Repository navigation
release: v2.0.12 — signing secrets out of .env, Facebook login removed - #118
Merged
Merged
Conversation
…nv, not .env react-native-config compiles every .env key into BuildConfig and string resources, so upload-keystore passwords placed in .env shipped readable in the release APK/AAB. Resolve the ANDROID_NAVIGATOR_APP_UPLOAD_* values from project.env, then android/local.properties, then System.getenv, and document local.properties / CI env vars as the supported setup.
…nv, not .env react-native-config compiles every .env key into BuildConfig and string resources, so upload-keystore passwords placed in .env shipped readable in the release APK/AAB. Resolve the ANDROID_NAVIGATOR_APP_UPLOAD_* values from project.env, then android/local.properties, then System.getenv, and document local.properties / CI env vars as the supported setup.
Drop the Meta login SDK entirely: the JS provider, logout call and login button, the iOS AppDelegate/Info.plist SDK setup and fb URL/query schemes, the Android com.facebook.sdk meta-data, katana query and facebook_* string resources, and the FACEBOOK_* keys written to .env in CI. React Native's own com.facebook.react packages are untouched.
…t-of-env fix(android): keep release signing secrets out of .env (they ship in the binary)
setup-android@v3 requests the legacy 'tools' package by default, which cmdline-tools 16.0 no longer ships, so sdkmanager exited 1 before the build started. Request platform-tools only; the build's own SDK components are installed in the next step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Navigator v2.0.12
A quick release so client apps can pull two changes from upstream: Android signing secrets no longer belong in
.env, and Facebook login is gone. Supersedes #117, which stays open until this merges.1. Release signing secrets out of
.env(from #117)android/app/build.gradleread the fourANDROID_NAVIGATOR_APP_UPLOAD_*values only from react-native-config's.envmap. react-native-config compiles every.envkey intoBuildConfigand string resources (and intoGeneratedDotEnv.mon iOS). Release builds don't minify andproguard-rules.prokeepsBuildConfig, so the upload keystore passwords shipped readable in the APK/AAB. Each value now resolves from.env(kept for compatibility), thenandroid/local.properties, then environment variables. The GradleException message and README explain the setup. Anyone who had these keys in.envshould rotate the upload key password.2. Facebook login removed
react-native-fbsdk-nextremoved;yarn.lockandios/Podfile.lockupdated (FBSDK pods gone).FBSDKCoreKitimport,ApplicationDelegate.sharedlaunch call and open-URL handler removed fromAppDelegate.swift. The Google Sign-In handler and RCTLinkingManager fallback are unchanged.Info.plistlosesFacebookAppID,FacebookClientToken,FacebookDisplayName, thefb$(FACEBOOK_APP_ID)URL scheme, and thefbapi,fbauth2andfb-messenger-share-apiquery schemes.com.facebook.sdk.*meta-data and thecom.facebook.katanapackage query removed fromAndroidManifest.xml.res/values/strings.xmlheld only the two self-referencingfacebook_*strings, so it's deleted. The app usesreact-native-shareonly throughShare.open, which doesn't need the katana query.facebookLoginIsSupportedremoved fromuse-oauth.ts. Also removed: the facebook branch ofloginSupported(apple/google stay),FacebookLoginManager.logOut()fromAuthContext, andFacebookLoginButton, which was imported but never rendered.FACEBOOK_APP_ID/FACEBOOK_CLIENT_TOKENlines inreact-native-ci.ymlare removed. Clients can drop those keys.com.facebook.react*,facebook::JNI namespaces, soloader and hermes are untouched.3. Version
package.json→ 2.0.12 (the only filerelease.ymlchecks), iOSMARKETING_VERSION→ 2.0.12, andRELEASE.mdnow starts with v2.0.12.CURRENT_PROJECT_VERSIONstays 11. The Android version comes from.envat build time.Verification
yarn test: 5 suites, 10 tests pass.fbsdk.plutil -lint Info.plistandxmllint AndroidManifest.xmlpass.pod install(CocoaPods 1.14.3 via bundler) succeeds.tscandeslintfail on main too (tsconfig lacksjsx, and@react-native-communityeslint config is missing), so they can't judge this change. No native Android or iOS build was run locally; CI's debug builds are the check.Committed Android JS bundle
android/app/src/main/assets/index.android.bundleis regenerated (react-native bundle --platform android --dev false, same format as the v2.0.11 one), so it no longer carries the fbsdk JS. It contains no local paths.