expo / expo/expo-github-action
EAS CD fingerprinting fails when using file-based secrets for Android configuration
- Dominant language
- TypeScript
- Stars
- 1k
- Forks
- 107
- PR merge metrics
- No merged PRs in 30d
Description
### Topic and scope of discussion
EAS CD fingerprint validation fails when using file-based secrets due to path differences between GitHub CI environment and EAS build environment
### Motivation
The continuous deployment process is breaking because the fingerprint generated in the GitHub CI environment doesn't match the fingerprint calculated during the EAS build when using file-based secrets. This prevents successful deployment of builds even when there are no actual changes to the application code.
### Additional context
I'm encountering an issue with the continuous deployment fingerprinting system when trying to securely handle the `google-services.json` file for Android builds.
**Current Setup:**
1. Using `expo-github-action/continuous-deploy-fingerprint` for CD
2. Following security best practices by not committing `google-services.json` to git
3. Implemented the recommended approach of using environment variables (https://docs.expo.dev/eas/environment-variables/#file-environment-variables):
```javascript
googleServicesFile: process.env.GOOGLE_SERVICES_JSON || "./google-services.json"
```
4. Created a file-based secret using EAS:
```bash
eas secret:create --scope project --name GOOGLE_SERVICES_JSON --type file --value ./google-services.json
```
**Problem:**
The fingerprint validation fails because:
1. In the GitHub CI environment, the fingerprint is calculated using one file path configuration
2. When the build runs in EAS, the secret is materialized to a different random file path
3. This path difference in `app.config.js` causes the fingerprints to mismatch
4. As a result, EAS build fails with a fingerprint validation error
**Questions:**
1. What's the recommended way to handle file-based secrets with the fingerprinting system to ensure consistent paths between CI and EAS environments?
2. Should the fingerprinting system ignore or normalize paths for file-based secrets?
3. Are there alternative approaches to managing the `google-services.json` file that would work better with the fingerprinting system?
Contributor guide
Assessment
This issue has not been assessed yet.