Add job summary to iOS deploy workflow by Asherlc · Pull Request #871 · Asherlc/dofek

Asherlc · 2026-04-12T21:53:25Z

Summary

Adds a GitHub Actions job summary to the Deploy iOS workflow showing version, build number, and commit SHA in a table
Outputs the build number from the "Set build number" step so it can be referenced later

Test plan

Trigger a manual iOS deploy via workflow_dispatch and verify the summary table appears on the run page
Verify the version, build number, and commit SHA are correct

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The deprecated "app-store" method uploads but doesn't auto-distribute to internal testers. The "app-store-connect" method is required for testFlightInternalTestingOnly to take effect. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds a GitHub Actions job summary to the iOS deploy workflow so each run surfaces the deployed app version, computed build number, and commit SHA.

Changes:

Exposes the computed build number as a step output from the “Set build number” step.
Appends a Markdown table to $GITHUB_STEP_SUMMARY after a successful deploy.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-12T21:56:11Z

+      - name: Write job summary
+        if: success()
+        env:
+          BUILD_NUMBER: ${{ steps.build-number.outputs.value }}


steps.build-number.outputs.value will be parsed as steps.build - number... because - is the subtraction operator in GitHub Actions expressions. As written, BUILD_NUMBER will not resolve. Rename the step id to use _ (e.g., build_number) or reference it with bracket notation: ${{ steps['build-number'].outputs.value }}.

Suggested change

BUILD_NUMBER: ${{ steps.build-number.outputs.value }}

BUILD_NUMBER: ${{ steps['build-number'].outputs.value }}

Skipping — GitHub Actions identifiers support hyphens in dot notation ([a-zA-Z_][a-zA-Z0-9_-]*). steps.build-number.outputs.value resolves correctly and is used throughout the codebase.

github-actions · 2026-04-12T21:56:46Z

Mobile Preview

Scan to open on device:


Channel	`pr-871`
Deep Link	`dofek://preview/pr-871`
Commit	`9a6b96f`

To test on device:

Build and install the preview client: PREVIEW_CHANNEL=pr-871 npx expo prebuild --clean -p ios
Or tap deep link on an existing preview build: dofek://preview/pr-871

Each PR gets its own channel. Build a preview client with PREVIEW_CHANNEL=pr-{N} to test.

github-actions · 2026-04-12T21:56:58Z

Storybook previews for 9a6b96f5 are ready:

This comment updates automatically on each PR push.

CI gate summary links to deploy workflow pages on main pushes. Deploy iOS summary links back to the triggering CI run. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CI's build-ios-native now uploads the .xcarchive as an artifact. Deploy iOS downloads it and just signs/exports/uploads — skipping expo prebuild, pod install, and xcodebuild archive entirely. Falls back to building from scratch on workflow_dispatch or if the CI artifact is missing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Deploy now errors if no archive artifact is found — no more building from scratch. For workflow_dispatch, finds the most recent successful CI run on main via gh CLI. Also reduced timeout from 60m to 30m since we're only signing and uploading, not building. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Docker image is now built and pushed to GHCR as part of CI (main pushes only, after ci-gate passes). Deploy Web no longer builds — it verifies the image exists, runs Terraform, and deploys. This follows the same principle as iOS deploy: CI builds, deploy just publishes/deploys pre-built artifacts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Matches the pattern of build-mobile.yml and build-web.yml — CI orchestrates, build workflows are self-contained. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-12T22:36:07Z

+          SHORT_SHA=$(echo "$SHA" | head -c 7)
+          IMAGE="ghcr.io/asherlc/dofek:sha-${SHORT_SHA}"
+          echo "Checking for image: $IMAGE"
+          if ! gh api "/orgs/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/packages/container/dofek/versions" \


The GHCR API path here uses /orgs/.../packages/..., but this repo’s image is under the user namespace (ghcr.io/asherlc/dofek). For user-owned packages the REST path is /users/{username}/packages/container/{package}/versions; using /orgs will 404 and make deploys fail.

Suggested change

if ! gh api "/orgs/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/packages/container/dofek/versions" \

if ! gh api "/users/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')/packages/container/dofek/versions" \

Fixed in f512ceed. Changed to /users/ since this is a user-owned package.

Copilot · 2026-04-12T22:36:07Z

+      - name: Verify Docker image exists
+        if: steps.latest.outputs.should_deploy == 'true'
+        env:
+          SHA: ${{ steps.resolve.outputs.sha }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |


This step relies on gh api to read GHCR package versions/tags, but the workflow doesn’t declare any permissions:. If the repo default token permissions are read-only (common), the GITHUB_TOKEN may not have packages: read, causing this check to fail. Consider adding explicit permissions: packages: read (and possibly contents: read) at workflow or job scope.

Fixed in f512ceed. Added permissions: { contents: read, packages: read }.

Copilot · 2026-04-12T22:36:08Z

+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ "$EVENT_NAME" != "workflow_dispatch" ]; then
+            echo "run_id=$WORKFLOW_RUN_ID" >> "$GITHUB_OUTPUT"
+            echo "Using triggering CI run: $WORKFLOW_RUN_ID"
+            exit 0
+          fi
+


Find CI run with archive treats every non-workflow_dispatch trigger as workflow_run, but this workflow is also callable via workflow_call (see deploy.yml). In that case github.event.workflow_run.id is unset, so this writes an empty run_id, and the later actions/download-artifact with run-id: will fail.

Suggested change

GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

run: |

if [ "$EVENT_NAME" != "workflow_dispatch" ]; then

echo "run_id=$WORKFLOW_RUN_ID" >> "$GITHUB_OUTPUT"

echo "Using triggering CI run: $WORKFLOW_RUN_ID"

exit 0

fi

RESOLVED_SHA: ${{ steps.resolve.outputs.sha }}

GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

run: |

if [ "$EVENT_NAME" = "workflow_run" ]; then

echo "run_id=$WORKFLOW_RUN_ID" >> "$GITHUB_OUTPUT"

echo "Using triggering CI run: $WORKFLOW_RUN_ID"

exit 0

fi

if [ "$EVENT_NAME" = "workflow_call" ]; then

RUN_ID=$(gh run list \

--workflow=ci.yml \

--commit="$RESOLVED_SHA" \

--status=success \

--limit=1 \

--json databaseId \

--jq '.[0].databaseId')

if [ -z "$RUN_ID" ] || [ "$RUN_ID" = "null" ]; then

echo "No successful CI run found for commit $RESOLVED_SHA"

exit 1

fi

echo "run_id=$RUN_ID" >> "$GITHUB_OUTPUT"

echo "Using successful CI run for commit $RESOLVED_SHA: $RUN_ID"

exit 0

fi

Fixed in f512ceed. Now explicitly checks for workflow_run and falls through to commit-based lookup for both workflow_dispatch and workflow_call.

Copilot · 2026-04-12T22:36:08Z

+          # For manual dispatch, find the most recent successful CI run on main
+          RUN_ID=$(gh run list \
+            --workflow=ci.yml \
+            --branch=main \
+            --status=success \
+            --limit=1 \
+            --json databaseId \
+            --jq '.[0].databaseId')


For workflow_dispatch, this selects the most recent successful CI run on main regardless of the resolved commit_sha being deployed. If the caller supplies commit_sha (or main has advanced since the last successful CI), you can end up exporting/uploading an archive from a different commit than the one checked out, which is a correctness/release integrity issue. Prefer finding the CI run for the specific commit SHA (and/or verify the downloaded archive’s commit matches before uploading).

Fixed in f512ceed. Now uses --commit=$COMMIT_SHA to find the CI run for the specific commit instead of just the latest on main.

Copilot · 2026-04-12T22:36:08Z

+  build-docker:
+    name: Build Docker
+    needs: [ci-gate]
+    uses: ./.github/workflows/build-docker.yml
+    secrets: inherit


build-docker.yml requests packages: write, but in reusable workflows the called workflow’s GITHUB_TOKEN permissions cannot exceed the caller workflow’s permissions. ci.yml currently doesn’t grant packages: write, so the docker push to GHCR is likely to fail. Add packages: write to ci.yml (or set job-level permissions on the build-docker job in the caller).

Fixed in f512ceed. Restored packages: write in ci.yml.

- deploy-web: /orgs/ → /users/ for user-owned GHCR packages - deploy-web: add permissions (contents: read, packages: read) - deploy-ios: handle workflow_call trigger (was only handling workflow_run and workflow_dispatch) - deploy-ios: find CI run by commit SHA instead of latest on main, preventing archive/commit mismatch on manual dispatch - ci.yml: restore packages: write (needed by build-docker reusable workflow) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Asherlc · 2026-04-12T22:39:26Z

CR comment summary

Fixed (5)

GHCR API path: /orgs/ → /users/ for user-owned packages (deploy-web)
Missing permissions: Added contents: read, packages: read to deploy-web
workflow_call handling: deploy-ios now handles all three trigger types (workflow_run, workflow_dispatch, workflow_call) instead of assuming non-dispatch = workflow_run
Archive/commit mismatch: deploy-ios now finds CI run by commit SHA (--commit=$SHA) instead of latest on main, preventing wrong archive on manual dispatch with specific SHA
packages: write on caller: Restored in ci.yml since reusable workflows can't exceed caller permissions

Declined (1)

Hyphenated step ID expression parsing: GitHub Actions identifiers support hyphens in dot notation ([a-zA-Z_][a-zA-Z0-9_-]*). steps.build-number.outputs.value resolves correctly.

All fixes in f512ceed.

Add job summary to iOS deploy with version, build number, and commit

b0ccd1a

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings April 12, 2026 21:53

Copilot started reviewing on behalf of Asherlc April 12, 2026 21:54 View session

Copilot AI reviewed Apr 12, 2026

View reviewed changes

Asherlc and others added 5 commits April 12, 2026 14:57

Link CI runs to triggered deploys and vice versa

c36697c

CI gate summary links to deploy workflow pages on main pushes. Deploy iOS summary links back to the triggering CI run. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Extract Docker build into build-docker.yml reusable workflow

76c457d

Matches the pattern of build-mobile.yml and build-web.yml — CI orchestrates, build workflows are self-contained. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Asherlc requested a review from Copilot April 12, 2026 22:31

Copilot started reviewing on behalf of Asherlc April 12, 2026 22:31 View session

Copilot AI reviewed Apr 12, 2026

View reviewed changes

Asherlc merged commit a7c2739 into main Apr 12, 2026
51 checks passed

Asherlc deleted the Asherlc/fix-ios-deploy-trigger branch April 12, 2026 22:48

This was referenced Jul 26, 2026

Fix iOS native change detection #1975

Merged

fix(ci): restore npm, Swift, and Zepp releases without a bypass credential #2052

Merged

	BUILD_NUMBER: ${{ steps.build-number.outputs.value }}
	BUILD_NUMBER: ${{ steps['build-number'].outputs.value }}

	if ! gh api "/orgs/$(echo '${{ github.repository_owner }}' \| tr '[:upper:]' '[:lower:]')/packages/container/dofek/versions" \
	if ! gh api "/users/$(echo '${{ github.repository_owner }}' \| tr '[:upper:]' '[:lower:]')/packages/container/dofek/versions" \

Conversation

Asherlc commented Apr 12, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Asherlc Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mobile Preview

Uh oh!

github-actions Bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Asherlc Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Asherlc Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Asherlc Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Asherlc Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Asherlc Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Asherlc commented Apr 12, 2026

CR comment summary

Fixed (5)

Declined (1)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Apr 12, 2026 •

edited

Loading

github-actions Bot commented Apr 12, 2026 •

edited

Loading