Set up remote ad hoc builds by rinej · Pull Request #70396 · Expensify/App

rinej · 2025-09-11T13:33:50Z

Explanation of Change

The primary goal of this change is to speed up the process of creating ad-hoc builds on request. We will use the Rock framework, following the same approach already in place for dev remote builds.

Proposed Plan:

~~After each merge to the branch, we will trigger an ad-hoc-remote-build, similar to the dev workflow. However, this job will generate a signed build. So we need to provide all necessary credentials.~~
When a user manually dispatches an ad-hoc build, we will use Rock’s signed build logic. If the requested ad-hoc build has already been created previously, it will be retrieved from cache.
Instead of relying on the Fastlane flow, the manual testBuild action will use the Rock build scripts.

Notes:

~~For now, we will maintain separate workflows: ad-hoc-remote-build-android and ad-hoc-remote-build-ios. This makes testing and isolation easier.~~
~~Once testing is complete, we will integrate them into the shared workflows (remote-build-android.yml and remote-build-ios.yml) using a matrix strategy.~~

Fixed Issues

$ #62296
PROPOSAL:

Tests

Offline tests

QA Steps

Trigger the TestBuild action
Verify that Adhoc builds complete successfully

PR Author Checklist

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

MacOS: Desktop

AndrewGable · 2025-09-16T23:05:34Z

+      - name: Convert keystore to base64
+        id: keystore-base64
+        run: |
+          echo "keystore_content=$(base64 -w 0 Mobile-Expensify/Android/upload-key.keystore)" >> "$GITHUB_OUTPUT" 


Let's not do this. I'm not exactly sure if this will cause security issues, but it at minimum doesn't feel right.

We can do one of two things:

Update rock so that it doesn't need this parameter, can it just do the base64 inside?

We can store the base64 version in 1Password and you can access it like all our other secrets.

I agree with Andrew - we normally keep this file in 1Password, and before that we would GPG-encrypt it

Yes it makes sense, I will ask the team if is possible to change it. If not, would it be a big effort to store it in the 1Password?

Currently, using Base64 encoding for the release keystore is necessary in our setup.
The common pattern is to store the Base64 string in GitHub Secrets and decode it during the workflow.
So in our case we could use the 1Password for it.

We can apply the same pattern for both Android and iOS:

Platform Encode Command GitHub / 1Password Secret Name

Android base64 -i release.keystore | pbcopy ROCK_ANDROID_KEYSTORE_BASE64

iOS Certificate base64 -i BUILD_CERTIFICATE.p12 | pbcopy ROCK_APPLE_CERTIFICATE_BASE64

iOS Profile base64 -i OldApp_AdHoc.mobileprovision | pbcopy ROCK_APPLE_PROFILE_BASE64

What are your thoughts? Do you know who can help with setting it up?

Use 1password/load-secrets-action to grab these all:

op://${{ vars.OP_VAULT }}/upload-key.keystore/base64

op://${{ vars.OP_VAULT }}/New Expensify Distribution Certificate/base64

op://${{ vars.OP_VAULT }}/OldApp_AdHoc/OldApp_AdHoc.mobileprovision

op://${{ vars.OP_VAULT }}/OldApp_AdHoc_Share_Extension/OldApp_AdHoc_Share_Extension.mobileprovision

op://${{ vars.OP_VAULT }}/OldApp_AdHoc_Notification_Service/OldApp_AdHoc_Notification_Service.mobileprovision

Thanks you for that, I’ve updated the PR.

For Android, it looks like everything is covered ✅

For iOS, we’ll also need the Base64 version of the provisioning profile (similar to how we have the certificate -
op://${{ vars.OP_VAULT }}/New Expensify Distribution Certificate/base64)

Could you provide that as well?

Additionally, we also need the certificate-password and keychain-password. We’re currently pulling them from secrets like this:

certificate-password: ${{ secrets.CERTIFICATE_PASSWORD || '' }} keychain-password: ${{ secrets.KEYCHAIN_PASSWORD || '' }}

Could you verify that these are properly set up?

Provisioning profiles are the last three bullet points. You can leave the certificate password and keychain passwords blank. They are not set.

@AndrewGable can you help with adding the base64 for the provisioning profile, share profile and for notification profile?

I've provided them here. Please DM me on Slack if you need more help.

AndrewGable

Small style suggestions

AndrewGable · 2025-09-24T14:35:44Z

+        # rock v3
+        uses: callstackincubator/android@1a7d52dfe3ca195ccbe5ad2f06c15f2fc3835115


Suggested change

# rock v3

uses: callstackincubator/android@1a7d52dfe3ca195ccbe5ad2f06c15f2fc3835115

uses: callstackincubator/android@1a7d52dfe3ca195ccbe5ad2f06c15f2fc3835115 # v3.0.0

AndrewGable · 2025-09-24T14:36:59Z

+        # v2
+        uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0


Suggested change

# v2

uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0

uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2

AndrewGable · 2025-09-24T14:37:24Z

+        # rock v3
+        uses: callstackincubator/ios@08a533dbeda6adec39f94d08d820091514d1f7af


Suggested change

# rock v3

uses: callstackincubator/ios@08a533dbeda6adec39f94d08d820091514d1f7af

uses: callstackincubator/ios@08a533dbeda6adec39f94d08d820091514d1f7af # v3.0.0

adhorodyski · 2025-09-29T14:00:09Z

+          keystore-key-alias: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_ALIAS }}
+          keystore-key-password: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEY_PASSWORD }}
+          comment-bot: true
+          rock-build-extra-params: '--extra-params -PreactNativeArchitectures=arm64-v8a,x86_64'


Can we make sure these are still required? As far as I remember the default value is now the same.

In the project’s Gradle setup, we’ve got all four architectures selected.
If we don’t want to build for the legacy one, I think we’ll still need to keep it. Do you know how we can verify that further?

No I think you're right, thanks for looking into it! Let's leave it as is.

adhorodyski · 2025-09-29T14:01:01Z

+          keystore-store-password: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}
+          keystore-key-alias: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_ALIAS }}
+          keystore-key-password: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEY_PASSWORD }}
+          comment-bot: true


Do we want the comment bot to post as-is? I'd expect we can integrate with the existing system. Maybe producing build metadata (url) artifacts from this step would play better?

we are saving ROCK_IOS_PATH and ROCK_APK_PATH as output in our build step and we print it postGithubComment. So you are right we don't need the comment-bot. I will disable it

adhorodyski · 2025-09-29T14:01:56Z

+                "file": "./OldApp_AdHoc_Notification_Service.mobileprovision"
+              }
+            ]
+          comment-bot: true


same comment about the bot posting

addressed it above

melvin-bot · 2025-09-30T14:20:26Z

@akinwale Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

github-actions · 2025-10-02T13:42:08Z

🚧 @mountiny has triggered a test Expensify/App build. You can view the workflow run here.

adhorodyski · 2025-10-15T13:21:07Z

@rinej will leave his 🟢 light for merging after some cleanup (some actions can be a followup, we can trim down fastlane stuff)

adhorodyski · 2025-10-16T07:37:56Z

Let's sync up with main before merging to test again with the latest Rock version. @rinej

rinej · 2025-10-16T09:00:20Z

Merged the main, we can do the final test and final review.
I will create separate PR with the fastfile cleanup as followup

github-actions · 2025-10-16T14:12:07Z

🚧 @mountiny has triggered a test Expensify/App build. You can view the workflow run here.

github-actions · 2025-10-16T14:33:12Z

🧪🧪 Use the links below to test this adhoc build on Android, iOS, Desktop, and Web. Happy testing! 🧪🧪
Built from App PR #70396.

Android 🤖	iOS 🍎
https://github.com/Expensify/App/actions/runs/18564202081/artifacts/4289474075	https://github.com/Expensify/App/actions/runs/18564202081/artifacts/4289462935

Desktop 💻	Web 🕸️
https://ad-hoc-expensify-cash.s3.amazonaws.com/desktop/70396/NewExpensify.dmg	https://70396.pr-testing.expensify.com

👀 View the workflow run that generated this build 👀

rinej · 2025-10-16T14:35:48Z

The last build was successful, we can proceed and merge the changes ✅

Should be addressed

mountiny

Builds work and changes look good to me, lets move it ahead

mountiny · 2025-10-16T14:55:17Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified there are no new alerts related to the canBeMissing param for useOnyx
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.ts or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

MacOS: Desktop

OSBotify · 2025-10-16T15:35:15Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2025-10-16T23:41:18Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.2.33-0 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

mvtglobally · 2025-10-16T23:45:33Z

@mountiny @AndrewGable @roryabraham Can you pls validate this PR internally as it needs a new build trigger

OSBotify · 2025-10-20T09:25:06Z

🚀 Deployed to production by https://github.com/mountiny in version: 9.2.33-4 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

…t-up-remote-ad-hoc-builds" This reverts commit 62e0287, reversing changes made to 33df3d5.

izarutskaya · 2025-10-21T08:17:15Z

@mountiny @AndrewGable Seems it was tested last deploy, no need testing it now with 9.2.35-0, right?

OSBotify · 2025-10-21T08:28:25Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.2.35-0 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

OSBotify · 2025-10-21T23:05:49Z

🚀 Deployed to production by https://github.com/blimpich in version: 9.2.35-4 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

…et-up-remote-ad-hoc-builds" This reverts commit 0c2ed1a.

OSBotify · 2025-12-30T15:19:14Z

🚀 Deployed to staging by https://github.com/mountiny in version: 9.2.89-1 🚀

platform	result
🖥 desktop 🖥	success ✅
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

m-natarajan · 2025-12-30T15:28:46Z

@mountiny @AndrewGable @roryabraham Can you pls validate this PR internally as it needs a new build trigger

mountiny · 2025-12-30T21:50:05Z

@m-natarajan We can check this off, this was deployed a while ago, some gremlins

OSBotify · 2025-12-31T18:33:10Z

🚀 Deployed to production by https://github.com/thienlnam in version: 9.2.89-6 🚀

platform	result
🖥 desktop 🖥	failure ❌
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

rinej added 5 commits August 25, 2025 12:28

add scaffold actions for remote adhocs

99e9e89

Merge branch 'Migrate-rnef-to-rock' into set-up-remote-ad-hoc-builds

0cbd691

adjust change after rnef to rock refactor

59ded22

Merge branch 'main' into set-up-remote-ad-hoc-builds

07fc01a

add ag-hoc flags to android

a2a8724

melvin-bot Bot assigned rinej Sep 11, 2025

rinej added 4 commits September 16, 2025 15:25

remove adhoc build on every merge to main

6a73b5a

adjust apps build urls

1197873

Merge branch 'main' into set-up-remote-ad-hoc-builds

ec40f06

fix lint for wokflow

04bcab5

AndrewGable previously requested changes Sep 16, 2025

View reviewed changes

rinej added 3 commits September 18, 2025 13:57

take base64 certificate from 1password

9b11a77

adjust load credential naming

bfce94a

load additional credentials from 1Pass

7dc2e78

AndrewGable reviewed Sep 24, 2025

View reviewed changes

roryabraham mentioned this pull request Sep 25, 2025

[Due for payment 2026-01-07] Remote builds cache: integrate into Adhoc builds #62296

Closed

rinej added 2 commits September 29, 2025 14:25

adjust android adhoc build to use file instead of base64

e73dea5

adjust ios adhoc build to use files instead of base64

caad4d5

adhorodyski reviewed Sep 29, 2025

View reviewed changes

disable comment bot on testBuild

e790d50

rinej marked this pull request as ready for review September 30, 2025 14:20

rinej requested a review from a team as a code owner September 30, 2025 14:20

melvin-bot Bot requested review from akinwale and removed request for a team September 30, 2025 14:20

Merge branch 'main' into set-up-remote-ad-hoc-builds

38af96c

This comment has been minimized.

Sign in to view

use most recent ios action commit hash

bb6d63e

Merge branch 'main' into set-up-remote-ad-hoc-builds

4ee45cd

mountiny approved these changes Oct 16, 2025

View reviewed changes

mountiny merged commit 62e0287 into Expensify:main Oct 16, 2025
10 of 12 checks passed

eh2077 mentioned this pull request Oct 16, 2025

Split expense flow (Phase 2 - Reverting existing split expenses) #72086

Merged

54 tasks

OSBotify mentioned this pull request Oct 16, 2025

Deploy Checklist: New Expensify 2025-10-16 #72816

Closed

67 tasks

rinej added a commit to callstack-internal/Expensify-App that referenced this pull request Oct 20, 2025

Revert "Merge pull request Expensify#70396 from callstack-internal/se…

0c2ed1a

…t-up-remote-ad-hoc-builds" This reverts commit 62e0287, reversing changes made to 33df3d5.

OSBotify mentioned this pull request Oct 21, 2025

Deploy Checklist: New Expensify 2025-10-21 #73066

Closed

47 tasks

LukasMod added a commit to callstack-internal/Expensify-App that referenced this pull request Nov 25, 2025

Reapply "Merge pull request Expensify#70396 from callstack-internal/s…

4c25468

…et-up-remote-ad-hoc-builds" This reverts commit 0c2ed1a.

LukasMod mentioned this pull request Nov 25, 2025

[No QA] Set up remote ad hoc builds 2 #76061

Merged

53 tasks

OSBotify mentioned this pull request Dec 30, 2025

Deploy Checklist: New Expensify 2025-12-30 #78583

Closed

56 tasks

Platform	Encode Command	GitHub / 1Password Secret Name
Android	`base64 -i release.keystore \| pbcopy`	`ROCK_ANDROID_KEYSTORE_BASE64`
iOS Certificate	`base64 -i BUILD_CERTIFICATE.p12 \| pbcopy`	`ROCK_APPLE_CERTIFICATE_BASE64`
iOS Profile	`base64 -i OldApp_AdHoc.mobileprovision \| pbcopy`	`ROCK_APPLE_PROFILE_BASE64`

		# rock v3
		uses: callstackincubator/android@1a7d52dfe3ca195ccbe5ad2f06c15f2fc3835115

		# v2
		uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0

		# rock v3
		uses: callstackincubator/ios@08a533dbeda6adec39f94d08d820091514d1f7af

Conversation

rinej commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation of Change

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AndrewGable Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AndrewGable left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adhorodyski Sep 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

melvin-bot Bot commented Sep 30, 2025

Uh oh!

github-actions Bot commented Oct 2, 2025

Uh oh!

This comment has been minimized.

adhorodyski commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adhorodyski commented Oct 16, 2025

Uh oh!

rinej commented Oct 16, 2025

Uh oh!

github-actions Bot commented Oct 16, 2025

Uh oh!

github-actions Bot commented Oct 16, 2025

Uh oh!

rinej commented Oct 16, 2025

Uh oh!

mountiny left a comment

Choose a reason for hiding this comment

Uh oh!

mountiny commented Oct 16, 2025

Reviewer Checklist

Screenshots/Videos

rinej commented Sep 11, 2025 •

edited

Loading

AndrewGable Sep 17, 2025 •

edited

Loading

adhorodyski Sep 29, 2025 •

edited

Loading

adhorodyski commented Oct 15, 2025 •

edited

Loading