fix(ci): unbreak the kilo-app release preflight

[iscekic]

Fixes the preflight job in kilo-app Release run 32768868183.

Failure 1: Verify EAS production environment

The log showed only Error: env:list command failed. The real reason went to eas-cli's stdout, which the step captured into $ENV_OUTPUT.

The reason: eas-cli spawns node_modules/.pnpm/expo@.../expo/bin/cli config --json directly, so it bypasses the pnpm bin shim that exports NODE_PATH. react-native-appsflyer/expo/withAppsFlyerIos.js requires @expo/config-plugins and deep paths under it, but the package declares no dependencies at all. Without the shim the require fails, so every eas-cli command that reads the app config fails.

The fix declares the dep through packageExtensions, next to the identical entries for @sentry/react-native and expo-share-intent. It resolves to @expo/config-plugins@57.0.6 — the same instance the SDK 57 graph already uses, so no duplicate copy.

Failure 2: Assert production config contract

This step would have failed next, for a different reason. EAS_BUILD_PROFILE=production applied to the eas-cli process itself, and eas-cli evaluates app.config.ts to resolve the project before it injects any environment. Under the production profile that evaluation throws on the missing env, and it also throws on the missing SENTRY_AUTH_TOKEN, which is a SECRET variable only EAS builders can read.

The variable now sits inside the quoted command, so it applies to pnpm assert:config and not to eas-cli. The run gets a placeholder SENTRY_AUTH_TOKEN; step 8 already proves the real secret exists in the EAS production environment.

Verification

Both steps ran locally against the real EAS project, with the CI environment (GITHUB_ACTIONS=1, no .env loading):

Command	main	this branch
expo config --json outside the pnpm shim	exit 1, Cannot find module '@expo/config-plugins'	exit 0
eas env:list --environment production --format long	exit 1	exit 0, all 12 required names present
eas env:exec production ... assert:config	exit 1	exit 0, Expo config contract OK

pnpm install --frozen-lockfile passes on the updated lockfile.

Not in scope

No CI job evaluates the app config outside the pnpm shim, so nothing catches a repeat of failure 1 before the nightly release. A guard is a separate change.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• .github/workflows/kilo-app-release.yml
• pnpm-lock.yaml
• pnpm-workspace.yaml

---

_{Reviewed by grok-4.6 · Input: 53.4K · Output: 9.1K · Cached: 376.1K}

_{Review guidance: REVIEW.md from base branch main}