Prod Release Sprint 157 — mobile app fixes · app-locale sync · peanut-shaper badge (2026-08-24)

.github/workflows/android-release.yml

@@ -113,22 +113,61 @@ jobs:
                       echo "NEXT_PUBLIC_ONESIGNAL_DEBUG=true" >> .env.production.local
                   fi
 
+            - name: Resolve release versionName
+              id: version
+              env:
+                  INPUT_VERSION: ${{ github.event.inputs.versionName || '' }}
+              run: |
+                  # versionName: manual dispatch input wins; else the tag name minus
+                  # its leading 'v' (v1.0.10 -> 1.0.10); else package.json (the same
+                  # fallback build.gradle uses). Resolved once, up front, so the OTA
+                  # floor check and the bundle publish below see the exact version
+                  # the binary ships with. Keep in lockstep with ios-release.yml.
+                  VERSION_NAME="$INPUT_VERSION"
+                  if [ -z "$VERSION_NAME" ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
+                      VERSION_NAME="${GITHUB_REF_NAME#v}"
+                  fi
+                  if [ -z "$VERSION_NAME" ]; then
+                      VERSION_NAME="$(node -p "require('./package.json').version")"
+                  fi
+                  echo "name=$VERSION_NAME" >> "$GITHUB_OUTPUT"
+                  echo "Release versionName: $VERSION_NAME"
+
+            # A binary whose versionName is ahead of the newest production OTA bundle
+            # makes Capgo's disable_auto_update_under_native rule reject every bundle
+            # on those devices — OTA goes silently dead for the whole fleet while CI
+            # stays green (TASK-21793: 102 devices, a month of refused updates). Read
+            # the floor before the long build; the publish step after the store
+            # upload closes the gap this detects. Keep in lockstep with
+            # ios-release.yml.
+            - name: Check production OTA floor
+              id: ota_floor
+              env:
+                  CAPGO_API_KEY: ${{ secrets.CAPGO_API_KEY }}
+                  VERSION_NAME: ${{ steps.version.outputs.name }}
+              run: |
+                  CURRENT="$(npx @capgo/cli@latest channel currentBundle production \
+                    --apikey "$CAPGO_API_KEY" --quiet | grep -oE '[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?' | tail -n1 || true)"
+                  if [ -z "$CURRENT" ]; then
+                      echo "::error::cannot read the production channel's current bundle from Capgo — refusing to ship a binary that may strand the fleet's OTA path" >&2
+                      exit 1
+                  fi
+                  NEEDS_OTA="$(node scripts/semver-newer.mjs "$VERSION_NAME" "$CURRENT")"
+                  echo "needs_ota=$NEEDS_OTA" >> "$GITHUB_OUTPUT"
+                  if [ "$NEEDS_OTA" = "true" ]; then
+                      echo "versionName $VERSION_NAME is ahead of production bundle $CURRENT — a matching bundle ships after the store upload"
+                  else
+                      echo "versionName $VERSION_NAME is covered by production bundle $CURRENT"
+                  fi
+
             - name: Build signed AAB
               env:
                   # native sentry sdk dsn — read by android/app/build.gradle into a
                   # manifest placeholder. same project dsn the js layer bakes into
                   # the static export above; no new secret needed.
                   SENTRY_DSN_ANDROID: ${{ secrets.NEXT_PUBLIC_SENTRY_DSN }}
+                  ANDROID_VERSION_NAME: ${{ steps.version.outputs.name }}
               run: |
-                  # versionName: manual dispatch input wins; else the tag name minus
-                  # its leading 'v' (v1.0.10 -> 1.0.10); else build.gradle's
-                  # package.json fallback. Keeps the Play versionName in lockstep
-                  # with the release tag without a manual package.json bump.
-                  VERSION_NAME="${{ github.event.inputs.versionName }}"
-                  if [ -z "$VERSION_NAME" ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
-                      VERSION_NAME="${GITHUB_REF_NAME#v}"
-                  fi
-                  export ANDROID_VERSION_NAME="$VERSION_NAME"
                   # Monotonic (run_number always increases). +10000 clears legacy
                   # codes already on Play from earlier manual/local uploads (small
                   # console codes plus git-commit-count builds up to ~8600).
@@ -146,6 +185,42 @@ jobs:
                   # Staged production rollout: set status: inProgress + userFraction: 0.1,
                   # then promote in Play Console once crash/error rates look clean.
 
+            # The binary that just shipped is ahead of every production OTA bundle, so
+            # its devices would refuse all existing bundles. Publish the exact JS baked
+            # into this binary (native:release leaves it in out/) under the binary's own
+            # version — the lanes can no longer drift apart. A failure here is the floor
+            # guard firing: the job goes red instead of the fleet going silently dark.
+            # Upload flags in lockstep with capgo-deploy.yml; ios-release.yml publishes
+            # the same version from the same tag, which --version-exists-ok turns into a
+            # verified no-op.
+            - name: Publish matching production OTA bundle
+              if: steps.ota_floor.outputs.needs_ota == 'true'
+              env:
+                  CAPGO_API_KEY: ${{ secrets.CAPGO_API_KEY }}
+                  CAPGO_PRIVATE_KEY: ${{ secrets.CAPGO_PRIVATE_KEY }}
+                  VERSION: ${{ steps.version.outputs.name }}
+              run: |
+                  if [ ! -f out/index.html ]; then
+                      echo "::error::out/ is missing its static export — cannot publish the matching OTA bundle, and without it every device on the $VERSION binary refuses OTA updates" >&2
+                      exit 1
+                  fi
+                  npx @capgo/cli@latest bundle upload \
+                    --channel production \
+                    --apikey "$CAPGO_API_KEY" \
+                    --key-data-v2 "$CAPGO_PRIVATE_KEY" \
+                    --path ./out \
+                    --bundle "$VERSION" \
+                    --auto-min-update-version \
+                    --version-exists-ok \
+                    --comment "${GITHUB_SHA:0:7} — auto-published with the $VERSION native release"
+                  CURRENT="$(npx @capgo/cli@latest channel currentBundle production \
+                    --apikey "$CAPGO_API_KEY" --quiet | grep -oE '[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?' | tail -n1 || true)"
+                  if [ "$CURRENT" != "$VERSION" ]; then
+                      echo "::error::production channel serves '${CURRENT:-<none>}', expected $VERSION — devices on the $VERSION binary have no OTA path" >&2
+                      exit 1
+                  fi
+                  echo "Production channel now serves $VERSION"
+
             - name: Upload AAB as build artifact
               if: always()
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/workflows/capgo-deploy.yml

@@ -7,6 +7,13 @@ on:
     # is the separate, deliberate act that says "ship this JS to everyone", and the
     # tag is a permanent record of exactly which commit went out.
     #
+    # One deliberate exception to "tags only": a NATIVE release whose versionName
+    # is ahead of the newest production bundle auto-publishes a matching bundle
+    # from its own commit (see android-release.yml / ios-release.yml). Without
+    # that, Capgo's disable_auto_update_under_native rule makes every device on
+    # the new binary refuse all existing bundles — OTA silently dead for the
+    # fleet while CI stays green (TASK-21793).
+    #
     #   git tag ota-1.0.48 && git push origin ota-1.0.48
     #
     # The bundle version is taken from the tag (ota-1.0.48 -> 1.0.48), so each
@@ -68,6 +75,8 @@ jobs:
               with:
                   submodules: true
                   token: ${{ secrets.SUBMODULE_TOKEN }}
+                  # Full history: the bundle version's patch is the commit count.
+                  fetch-depth: 0
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
@@ -101,6 +110,36 @@ jobs:
                     echo "name=staging" >> $GITHUB_OUTPUT
                   fi
 
+            - name: Resolve bundle version
+              id: version
+              env:
+                  CHANNEL: ${{ steps.channel.outputs.name }}
+              run: |
+                  # Capgo defaults the bundle version to package.json's, which only
+                  # moves on a native release, so a lane shipping on every merge
+                  # collides the moment two merges share a version ("Version x already
+                  # exists"). That silently killed dev -> staging: dev sat on 1.0.8 and
+                  # every deploy after the first failed, which looks identical to no
+                  # deploy at all.
+                  #
+                  # Production takes its version from the ota-* tag, so the bundle is
+                  # named by the tag that shipped it and re-shipping the same JS on the
+                  # same native build just needs a new tag (ota-1.0.48-hotfix1) rather
+                  # than a package.json bump.
+                  #
+                  # Every other lane derives <major>.<minor>.<commit count>. A short-SHA
+                  # suffix would look equivalent and is not: 1.0.8-abc1234 is a semver
+                  # prerelease, sorts BELOW plain 1.0.8, and Capgo's
+                  # disable_auto_update_under_native makes every device on the 1.0.8
+                  # binary refuse it — uploaded, listed, never installed.
+                  if [ "$CHANNEL" = "production" ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
+                      VERSION="${GITHUB_REF_NAME#ota-}"
+                  else
+                      VERSION="$(node scripts/capgo-bundle-version.mjs)"
+                  fi
+                  echo "name=$VERSION" >> "$GITHUB_OUTPUT"
+                  echo "Uploading as bundle version $VERSION"
+
             - name: Upload bundle to Capgo
               # Commit message via env, never inline — a multi-line message (or one
               # with quotes) injected into the run script breaks --comment quoting.
@@ -112,26 +151,8 @@ jobs:
                   CAPGO_PRIVATE_KEY: ${{ secrets.CAPGO_PRIVATE_KEY }}
                   COMMIT_MSG: ${{ github.event.head_commit.message }}
                   CHANNEL: ${{ steps.channel.outputs.name }}
+                  VERSION: ${{ steps.version.outputs.name }}
               run: |
-                  # Capgo defaults the bundle version to package.json's, so a lane that
-                  # ships on every merge collides the moment two merges share a version
-                  # ("Version x already exists"). That silently killed dev -> staging:
-                  # dev sat on 1.0.8 and every deploy after the first failed, which
-                  # looks identical to no deploy at all.
-                  #
-                  # Production takes its version from the ota-* tag, so the bundle is
-                  # named by the tag that shipped it and re-shipping the same JS on the
-                  # same native build just needs a new tag (ota-1.0.48-hotfix1) rather
-                  # than a package.json bump. Everything else is a continuous lane and
-                  # gets the short SHA appended to stay unique.
-                  if [ "$CHANNEL" = "production" ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
-                      VERSION="${GITHUB_REF_NAME#ota-}"
-                  else
-                      VERSION="$(node -p "require('./package.json').version")"
-                      if [ "$CHANNEL" != "production" ]; then
-                          VERSION="$VERSION-${GITHUB_SHA:0:7}"
-                      fi
-                  fi
                   echo "Uploading bundle $VERSION to channel $CHANNEL"
                   COMMENT="${GITHUB_SHA:0:7} — $(printf '%s' "${COMMIT_MSG:-Manual deploy}" | head -n1)"
                   npx @capgo/cli@latest bundle upload \
@@ -144,9 +165,28 @@ jobs:
                     --version-exists-ok \
                     --comment "$COMMENT"
 
+            # --version-exists-ok turns "this version is already uploaded" into a
+            # silent no-op, which is what we want for a re-run of the same commit
+            # and never what we want otherwise. Assert the channel really serves
+            # the version this run built, so a no-op that ships nothing is red.
+            - name: Verify channel serves the new bundle
+              env:
+                  CAPGO_API_KEY: ${{ secrets.CAPGO_API_KEY }}
+                  CHANNEL: ${{ steps.channel.outputs.name }}
+                  EXPECTED: ${{ steps.version.outputs.name }}
+              run: |
+                  CURRENT="$(npx @capgo/cli@latest channel currentBundle "$CHANNEL" \
+                    --apikey "$CAPGO_API_KEY" --quiet | grep -oE '[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?' | tail -n1 || true)"
+                  if [ "$CURRENT" != "$EXPECTED" ]; then
+                    echo "ERROR: channel $CHANNEL serves '${CURRENT:-<none>}', expected $EXPECTED — nothing shipped" >&2
+                    exit 1
+                  fi
+                  echo "Channel $CHANNEL now serves $EXPECTED"
+
             - name: Deployment summary
               run: |
                   echo "## OTA Deployment" >> $GITHUB_STEP_SUMMARY
                   echo "- **Channel:** ${{ steps.channel.outputs.name }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Bundle version:** ${{ steps.version.outputs.name }}" >> $GITHUB_STEP_SUMMARY
                   echo "- **Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
                   echo "- **Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY