let display: string;
+  if (isDev) {
+    display = [version ?? "dev", branch, commit].filter(Boolean).join(" · ");
+  } else if (isProduction) {
+    display = version ?? build ?? "N/A";
+  } else {
+    display =
+      [version, commit, runNumber && `#${runNumber}`]
+        .filter(Boolean)
+        .join(" · ") || "N/A";
+  }
+
+  return {
+    version,
+    build,
+    commit,
+    branch,
+    profile,
+    runNumber,
+    isDev,
+    isProduction,
+    display,
+  };
+}