fix(mobile): Android fingerprint covers Expo native modules again

.github/workflows/mobile-eas-production.yml

@@ -234,6 +234,29 @@ jobs:
           MOBILE_BUILD_PROFILE: ${{ inputs.profile || 'production' }}
         run: eas build --platform ${{ inputs.platform }} --profile "$MOBILE_BUILD_PROFILE" --auto-submit --non-interactive --no-wait
 
+      # @expo/fingerprint swallows autolinking errors and returns no Expo module
+      # sources, so native changes stop moving the hash and OTAs reach binaries
+      # that lack them. Refuse to publish any OTA from such a fingerprint.
+      - name: Verify fingerprints hash Expo native modules
+        if: steps.expo-token.outputs.present == 'true' && (github.event_name == 'push' || inputs.mode == 'update')
+        working-directory: apps/mobile
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          PLATFORM: ${{ inputs.platform || 'all' }}
+        run: |
+          if [ "$PLATFORM" = "all" ]; then platforms="ios android"; else platforms="$PLATFORM"; fi
+          failed=0
+          for platform in $platforms; do
+            # eas-cli prints an environment-loaded notice to stdout before the
+            # JSON even with --json, so discard everything before the document.
+            expo_modules="$(eas fingerprint:generate --platform "$platform" --environment production --json --non-interactive | sed -n '/^{/,$p' | jq --arg reason "expoAutolinking${platform^}" '[.sources[] | select((.reasons // []) | index($reason))] | length')"
+            if [ "${expo_modules:-0}" -eq 0 ]; then
+              failed=1
+              echo ":x: $platform: the native fingerprint hashes no Expo native modules — OTAs and builds skipped" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          done
+          exit "$failed"
+
       - name: Publish OTA update (manual)
         if: steps.expo-token.outputs.present == 'true' && github.event_name == 'workflow_dispatch' && inputs.mode == 'update'
         working-directory: apps/mobile

patches/@expo__fingerprint@0.21.5.patch

@@ -0,0 +1,16 @@
+diff --git a/build/sourcer/Expo.js b/build/sourcer/Expo.js
+index 785ec516921af68ea5922462a0177112e15c6bb1..8ce5ce7937b83b3677416bf18f4c60d759ba4fcf 100644
+--- a/build/sourcer/Expo.js
++++ b/build/sourcer/Expo.js
+@@ -368,6 +368,11 @@ async function getExpoAutolinkingAndroidSourcesAsync(projectRoot, options, expoA
+             }
+             if (module1.plugins) {
+                 for (const plugin of module1.plugins){
++                    // Gradle plugins resolved from Maven (e.g. expo-widgets' glance fork) have no
++                    // sourceDir; hashing them would throw and drop every Expo module source.
++                    if (typeof plugin.sourceDir !== 'string') {
++                        continue;
++                    }
+                     const filePath = (0, _Path.toPosixPath)(_path().default.relative(realProjectRoot, plugin.sourceDir));
+                     plugin.sourceDir = filePath; // use relative path for the dir
+                     debug(`Adding expo-modules-autolinking android dir - ${_chalk().default.dim(filePath)}`);

pnpm-workspace.yaml

@@ -332,6 +332,9 @@ patchedDependencies:
   # Android: a nested WebView hands a vertical drag to its scrolling parent at the page's edge.
   react-native-webview@14.0.1: patches/react-native-webview@14.0.1.patch
   "@expo/ui@58.0.20": patches/@expo__ui@58.0.20.patch
+  # Android: Maven-resolved gradle plugins (expo-widgets) have no sourceDir; without this
+  # skip, the fingerprint silently drops every Expo native module and OTAs reach stale binaries.
+  "@expo/fingerprint@0.21.5": patches/@expo__fingerprint@0.21.5.patch
 
 peerDependencyRules:
   allowAny: