| 12 | 12 | | # the app's code from `npx expo start` on your computer. |
| 13 | 13 | | # |
| 14 | 14 | | # Needs the repository secret EXPO_TOKEN (an Expo access token with access |
| 15 | | − | # to @flagon-io/g1t). |
| 15 | + | # to @flagon-io/g1t), and Expo's hosts allowed for these workflows alone in |
| 16 | + | # the project's Settings, Guardrails, Workflow-only domains: |
| 17 | + | # |
| 18 | + | # api.expo.dev | mobile-build.yml, mobile-release.yml |
| 19 | + | # expo.dev | mobile-build.yml, mobile-release.yml |
| 20 | + | # storage.googleapis.com | mobile-build.yml, mobile-release.yml |
| 21 | + | # |
| 22 | + | # (the API, its artifacts, and where EAS uploads the project's archive). |
| 16 | 23 | | name: Mobile build |
| 17 | 24 | | |
| 18 | 25 | | on: |
| ⋯ |
| 63 | 70 | | run: | |
| 64 | 71 | | # A token pasted with a newline breaks the request's header. |
| 65 | 72 | | export EXPO_TOKEN="$(printf %s "$EXPO_TOKEN" | tr -d '[:space:]')" |
| 66 | | − | # Without a token Expo answers 200; a bare 403 is its edge refusing this network. |
| 73 | + | # Without a token Expo answers 200; a bare 403 is the sandbox's egress refusing it. |
| 67 | 74 | | code="$(curl -s -o /dev/null -w '%{http_code}' -X POST https://api.expo.dev/graphql \ |
| 68 | 75 | | -H 'Content-Type: application/json' -d '{"query":"{ meUserActor { id } }"}')" |
| 69 | 76 | | echo "api.expo.dev answers this runner with $code" |
| 70 | | − | if [ "$code" = 403 ]; then echo "::error::Expo refuses requests from this runner's network"; exit 1; fi |
| 77 | + | if [ "$code" = 403 ]; then echo "::error::api.expo.dev is not allowed: add the workflow-only domains above in the project's Guardrails"; exit 1; fi |
| 71 | 78 | | npx --yes eas-cli@24.12.1 whoami |
| 72 | 79 | | npx --yes eas-cli@24.12.1 build --platform android --profile "$PROFILE" \ |
| 73 | 80 | | --non-interactive --wait --json > build.json |
