fix(ci): evaluate the release build config as the production profile

.github/workflows/kilo-app-release.yml

@@ -250,9 +250,19 @@ jobs:
         working-directory: apps/mobile
         env:
           EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+        # eas-cli evaluates app.config.ts itself before it submits, and it syncs
+        # the App ID capabilities from what that evaluation returns. A release
+        # must be evaluated as the production profile: an unset EAS_BUILD_PROFILE
+        # makes app.config.ts evaluate as non-production, which puts the dev-only
+        # File Provider testing-mode entitlement in the extension's EAS entry.
+        # Apple then rejects the capability sync and the whole build command
+        # fails before any artifact exists. env:exec injects the production
+        # environment for that evaluation (a bare EAS_BUILD_PROFILE throws on the
+        # values it never sees), and SENTRY_AUTH_TOKEN is a SECRET variable only
+        # a builder can read, so the evaluation gets the preflight placeholder.
         run: |
           mkdir -p artifacts
-          pnpx eas-cli@24.8.0 build --profile production --platform all --non-interactive --json --wait > build.json
+          pnpx eas-cli@24.8.0 env:exec production --non-interactive 'EAS_BUILD_PROFILE=production SENTRY_AUTH_TOKEN=preflight-placeholder pnpx eas-cli@24.8.0 build --profile production --platform all --non-interactive --json --wait > build.json'
           node ../../scripts/inspect-mobile-artifacts.mjs --select build.json > urls.txt
           echo "IOS_URL=$(sed -n '1p' urls.txt)" >> "$GITHUB_ENV"
           echo "ANDROID_URL=$(sed -n '2p' urls.txt)" >> "$GITHUB_ENV"

apps/mobile/scripts/assert-expo-config.mjs

@@ -345,6 +345,29 @@ check(
   appExtensions.some(extension => extension.targetName === 'ArtifactsFileProvider'),
   'extra.eas.build.experimental.ios.appExtensions must carry the ArtifactsFileProvider target'
 );
+// Dev-only capability, asserted where it would break a release: Apple rejects
+// the capability sync for `FILEPROVIDER_TESTINGMODE` on the extension's App ID,
+// and App Store review rejects the entitlement itself. The release build and
+// this assertion share one evaluation, so a production config that carried it
+// would fail here before Apple sees it.
+if (process.env.EAS_BUILD_PROFILE === 'production') {
+  const FILE_PROVIDER_TESTING_MODE = 'com.apple.developer.fileprovider.testing-mode';
+  const fileProviderExtension = appExtensions.find(
+    extension => extension.targetName === 'ArtifactsFileProvider'
+  );
+  check(
+    !(FILE_PROVIDER_TESTING_MODE in (config.ios?.entitlements ?? {})),
+    `a production build must not carry the ${FILE_PROVIDER_TESTING_MODE} app entitlement`
+  );
+  check(
+    !('KiloArtifactsFileProviderTesting' in (config.ios?.infoPlist ?? {})),
+    'a production build must not carry the KiloArtifactsFileProviderTesting Info.plist key'
+  );
+  check(
+    !(FILE_PROVIDER_TESTING_MODE in (fileProviderExtension?.entitlements ?? {})),
+    `a production build must not carry the ${FILE_PROVIDER_TESTING_MODE} extension entitlement`
+  );
+}
 // The app target's one `Localizable.strings` (the App Intent copy plus the
 // appended Focus-filter catalog) is written by this plugin; without it the
 // Shortcuts actions and the Focus filter stay English on a localized device.