fix(ota): propagate profile env to EOAS

apps/mobile/scripts/ota-publish.mjs

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const projectDir = resolve(import.meta.dirname, '..');
+const easConfig = JSON.parse(readFileSync(join(projectDir, 'eas.json'), 'utf8'));
+const profiles = {
+  production: {
+    apiOrigin: 'https://api.sauci.app',
+    authOrigin: 'https://ckjcrkjpmhqhiucifukx.supabase.co',
+    branch: 'production',
+    profile: 'production',
+  },
+  staging: {
+    apiOrigin: 'https://api.preprod.sauci.app',
+    authOrigin: 'https://itbzhrvlgvdmzbnhzhyx.supabase.co',
+    branch: 'staging',
+    profile: 'preview',
+  },
+};
+const requiredPublicKeys = [
+  'EXPO_PUBLIC_API_URL',
+  'EXPO_PUBLIC_SUPABASE_URL',
+  'EXPO_PUBLIC_SUPABASE_ANON_KEY',
+];
+
+function fail(message) {
+  throw new Error(`OTA publish preflight: ${message}`);
+}
+
+function requireCanonicalHttpsRoot(value, expected, label) {
+  try {
+    const parsed = new URL(value);
+    if (
+      value !== expected ||
+      parsed.protocol !== 'https:' ||
+      parsed.origin !== expected ||
+      parsed.username ||
+      parsed.password ||
+      parsed.pathname !== '/' ||
+      parsed.search ||
+      parsed.hash ||
+      parsed.port
+    ) {
+      fail(`${label} must be the canonical HTTPS root ${expected}`);
+    }
+  } catch {
+    fail(`${label} must be the canonical HTTPS root ${expected}`);
+  }
+}
+
+export function resolvePublishEnvironment(target, environment = process.env, config = easConfig) {
+  const profile = profiles[target];
+  if (!profile) fail(`target must be one of: ${Object.keys(profiles).join(', ')}`);
+
+  const profileEnv = config.build?.[profile.profile]?.env;
+  if (!profileEnv) fail(`missing EAS build profile ${profile.profile}`);
+  const env = { ...environment, ...profileEnv, RELEASE_CHANNEL: target };
+
+  for (const key of requiredPublicKeys) {
+    if (!env[key]) fail(`${key} is required for ${target} export`);
+  }
+  requireCanonicalHttpsRoot(env.EXPO_PUBLIC_SUPABASE_URL, profile.authOrigin, `${target} Auth URL`);
+  requireCanonicalHttpsRoot(env.EXPO_PUBLIC_API_URL, profile.apiOrigin, `${target} API URL`);
+
+  return { branch: profile.branch, env };
+}
+
+export function parsePublishArgs(args) {
+  const parsed = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    const takeValue = (flag, validate) => {
+      const value = args[index + 1];
+      if (!value || !validate(value)) fail(`${flag} requires a valid value`);
+      parsed.push(flag, value);
+      index += 1;
+    };
+    if (argument === '--platform') {
+      takeValue('--platform', (value) => ['ios', 'android', 'all'].includes(value));
+    } else if (argument.startsWith('--platform=')) {
+      const value = argument.slice('--platform='.length);
+      if (!['ios', 'android', 'all'].includes(value)) fail('--platform requires ios, android, or all');
+      parsed.push(argument);
+    } else if (argument === '-m' || argument === '--message') {
+      takeValue(argument, (value) => value.length > 0);
+    } else if (argument.startsWith('--message=')) {
+      if (!argument.slice('--message='.length)) fail('--message requires a value');
+      parsed.push(argument);
+    } else if (argument === '--rollout-percentage') {
+      takeValue(argument, (value) => /^(?:[1-9]|[1-9][0-9])$/.test(value));
+    } else if (argument.startsWith('--rollout-percentage=')) {
+      const value = argument.slice('--rollout-percentage='.length);
+      if (!/^(?:[1-9]|[1-9][0-9])$/.test(value)) fail('--rollout-percentage must be 1-99');
+      parsed.push(argument);
+    } else if (argument === '--nonInteractive') {
+      parsed.push(argument);
+    } else {
+      fail(`unsupported publish argument ${argument}`);
+    }
+  }
+  return parsed;
+}
+
+function run(command, args, env) {
+  const result = spawnSync(command, args, { cwd: projectDir, env, stdio: 'inherit' });
+  if (result.error) throw result.error;
+  if (result.status !== 0) process.exit(result.status ?? 1);
+}
+
+export function main(args = process.argv.slice(2), environment = process.env) {
+  const [target, ...remaining] = args;
+  const preflight = remaining.includes('--preflight');
+  const doctor = remaining.includes('--doctor');
+  const rawPublishArgs = remaining.filter((arg) => arg !== '--preflight' && arg !== '--doctor');
+  if (preflight && doctor) fail('choose either --preflight or --doctor');
+
+  const { branch, env } = resolvePublishEnvironment(target, environment);
+  const exportEnv = { ...env, EXPO_NO_DOTENV: '1' };
+  if (preflight) {
+    const outputDir = mkdtempSync(join(tmpdir(), `sauci-ota-${target}-`));
+    try {
+      run('npx', ['expo', 'export', '--output-dir', outputDir], exportEnv);
+    } finally {
+      rmSync(outputDir, { recursive: true, force: true });
+    }
+    console.log(`OTA ${target} export preflight passed`);
+    return;
+  }
+
+  if (doctor) {
+    if (rawPublishArgs.length) fail('--doctor does not accept additional EOAS arguments');
+    run('npx', ['eoas', 'doctor', '--channel', branch], exportEnv);
+    return;
+  }
+
+  run('npx', ['eoas', 'publish', '--branch', branch, ...parsePublishArgs(rawPublishArgs)], exportEnv);
+}
+
+if (process.argv[1] === new URL(import.meta.url).pathname) main();