Harden EAS pipeline, env isolation, and secret handling

.env.development

@@ -1,20 +1,6 @@
 ENV=dev
 API_URL=https://dev-api.example.com/v1
-# Node.js Settings
-NODE_VERSION=18
-
-# Yarn Configuration
-YARN_VERSION=1.22.22
-
-# Android Signing Configurations (for signing the Android app)
-ANDROID_SIGNING_KEY=dummy_base64_encoded_key
-ANDROID_SIGNING_ALIAS=dummy_alias
-ANDROID_SIGNING_STORE_PASSWORD=dummy_store_password
-ANDROID_SIGNING_KEY_PASSWORD=dummy_key_password
-
-# Google Play Store API Configurations
-ANDROID_SERVICE_ACCOUNT=dummy_service_account_json
-
+GOOGLE_MAPS_API_KEY=dev_maps_key_placeholder
 # Application Details
 PACKAGE_NAME=com.shivshankartiwari.reactnativeignitekit
 TRACK=beta

.env.development.local.example

@@ -0,0 +1 @@
+GOOGLE_MAPS_API_KEY=your_dev_restricted_maps_key

.env.production

@@ -1,20 +1,6 @@
 ENV=prod
 API_URL=https://api.example.com/v1
-# Node.js Settings
-NODE_VERSION=18
-
-# Yarn Configuration
-YARN_VERSION=1.22.22
-
-# Android Signing Configurations (for signing the Android app)
-ANDROID_SIGNING_KEY=dummy_base64_encoded_key
-ANDROID_SIGNING_ALIAS=dummy_alias
-ANDROID_SIGNING_STORE_PASSWORD=dummy_store_password
-ANDROID_SIGNING_KEY_PASSWORD=dummy_key_password
-
-# Google Play Store API Configurations
-ANDROID_SERVICE_ACCOUNT=dummy_service_account_json
-
+GOOGLE_MAPS_API_KEY=replace_in_.env.production.local_or_EAS_secret
 # Application Details
 PACKAGE_NAME=com.shivshankartiwari.reactnativeignitekit
 TRACK=beta

.env.production.local.example

@@ -0,0 +1 @@
+GOOGLE_MAPS_API_KEY=your_production_restricted_maps_key

.env.signing.example

@@ -2,4 +2,4 @@
 KEYSTORE_PATH=android/app/keystore/ignitekit-release-key.keystore
 KEYSTORE_PASSWORD=your_keystore_password
 KEY_ALIAS=your_key_alias
-KEY_PASSWORD=your_key_password
+KEY_PASSWORD=your_key_password

.env.staging

@@ -1,20 +1,6 @@
 ENV=staging
 API_URL=https://staging-api.example.com/v1
-# Node.js Settings
-NODE_VERSION=18
-
-# Yarn Configuration
-YARN_VERSION=1.22.22
-
-# Android Signing Configurations (for signing the Android app)
-ANDROID_SIGNING_KEY=dummy_base64_encoded_key
-ANDROID_SIGNING_ALIAS=dummy_alias
-ANDROID_SIGNING_STORE_PASSWORD=dummy_store_password
-ANDROID_SIGNING_KEY_PASSWORD=dummy_key_password
-
-# Google Play Store API Configurations
-ANDROID_SERVICE_ACCOUNT=dummy_service_account_json
-
+GOOGLE_MAPS_API_KEY=staging_maps_key_placeholder
 # Application Details
 PACKAGE_NAME=com.shivshankartiwari.reactnativeignitekit
 TRACK=beta

.env.staging.local.example

@@ -0,0 +1 @@
+GOOGLE_MAPS_API_KEY=your_staging_restricted_maps_key

.github/workflows/ci.yml

@@ -1,127 +1,46 @@
-name: Continuous Integration
+name: CI
 
 on:
   pull_request:
     branches:
       - dev
-      - sit
+      - staging
       - main
 
-jobs:
-  test:
-    name: Run Tests
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'  # Use Node.js version 18.x
-
-      - name: Install Yarn
-        run: npm install --global yarn@1.22.22  # Specify Yarn version 1.22.22
-
-      - name: Cache Yarn dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.cache/yarn
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
-
-      - name: Install dependencies
-        run: yarn install
-
-      - name: Run Lefthook CI checks
-        run: yarn lefthook run ci-hook  # Runs Lefthook CI hook defined in .lefthook.yml
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 
-      - name: Run tests
-        run: yarn test-ci  # Ensure that your package.json has this script defined
-
-      # Optional: Add a step for building the project (if applicable)
-      # - name: Build Project
-      #   run: yarn build
-
-  android-build:
-    name: Build Android and Deploy to Play Store (Beta)
+jobs:
+  quality:
+    name: Lint, Test, Version Checks
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
-      # Set up Node.js for Yarn and related tasks
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20.x'
+          cache: 'yarn'
 
-      - name: Install Yarn
-        run: npm install --global yarn@1.22.22
-
-      - name: Cache Yarn dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.cache/yarn
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
+      - name: Enable Corepack
+        run: corepack enable
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --immutable
 
-      # Cache Gradle Wrapper
-      - name: Cache Gradle Wrapper
-        uses: actions/cache@v3
-        with:
-          path: ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
+      - name: Lint
+        run: yarn lint
 
-      # Cache Gradle dependencies
-      - name: Cache Gradle Dependencies
-        uses: actions/cache@v3
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-caches-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-caches-
+      - name: Tests
+        run: yarn test
 
-      # Make Gradle Wrapper executable
-      - name: Make Gradlew Executable
-        run: cd android && chmod +x ./gradlew
+      - name: Lefthook CI hook
+        run: yarn lefthook run ci-hook
 
-      # Build Android App Bundle
-      - name: Build Android App Bundle
-        run: cd android && ./gradlew bundleRelease --no-daemon
-
-      # Sign the App Bundle
-      - name: Sign App Bundle
-        id: sign_app
-        uses: r0adkll/sign-android-release@v1
-        with:
-          releaseDirectory: android/app/build/outputs/bundle/release
-          signingKeyBase64: ${{ secrets.ANDROID_SIGNING_KEY }}
-          alias: ${{ secrets.ANDROID_SIGNING_ALIAS }}
-          keyStorePassword: ${{ secrets.ANDROID_SIGNING_STORE_PASSWORD }}
-          keyPassword: ${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }}
-
-      # Upload the signed App Bundle
-      - name: Upload Signed App Bundle
-        uses: actions/upload-artifact@v2
-        with:
-          name: Signed App Bundle
-          path: ${{steps.sign_app.outputs.signedReleaseFile}}
-
-      # Deploy to Google Play Store Beta
-      - name: Deploy to Google Play Store (Beta)
-        uses: r0adkll/upload-google-play@v1
-        with:
-          serviceAccountJsonPlainText: ${{ secrets.ANDROID_SERVICE_ACCOUNT }}
-          packageName: com.shivshankartiwari.reactnativeignitekit
-          releaseFile: ${{steps.sign_app.outputs.signedReleaseFile}}
-          track: beta
-          userFraction: 0.5
-          whatsNewDirectory: android/release-notes/
+      # Informational version consistency check across package.json + native files.
+      - name: EAS version consistency
+        run: yarn eas:version:get

.gitignore

@@ -39,6 +39,7 @@ local.properties
 node_modules/
 npm-debug.log
 yarn-error.log
+package-lock.json
 
 # fastlane
 #
@@ -77,6 +78,9 @@ yarn-error.log
 # NOTE: These will be removed in production. Do not include real credentials or secrets.
 .env*
 !.env.signing.example
+!.env.development.local.example
+!.env.staging.local.example
+!.env.production.local.example
 
 # EAS credentials export (keystore + secrets — never commit)
 /credentials.json
@@ -91,4 +95,9 @@ fastlane/keys/*.json
 
 # 🔐 Android keystore files (highly sensitive)
 android/keystores/*.jks
-!android/keystores/your-app-upload-key.jks
+android/keystores/*.keystore
+ios/tmp.xcconfig
+# Expo
+.expo
+dist/
+web-build/

.yarnrc.yml

@@ -1,3 +1,10 @@
 nodeLinker: node-modules
 
 yarnPath: .yarn/releases/yarn-3.6.4.cjs
+
+# Nested @react-native/* / Babel packages declare peers that are satisfied from the
+# workspace root (devDependencies). Yarn 3 still emits YN0002; installs are valid.
+# https://yarnpkg.com/configuration/yarnrc#logFilters
+logFilters:
+  - code: YN0002
+    level: discard

README.md

@@ -22,7 +22,7 @@ eas init
 
 # 4. You're ready — trigger a build from the Actions tab or locally:
 yarn eas:build:staging        # build both platforms, staging
-yarn eas:build:safe:staging   # same, but checks version consistency first
+yarn eas:version:check        # verify native/app version alignment before release
 yarn eas:update:staging       # OTA update (JS changes only, no new build)
 ```
 
@@ -45,13 +45,13 @@ yarn eas:help
 
 ## Environment → Android flavor mapping
 
-| EAS profile | Android Gradle task | iOS scheme |
+| EAS profile | Android Gradle task | iOS Xcode scheme |
 |---|---|---|
-| `development` | `bundleDevelopmentRelease` | `ReactNativeIgniteKit dev` |
-| `staging` | `bundleSitRelease` | `ReactNativeIgniteKit stag` |
-| `production` | `bundleProductionRelease` | `ReactNativeIgniteKit prod` |
+| `development` | `bundleDevelopmentRelease` | `ReactNativeCICD development` |
+| `staging` | `bundleStagingRelease` | `ReactNativeCICD staging` |
+| `production` | `bundleProductionRelease` | `ReactNativeCICD production` |
 
-> The project uses `sit` (System Integration Testing) as the Android flavor for the `staging` EAS profile. To use a dedicated `staging` flavor, add it to `android/app/build.gradle` → `productFlavors` and update `eas.json`.
+**Naming:** The three environments are always **`development`**, **`staging`**, **`production`** (EAS profile = Android flavor = env file). iOS schemes are prefixed **`ReactNativeCICD `** so they read clearly in Xcode; Android flavors stay short for Gradle. Same `applicationId` on Android across flavors.
 
 ---